build(deps-dev): bump @vitejs/plugin-react from 4.7.0 to 6.1.0 in /web

[dependabot]

Bumps @vitejs/plugin-react from 4.7.0 to 6.1.0.

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

plugin-react@6.0.3

No release notes provided.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

6.0.3 (2026-06-23)

Improve the react compiler preset filter to reduce false-positives (#1138)

Improved the filter in the react compiler babel preset to reduce the false-positives so that less modules are processed by the react compiler.

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

... (truncated)

Commits

• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• 555cdbc fix(react): make the react compiler preset filter linear (#1353)
• a00a9f8 fix(deps): update all non-major dependencies (#1327)
• f4b5498 release: plugin-react@6.0.4
• 7a40659 fix(react): $RefreshSig$ is not defined with NODE_ENV=production vite dev ...
• 98b32d4 fix(deps): update react 19.2.8 (#1298)
• 8ae5449 fix: babel-plugin-react-compiler cannot be imported when used in a framework ...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitejs/plugin-react since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

bulwark

• ❌ scan — failed, see error output below

error output

typescript: using ambient node 22.23.2 (no version declared by this repo)
go: using ambient go 1.26.6 (satisfies 1.26.6 from go.mod)
go: pinned GOTOOLCHAIN=local so installing an external tool cannot silently downgrade the toolchain
The `json` and `json-pretty` reporters are experimental and may change in patch releases.
lint ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.
  

go: downloading github.com/securego/gosec/v2 v2.28.0
go: downloading golang.org/x/sync v0.22.0
go: downloading golang.org/x/tools v0.48.0
go: downloading github.com/anthropics/anthropic-sdk-go v1.57.0
go: downloading github.com/openai/openai-go/v3 v3.42.0
go: downloading google.golang.org/genai v1.63.0
go: downloading github.com/ccojocar/zxcvbn-go v1.0.4
go: downloading github.com/tidwall/sjson v1.2.5
go: downloading github.com/invopop/jsonschema v0.14.0
go: downloading github.com/pb33f/ordered-map/v2 v2.3.1
go: downloading github.com/standard-webhooks/standard-webhooks/libraries v0.0.1
go: downloading github.com/tidwall/gjson v1.19.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/gookit/color v1.6.1
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading golang.org/x/mod v0.38.0
go: downloading cloud.google.com/go/auth v0.21.0
go: downloading cloud.google.com/go v0.123.0
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/gorilla/websocket v1.5.3
go: downloading github.com/bahlo/generic-list-go v0.2.0
go: downloading github.com/buger/jsonparser v1.2.0
go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.6
go: downloading github.com/tidwall/match v1.2.0
go: downloading github.com/tidwall/pretty v1.2.1
go: downloading github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e
go: downloading github.com/googleapis/gax-go/v2 v2.23.0
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
go: downloading go.opentelemetry.io/otel/trace v1.44.0
go: downloading go.opentelemetry.io/otel v1.44.0
go: downloading golang.org/x/net v0.57.0
go: downloading google.golang.org/api v0.288.0
go: downloading github.com/google/s2a-go v0.1.9
go: downloading google.golang.org/grpc v1.82.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.18
go: downloading go.opentelemetry.io/otel/metric v1.44.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading github.com/felixge/httpsnoop v1.1.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800
go: downloading github.com/go-logr/logr v1.4.3
go: downloading golang.org/x/text v0.40.0
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading golang.org/x/sys v0.47.0
go: downloading golang.org/x/crypto v0.54.0
[gosec] 2026/08/29 16:05:39 Including rules: default
[gosec] 2026/08/29 16:05:39 Excluding rules: default
[gosec] 2026/08/29 16:05:39 Including analyzers: default
[gosec] 2026/08/29 16:05:39 Excluding analyzers: default
[gosec] 2026/08/29 16:05:39 Import directory: /home/runner/work/cubit/cubit/internal/dashboard
[gosec] 2026/08/29 16:05:39 Import directory: /home/runner/work/cubit/cubit/internal/gitstore
[gosec] 2026/08/29 16:05:39 Import directory: /home/runner/work/cubit/cubit/cmd/cubit
[gosec] 2026/08/29 16:05:39 Import directory: /home/runner/work/cubit/cubit/internal/criterion
[gosec] 2026/08/29 16:05:39 Checking package: criterion
[gosec] 2026/08/29 16:05:39 Checking file: /home/runner/work/cubit/cubit/internal/criterion/ingest.go
[gosec] 2026/08/29 16:05:39 Checking package: gitstore
[gosec] 2026/08/29 16:05:39 Checking file: /home/runner/work/cubit/cubit/internal/gitstore/gitstore.go
[gosec] 2026/08/29 16:05:39 Import directory: /home/runner/work/cubit/cubit/internal/model
[gosec] 2026/08/29 16:05:39 Import directory: /home/runner/work/cubit/cubit/internal/report
[gosec] 2026/08/29 16:05:39 Checking package: dashboard
[gosec] 2026/08/29 16:05:39 Checking file: /home/runner/work/cubit/cubit/internal/dashboard/dashboard.go
[gosec] 2026/08/29 16:05:39 Checking package: model
[gosec] 2026/08/29 16:05:39 Checking file: /home/runner/work/cubit/cubit/internal/model/model.go
[gosec] 2026/08/29 16:05:39 Checking package: report
[gosec] 2026/08/29 16:05:39 Checking file: /home/runner/work/cubit/cubit/internal/report/report.go
[gosec] 2026/08/29 16:05:40 Checking package: main
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/compare.go
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/main.go
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/record.go
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/root.go
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/run.go
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/serve.go
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/update.go
[gosec] 2026/08/29 16:05:40 Checking file: /home/runner/work/cubit/cubit/cmd/cubit/version.go
Results:


Summary:
  Gosec  : dev
  Files  : 13
  Lines  : 1679
  Nosec  : 11
  Issues : 0

go: downloading golang.org/x/vuln v1.7.0
go: downloading golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5
go: downloading golang.org/x/mod v0.39.0
go: downloading golang.org/x/tools v0.49.0
=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
From https://github.com/wardnet/cubit
 * branch            main       -> FETCH_HEAD
51dfca0199be2a82dfa1853a1218df611c0eff4a
creating virtual environment...
installing semgrep from spec 'semgrep==1.173.0'...
done! ✨ 🌟 ✨
  installed package semgrep 1.173.0, installed using Python 3.12.3
  These apps are now available
    - pysemgrep
    - semgrep
               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 2 files tracked by git with 1074 Code rules:
                                                                                                                        
  Language      Rules   Files          Origin      Rules                                                                
 ─────────────────────────────        ───────────────────                                                               
  <multilang>      46       2          Community    1074                                                                
  json              4       1                                                                                           
                                                                                                                        
  Current version has 0 findings.

Skipping baseline scan, because there are no current findings.
                
                
┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ Scan completed successfully.
 • Findings: 0 (0 blocking)
 • Rules run: 50
 • Targets scanned: 2
 • Parsed lines: ~100.0%
 • Scan was limited to files changed since baseline commit.
 • For a detailed list of skipped files and lines, run semgrep with the --verbose flag
Ran 50 rules on 2 files: 0 findings.
(need more rules? `semgrep login` for additional free Semgrep Registry rules)


A new version of Semgrep is available. See https://semgrep.dev/docs/upgrading
If Semgrep missed a finding, please send us feedback to let us know!
See https://semgrep.dev/docs/reporting-false-negatives/
[FAIL] biome(./web)
  src/LineChart.tsx:41  lint/correctness/noUnusedFunctionParameters  This parameter p is unused.
[PASS] gosec
[PASS] govulncheck
[PASS] semgrep
Error: 1 check(s) failed
bulwark: 1 check(s) failed

• ✅ coverage — see error output below

📦 Full bulwark output — complete scan and coverage logs.