Skip to content

chore(deps-dev): bump vite and @sveltejs/vite-plugin-svelte in /web-portal - #80

Open
dependabot[bot] wants to merge 2 commits into
developfrom
dependabot/npm_and_yarn/web-portal/multi-e43085bb03
Open

chore(deps-dev): bump vite and @sveltejs/vite-plugin-svelte in /web-portal#80
dependabot[bot] wants to merge 2 commits into
developfrom
dependabot/npm_and_yarn/web-portal/multi-e43085bb03

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 16, 2026

Copy link
Copy Markdown

Bumps vite and @sveltejs/vite-plugin-svelte. These dependencies needed to be updated together.
Updates vite from 7.3.1 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

  • bundled-dev: avoid duplicated buildEnd (#22931) (8100320)
  • client: overlay error message format align rolldown (#22869) (5a72b87)
  • deps: update all non-major dependencies (#22921) (fef682d)
  • deps: update rolldown-related dependencies (#22922) (3c345e4)
  • module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)
  • optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)
  • ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

  • build: fix incorrect @default for build.cssMinify (#22948) (c88c236)
  • build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

  • avoid scanner scanning all files under __tests__ (#22912) (c961cae)

8.1.4 (2026-07-09)

Features

Bug Fixes

  • build: add workaround for building on stackblitz (#22840) (575c32c)
  • build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)
  • deps: update all non-major dependencies (#22865) (d4295a9)
  • deps: update rolldown-related dependencies (#22866) (7cf07e4)
  • html: avoid backtracking in import-only check (#22848) (b5868c0)
  • optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)
  • ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)
  • strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

Miscellaneous Chores

  • deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

Tests

... (truncated)

Commits
  • 5e7fe12 release: v8.1.5
  • 6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
  • 5a72b87 fix(client): overlay error message format align rolldown (#22869)
  • f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
  • 8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
  • c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
  • b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
  • fef682d fix(deps): update all non-major dependencies (#22921)
  • 3c345e4 fix(deps): update rolldown-related dependencies (#22922)
  • 369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
  • Additional commits viewable in compare view

Updates @sveltejs/vite-plugin-svelte from 6.2.4 to 7.2.0

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.2.0

Minor Changes

  • feat(inspector): add a context menu with current component stack (#1370)

@​sveltejs/vite-plugin-svelte@​7.1.4

Patch Changes

  • fix: enforce ltr styles for inspector (#1324)

@​sveltejs/vite-plugin-svelte@​7.1.3

Patch Changes

  • fix: ensure the inspector is injected into the client correctly for Vite+ projects (#1355)

@​sveltejs/vite-plugin-svelte@​7.1.2

Patch Changes

  • fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (#1342)

@​sveltejs/vite-plugin-svelte@​7.1.1

Patch Changes

  • fix: pass typescript.onlyRemoveTypeImports to transformWithOxc in vitePreprocess so that value imports are not dropped when they are only referenced in Svelte template markup (#1326)

  • fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)

@​sveltejs/vite-plugin-svelte@​7.1.0

Minor Changes

  • feat: enable optimizer for server environments during dev (#1328)

@​sveltejs/vite-plugin-svelte@​7.0.0

Major Changes

  • breaking(deps): require vite 8 (#1266)

  • breaking(options): remove deprecated options (#1274)

    • vitePlugin.hot in svelte.config.js use compilerOptions.hmr instead
    • vitePlugin.ignorePluginPreprocessors in svelte.config.js no longer needed
    • api.idFilter of vite-plugin-svelte:api use api.filter instead

... (truncated)

Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.2.0

Minor Changes

  • feat(inspector): add a context menu with current component stack (#1370)

7.1.4

Patch Changes

  • fix: enforce ltr styles for inspector (#1324)

7.1.3

Patch Changes

  • fix: ensure the inspector is injected into the client correctly for Vite+ projects (#1355)

7.1.2

Patch Changes

  • fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (#1342)

7.1.1

Patch Changes

  • fix: pass typescript.onlyRemoveTypeImports to transformWithOxc in vitePreprocess so that value imports are not dropped when they are only referenced in Svelte template markup (#1326)

  • fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)

7.1.0

Minor Changes

  • feat: enable optimizer for server environments during dev (#1328)

7.0.0

Major Changes

  • breaking(deps): require vite 8 (#1266)

  • breaking(options): remove deprecated options (#1274)

    • vitePlugin.hot in svelte.config.js use compilerOptions.hmr instead

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

martinbogo and others added 2 commits July 16, 2026 13:28
@martinbogo
Merge develop into master (release 20260716_01)
7cb84a0
@dependabot
chore(deps-dev): bump vite and @sveltejs/vite-plugin-svelte
80bb06e 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte). These dependencies needed to be updated together.

Updates `vite` from 7.3.1 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

Updates `@sveltejs/vite-plugin-svelte` from 6.2.4 to 7.2.0
- [Release notes](https://github.com/sveltejs/vite-plugin-svelte/releases)
- [Changelog](https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.2.0/packages/vite-plugin-svelte)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
- dependency-name: "@sveltejs/vite-plugin-svelte"
  dependency-version: 7.2.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 16, 2026
@martinbogo
martinbogo changed the base branch from master to develop July 27, 2026 00:16
@martinbogo

martinbogo commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator

Holding this one, and it needs more than a rebase. Flagging what the title hides.

This is not a routine dev-dependency bump. It is two major version jumps - vite 7.3.1 to 8.1.5 and @sveltejs/vite-plugin-svelte 6.2.4 to 7.2.0 - which together swap the bundler from rollup + esbuild to rolldown (54 packages removed, 30 added). It also carries an undisclosed @tailwindcss/vite 4.1.18 to 4.2.2 bump. The JavaScript we ship inside the firmware image would be produced by a completely different bundler. That deserves an explicit decision rather than being merged as "chore(deps-dev)".

The sibling bumps (#90 dompurify, #79 @sveltejs/kit, #77 svelte) have been merged to develop, and I verified npm ci && npm run build succeeds there.

What has to happen before this can be considered:

  1. @dependabot rebase - this now conflicts on both package.json and package-lock.json. It will not merge as-is.
  2. Re-review the rebased lockfile from scratch. This is the important part: the rebase will produce a tree nobody has reviewed. Testing showed npm install fails ERESOLVE against the retained lockfile (vite-plugin-svelte-inspector@5.0.2 peer-pins the plugin at ^6) and only resolves once package-lock.json is deleted, which then pulls in versions newer than anything proposed in any of these four PRs.
  3. On that rebased tree, run npm ci && npm run build and npm run check, plus a browser smoke test - dashboard hydration, release-notes modal, the xterm terminal, and the file browser. No CI will do this for us; there is no pull_request-triggered workflow in this repo.

Licensing and supply chain are clean, for the record: MIT throughout with no licence changes, every package resolving to registry.npmjs.org with integrity hashes, and this bump actually reduces install scripts from 2 to 1 by dropping esbuild.

One thing to note for whoever picks this up: web-portal/.npmrc sets engine-strict=true and vite 8 requires node ^20.19.0 || >=22.12.0. Our Dockerfile uses the floating node:22-bookworm tag, which satisfies that today but is not pinned.

@martinbogo martinbogo mentioned this pull request Jul 27, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@martinbogo