[pull] main from vitejs:main

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # Assume PRs are less than 50 commits
           fetch-depth: 50
@@ -76,12 +76,12 @@ jobs:
     name: "Build&Test: node-${{ matrix.node_version }}, ${{ matrix.os }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Set node version to ${{ matrix.node_version }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -151,12 +151,12 @@ jobs:
     runs-on: ubuntu-latest
     name: "Lint: node-24, ubuntu-latest"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/copilot-setup-steps.yml

@@ -14,12 +14,12 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/issue-close-require.yml

@@ -13,7 +13,7 @@ jobs:
       issues: write # for actions/issues-helper to update issues
       pull-requests: write # for actions/issues-helper to update PRs
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/issue-labeled.yml

@@ -13,7 +13,7 @@ jobs:
       issues: write # for actions/issues-helper to update issues
       pull-requests: write # for actions/issues-helper to update PRs
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/issue-template-check.yml

@@ -17,7 +17,7 @@ jobs:
       template_type: ${{ steps.detect.outputs.template_type }}
       skip: ${{ steps.detect.outputs.skip }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/lock-closed-issues.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'vitejs/vite'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/preview-release.yml

@@ -23,12 +23,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/publish.yml

@@ -18,12 +18,12 @@ jobs:
     environment: Release
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/pull-request-template-check.yml

@@ -20,7 +20,7 @@ jobs:
     outputs:
       agent_output: ${{ steps.agent.outputs.agent_output }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/release-tag.yml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write # for yyx990803/release-tag to create a release tag
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/zizmor.yml

@@ -22,9 +22,9 @@ jobs:
     permissions:
       security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7

docs/.vitepress/config.ts

@@ -101,15 +101,6 @@ const config = defineConfig({
     ['meta', { name: 'twitter:card', content: 'summary_large_image' }],
     ['meta', { name: 'twitter:site', content: '@vite_js' }],
     ['meta', { name: 'theme-color', content: '#646cff' }],
-    [
-      'script',
-      {
-        src: 'https://cdn.usefathom.com/script.js',
-        'data-site': 'CBDFBSLI',
-        'data-spa': 'auto',
-        defer: '',
-      },
-    ],
   ],
 
   locales: {

docs/config/server-options.md

@@ -103,7 +103,7 @@ export default defineConfig({
 
 - **Type:** `Record<string, string | ProxyOptions>`
 
-Configure custom proxy rules for the dev server. Expects an object of `{ key: options }` pairs. Any requests that request path starts with that key will be proxied to that specified target. If the key starts with `^`, it will be interpreted as a `RegExp`. The `configure` option can be used to access the proxy instance. If a request matches any of the configured proxy rules, the request won't be transformed by Vite.
+Configure custom proxy rules for the dev server. Expects an object of `{ key: options }` pairs. Any requests whose request path starts with that key will be proxied to the specified target. If the key starts with `^`, it will be interpreted as a `RegExp`. The `configure` option can be used to access the proxy instance. If a request matches any of the configured proxy rules, the request won't be transformed by Vite.
 
 Note that if you are using non-relative [`base`](/config/shared-options.md#base), you must prefix each key with that `base`.
 

docs/guide/api-plugin.md

@@ -155,7 +155,7 @@ During dev, the Vite dev server creates a plugin container that invokes [Rolldow
 
 The following hooks are called once on server start:
 
-- [`options`](https://rolldown.rs/reference/interface.plugin#options)
+- [`options`](https://rolldown.rs/reference/Interface.Plugin#options)
 - [`buildStart`](https://rolldown.rs/reference/Interface.Plugin#buildstart)
 
 The following hooks are called on each incoming module request:

docs/guide/dep-pre-bundling.md

@@ -17,7 +17,7 @@ This is Vite performing what we call "dependency pre-bundling". This process ser
 
 2. **Performance:** Vite converts ESM dependencies with many internal modules into a single module to improve subsequent page load performance.
 
-   Some packages ship their ES modules builds as many separate files importing one another. For example, [`lodash-es` has over 600 internal modules](https://unpkg.com/browse/lodash-es/)! When we do `import { debounce } from 'lodash-es'`, the browser fires off 600+ HTTP requests at the same time! Even though the server has no problem handling them, the large amount of requests create a network congestion on the browser side, causing the page to load noticeably slower.
+   Some packages ship their ES modules builds as many separate files importing one another. For example, [`lodash-es` has over 600 internal modules](https://unpkg.com/browse/lodash-es/)! When we do `import { debounce } from 'lodash-es'`, the browser fires off 600+ HTTP requests at the same time! Even though the server has no problem handling them, the large number of requests creates network congestion on the browser side, causing the page to load noticeably slower.
 
