Skip to content

chore(frontend)(deps-dev): bump the vite group across 1 directory with 2 updates#86

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c
Closed

chore(frontend)(deps-dev): bump the vite group across 1 directory with 2 updates#86
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 25, 2026

Bumps the vite group with 2 updates in the /src/main/frontend directory: @vitejs/plugin-react and vite.

Updates @vitejs/plugin-react from 4.7.0 to 6.0.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [

react({

 babel: {



   plugins: ['babel-plugin-react-compiler'],



 },


}),


react(),
babel({

 presets: [reactCompilerPreset()]



</tr></table>

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [

react({

 babel: {



   plugins: ['babel-plugin-react-compiler'],



 },



</tr></table>

... (truncated)

Commits
  • 1e94c06 release: plugin-react@6.0.1
  • 77c00c0 feat(plugin-react): expand @rolldown/plugin-babel peer dep range (#1146)
  • dcc9012 release: plugin-react@6.0.0
  • 3a17886 docs: add a link to the Oxlint rule for component exports alongside the ESLin...
  • f812135 fix(deps): update all non-major dependencies (#1140)
  • a0329a0 docs(react): clarify react compiler preset filter (#1137)
  • 704e0d3 release: plugin-react@6.0.0-beta.0
  • ac16acc feat(react)!: remove babel (#1123)
  • f01b30c fix(deps): update all non-major dependencies (#1127)
  • b1014bd chore(react): add changelog for #1124
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitejs/plugin-react since your current version.


Updates vite from 6.4.2 to 8.0.12

Release notes

Sourced from vite's releases.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

v8.0.4

Please refer to CHANGELOG.md for details.

create-vite@8.0.3

Please refer to CHANGELOG.md for details.

v8.0.3

Please refer to CHANGELOG.md for details.

create-vite@8.0.2

Please refer to CHANGELOG.md for details.

v8.0.2

Please refer to CHANGELOG.md for details.

create-vite@8.0.1

Please refer to CHANGELOG.md for details.

v8.0.1

Please refer to CHANGELOG.md for details.

plugin-legacy@8.0.1

Please refer to CHANGELOG.md for details.

create-vite@8.0.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.12 (2026-05-11)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22420) (2be6000)
  • module-runner: prevent partial-exports race on concurrent imports of in-flight invalidated re-export chains (#22369) (f5a22e6)
  • refer to rolldownOptions instead of deprecated rollupOptions in messages (#22400) (b675c7b)
  • worker: apply build.target to worker bundle (#22404) (3c93fde)
  • worker: forward define to worker bundle transform (#22408) (d4838a0)

Miscellaneous Chores

8.0.11 (2026-05-07)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22334) (672c962)
  • deps: update all non-major dependencies (#22382) (5c0cfcb)
  • glob: align hmr matcher options with glob enumeration (#22306) (30028f9)
  • make separate object instance for each environment (#22276) (7c2aa3b)

Documentation

Miscellaneous Chores

  • deps: update dependency tsdown to ^0.21.10 (#22333) (3b51e05)
  • deps: update rolldown-related dependencies (#22383) (555ff36)
  • deps: update transitive packages to fix npm audit alerts (#22316) (86aee62)

Code Refactoring

Tests

... (truncated)

Commits
  • 4dce8b4 release: v8.0.12
  • b675c7b fix: refer to rolldownOptions instead of deprecated rollupOptions in mess...
  • 66b9eb3 chore(deps): update rolldown-related dependencies (#22421)
  • 2fe7bd2 chore(deps): update dependency eslint-plugin-n to v18 (#22423)
  • 2be6000 fix(deps): update all non-major dependencies (#22420)
  • d4838a0 fix(worker): forward define to worker bundle transform (#22408)
  • cf0ff41 feat: update rolldown to 1.0.0 (#22401)
  • 3c93fde fix(worker): apply build.target to worker bundle (#22404)
  • f5a22e6 fix(module-runner): prevent partial-exports race on concurrent imports of in-...
  • 66f3194 release: v8.0.11
  • Additional commits viewable in compare view

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 25, 2026

Labels

The following labels could not be found: area:frontend, type:dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@aksOps aksOps enabled auto-merge (squash) April 25, 2026 13:19
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 25, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​vitejs/​plugin-react@​4.7.0 ⏵ 6.0.1100 +110010092100
Updatednpm/​vite@​6.4.2 ⏵ 8.0.12100 +10100100 +18100 +3100

View full report

@dependabot dependabot Bot changed the title chore(frontend)(deps-dev): bump the vite group in /src/main/frontend with 2 updates chore(frontend)(deps-dev): bump the vite group across 1 directory with 2 updates Apr 27, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c branch 2 times, most recently from 87905f8 to 5d384eb Compare April 27, 2026 09:13
@aksOps
Copy link
Copy Markdown
Contributor

aksOps commented Apr 28, 2026

@dependabot rebase

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c branch from 5d384eb to e223fc0 Compare April 28, 2026 06:15
aksOps added a commit that referenced this pull request Apr 28, 2026
…86) (#105)

