Bump vite, @vitejs/plugin-react and vitest

[dependabot]

Bumps vite, @vitejs/plugin-react and vitest. These dependencies needed to be updated together.
Updates vite from 3.1.8 to 6.0.11

Release notes

Sourced from vite's releases.

v6.0.11

Please refer to CHANGELOG.md for details.

v6.0.10

Please refer to CHANGELOG.md for details.

v6.0.9

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v6.0.8

Please refer to CHANGELOG.md for details.

v6.0.7

Please refer to CHANGELOG.md for details.

v6.0.6

Please refer to CHANGELOG.md for details.

v6.0.5

Please refer to CHANGELOG.md for details.

v6.0.4

Please refer to CHANGELOG.md for details.

v6.0.3

Please refer to CHANGELOG.md for details.

v6.0.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.0.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.0.0

Please refer to CHANGELOG.md for details.

v6.0.0-beta.10

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

6.0.11 (2025-01-21)

• fix: preview.allowedHosts with specific values was not respected (#19246) (aeb3ec8), closes #19246
• fix: allow CORS from loopback addresses by default (#19249) (3d03899), closes #19249

6.0.10 (2025-01-20)

• fix: try parse server.origin URL (#19241) (2495022), closes #19241

6.0.9 (2025-01-20)

• fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (bd896fb)
• fix!: default server.cors: false to disallow fetching from untrusted origins (b09572a)
• fix: verify token for HMR WebSocket connection (029dcd6)

6.0.8 (2025-01-20)

• fix: avoid SSR HMR for HTML files (#19193) (3bd55bc), closes #19193
• fix: build time display 7m 60s (#19108) (cf0d2c8), closes #19108
• fix: don't resolve URL starting with double slash (#19059) (35942cd), closes #19059
• fix: ensure server.close() only called once (#19204) (db81c2d), closes #19204
• fix: resolve.conditions in ResolvedConfig was defaultServerConditions (#19174) (ad75c56), closes #19174
• fix: tree shake stringified JSON imports (#19189) (f2aed62), closes #19189
• fix: use shared sigterm callback (#19203) (47039f4), closes #19203
• fix(deps): update all non-major dependencies (#19098) (8639538), closes #19098
• fix(optimizer): use correct default install state path for yarn PnP (#19119) (e690d8b), closes #19119
• fix(types): improve ESBuildOptions.include / exclude type to allow readonly (string | RegExp)[] (ea53e70), closes #19146
• chore(deps): update dependency pathe to v2 (#19139) (71506f0), closes #19139

6.0.7 (2025-01-02)

• fix: fix minify when builder.sharedPlugins: true (#19025) (f7b1964), closes #19025
• fix: skip the plugin if it has been called before with the same id and importer (#19016) (b178c90), closes #19016
• fix(html): error while removing vite-ignore attribute for inline script (#19062) (a492253), closes #19062
• fix(ssr): fix semicolon injection by ssr transform (#19097) (1c102d5), closes #19097
• perf: skip globbing for static path in warmup (#19107) (677508b), closes #19107
• feat(css): show lightningcss warnings (#19076) (b07c036), closes #19076

6.0.6 (2024-12-26)

... (truncated)

Commits

• a0ed405 release: v6.0.11
• 3d03899 fix: allow CORS from loopback addresses by default (#19249)
• aeb3ec8 fix: preview.allowedHosts with specific values was not respected (#19246)
• 9654348 release: v6.0.10
• 2495022 fix: try parse server.origin URL (#19241)
• a55f8ba release: v6.0.9
• bd896fb fix!: check host header to prevent DNS rebinding attacks and introduce `serve...
• 029dcd6 fix: verify token for HMR WebSocket connection
• b09572a fix!: default server.cors: false to disallow fetching from untrusted origins
• c0f72a6 release: v6.0.8
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 2.1.0 to 4.3.4

Release notes

Sourced from @​vitejs/plugin-react's releases.

v4.3.4

Add Vite 6 to peerDependencies range

Vite 6 is highly backward compatible, not much to add!

Force Babel to output spec compliant import attributes #386

The default was an old spec (with type: "json"). We now enforce spec compliant (with { type: "json" })

v4.3.3

React Compiler runtimeModule option removed

React Compiler was updated to accept a target option and runtimeModule was removed. vite-plugin-react will still detect runtimeModule for backwards compatibility.

When using a custom runtimeModule or target !== '19', the plugin will not try to pre-optimize react/compiler-runtime dependency.

The react-compiler-runtime is now available on npm can be used instead of the local shim for people using the compiler with React < 19.

Here is the configuration to use the compiler with React 18 and correct source maps in development:

npm install babel-plugin-react-compiler react-compiler-runtime @babel/plugin-transform-react-jsx-development

export default defineConfig(({ command }) => {
  const babelPlugins = [['babel-plugin-react-compiler', { target: '18' }]]
  if (command === 'serve') {
    babelPlugins.push(['@babel/plugin-transform-react-jsx-development', {}])
  }
return {
plugins: [react({ babel: { plugins: babelPlugins } })],
}
})

v4.3.2

Ignore directive sourcemap error #369

v4.3.1

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.

v4.3.0

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

4.3.4 (2024-11-26)

Add Vite 6 to peerDependencies range

Vite 6 is highly backward compatible, not much to add!

