fix(deps): update dependency vite to v6

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	^5.4.11 -> ^6.1.0

---

Release Notes

vitejs/vite (vite)

v6.1.0

Compare Source

• refactor: deprecate vite optimize command (#​19348) (6e0e3c0), closes #​19348
• feat: show hosts in cert in CLI (#​19317) (a5e306f), closes #​19317
• feat: support for env var for defining allowed hosts (#​19325) (4d88f6c), closes #​19325
• feat: use native runtime to import the config (#​19178) (7c2a794), closes #​19178
• fix: avoid builtStart during vite optimize (#​19356) (fdb36e0), closes #​19356
• fix(build): fix stale build manifest on watch rebuild (#​19361) (fcd5785), closes #​19361

v6.0.11

Compare Source

• fix: preview.allowedHosts with specific values was not respected (#​19246) (aeb3ec8), closes #​19246
• fix: allow CORS from loopback addresses by default (#​19249) (3d03899), closes #​19249

v6.0.10

Compare Source

• fix: try parse server.origin URL (#​19241) (2495022), closes #​19241

v6.0.9

Compare Source

• fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (bd896fb)
• fix!: default server.cors: false to disallow fetching from untrusted origins (b09572a)
• fix: verify token for HMR WebSocket connection (029dcd6)

v6.0.8

Compare Source

• fix: avoid SSR HMR for HTML files (#​19193) (3bd55bc), closes #​19193
• fix: build time display 7m 60s (#​19108) (cf0d2c8), closes #​19108
• fix: don't resolve URL starting with double slash (#​19059) (35942cd), closes #​19059
• fix: ensure server.close() only called once (#​19204) (db81c2d), closes #​19204
• fix: resolve.conditions in ResolvedConfig was defaultServerConditions (#​19174) (ad75c56), closes #​19174
• fix: tree shake stringified JSON imports (#​19189) (f2aed62), closes #​19189
• fix: use shared sigterm callback (#​19203) (47039f4), closes #​19203
• fix(deps): update all non-major dependencies (#​19098) (8639538), closes #​19098
• fix(optimizer): use correct default install state path for yarn PnP (#​19119) (e690d8b), closes #​19119
• fix(types): improve ESBuildOptions.include / exclude type to allow readonly (string | RegExp)[] (ea53e70), closes #​19146
• chore(deps): update dependency pathe to v2 (#​19139) (71506f0), closes #​19139

v6.0.7

Compare Source

• fix: fix minify when builder.sharedPlugins: true (#​19025) (f7b1964), closes #​19025
• fix: skip the plugin if it has been called before with the same id and importer (#​19016) (b178c90), closes #​19016
• fix(html): error while removing vite-ignore attribute for inline script (#​19062) (a492253), closes #​19062
• fix(ssr): fix semicolon injection by ssr transform (#​19097) (1c102d5), closes #​19097
• perf: skip globbing for static path in warmup (#​19107) (677508b), closes #​19107
• feat(css): show lightningcss warnings (#​19076) (b07c036), closes #​19076

v6.0.6

Compare Source

• fix: replace runner-side path normalization with fetchModule-side resolve (#​18361) (9f10261), closes #​18361
• fix(css): resolve style tags in HTML files correctly for lightningcss (#​19001) (afff05c), closes #​19001
• fix(css): show correct error when unknown placeholder is used for CSS modules pattern in lightningcs (9290d85), closes #​19070
• fix(resolve): handle package.json with UTF-8 BOM (#​19000) (902567a), closes #​19000
• fix(ssrTransform): preserve line offset when transforming imports (#​19004) (1aa434e), closes #​19004
• chore: fix typo in comment (#​19067) (eb06ec3), closes #​19067
• chore: update comment about build.target (#​19047) (0e9e81f), closes #​19047
• revert: unpin esbuild version (#​19043) (8bfe247), closes #​19043
• test(ssr): test virtual module with query (#​19044) (a1f4b46), closes #​19044