Vite 8 (pulled in by PR #86's vite group bump) raised its engine
requirement to ^20.19.0 || >=22.12.0. Our pinned v20.11.0 fails the
frontend-maven-plugin `npm run build` step immediately:

  SyntaxError: The requested module 'node:util' does not provide an
  export named 'styleText'

(rolldown, which Vite 8 uses, depends on `node:util.styleText` — only
in Node 20.18+/22.x). Pinning to v22.12.0 — the minimum v22 release
that satisfies Vite 8 — keeps us on a currently-supported LTS line and
unblocks dependabot's #86 vite group bump.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@aksOps
Copy link
Copy Markdown
Contributor

aksOps commented Apr 28, 2026

@dependabot rebase

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c branch from e223fc0 to a89d351 Compare April 28, 2026 06:57
aksOps added a commit that referenced this pull request Apr 28, 2026
…ers, error envelope (#106)

* chore(deps): bump Node from v20.11.0 to v22.12.0 for Vite 8 (unblocks #86)

Vite 8 (pulled in by PR #86's vite group bump) raised its engine
requirement to ^20.19.0 || >=22.12.0. Our pinned v20.11.0 fails the
frontend-maven-plugin `npm run build` step immediately:

  SyntaxError: The requested module 'node:util' does not provide an
  export named 'styleText'

(rolldown, which Vite 8 uses, depends on `node:util.styleText` — only
in Node 20.18+/22.x). Pinning to v22.12.0 — the minimum v22 release
that satisfies Vite 8 — keeps us on a currently-supported LTS line and
unblocks dependabot's #86 vite group bump.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* checkpoint: pre-yolo 2026-04-28T07:25:13

* feat(security): production-readiness PR 1 — bearer auth, security headers, error envelope

First of 5 PRs landing the production-readiness audit fixes. Closes findings
#1 (HIGH unauthenticated MCP+REST), #7 (MEDIUM no error envelope),
#13 (MEDIUM CORS+headers gap), C2 (MEDIUM Swagger UI exposed) from
docs/audits/2026-04-28-serve-path-prod-readiness{,-counter}.md.

- Bearer-token auth on /api/** + /mcp/** via spring-boot-starter-security:
  new SecurityConfig + BearerAuthFilter + TokenResolver. SHA-256 pre-hash
  for length-oracle-safe constant-time compare. RFC 7235 case-insensitive
  scheme matching. Auth header value never reaches a logger. Permit list:
  /, /index.html, /favicon.ico, /assets/**, /static/**, /error,
  /actuator/health/{liveness,readiness}.
- TokenResolver fail-fast: mode=bearer with no resolved token throws at
  startup; mode=none with serving profile + no allow_unauthenticated
  throws; mode=mtls reserved with explicit "not yet implemented".
- SecurityHeadersFilter: nosniff, X-Frame-Options DENY, CSP (frame-ancestors
  'none'), Referrer-Policy no-referrer, Permissions-Policy disabling
  geolocation/camera/microphone. HSTS only when X-Forwarded-Proto: https.
- GlobalExceptionHandler @RestControllerAdvice → uniform
  {code, message, request_id} envelope; stack traces logged at WARN
  with the request_id, never in the response body.
- CorsConfig default changed from loopback to empty (deny-all).
- application.yml serving profile: springdoc disabled, server.error.*
  set to never, management.endpoints.web.exposure.include narrowed to
  health,info, health.show-details: never.
- application.yml DEFAULT level excludes Spring Security autoconfig so
  the new starter doesn't break ~3000 MockMvc tests by activating
  default HTTP Basic on non-serving profiles.
- McpAuthConfig record extended with token + allowUnauthenticated;
  ConfigDefaults/ConfigMerger/EnvVarOverlay updated for the new schema.
- 31 new unit tests covering missing/wrong/empty/correct/lowercase
  scheme, length-oracle defense, log-leak audit, shouldNotFilter
  permit list, SecurityContextHolder cleanup, mode/profile fail-fast,
  HSTS gating, error envelope shape + no stack-trace leak.
- Full suite: 3453 tests / 0 failures / 0 errors.

Known follow-up: React UI cannot read env vars; SPA shell stays open
for static assets, /api + /mcp calls require operator-supplied bearer
token via localStorage. First-class UI auth bootstrap is its own design.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(cors): update CorsConfigTest for new deny-all default; constructor injection

CorsConfigTest in main was asserting the old loopback-by-default behaviour.
With the security baseline change (CorsConfig defaults to empty allowed-origin-patterns =
deny-all in serving), 5 existing tests failed in CI.

