[squiggler-app]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	^8.3.4 → ^8.3.8

---

Release Notes

vitejs/vite (vite)

v8.3.8

Compare Source

Bug Fixes

• build: keep magicString and ast in transform hook meta (#​24012) (a3b28e8)
• bundled-dev: emit assets referenced by inline workers during load (#​23103) (5e50bae)
• config: skip native loader compat checks for type-only imports (#​24021) (e554294)
• css: reject CSS entrypoints when build.cssCodeSplit: false (#​23112) (e4ad62b)
• deps: update all non-major dependencies (#​24027) (a13aa04)
• hide console window when running yarn config get on Windows (#​24013) (3f6c4cd)

Performance Improvements

• css: import sass once instead of per file (#​24041) (db8b119)
• defer net use until a UNC path is resolved on Windows (#​24014) (b643046)

Miscellaneous Chores

• deps: update dependency @​types/node to v26 (#​24029) (dd780cd)
• enable vitest plugin in Oxlint (#​24052) (ce979e4)
• enable vitest style rules in Oxlint (#​24053) (b8c8270)
• revert "fix(build): keep magicString and ast in transform hook meta (#​24012)" (#​24065) (afc44f0)

Code Refactoring

• optimizer: use non-capturing group for external types regex (#​24048) (ef23433)

Tests

• avoid joining logs for assertion (#​24057) (fbb0a4e)

v8.3.7

Compare Source

Bug Fixes

• deps: update Rolldown to v1.2.18 (#​24038) (517affb)

Miscellaneous Chores

• enable more lint rules (#​24035) (72f86e5)

Tests

• use onTestFinished for tear downs (#​24003) (a579e35)

Build System

• generate sourcemaps in shim-deps plugin (#​24023) (c02138c)

v8.3.6

Compare Source

Bug Fixes

• await overlapping plugin container close calls (#​23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#​23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #​23975) (#​23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#​23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#​23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#​23862) (67c965b)
• deps: update all non-major dependencies (#​23896) (46b91c5)
• deps: update all non-major dependencies (#​23966) (b3cb057)
• deps: update rolldown-related dependencies (#​23868) (a63eb87)
• deps: update rolldown-related dependencies (#​23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#​23933) (4f340fd)
• html: remove adjacent module tags on the first line (#​23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#​23634) (95c2daf)
• optimizer: detect cache dir precisely (#​23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#​23959) (0fdd81e)
• respect build.sourcemap from environment (#​23879) (82e7aa0)
• server: escape HTML attributes (#​23995) (a270391)
• server: preserve $ patterns in static alias replacements (#​23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#​23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#​23898) (90bc034)
• wasm: reject .wasm outside server.fs (#​23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#​23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#​23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #​23920) (#​23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#​23889) (1b905e5)

Miscellaneous Chores

• align charset case (#​23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#​23904) (20d355a)

v8.3.5

Compare Source

Bug Fixes

• build: handle missing chunk import maps (#​23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#​23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#​23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#​23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#​23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#​23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#​23741) (11fe1e4)
• bundled-dev: normalize served output files (#​23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#​23839) (7471e8c)
• css: don't fail on a literal % in url() (#​23676) (50b382d)
• deps: update all non-major dependencies (#​23731) (cf80aa5)
• deps: update all non-major dependencies (#​23826) (77d8373)
• deps: update rolldown-related dependencies (#​23733) (43f0d05)
• deps: update rolldown-related dependencies (#​23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#​23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#​23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#​23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#​23761) (a7d5696)
• resolve: support subpath imports with multiple # (#​23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#​23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#​23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#​23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#​23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#​23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#​23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#​23828) (df7b40e)
• dev: separate import resolution from URL conversion (#​23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#​23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#​23815) (a162990)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 3am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
async-react	Ready	Preview	Nov 12, 2026 4:13am UTC
react-rx	Ready	Preview	Nov 12, 2026 4:13am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7ef5e34

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vite@​8.3.4 ⏵ 8.3.8			+1

View full report