v6.0.5

Compare Source

• fix: esbuild regression (pin to 0.24.0) (#​19027) (4359e0d), closes #​19027

v6.0.4

Compare Source

• fix: this.resolve skipSelf should not skip for different id or import (#​18903) (4727320), closes #​18903
• fix: fallback terser to main thread when function options are used (#​18987) (12b612d), closes #​18987
• fix: merge client and ssr values for pluginContainer.getModuleInfo (#​18895) (258cdd6), closes #​18895
• fix(css): escape double quotes in url() when lightningcss is used (#​18997) (3734f80), closes #​18997
• fix(css): root relative import in sass modern API on Windows (#​18945) (c4b532c), closes #​18945
• fix(css): skip non css in custom sass importer (#​18970) (21680bd), closes #​18970
• fix(deps): update all non-major dependencies (#​18967) (d88d000), closes #​18967
• fix(deps): update all non-major dependencies (#​18996) (2b4f115), closes #​18996
• fix(optimizer): keep NODE_ENV as-is when keepProcessEnv is true (#​18899) (8a6bb4e), closes #​18899
• fix(ssr): recreate ssrCompatModuleRunner on restart (#​18973) (7d6dd5d), closes #​18973
• chore: better validation error message for dts build (#​18948) (63b82f1), closes #​18948
• chore(deps): update all non-major dependencies (#​18916) (ef7a6a3), closes #​18916
• chore(deps): update dependency @​rollup/plugin-node-resolve to v16 (#​18968) (62fad6d), closes #​18968
• refactor: make internal invoke event to use the same interface with handleInvoke (#​18902) (27f691b), closes #​18902
• refactor: simplify manifest plugin code (#​18890) (1bfe21b), closes #​18890
• test: test ModuleRunnerTransport invoke API (#​18865) (e5f5301), closes #​18865
• test: test output hash changes (#​18898) (bfbb130), closes #​18898

v6.0.3

Compare Source

• fix: handle postcss load unhandled rejections (#​18886) (d5fb653), closes #​18886
• fix: make handleInvoke interface compatible with invoke (#​18876) (a1dd396), closes #​18876
• fix: make result interfaces for ModuleRunnerTransport#invoke more explicit (#​18851) (a75fc31), closes #​18851
• fix: merge environments.ssr.resolve with root ssr config (#​18857) (3104331), closes #​18857
• fix: no permission to create vite config file (#​18844) (ff47778), closes #​18844
• fix: remove CSS import in CJS correctly in some cases (#​18885) (690a36f), closes #​18885
• fix(config): bundle files referenced with imports field (#​18887) (2b5926a), closes #​18887
• fix(config): make stacktrace path correct when sourcemap is enabled (#​18833) (20fdf21), closes #​18833
• fix(css): rewrite url when image-set and url exist at the same time (#​18868) (d59efd8), closes #​18868
• fix(deps): update all non-major dependencies (#​18853) (5c02236), closes #​18853
• fix(html): allow unexpected question mark in tag name (#​18852) (1b54e50), closes #​18852
• fix(module-runner): decode uri for file url passed to import (#​18837) (88e49aa), closes #​18837
• refactor: fix logic errors found by no-unnecessary-condition rule (#​18891) (ea802f8), closes #​18891
• chore: fix duplicate attributes issue number in comment (#​18860) (ffee618), closes #​18860

v6.0.2

Compare Source

• chore: run typecheck in unit tests (#​18858) (49f20bb), closes #​18858
• chore: update broken links in changelog (#​18802) (cb754f8), closes #​18802
• chore: update broken links in changelog (#​18804) (47ec49f), closes #​18804
• fix: don't store temporary vite config file in node_modules if deno (#​18823) (a20267b), closes #​18823
• fix(css): referencing aliased svg asset with lightningcss enabled errored (#​18819) (ae68958), closes #​18819
• fix(manifest): use style.css as a key for the style file for cssCodesplit: false (#​18820) (ec51115), closes #​18820
• fix(optimizer): resolve all promises when cancelled (#​18826) (d6e6194), closes #​18826
• fix(resolve): don't set builtinModules to external by default (#​18821) (2250ffa), closes #​18821
• fix(ssr): set ssr.target: 'webworker' defaults as fallback (#​18827) (b39e696), closes #​18827
• feat(css): format lightningcss error (#​18818) (dac7992), closes #​18818
• refactor: make properties of ResolvedServerOptions and ResolvedPreviewOptions required (#​18796) (51a5569), closes #​18796

