vitejs · sapphi-red · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026
diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: AgentScan
         id: agentscan
-        uses: MatteoGabriele/agentscan-action@98202262c925c508d4c1424b1dfbe17ee35b0c02 # v2.4.0
+        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410 # v2.5.0
         with:
           mode: labels
           cache-path: .agentscan-cache

diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
@@ -75,7 +75,7 @@ jobs:
           node scripts/prepare-release.ts "$RELEASE_PACKAGE" "$RELEASE" >> "$GITHUB_OUTPUT"
 
       - name: Open release PR
-        uses: vitejs/release-scripts/action/release-pr@005dab4c647ff12519bfd076a595b2be33be8f6b # v1.9.2
+        uses: vitejs/release-scripts/action/release-pr@083fcf277cb3edc873f60d820738be35323d14e7 # v1.10.0
         with:
           token: ${{ github.token }}
           package-name: ${{ inputs.package }}

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
@@ -14,7 +14,7 @@ jobs:
     permissions:
       security-events: write # Required for upload-sarif to upload SARIF files.
     container:
-      image: semgrep/semgrep:1.174.0@sha256:f1f7b71861c7b28b6e0f661225a2c4f58a484f5d0f182465c6d6b3b22f972ade
+      image: semgrep/semgrep:1.175.0@sha256:b94b53d02fd4a022f9eac4e2af1380f5c3c4c21400e79d3336bdff1d1db5e796
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -31,6 +31,6 @@ jobs:
           > semgrep-results.sarif
 
       - name: Upload SARIF result
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: semgrep-results.sarif
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -27,4 +27,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
diff --git a/docs/package.json b/docs/package.json
@@ -17,7 +17,7 @@
     "vitepress-plugin-graphviz": "^0.1.0",
     "vitepress-plugin-group-icons": "^1.7.6",
     "vitepress-plugin-llms": "^1.13.5",
-    "vue": "^3.5.41",
+    "vue": "^3.5.42",
     "vue-tsc": "^3.3.11"
   }
 }
diff --git a/package.json b/package.json
@@ -53,23 +53,23 @@
     "@types/picomatch": "^4.0.3",
     "@types/stylus": "^0.48.43",
     "@types/ws": "^8.18.1",
-    "@vitejs/release-scripts": "^1.9.2",
+    "@vitejs/release-scripts": "^1.10.0",
     "eslint": "^9.39.5",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.3.0",
     "eslint-plugin-regexp": "^3.2.0",
     "execa": "^9.6.1",
     "globals": "^17.11.0",
-    "lint-staged": "^17.3.0",
-    "oxfmt": "^0.64.0",
+    "lint-staged": "^17.4.1",
+    "oxfmt": "^0.65.0",
     "picocolors": "^1.1.1",
     "playwright-chromium": "^1.62.1",
     "rolldown": "~1.2.6",
     "rollup": "^4.59.0",
-    "simple-git-hooks": "^2.13.1",
-    "tsx": "^4.23.12",
+    "simple-git-hooks": "^2.14.0",
+    "tsx": "^4.23.13",
     "typescript": "~6.0.2",
-    "typescript-eslint": "^8.67.0",
+    "typescript-eslint": "^8.68.0",
     "vite": "workspace:*",
     "vitest": "^4.1.11"
   },

diff --git a/packages/create-vite/src/index.ts b/packages/create-vite/src/index.ts
@@ -860,15 +860,15 @@ function setupEslint(root: string, isTs: boolean) {
   // renovate: datasource=npm depName=@eslint/js
   const eslintJsVersion = '10.0.1'
   // renovate: datasource=npm depName=eslint
-  const eslintVersion = '10.9.0'
+  const eslintVersion = '10.9.1'
   // renovate: datasource=npm depName=eslint-plugin-react-hooks
   const eslintPluginReactHooksVersion = '7.1.1'
   // renovate: datasource=npm depName=eslint-plugin-react-refresh
-  const eslintPluginReactRefreshVersion = '0.5.4'
+  const eslintPluginReactRefreshVersion = '0.5.5'
   // renovate: datasource=npm depName=globals
   const globalsVersion = '17.11.0'
   // renovate: datasource=npm depName=typescript-eslint
-  const typescriptEslintVersion = '8.67.0'
+  const typescriptEslintVersion = '8.68.0'
 
   const eslintConfigForTS = /* js */ `import js from '@eslint/js'
 import globals from 'globals'

diff --git a/packages/create-vite/template-react-ts/package.json b/packages/create-vite/template-react-ts/package.json
@@ -16,9 +16,9 @@
   "devDependencies": {
     "@types/node": "^24.13.3",
     "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^6.1.0",
-    "oxlint": "^1.79.0",
+    "@types/react-dom": "^19.2.5",
+    "@vitejs/plugin-react": "^6.1.1",
+    "oxlint": "^1.80.0",
     "typescript": "~6.0.2",
     "vite": "^8.2.2"
   }

diff --git a/packages/create-vite/template-react/package.json b/packages/create-vite/template-react/package.json
@@ -15,9 +15,9 @@
   },
   "devDependencies": {
     "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^6.1.0",
-    "oxlint": "^1.79.0",
+    "@types/react-dom": "^19.2.5",
+    "@vitejs/plugin-react": "^6.1.1",
+    "oxlint": "^1.80.0",
     "vite": "^8.2.2"
   }
 }
diff --git a/packages/create-vite/template-svelte-ts/package.json b/packages/create-vite/template-svelte-ts/package.json
@@ -13,7 +13,7 @@
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@tsconfig/svelte": "^5.0.8",
     "@types/node": "^24.13.3",
-    "svelte": "^5.56.10",
+    "svelte": "^5.57.0",
     "svelte-check": "^4.7.6",
     "typescript": "~6.0.2",
     "vite": "^8.2.2"

diff --git a/packages/create-vite/template-svelte/package.json b/packages/create-vite/template-svelte/package.json
@@ -10,7 +10,7 @@
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
-    "svelte": "^5.56.10",
+    "svelte": "^5.57.0",
     "vite": "^8.2.2"
   }
 }
diff --git a/packages/create-vite/template-vue-ts/package.json b/packages/create-vite/template-vue-ts/package.json
@@ -9,7 +9,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "vue": "^3.5.41"
+    "vue": "^3.5.42"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",

diff --git a/packages/create-vite/template-vue/package.json b/packages/create-vite/template-vue/package.json
@@ -9,7 +9,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "vue": "^3.5.41"
+    "vue": "^3.5.42"
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^6.0.8",

diff --git a/packages/plugin-legacy/package.json b/packages/plugin-legacy/package.json
@@ -43,7 +43,7 @@
     "browserslist": "^4.28.8",
     "browserslist-to-esbuild": "^2.1.1",
     "core-js": "^3.50.0",
-    "magic-string": "^1.2.2",
+    "magic-string": "^1.2.3",
     "regenerator-runtime": "^0.14.1",
     "systemjs": "^6.15.1"
   },

diff --git a/packages/vite/package.json b/packages/vite/package.json
@@ -70,7 +70,7 @@
   },
   "dependencies": {
     "lightningcss": "^1.33.0",
-    "picomatch": "^4.0.5",
+    "picomatch": "^4.0.7",
     "postcss": "^8.5.26",
     "rolldown": "~1.2.6",
     "tinyglobby": "^0.2.17"
@@ -90,7 +90,7 @@
     "@vitest/utils": "4.1.11",
     "@voidzero-dev/vite-task-client": "^0.2.0",
     "artichokie": "^0.4.4",
-    "baseline-browser-mapping": "^2.11.18",
+    "baseline-browser-mapping": "^2.11.20",
     "cac": "^7.0.0",
     "chokidar": "^3.6.0",
     "connect": "^3.7.0",
@@ -107,7 +107,7 @@
     "host-validation-middleware": "^0.1.4",
     "http-proxy-3": "^1.23.3",
     "launch-editor-middleware": "^2.14.1",
-    "magic-string": "^1.2.2",
+    "magic-string": "^1.2.3",
     "mlly": "^1.8.2",
     "mrmime": "^2.0.1",
     "nanoid": "^5.1.16",
@@ -129,7 +129,7 @@
     "sass-embedded": "^1.103.1",
     "sirv": "^3.0.2",
     "strip-literal": "^4.0.0",
-    "terser": "^5.50.0",
+    "terser": "^5.51.2",
     "ufo": "^1.6.4",
     "ws": "^8.21.3"
   },

diff --git a/playground/alias/package.json b/playground/alias/package.json
@@ -11,8 +11,8 @@
   },
   "dependencies": {
     "aliased-module": "file:./dir/module",
-    "vue": "^3.5.41",
-    "@vue/shared": "^3.5.41"
+    "vue": "^3.5.42",
+    "@vue/shared": "^3.5.42"
   },
   "devDependencies": {
     "@vitejs/test-resolve-linked": "workspace:*"

diff --git a/playground/css-sourcemap/package.json b/playground/css-sourcemap/package.json
@@ -12,7 +12,7 @@
   "devDependencies": {
     "less": "^4.9.0",
     "lightningcss": "^1.33.0",
-    "magic-string": "^1.2.2",
+    "magic-string": "^1.2.3",
     "sass": "^1.103.1",
     "stylus": "^0.64.0",
     "sugarss": "^5.0.1"

diff --git a/playground/devtools/package.json b/playground/devtools/package.json
@@ -10,7 +10,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "vue": "^3.5.41"
+    "vue": "^3.5.42"
   },
   "devDependencies": {
     "vite": "workspace:*",

diff --git a/playground/environment-react-ssr/package.json b/playground/environment-react-ssr/package.json
@@ -10,7 +10,7 @@
   },
   "devDependencies": {
     "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
+    "@types/react-dom": "^19.2.5",
     "react": "^19.2.8",
     "react-fake-client": "npm:react@^19.2.8",
     "react-fake-server": "npm:react@^19.2.8",

diff --git a/playground/extensions/package.json b/playground/extensions/package.json
@@ -10,6 +10,6 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "vue": "^3.5.41"
+    "vue": "^3.5.42"
   }
 }
diff --git a/playground/external/dep-that-imports/package.json b/playground/external/dep-that-imports/package.json
@@ -5,6 +5,6 @@
   "dependencies": {
     "slash3": "npm:slash@^3.0.0",
     "slash5": "npm:slash@^5.1.0",
-    "vue": "^3.5.41"
+    "vue": "^3.5.42"
   }
 }
diff --git a/playground/external/dep-that-requires/package.json b/playground/external/dep-that-requires/package.json
@@ -5,6 +5,6 @@
   "dependencies": {
     "slash3": "npm:slash@^3.0.0",
     "slash5": "npm:slash@^5.1.0",
-    "vue": "^3.5.41"
+    "vue": "^3.5.42"
   }
 }
diff --git a/playground/external/package.json b/playground/external/package.json
@@ -17,7 +17,7 @@
     "slash3": "npm:slash@^3.0.0",
     "slash5": "npm:slash@^5.1.0",
     "vite": "workspace:*",
-    "vue": "^3.5.41",
+    "vue": "^3.5.42",
     "vue34": "npm:vue@~3.4.38"
   }
 }
diff --git a/playground/js-sourcemap/package.json b/playground/js-sourcemap/package.json
@@ -15,7 +15,7 @@
     "@vitejs/test-dep-malicious-sourcemap": "file:dep-malicious-sourcemap",
     "@vitejs/test-dep-optimized-malicious": "file:dep-optimized-malicious",
     "@vitejs/test-importee-pkg": "file:importee-pkg",
-    "magic-string": "^1.2.2",
+    "magic-string": "^1.2.3",
     "oxc-parser": "^0.147.0"
   }
 }
diff --git a/playground/json/package.json b/playground/json/package.json
@@ -12,6 +12,6 @@
   "devDependencies": {
     "@vitejs/test-json-require": "file:./dep-json-require",
     "@vitejs/test-json-module": "file:./json-module",
-    "vue": "^3.5.41"
+    "vue": "^3.5.42"
   }
 }
diff --git a/playground/legacy/package.json b/playground/legacy/package.json
@@ -19,6 +19,6 @@
     "vite": "workspace:*",
     "@vitejs/plugin-legacy": "workspace:*",
     "express": "^5.2.1",
-    "terser": "^5.50.0"
+    "terser": "^5.51.2"
   }
 }
diff --git a/playground/optimize-deps-no-discovery/package.json b/playground/optimize-deps-no-discovery/package.json
@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@vitejs/test-dep-no-discovery": "file:./dep-no-discovery",
-    "vue": "^3.5.41",
+    "vue": "^3.5.42",
     "vuex": "^4.1.0"
   }
 }
diff --git a/playground/optimize-deps/package.json b/playground/optimize-deps/package.json
@@ -53,12 +53,12 @@
     "@vitejs/test-dep-lodash.clonedeep": "file:./dep-lodash-clonedeep",
     "@vitejs/test-dep-lodash-es": "file:./dep-lodash-es",
     "@vitejs/test-nested-exclude": "file:./nested-exclude",
-    "phoenix": "^1.8.12",
+    "phoenix": "^1.8.13",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "@vitejs/test-resolve-linked": "workspace:0.0.0",
     "url": "^0.11.4",
-    "vue": "^3.5.41",
+    "vue": "^3.5.42",
     "vuex": "^4.1.0"
   }
 }
diff --git a/playground/preload/package.json b/playground/preload/package.json
@@ -18,7 +18,7 @@
     "preview:preload-disabled": "vite preview --config vite.config-preload-disabled.js"
   },
   "devDependencies": {
-    "terser": "^5.50.0",
+    "terser": "^5.51.2",
     "@vitejs/test-dep-a": "file:./dep-a",
     "@vitejs/test-dep-including-a": "file:./dep-including-a"
   }

diff --git a/playground/tailwind-v3/package.json b/playground/tailwind-v3/package.json
@@ -14,6 +14,6 @@
     "tailwindcss": "^3.4.19"
   },
   "devDependencies": {
-    "tsx": "^4.23.12"
+    "tsx": "^4.23.13"
   }
 }
diff --git a/playground/tailwind/package.json b/playground/tailwind/package.json
@@ -14,6 +14,6 @@
     "tailwindcss": "^4.3.3"
   },
   "devDependencies": {
-    "tsx": "^4.23.12"
+    "tsx": "^4.23.13"
   }
 }