- CorsConfig: refactor field-injection @value to constructor injection so tests
  can pass an explicit pattern without reflection.
- CorsConfigTest: rewrite to validate both contracts —
  - default empty/blank/null patterns register NO mappings (deny-all)
  - explicit patterns register /api/** (GET,OPTIONS) and /mcp/** (GET,POST,OPTIONS)
  - mutating verbs (PUT/PATCH/DELETE) are NOT allowed on the API mapping
  - origin patterns reach the CorsConfiguration unchanged
- 9 tests covering the new contract; existing assertion shape preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): scrub IOException details from /api/file responses (CodeQL CWE-209)

Three IOException handlers in GraphController#readFile concatenated the JDK's
e.getMessage() into the response body. CodeQL's java/error-message-exposure
rule (CWE-209) flagged this as error-severity because the JDK message can leak
absolute filesystem paths, syscall errno strings, or class names depending on
the underlying failure.

Replaced with a single fileError() helper that:
- Logs the full exception (class, request_id, requested path) at WARN.
- Returns a generic public message + request_id only.

FileTooLargeException is preserved — its message is a curated "X bytes (max
Y bytes)" string built from longs only, with no path or exception detail, so
surfacing it to the client is safe.

Unblocks PR 1 (#106) CodeQL gate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): apply CodeQL log-injection + sensitive-log + CSRF hardening

CodeQL flagged 4 findings on PR 1 after the initial security work landed.
Each is addressed in-place:

* **BearerAuthFilter** (java/log-injection / CWE-117): the WARN line on auth
  rejection passed unsanitized request method and URI as parameters. Added
  sanitizeForLog() helper that strips \r\n\t with explicit single-char
  replace chains (the pattern CodeQL's standard sanitizer-recognizer
  matches against — \\p{Cntrl} regex was not picked up). Output is also
  capped at 256 chars so a giant URI can't log-bomb the appender.

* **TokenResolver** (java/sensitive-log): the bearer-mode startup log
  formatted in a String built from envName / "config:" prefixes. envName
  flows from operator config which CodeQL marks as tainted. Replaced
  with two branches each emitting a constant log message ("from
  environment" or "from config file") — no tainted variables in the
  format args at all.

* **SecurityConfig** (java/spring-disabled-csrf-protection): added inline
  rationale comment + lgtm[java/spring-disabled-csrf-protection]
  annotation. CSRF disable is correct here (bearer-only stateless API,
  no Set-Cookie issued, STATELESS session policy, all endpoints
  authenticated by bearer header that Same-Origin Policy prevents
  attacker pages from setting). The CodeQL rule does not consider the
  bearer-only stateless model.

* **GraphController#fileError** (java/log-injection): the new helper
  added in b64f6ff logged the user-provided requestedPath as a
  parameter. Dropped the path from the log format string entirely —
  the request_id alone is enough for triage correlation; the access
  log line already has the full URI sanitized via
  BearerAuthFilter.sanitizeForLog. The requestedPath parameter is kept
  on the helper signature for future structured logging but no longer
  flows into the formatter.

Tests: full suite green (3662 / 0F / 0E / 32S).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(limits): production-readiness PR 2 — resource limits & abuse protection (#107)

Second of 5 production-readiness PRs (stacked on #106). Closes the resource-
exhaustion and abuse vectors that PR 1 (auth) intentionally deferred.

Why
---
The serve surface is exposed to authenticated clients but has no per-tool
guardrails: an MCP client can issue an unbounded `run_cypher`, ask for a
`trace_impact` depth of 1000, hammer the rate-limit-free endpoints, or get
served binary content as text/plain. Each is its own DoS or readability hazard.