v6.0.1

Compare Source

• fix: default empty server proxy prevents starting http2 server (#​18788) (bbaf514), closes #​18788
• fix(manifest): do not override existing js manifest entry (#​18776) (3b0837e), closes #​18776
• fix(server): close _ssrCompatModuleRunner on server close (#​18784) (9b4c410), closes #​18784
• fix(server): skip hot channel client normalization for wsServer (#​18782) (cc7670a), closes #​18782
• fix(worker): fix applyToEnvironment hooks on worker build (#​18793) (0c6cdb0), closes #​18793
• chore: flat v6 config file (#​18777) (c7b3308), closes #​18777
• chore: split changelog (#​18787) (8542632), closes #​18787
• chore: update changelog for v6 (#​18773) (b254fac), closes #​18773
• revert: update moduleResolution value casing (#​18409) (#​18774) (b0fc6e3), closes #​18409 #​18774

v6.0.0

Compare Source

• fix: createRunnableDevEnvironment returns RunnableDevEnvironment, not DevEnvironment (#​18673) (74221c3), closes #​18673
• fix: getModulesByFile should return a serverModule (#​18715) (b80d5ec), closes #​18715
• fix: catch error in full reload handler (#​18713) (a10e741), closes #​18713
• fix: display pre-transform error details (#​18764) (554f45f), closes #​18764
• fix: exit code on SIGTERM (#​18741) (cc55e36), closes #​18741
• fix: expose missing InterceptorOptions type (#​18766) (6252c60), closes #​18766
• fix: log error when send in module runner failed (#​18753) (ba821bb), closes #​18753
• fix(client): overlay not appearing when multiple vite clients were loaded (#​18647) (27d70b5), closes #​18647
• fix(deps): update all non-major dependencies (#​18691) (f005461), closes #​18691
• fix(html): fix inline proxy modules invalidation (#​18696) (8ab04b7), closes #​18696
• fix(module-runner): make evaluator optional (#​18672) (fd1283f), closes #​18672
• fix(optimizer): detect npm / yarn / pnpm dependency changes correctly (#​17336) (#​18560) (818cf3e), closes #​17336 #​18560
• fix(optimizer): trigger onCrawlEnd after manual included deps are registered (#​18733) (dc60410), closes #​18733
• fix(optimizer): workaround firefox's false warning for no sources source map (#​18665) (473424e), closes #​18665
• fix(ssr): replace __vite_ssr_identity__ with (0, ...) and inject ; between statements (#​18748) (94546be), closes #​18748
• chore: add 5.4.x changelogs (#​18768) (26b58c8), closes #​18768
• chore: add some comments about mimes (#​18705) (f07e9b9), closes #​18705
• chore(deps): update all non-major dependencies (#​18746) (0ad16e9), closes #​18746
• perf: reduce bundle size for Object.keys(import.meta.glob(...)) / `Object.values(import.meta.glob( (ed99a2c), closes #​18666
• perf(worker): inline worker without base64 (#​18752) (90c66c9), closes #​18752
• feat: add support for .cur type (#​18680) (5ec9eed), closes #​18680
• feat: enable HMR by default on ModuleRunner side (#​18749) (4d2abc7), closes #​18749
• feat: support module-sync condition when loading config if enabled (#​18650) (cf5028d), closes #​18650
• feat!: drop node 21 support in version ranges (#​18729) (a384d8f), closes #​18729
• fix(deps)!: update dependency dotenv-expand to v12 (#​18697) (0c658de), closes #​18697
• docs: rename HotUpdateContext to HotUpdateOptions (#​18718) (824c347), closes #​18718
• test: simplify playground/json/__tests__/ssr (#​18701) (f731ca2), closes #​18701
• refactor: first character judgment replacement regexp (#​18658) (58f1df3), closes #​18658

v5.4.14

Compare Source

Please refer to CHANGELOG.md for details.

v5.4.13

Compare Source

Please refer to CHANGELOG.md for details.

v5.4.12

Compare Source

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: Branch creation - "* 0-3 * * 1" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.