    By pre-bundling `lodash-es` into a single module, we now only need one HTTP request instead!
 
@@ -27,7 +27,7 @@ Dependency pre-bundling only applies in development mode.
 
 ## Automatic Dependency Discovery
 
-If an existing cache is not found, Vite will crawl your source code and automatically discover dependency imports (i.e. "bare imports" that expect to be resolved from `node_modules`) and use these found imports as entry points for the pre-bundle. The pre-bundling is performed with [Rolldown](https://rolldown.rs/) so it's typically very fast.
+If an existing cache is not found, Vite will crawl your source code and automatically discover dependency imports (i.e. "bare imports" that expect to be resolved from `node_modules`) and use these found imports as entry points for the pre-bundle. The pre-bundling is performed with [Rolldown](https://rolldown.rs/), so it's typically very fast.
 
 After the server has already started, if a new dependency import is encountered that isn't already in the cache, Vite will re-run the dep bundling process and reload the page if needed.
 

docs/guide/static-deploy-github-pages.yaml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:

docs/guide/troubleshooting.md

@@ -105,7 +105,7 @@ When using a self-signed SSL certificate, Chrome ignores all caching directives
 
 To resolve the problem use a trusted SSL cert.
 
-See: [Cache problems](https://helpx.adobe.com/mt/experience-manager/kb/cache-problems-on-chrome-with-SSL-certificate-errors.html), [Chrome issue](https://bugs.chromium.org/p/chromium/issues/detail?id=110649#c8)
+See: [Chrome issue](https://bugs.chromium.org/p/chromium/issues/detail?id=110649#c8)
 
 #### macOS
 

docs/package.json

@@ -18,7 +18,7 @@
     "vitepress": "^2.0.0-alpha.17",
     "vitepress-plugin-graphviz": "^0.1.0",
     "vitepress-plugin-group-icons": "^1.7.5",
-    "vitepress-plugin-llms": "^1.13.1",
+    "vitepress-plugin-llms": "^1.13.2",
     "vue": "^3.5.38",
     "vue-tsc": "^3.3.5"
   }

package.json

@@ -55,23 +55,23 @@
     "@types/ws": "^8.18.1",
     "@vitejs/release-scripts": "^1.7.1",
     "eslint": "^9.39.4",
-    "eslint-plugin-import-x": "^4.16.2",
+    "eslint-plugin-import-x": "^4.17.0",
     "eslint-plugin-n": "^18.1.0",
     "eslint-plugin-regexp": "^3.1.0",
     "execa": "^9.6.1",
-    "globals": "^17.6.0",
-    "lint-staged": "^17.0.7",
-    "oxfmt": "^0.54.0",
+    "globals": "^17.7.0",
+    "lint-staged": "^17.0.8",
+    "oxfmt": "^0.56.0",
     "picocolors": "^1.1.1",
-    "playwright-chromium": "^1.60.0",
+    "playwright-chromium": "^1.61.1",
     "rolldown": "~1.1.2",
     "rollup": "^4.59.0",
     "simple-git-hooks": "^2.13.1",
     "tsx": "^4.22.4",
     "typescript": "~6.0.2",
-    "typescript-eslint": "^8.61.0",
+    "typescript-eslint": "^8.62.0",
     "vite": "workspace:*",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
   },
   "simple-git-hooks": {
     "pre-commit": "pnpm exec lint-staged --concurrent false"
@@ -90,7 +90,7 @@
       "eslint --cache --fix --concurrency auto"
     ]
   },
-  "packageManager": "pnpm@10.34.3",
+  "packageManager": "pnpm@10.34.4",
   "stackblitz": {
     "startCommand": "pnpm --filter='./packages/vite' run dev"
   }

packages/create-vite/__tests__/cli.spec.ts

@@ -102,7 +102,7 @@ test('prompts to use ESLint for React templates in interactive mode', () => {
     '--template',
     'react-ts',
   ])
-  expect(stdout).toContain('Use ESLint instead of Oxlint?')
+  expect(stdout).toContain('Which linter to use?')
 })
 
 test('asks to overwrite non-empty target directory', () => {

packages/create-vite/package.json

@@ -34,7 +34,7 @@
   "homepage": "https://github.com/vitejs/vite/tree/main/packages/create-vite#readme",
   "funding": "https://github.com/vitejs/vite?sponsor=1",
   "devDependencies": {
-    "@clack/prompts": "^1.5.1",
+    "@clack/prompts": "^1.6.0",
     "@vercel/detect-agent": "^1.2.3",
     "cross-spawn": "^7.0.6",
     "mri": "^1.2.0",

packages/create-vite/src/index.ts

@@ -633,10 +633,10 @@ async function init() {
   if (isReactTemplate && eslint === undefined) {
     if (interactive) {
       const eslintResult = await prompts.select({
-        message: 'Use ESLint instead of Oxlint?',
+        message: 'Which linter to use?',
         options: [
-          { label: 'No (Oxlint)', value: false },
-          { label: 'Yes (ESLint)', value: true },
+          { label: 'Oxlint', value: false },
+          { label: 'ESLint', value: true },
         ],
       })
       if (prompts.isCancel(eslintResult)) return cancel()
@@ -858,9 +858,9 @@ function setupEslint(root: string, isTs: boolean) {
   // renovate: datasource=npm depName=eslint-plugin-react-refresh
   const eslintPluginReactRefreshVersion = '0.5.3'
   // renovate: datasource=npm depName=globals
-  const globalsVersion = '17.6.0'
+  const globalsVersion = '17.7.0'
   // renovate: datasource=npm depName=typescript-eslint
-  const typescriptEslintVersion = '8.61.0'
+  const typescriptEslintVersion = '8.62.0'
 
   const eslintConfigForTS = /* js */ `import js from '@eslint/js'
 import globals from 'globals'

packages/create-vite/template-react-ts/package.json

@@ -17,8 +17,8 @@
     "@types/node": "^24.13.2",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.2",
-    "oxlint": "^1.69.0",
+    "@vitejs/plugin-react": "^6.0.3",
+    "oxlint": "^1.71.0",
     "typescript": "~6.0.2",
     "vite": "^8.1.0"
   }

packages/create-vite/template-react/package.json

@@ -16,8 +16,8 @@
   "devDependencies": {
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.2",
-    "oxlint": "^1.69.0",
+    "@vitejs/plugin-react": "^6.0.3",
+    "oxlint": "^1.71.0",
     "vite": "^8.1.0"
   }
 }

packages/create-vite/template-svelte-ts/package.json

@@ -13,8 +13,8 @@
     "@sveltejs/vite-plugin-svelte": "^7.1.2",
     "@tsconfig/svelte": "^5.0.8",
     "@types/node": "^24.13.2",
-    "svelte": "^5.56.3",
-    "svelte-check": "^4.6.0",
+    "svelte": "^5.56.4",
+    "svelte-check": "^4.7.0",
     "typescript": "~6.0.2",
     "vite": "^8.1.0"
   }

packages/create-vite/template-svelte/package.json

@@ -10,7 +10,7 @@
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "svelte": "^5.56.3",
+    "svelte": "^5.56.4",
     "vite": "^8.1.0"
   }
 }

packages/plugin-legacy/package.json

@@ -40,7 +40,7 @@
     "@babel/preset-env": "^7.29.7",
     "babel-plugin-polyfill-corejs3": "^0.14.2",
     "babel-plugin-polyfill-regenerator": "^0.6.8",
-    "browserslist": "^4.28.2",
+    "browserslist": "^4.28.4",
     "browserslist-to-esbuild": "^2.1.1",
     "core-js": "^3.49.0",
     "magic-string": "^0.30.21",

packages/vite/package.json

@@ -87,10 +87,10 @@
     "@types/pnpapi": "^0.0.5",
     "@vercel/detect-agent": "^1.2.3",
     "@vitejs/devtools": "^0.3.3",
-    "@vitest/utils": "4.1.8",
+    "@vitest/utils": "4.1.9",
     "@voidzero-dev/vite-task-client": "^0.2.0",
     "artichokie": "^0.4.3",
-    "baseline-browser-mapping": "^2.10.37",
+    "baseline-browser-mapping": "^2.10.38",
     "cac": "^7.0.0",
     "chokidar": "^3.6.0",
     "connect": "^3.7.0",
@@ -110,7 +110,7 @@
     "magic-string": "^0.30.21",
     "mlly": "^1.8.2",
     "mrmime": "^2.0.1",
-    "nanoid": "^5.1.11",
+    "nanoid": "^5.1.15",
     "obug": "^1.0.2",
     "open": "^10.2.0",
     "parse5": "^8.0.1",