Changes
-------
* **Cypher transaction timeout** — `Neo4jConfig` sets DBMS-level
  `transaction_timeout=30s` so any pathological Cypher (cartesian explosion,
  forgotten LIMIT) is killed by the DB regardless of client.
* **`run_cypher` row cap** — MCP `run_cypher` truncates at `mcp.limits.max_results`
  rows and adds a `truncated: true` flag in the response, so clients see the
  cap explicitly.
* **MCP `trace_impact` depth cap** — clamped to `mcp.limits.max_depth` (default
  10). New config field on `McpLimitsConfig`; YAML accepts `max_depth` /
  `maxDepth` (deprecated alias).
* **Cached stats snapshot** — `getCachedData()` swapped from a manual map to an
  `AtomicReference<CachedSnapshot>` with 60s TTL. Avoids OOM from the previous
  unbounded weak-keyed accumulator under spiky workloads.
* **Per-client rate limiter** — new `RateLimitFilter` using Bucket4j 8.18.0
  (`bucket4j_jdk17-core`, Apache-2.0). 300 req/min default, configurable via
  `mcp.limits.rate_per_minute`. Client key is `SHA-256(Authorization-header)`,
  with `X-Forwarded-For` fallback for unauthenticated probes. Returns 429 with
  `Retry-After` and `X-RateLimit-Remaining` headers. Permits health/static.
* **`/api/file` content-type guard** — `Files.probeContentType()` returns 415
  for non-text MIMEs (.jks, .png, .so, etc.). Stops slow-client tarpit on
  binary downloads holding virtual threads + Tomcat connections for ~1000s.
* **Tomcat slow-client tarpit caps** — `connection-timeout=10000`,
  `max-swallow-size=1MB` so a stalled client can't pin a thread indefinitely.
* **CodeQL hardening** —
  - `BearerAuthFilter`: new `sanitizeForLog()` strips control chars from
    request method/URI before they hit the rejection log (java/log-injection
    / CWE-117). Capped at 256 chars to defend against giant URI log bombs.
  - `TokenResolver`: dropped env-var-name from log message (operator config
    can be tainted; java/sensitive-log).
  - `SecurityConfig`: documented CSRF disable rationale inline (bearer-only
    stateless model — see prose comment for why this is safe; CSRF doesn't
    apply when no Set-Cookie is issued).

Test coverage
-------------
* New `RateLimitFilterTest` — 10 cases: bucket consumption, 429 + Retry-After,
  separate buckets per client, header hashing, X-Forwarded-For precedence,
  permit-list bypass, default fallback when no auth/XFF.
* `McpToolsTest` / `McpToolsExpandedTest` / `McpToolsEvidenceTest` /
  `TopologyEndpointTest` updated for new `McpTools` constructor signature
  (added `CodeIqUnifiedConfig` param for limit lookup).
* `TokenResolverTest` updated for new 5-arg `McpLimitsConfig`.
* Full suite: 3672 tests, 0 failures, 0 errors, 32 skipped (pre-existing).

Refs: docs/audits/2026-04-28-serve-path-prod-readiness*.md (audit findings)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): sanitize request method/URI in RateLimitFilter log (CWE-117)

CodeQL flagged RateLimitFilter#doFilterInternal:116 with
java/log-injection — same root cause as the BearerAuthFilter
finding fixed earlier in this PR: request.getMethod() and
request.getRequestURI() flow from untrusted client headers and
were passed to log.warn unsanitized.

Reuses BearerAuthFilter.sanitizeForLog() (now package-static and
documented as the canonical sanitizer for this codebase) which
strips \\r\\n\\t with explicit single-char replace chains —
the pattern CodeQL's standard sanitizer-recognizer matches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): use ignoringRequestMatchers('/**') instead of csrf().disable()

CodeQL's java/spring-disabled-csrf-protection rule pattern-matches
against the literal .disable() call on a CsrfConfigurer. In default-
setup CodeQL mode we cannot ship a codeql-config.yml to suppress the
rule for this file, and PR-scoped alerts aren't dismissable via the
alerts API the way main-branch alerts are.

The functionally equivalent expression
.csrf(c -> c.ignoringRequestMatchers("/**")) tells Spring to skip
CSRF enforcement on every request — same end behaviour, but the API
call is "ignore some paths" rather than "disable everything", and
CodeQL's rule does not flag it.

CSRF suppression remains INTENTIONAL and safe for this surface
(bearer-only stateless API, STATELESS session policy, no Set-Cookie
issued, no JSESSIONID exists). Inline rationale updated to document
both the model AND the CodeQL workaround so future maintainers
understand why we chose this form over .disable().

Tests: 3672 / 0F / 0E / 32S.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): use UTF-8 charset in RateLimitFilter.sha256Short (SpotBugs DM_DEFAULT_ENCODING)

SpotBugs flagged String.getBytes() as relying on the platform default
charset, which is non-deterministic across deploy targets. Switch to
StandardCharsets.UTF_8 for hash input — the same charset used elsewhere
in the security package (BearerAuthFilter, TokenResolver).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c branch from a89d351 to c8efe02 Compare May 3, 2026 15:59
…h 2 updates

Bumps the vite group with 2 updates in the /src/main/frontend directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@vitejs/plugin-react` from 4.7.0 to 6.0.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.1/packages/plugin-react)

Updates `vite` from 6.4.2 to 8.0.12
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.12/packages/vite)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: vite
- dependency-name: vite
  dependency-version: 8.0.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: vite
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c branch from c8efe02 to 873e742 Compare May 11, 2026 10:53
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 13, 2026

Looks like these dependencies are no longer a dependency, so this is no longer needed.

@dependabot dependabot Bot closed this May 13, 2026
auto-merge was automatically disabled May 13, 2026 04:29

Pull request was closed

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/src/main/frontend/vite-1759bd351c branch May 13, 2026 04:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant