build(deps-dev): bump vite from 6.4.3 to 8.2.2 in /web by dependabot[bot] · Pull Request #21 · wardnet/cubit

dependabot · 2026-08-29T16:03:18Z

Bumps vite from 6.4.3 to 8.2.2.

Release notes

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

bundled-dev: handle lazy request error (#23291) (3ba026d)

bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)

config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)

css: don't pass empty targets to lightningcss (#23295) (2804636)

define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)

deps: update all non-major dependencies (#23217) (ba958bd)

deps: update rolldown-related dependencies (#23218) (83ecb2c)

module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)

optimizer: close custom extension analysis bundles (#23207) (8fb7675)

reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)

respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)

ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)

vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)

use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

define: close rolldown bundler after generate (#23231) (b4d66fe)

module-runner: add TLA circular import case (#23299) (4a261f2)

module-runner: simplify server-hmr tests (#23300) (599b44b)

ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

8.2.1 (2026-08-06)

Bug Fixes

build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)

bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)

... (truncated)

Commits

de1111a release: v8.2.2
cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
2804636 fix(css): don't pass empty targets to lightningcss (#23295)
599b44b test(module-runner): simplify server-hmr tests (#23300)
4a261f2 test(module-runner): add TLA circular import case (#23299)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.3 to 8.2.2. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-29T16:05:55Z

bulwark

❌ scan — failed, see error output below

error output

typescript: using ambient node 22.23.2 (no version declared by this repo)
go: using ambient go 1.26.6 (satisfies 1.26.6 from go.mod)
go: pinned GOTOOLCHAIN=local so installing an external tool cannot silently downgrade the toolchain
The `json` and `json-pretty` reporters are experimental and may change in patch releases.
lint ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.
  

go: downloading github.com/securego/gosec/v2 v2.28.0
go: downloading golang.org/x/sync v0.22.0
go: downloading golang.org/x/tools v0.48.0
go: downloading github.com/anthropics/anthropic-sdk-go v1.57.0
go: downloading github.com/openai/openai-go/v3 v3.42.0
go: downloading google.golang.org/genai v1.63.0
go: downloading github.com/ccojocar/zxcvbn-go v1.0.4
go: downloading github.com/invopop/jsonschema v0.14.0
go: downloading github.com/pb33f/ordered-map/v2 v2.3.1
go: downloading github.com/standard-webhooks/standard-webhooks/libraries v0.0.1
go: downloading github.com/tidwall/gjson v1.19.0
go: downloading github.com/tidwall/sjson v1.2.5
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/gookit/color v1.6.1
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading golang.org/x/mod v0.38.0
go: downloading github.com/bahlo/generic-list-go v0.2.0
go: downloading github.com/buger/jsonparser v1.2.0
go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.6
go: downloading github.com/tidwall/match v1.2.0
go: downloading github.com/tidwall/pretty v1.2.1
go: downloading github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e
go: downloading cloud.google.com/go v0.123.0
go: downloading cloud.google.com/go/auth v0.21.0
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/gorilla/websocket v1.5.3
go: downloading github.com/googleapis/gax-go/v2 v2.23.0
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
go: downloading go.opentelemetry.io/otel v1.44.0
go: downloading go.opentelemetry.io/otel/trace v1.44.0
go: downloading golang.org/x/net v0.57.0
go: downloading google.golang.org/api v0.288.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.18
go: downloading github.com/google/s2a-go v0.1.9
go: downloading google.golang.org/grpc v1.82.0
go: downloading go.opentelemetry.io/otel/metric v1.44.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading github.com/felixge/httpsnoop v1.1.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800
go: downloading github.com/go-logr/logr v1.4.3
go: downloading golang.org/x/text v0.40.0
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading golang.org/x/sys v0.47.0
go: downloading golang.org/x/crypto v0.54.0
[gosec] 2026/08/29 16:05:26 Including rules: default
[gosec] 2026/08/29 16:05:26 Excluding rules: default
[gosec] 2026/08/29 16:05:26 Including analyzers: default
[gosec] 2026/08/29 16:05:26 Excluding analyzers: default
[gosec] 2026/08/29 16:05:26 Import directory: /home/runner/work/cubit/cubit/internal/report
[gosec] 2026/08/29 16:05:26 Import directory: /home/runner/work/cubit/cubit/internal/criterion
[gosec] 2026/08/29 16:05:26 Import directory: /home/runner/work/cubit/cubit/cmd/cubit
[gosec] 2026/08/29 16:05:26 Import directory: /home/runner/work/cubit/cubit/internal/dashboard
[gosec] 2026/08/29 16:05:27 Checking package: report
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/internal/report/report.go
[gosec] 2026/08/29 16:05:27 Checking package: criterion
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/internal/criterion/ingest.go
[gosec] 2026/08/29 16:05:27 Import directory: /home/runner/work/cubit/cubit/internal/gitstore
[gosec] 2026/08/29 16:05:27 Import directory: /home/runner/work/cubit/cubit/internal/model
[gosec] 2026/08/29 16:05:27 Checking package: dashboard
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/internal/dashboard/dashboard.go
[gosec] 2026/08/29 16:05:27 Checking package: model
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/internal/model/model.go
[gosec] 2026/08/29 16:05:27 Checking package: gitstore
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/internal/gitstore/gitstore.go
[gosec] 2026/08/29 16:05:27 Checking package: main
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/compare.go
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/main.go
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/record.go
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/root.go
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/run.go
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/serve.go
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/update.go
[gosec] 2026/08/29 16:05:27 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/version.go
Results:


Summary:
  Gosec  : dev
  Files  : 13
  Lines  : 1679
  Nosec  : 11
  Issues : 0

go: downloading golang.org/x/vuln v1.7.0
go: downloading golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5
go: downloading golang.org/x/mod v0.39.0
go: downloading golang.org/x/tools v0.49.0
=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
From https://github.com/wardnet/cubit
 * branch            main       -> FETCH_HEAD
51dfca0199be2a82dfa1853a1218df611c0eff4a
creating virtual environment...
installing semgrep from spec 'semgrep==1.173.0'...
done! ✨ 🌟 ✨
  installed package semgrep 1.173.0, installed using Python 3.12.3
  These apps are now available
    - pysemgrep
    - semgrep
               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 2 files tracked by git with 1074 Code rules:
                                                                                                                        
  Language      Rules   Files          Origin      Rules                                                                
 ─────────────────────────────        ───────────────────                                                               
  <multilang>      46       2          Community    1074                                                                
  json              4       1                                                                                           
                                                                                                                        
  Current version has 0 findings.

Skipping baseline scan, because there are no current findings.
                
                
┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ Scan completed successfully.
 • Findings: 0 (0 blocking)
 • Rules run: 50
 • Targets scanned: 2
 • Parsed lines: ~100.0%
 • Scan was limited to files changed since baseline commit.
 • For a detailed list of skipped files and lines, run semgrep with the --verbose flag
Ran 50 rules on 2 files: 0 findings.
(need more rules? `semgrep login` for additional free Semgrep Registry rules)


A new version of Semgrep is available. See https://semgrep.dev/docs/upgrading
If Semgrep missed a finding, please send us feedback to let us know!
See https://semgrep.dev/docs/reporting-false-negatives/
[FAIL] biome(./web)
  src/LineChart.tsx:41  lint/correctness/noUnusedFunctionParameters  This parameter p is unused.
[PASS] gosec
[PASS] govulncheck
[PASS] semgrep
Error: 1 check(s) failed
bulwark: 1 check(s) failed

✅ coverage — see error output below

📦 Full bulwark output — complete scan and coverage logs.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 29, 2026

dependabot Bot mentioned this pull request Aug 29, 2026

build(deps-dev): bump vite from 6.4.3 to 8.2.1 in /web #14

Closed

Navigation Menu

Uh oh!

build(deps-dev): bump vite from 6.4.3 to 8.2.2 in /web - #21

build(deps-dev): bump vite from 6.4.3 to 8.2.2 in /web#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/vite-8.2.2

dependabot Bot commented on behalf of github Aug 29, 2026

Uh oh!

github-actions Bot commented Aug 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 29, 2026

plugin-legacy@8.2.2

v8.2.2

plugin-legacy@8.2.1

v8.2.1

create-vite@8.2.0

plugin-legacy@8.2.0

v8.2.0

v8.2.0-beta.0

v8.1.5

v8.1.4

v8.1.3

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

8.2.2 (2026-08-20)

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Build System

8.2.1 (2026-08-06)

Bug Fixes

Uh oh!

github-actions Bot commented Aug 29, 2026

bulwark

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants