Skip to content

Bump vite, @sveltejs/kit, @sveltejs/vite-plugin-svelte and @tailwindcss/vite#12

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4a79181153
Open

Bump vite, @sveltejs/kit, @sveltejs/vite-plugin-svelte and @tailwindcss/vite#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4a79181153

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 18, 2026

Copy link
Copy Markdown

Bumps vite, @sveltejs/kit, @sveltejs/vite-plugin-svelte and @tailwindcss/vite. These dependencies needed to be updated together.
Updates vite from 7.2.7 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

v8.0.4

Please refer to CHANGELOG.md for details.

create-vite@8.0.3

Please refer to CHANGELOG.md for details.

v8.0.3

Please refer to CHANGELOG.md for details.

create-vite@8.0.2

Please refer to CHANGELOG.md for details.

v8.0.2

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

  • capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)
  • deps: update all non-major dependencies (#22511) (2686d7d)
  • dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)
  • glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)
  • optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)
  • resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22471) (98b8163)
  • dev: handle errors when sending messages to vite server (#22450) (e8e9a34)
  • html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)
  • optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

  • deps: update rolldown-related dependencies (#22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)

Code Refactoring

  • glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

Updates @sveltejs/kit from 2.49.2 to 2.65.2

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.65.2

Patch Changes

  • fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#15994)

  • fix: decode base64-serialized fetch bodies before caching them for client-side replay (#16034)

  • fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#16024)

  • fix: allow preloadCode to be called during initial page load (#16028)

  • fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#16020)

  • fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#16021)

  • fix: avoid loading universal nodes during build analysis when the app uses a hash router (#16042)

  • fix: correctly serve client entry during development when using the pnpm global virtual store (#16045)

  • fix: normalize path separators when comparing config (#16037)

  • fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#16058)

  • fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#16018)

@​sveltejs/kit@​2.65.1

Patch Changes

  • fix: avoid importing the Vite development client code into builds with a non-standard NODE_ENV (#16023)

  • fix: don't emit the unused bundle and stylesheet files when using bundleStrategy: 'inline' (#16025)

  • fix: reset queries before navigating when invalidateAll is set (#16014)

  • fix: regression in loading assets for absolute path apps (#16026)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.65.2

Patch Changes

  • fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#15994)

  • fix: decode base64-serialized fetch bodies before caching them for client-side replay (#16034)

  • fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#16024)

  • fix: allow preloadCode to be called during initial page load (#16028)

  • fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#16020)

  • fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#16021)

  • fix: avoid loading universal nodes during build analysis when the app uses a hash router (#16042)

  • fix: correctly serve client entry during development when using the pnpm global virtual store (#16045)

  • fix: normalize path separators when comparing config (#16037)

  • fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#16058)

  • fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#16018)

2.65.1

Patch Changes

  • fix: avoid importing the Vite development client code into builds with a non-standard NODE_ENV (#16023)

  • fix: don't emit the unused bundle and stylesheet files when using bundleStrategy: 'inline' (#16025)

  • fix: reset queries before navigating when invalidateAll is set (#16014)

  • fix: regression in loading assets for absolute path apps (#16026)

... (truncated)

Commits
  • 33fdd3f Version Packages (#16050)
  • 0ccdb68 chore: make set_env synchronous (#16060)
  • 913643c chore: fix flaky tests (#16059)
  • c3b2c34 fix: allow runtime/build only explicit environment variable validation (#16058)
  • 80cc084 fix: throw an error when prerendering a root +server.js that returns a non-HT...
  • 8bae090 chore: remove unnecessary condition (#16056)
  • 82bcb7d fix: prevent unhandled rejections from reactively-consumed remote resources (...
  • a34e663 fix: preserve status code when remote function transport requests fail (#16021)
  • d33bc6b fix: only reference env.js/env.script.js if dynamic public env vars are i...
  • 726b13e chore: Add tests for un-covered behaviors in LiveQuery (#16019)
  • Additional commits viewable in compare view

Updates @sveltejs/vite-plugin-svelte from 6.1.0 to 7.1.2

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.1.2

Patch Changes

  • fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (#1342)

@​sveltejs/vite-plugin-svelte@​7.1.1

Patch Changes

  • fix: pass typescript.onlyRemoveTypeImports to transformWithOxc in vitePreprocess so that value imports are not dropped when they are only referenced in Svelte template markup (#1326)

  • fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)

@​sveltejs/vite-plugin-svelte@​7.1.0

Minor Changes

  • feat: enable optimizer for server environments during dev (#1328)

@​sveltejs/vite-plugin-svelte@​7.0.0

Major Changes

  • breaking(deps): require vite 8 (#1266)

  • breaking(options): remove deprecated options (#1274)

    • vitePlugin.hot in svelte.config.js use compilerOptions.hmr instead
    • vitePlugin.ignorePluginPreprocessors in svelte.config.js no longer needed
    • api.idFilter of vite-plugin-svelte:api use api.filter instead
    • plugin.api.sveltePreprocess of other vite plugins Update affected plugins to a newer version or remove them. See docs for more information.

  • breaking(dev): no longer overrides compilerOptions.cssHash because Svelte now produces a stable css hash by itself (#1271)

  • breaking(inspector): integrate vite-plugin-svelte-inspector into vite-plugin-svelte to avoid circular dependency (#1270)

  • breaking(deps): require svelte 5.46.4 or later (#1271)

Patch Changes

  • chore: upgrade vitefu to compatible peer dependency range (#1286)

  • remove author field from package.json (#1281)

... (truncated)

Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.1.2

Patch Changes

  • fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (#1342)

7.1.1

Patch Changes

  • fix: pass typescript.onlyRemoveTypeImports to transformWithOxc in vitePreprocess so that value imports are not dropped when they are only referenced in Svelte template markup (#1326)

  • fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)

7.1.0

Minor Changes

  • feat: enable optimizer for server environments during dev (#1328)

7.0.0

Major Changes

  • breaking(deps): require vite 8 (#1266)

  • breaking(options): remove deprecated options (#1274)

    • vitePlugin.hot in svelte.config.js use compilerOptions.hmr instead
    • vitePlugin.ignorePluginPreprocessors in svelte.config.js no longer needed
    • api.idFilter of vite-plugin-svelte:api use api.filter instead
    • plugin.api.sveltePreprocess of other vite plugins Update affected plugins to a newer version or remove them. See docs for more information.

  • breaking(dev): no longer overrides compilerOptions.cssHash because Svelte now produces a stable css hash by itself (#1271)

  • breaking(inspector): integrate vite-plugin-svelte-inspector into vite-plugin-svelte to avoid circular dependency (#1270)

  • breaking(deps): require svelte 5.46.4 or later (#1271)

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​sveltejs/vite-plugin-svelte since your current version.


Updates @tailwindcss/vite from 4.1.11 to 4.3.1

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.1

Added

  • Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

  • Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
  • Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
  • Allow @apply to be used with CSS mixins (#19427)
  • Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
  • Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
  • Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
  • Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)
  • Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)
  • Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)
  • Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)
  • Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)
  • Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)
  • Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)
  • Allow @variant to be used inside addBase (#19480)
  • Ensure @source globs with symlinks are preserved (#20203)
  • Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
  • Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
  • Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
  • Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
  • Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
  • Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
  • Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

  • Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)
  • Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#20196)

v4.3.0

Added

  • Add @container-size utility (#18901)
  • Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)
  • Add scrollbar-gutter-* utilities (#20018)
  • Add zoom-* utilities (#20020)
  • Add tab-* utilities (#20022)
  • Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)
  • Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)
  • Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

  • Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)

... (truncated)

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.1] - 2026-06-12

Added

  • Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

  • Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
  • Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
  • Allow @apply to be used with CSS mixins (#19427)
  • Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
  • Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
  • Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
  • Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)
  • Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)
  • Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)
  • Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)
  • Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)
  • Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)
  • Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)
  • Allow @variant to be used inside addBase (#19480)
  • Ensure @source globs with symlinks are preserved (#20203)
  • Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
  • Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
  • Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
  • Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
  • Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
  • Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
  • Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

  • Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)
  • Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#20196)

[4.3.0] - 2026-05-08

Added

  • Add @container-size utility (#18901)
  • Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)
  • Add scrollbar-gutter-* utilities (#20018)
  • Add zoom-* utilities (#20020)
  • Add tab-* utilities (#20022)
  • Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)
  • Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)
  • Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tailwindcss/vite since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump vite, @sveltejs/kit, @sveltejs/vite-plugin-svelte and @tailwindc…
268acd7 
…ss/vite

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit), [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte) and [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite). These dependencies needed to be updated together.

Updates `vite` from 7.2.7 to 8.0.16
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

Updates `@sveltejs/kit` from 2.49.2 to 2.65.2
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.65.2/packages/kit)

Updates `@sveltejs/vite-plugin-svelte` from 6.1.0 to 7.1.2
- [Release notes](https://github.com/sveltejs/vite-plugin-svelte/releases)
- [Changelog](https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.1.2/packages/vite-plugin-svelte)

Updates `@tailwindcss/vite` from 4.1.11 to 4.3.1
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:development
- dependency-name: "@sveltejs/kit"
  dependency-version: 2.65.2
  dependency-type: direct:development
- dependency-name: "@sveltejs/vite-plugin-svelte"
  dependency-version: 7.1.2
  dependency-type: direct:development
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 18, 2026
This was referenced Jun 18, 2026
Closed
Closed
@socket-security

socket-security Bot commented Jun 18, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​sveltejs/​kit@​2.49.2 ⏵ 2.65.299100 +3181 +198 +1100
Updated@​sveltejs/​vite-plugin-svelte@​6.1.0 ⏵ 7.1.2100 +110081 +193 -2100
Updatedvite@​7.2.7 ⏵ 8.0.1699 +1100 +3182 +198100
Updatedtailwindcss@​4.1.11 ⏵ 4.3.1100 +11008498100
Updatedsvelte@​5.36.8 ⏵ 5.56.388 +1100 +1688 +197100
Updated@​tailwindcss/​vite@​4.1.11 ⏵ 4.3.1100 +110090 +1798100

View full report

@socket-security

socket-security Bot commented Jun 18, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm svelte is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: package-lock.json → npm/svelte@5.56.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svelte@5.56.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants