diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed1cee5c4ede04..6e3231ddae7488 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Assume PRs are less than 50 commits
           fetch-depth: 50
@@ -77,7 +77,7 @@ jobs:
     name: "Build&Test: node-${{ matrix.node_version }}, ${{ matrix.os }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -152,7 +152,7 @@ jobs:
     runs-on: ubuntu-latest
     name: "Lint: node-24, ubuntu-latest"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 4b43e7edf8f9b5..7fc11b7d8c11f9 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -14,7 +14,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml
index 9945a9dc188eb0..2c1bed4167f8b3 100644
--- a/.github/workflows/issue-close-require.yml
+++ b/.github/workflows/issue-close-require.yml
@@ -13,7 +13,7 @@ jobs:
       issues: write # for actions/issues-helper to update issues
       pull-requests: write # for actions/issues-helper to update PRs
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/issue-labeled.yml b/.github/workflows/issue-labeled.yml
index e3f137590eade7..d68cbd74adc0cb 100644
--- a/.github/workflows/issue-labeled.yml
+++ b/.github/workflows/issue-labeled.yml
@@ -13,7 +13,7 @@ jobs:
       issues: write # for actions/issues-helper to update issues
       pull-requests: write # for actions/issues-helper to update PRs
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/issue-template-check.yml b/.github/workflows/issue-template-check.yml
index e5c8db2c7b60a8..a4818b1bf301f2 100644
--- a/.github/workflows/issue-template-check.yml
+++ b/.github/workflows/issue-template-check.yml
@@ -17,7 +17,7 @@ jobs:
       template_type: ${{ steps.detect.outputs.template_type }}
       skip: ${{ steps.detect.outputs.skip }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/lock-closed-issues.yml b/.github/workflows/lock-closed-issues.yml
index 847787655aae8f..a67244440f6c81 100644
--- a/.github/workflows/lock-closed-issues.yml
+++ b/.github/workflows/lock-closed-issues.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'vitejs/vite'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/preview-release.yml b/.github/workflows/preview-release.yml
index 8051e4e86eddfd..34f693be3049d3 100644
--- a/.github/workflows/preview-release.yml
+++ b/.github/workflows/preview-release.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a08e6ed177ca7c..1d9c58f1c02b2e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -18,7 +18,7 @@ jobs:
     environment: Release
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pull-request-template-check.yml b/.github/workflows/pull-request-template-check.yml
index 6a995ae9f179d9..76fa5914c66485 100644
--- a/.github/workflows/pull-request-template-check.yml
+++ b/.github/workflows/pull-request-template-check.yml
@@ -20,7 +20,7 @@ jobs:
     outputs:
       agent_output: ${{ steps.agent.outputs.agent_output }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index a494a231ef0df5..24274cd72b4393 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write # for yyx990803/release-tag to create a release tag
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index a7d0ddadc41d86..27a7673c78a33f 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -22,7 +22,7 @@ jobs:
     permissions:
       security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/docs/guide/static-deploy-github-pages.yaml b/docs/guide/static-deploy-github-pages.yaml
index 5a9ba26c5266f0..21226a3bea1ab4 100644
--- a/docs/guide/static-deploy-github-pages.yaml
+++ b/docs/guide/static-deploy-github-pages.yaml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
diff --git a/packages/plugin-legacy/package.json b/packages/plugin-legacy/package.json
index 7df328f2e205c2..e57d90970d055c 100644
--- a/packages/plugin-legacy/package.json
+++ b/packages/plugin-legacy/package.json
@@ -43,7 +43,7 @@
     "browserslist": "^4.28.6",
     "browserslist-to-esbuild": "^2.1.1",
     "core-js": "^3.49.0",
-    "magic-string": "^0.30.21",
+    "magic-string": "^1.0.0",
     "regenerator-runtime": "^0.14.1",
     "systemjs": "^6.15.1"
   },
diff --git a/packages/vite/package.json b/packages/vite/package.json
index ff64869e8299a9..9977a582337f3c 100644
--- a/packages/vite/package.json
+++ b/packages/vite/package.json
@@ -107,7 +107,7 @@
     "host-validation-middleware": "^0.1.4",
     "http-proxy-3": "^1.23.3",
     "launch-editor-middleware": "^2.14.1",
-    "magic-string": "^0.30.21",
+    "magic-string": "^1.0.0",
     "mlly": "^1.8.2",
     "mrmime": "^2.0.1",
     "nanoid": "^5.1.16",
diff --git a/packages/vite/src/node/__tests__/fixtures/config/native-compat/mts-config/package.json b/packages/vite/src/node/__tests__/fixtures/config/native-compat/mts-config/package.json
new file mode 100644
index 00000000000000..88f8d5b1f64fa0
--- /dev/null
+++ b/packages/vite/src/node/__tests__/fixtures/config/native-compat/mts-config/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "@vitejs/test-native-compat-mts",
+  "type": "commonjs",
+  "private": true
+}
diff --git a/packages/vite/src/node/__tests__/fixtures/config/native-compat/mts-config/vite.config.mts b/packages/vite/src/node/__tests__/fixtures/config/native-compat/mts-config/vite.config.mts
new file mode 100644
index 00000000000000..4f1b25a0c3d348
--- /dev/null
+++ b/packages/vite/src/node/__tests__/fixtures/config/native-compat/mts-config/vite.config.mts
@@ -0,0 +1,3 @@
+import { defineConfig } from 'vite'
+
+export default defineConfig({})
diff --git a/packages/vite/src/node/nativeConfigCompat.ts b/packages/vite/src/node/nativeConfigCompat.ts
index 8af469e2d00388..b2fc57040f295b 100644
--- a/packages/vite/src/node/nativeConfigCompat.ts
+++ b/packages/vite/src/node/nativeConfigCompat.ts
@@ -217,7 +217,13 @@ export function createNativeConfigCompatPlugin(
   return {
     name: 'vite:native-config-compat-check',
     transform: {
-      filter: { id: /\.[cm]?[jt]sx?$/ },
+      filter: {
+        id: {
+          include: /\.[cm]?[jt]sx?$/,
+          // exclude rolldown runtime
+          exclude: /^\0/,
+        },
+      },
       async handler(code, id) {
         const isESM =
           typeof process.versions.deno === 'string' || isFilePathESM(id)
diff --git a/packages/vite/src/node/utils.ts b/packages/vite/src/node/utils.ts
index 38eb7bc8ec5a77..7108016c713058 100644
--- a/packages/vite/src/node/utils.ts
+++ b/packages/vite/src/node/utils.ts
@@ -430,6 +430,13 @@ export function isFilePathESM(
     return true
   } else if (/\.c[jt]s$/.test(filePath)) {
     return false
+  } else if (filePath.startsWith('\0')) {
+    // treat virtual modules as ESM
+    return true
+  } else if (!path.isAbsolute(filePath)) {
+    // should not rely on `process.cwd()` as that would depend on
+    // the environment and make it unreproducible
+    return false
   } else {
     // check package.json for type: "module"
     try {
@@ -453,6 +460,15 @@ export function isFilePathFormatExplicit(
   if (/\.[mc][jt]s$/.test(filePath)) {
     return true
   }
+  if (filePath.startsWith('\0')) {
+    // treat virtual modules as ESM
+    return true
+  }
+  if (!path.isAbsolute(filePath)) {
+    // should not rely on `process.cwd()` as that would depend on
+    // the environment and make it unreproducible
+    return false
+  }
   try {
     const pkg = findNearestPackageData(path.dirname(filePath), packageCache)
     return pkg?.data.type === 'module' || pkg?.data.type === 'commonjs'
diff --git a/playground/css-sourcemap/package.json b/playground/css-sourcemap/package.json
index 2797923959e427..d87d303823f823 100644
--- a/playground/css-sourcemap/package.json
+++ b/playground/css-sourcemap/package.json
@@ -12,7 +12,7 @@
   "devDependencies": {
     "less": "^4.7.0",
     "lightningcss": "^1.33.0",
-    "magic-string": "^0.30.21",
+    "magic-string": "^1.0.0",
     "sass": "^1.101.0",
     "stylus": "^0.64.0",
     "sugarss": "^5.0.1"
diff --git a/playground/js-sourcemap/package.json b/playground/js-sourcemap/package.json
index 13d96578dc4648..7c36d73374aec4 100644
--- a/playground/js-sourcemap/package.json
+++ b/playground/js-sourcemap/package.json
@@ -15,7 +15,7 @@
     "@vitejs/test-dep-malicious-sourcemap": "file:dep-malicious-sourcemap",
     "@vitejs/test-dep-optimized-malicious": "file:dep-optimized-malicious",
     "@vitejs/test-importee-pkg": "file:importee-pkg",
-    "magic-string": "^0.30.21",
+    "magic-string": "^1.0.0",
     "oxc-parser": "^0.139.0"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 58e303106f7a23..9016104c97ae54 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -214,8 +214,8 @@ importers:
         specifier: ^3.49.0
         version: 3.49.0
       magic-string:
-        specifier: ^0.30.21
-        version: 0.30.21
+        specifier: ^1.0.0
+        version: 1.0.0
       regenerator-runtime:
         specifier: ^0.14.1
         version: 0.14.1
@@ -351,8 +351,8 @@ importers:
         specifier: ^2.14.1
         version: 2.14.1
       magic-string:
-        specifier: ^0.30.21
-        version: 0.30.21
+        specifier: ^1.0.0
+        version: 1.0.0
       mlly:
         specifier: ^1.8.2
         version: 1.8.2
@@ -459,6 +459,8 @@ importers:
 
   packages/vite/src/node/__tests__/fixtures/config/native-compat/esm-in-commonjs-pkg: {}
 
+  packages/vite/src/node/__tests__/fixtures/config/native-compat/mts-config: {}
+
   packages/vite/src/node/__tests__/fixtures/config/native-import: {}
 
   packages/vite/src/node/__tests__/fixtures/config/plugin-module-condition: {}
@@ -706,8 +708,8 @@ importers:
         specifier: ^1.33.0
         version: 1.33.0
       magic-string:
-        specifier: ^0.30.21
-        version: 0.30.21
+        specifier: ^1.0.0
+        version: 1.0.0
       sass:
         specifier: ^1.101.0
         version: 1.101.0
@@ -923,8 +925,8 @@ importers:
         specifier: file:importee-pkg
         version: file:playground/js-sourcemap/importee-pkg
       magic-string:
-        specifier: ^0.30.21
-        version: 0.30.21
+        specifier: ^1.0.0
+        version: 1.0.0
       oxc-parser:
         specifier: ^0.139.0
         version: 0.139.0
@@ -6355,6 +6357,9 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  magic-string@1.0.0:
+    resolution: {integrity: sha512-CGvjzMN08iv6w1mm4/x3Gh1hLb4VnyRUA15FFpl6CsCIGGoe36k7kY5KNz9QDbSBN5I/fWHM6ZlIkUTa5xdUEA==}
+
   make-dir@5.1.0:
     resolution: {integrity: sha512-IfpFq6UM39dUNiphpA6uDezNx/AvWyhwfICWPR3t1VspkgkMZrL+Rk1RbN1bx+aeNYwOrqGJgEgV3yotk+ZUVw==}
     engines: {node: '>=18'}
@@ -12228,6 +12233,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  magic-string@1.0.0:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
   make-dir@5.1.0:
     optional: true