Force Babel to output spec compliant import attributes #386

The default was an old spec (with type: "json"). We now enforce spec compliant (with { type: "json" })

4.3.3 (2024-10-19)

React Compiler runtimeModule option removed

React Compiler was updated to accept a target option and runtimeModule was removed. vite-plugin-react will still detect runtimeModule for backwards compatibility.

When using a custom runtimeModule or target !== '19', the plugin will not try to pre-optimize react/compiler-runtime dependency.

The react-compiler-runtime is now available on npm can be used instead of the local shim for people using the compiler with React < 19.

Here is the configuration to use the compiler with React 18 and correct source maps in development:

npm install babel-plugin-react-compiler react-compiler-runtime @babel/plugin-transform-react-jsx-development

export default defineConfig(({ command }) => {
  const babelPlugins = [['babel-plugin-react-compiler', { target: '18' }]]
  if (command === 'serve') {
    babelPlugins.push(['@babel/plugin-transform-react-jsx-development', {}])
  }
return {
plugins: [react({ babel: { plugins: babelPlugins } })],
}
})

4.3.2 (2024-09-29)

Ignore directive sourcemap error #369

4.3.1 (2024-06-10)

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

... (truncated)

Commits

• See full diff in compare view

Updates vitest from 0.24.3 to 3.0.3

Release notes

Sourced from vitest's releases.

v3.0.3

   🐞 Bug Fixes

• browser:
  • Don't throw a validation error if v8 coverage is used with filtered instances  -  by @​sheremet-va in vitest-dev/vitest#7306 (fa463)
  • Don't fail when running --browser.headless if the browser projest is part of the workspace  -  by @​sheremet-va in vitest-dev/vitest#7311 (e43a8)

   🏎 Performance

• reporters: Update summary only when needed  -  by @​AriPerkkio in vitest-dev/vitest#7291 (7f36b)

    View changes on GitHub

v3.0.2

   🐞 Bug Fixes

• Don't await an empty timeout after every test  -  by @​sheremet-va in vitest-dev/vitest#7281 (ef1aa)
• expect: Fix expect().resolves/rejects chain typings  -  by @​hi-ogawa in vitest-dev/vitest#7273 (fa415)

    View changes on GitHub

v3.0.1

   🐞 Bug Fixes

• Revert "fix: re-apply default conditions if using vite 6 or later (vitest-dev/vitest#7071)"  -  by @​sheremet-va in vitest-dev/vitest#7071 and vitest-dev/vitest#7271 (755ec)
• deps: Update all non-major dependencies  -  by @​sheremet-va in vitest-dev/vitest#7147 (537fa)

    View changes on GitHub

v3.0.0

Vitest 3 is here! There are a few breaking changes, but we expect the migration to be smooth. This release page lists all changes made to the project during the beta. For the migration guide, please refer to the documentation.

   🚨 Breaking Changes

• spy.mockReset changes  -  by @​Lordfirespeed in vitest-dev/vitest#6426 (db7a8)
• Pass down context to test hooks  -  by @​sheremet-va in vitest-dev/vitest#7034 (82c2e)
• Support Vite 6  -  by @​sheremet-va in vitest-dev/vitest#7026 (7abe8)
• coverage: Always exclude test files  -  by @​AriPerkkio in vitest-dev/vitest#7254 (b5268)
• deps: Update fake-timers to v14.0.0  -  by @​xxzefgh and @​hi-ogawa in vitest-dev/vitest#7097 (c98b4)
• expect: Check more properties for error equality  -  by @​hi-ogawa and @​sheremet-va in vitest-dev/vitest#5876 (10023)
• runner: Support describe(..., { shuffle: boolean }) and inherit from parent suite  -  by @​hi-ogawa in vitest-dev/vitest#6670 (aa1da)
• snapshot: Reset snapshot state for retry and repeats  -  by @​hi-ogawa in vitest-dev/vitest#6817 (e8ce9)
• spy: SpyOn reuses mock if method is already spyed on  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#6464 (b3e43)
• vitest: Don't expose default toFake config  -  by @​sheremet-va in vitest-dev/vitest#6288 (e3144)

   🚀 Features

• Support inline diff options and support printBasicPrototype  -  by @​hi-ogawa, @​sheremet-va and Michał Grzegorzewski in vitest-dev/vitest#6740 (39186)
• Allow a custom note when calling ctx.skip() dynamically  -  by @​sheremet-va in vitest-dev/vitest#6805 (697c3)
• Allow inline workspace configuration  -  by @​sheremet-va in vitest-dev/vitest#6923 (562e1)

... (truncated)

Commits

• 33ab8a2 chore: release v3.0.3
• e43a8f5 fix(browser): don't fail when running --browser.headless if the browser proje...
• fa4634b fix(browser): don't throw a validation error if v8 coverage is used with filt...
• 7f36b6f perf(reporters): update summary only when needed (#7291)
• f17918a chore: release v3.0.2
• 56c5018 chore: release v3.0.1
• 755ecdf Revert "fix: re-apply default conditions if using vite 6 or later (#7071)" (#...
• 537fa5e fix(deps): update all non-major dependencies (#7147)
• 01600e0 chore: release v3.0.0
• 84287fc fix: re-apply default conditions if using vite 6 or later (#7071)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by vitestbot, a new releaser for vitest since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #143.