chore(deps-dev): take vite 8 deliberately, with vite as a direct devDependency - #57
Merged
Merged
Conversation
…ependency Completes the vite-toolchain alignment: all three apps and both client repos moved to @vitejs/plugin-react ^6 with vite ^8 today, and core was the last repo still on plugin-react ^4. Dependabot offered this as #54 (plugin-react 4.7.0 -> 6.1.1) hours before the vite-toolchain group landed in #56, so it arrived ungrouped — a one-line package.json change whose real content was a bundler swap, since plugin-react 6 peers vite ^8. #54 was closed in favour of doing it deliberately. vite is added as a direct devDependency rather than left transitive. That matters more here than in the apps: package-lock.json is gitignored in this repo, so without a direct entry the vite version would be recorded nowhere at all — no lockfile, no package.json line, nothing to review or pin. Now a future bundler major arrives titled what it is. One mismatch worth knowing about, deliberately not "fixed": core declares engines >=22.0.0, while plugin-react 6 and vite 8 want ^20.19.0 || >=22.12.0. That gap only affects contributors on Node 22.0-22.11, who will see an EBADENGINE warning (npm does not enforce engines unless engine-strict is set). It does not affect consumers, because devDependencies are not installed by them — so raising the published engines range to satisfy a dev tool would narrow a consumer-facing promise for no consumer-facing reason. CI is unaffected: node-version '22' resolves to the latest 22.x, well past 22.12. Verified with the full gate on vite 8: format:check, lint, typecheck, test (43 files, 492 passed / 16 skipped) and build all pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the vite-toolchain alignment. All three apps and both client repos moved to
@vitejs/plugin-react ^6withvite ^8today — core was the last repo still on plugin-react ^4.Why not just merge Dependabot's #54
#54 offered
@vitejs/plugin-react4.7.0 → 6.1.1 at 11:28, about seven hours before thevite-toolchaingroup landed in #56 at 18:12. So it arrived ungrouped: a one-linepackage.jsonchange whose actual content was a bundler swap, since plugin-react 6 peersvite ^8.That's the exact shape the group was added to prevent, so #54 was closed in favour of doing it deliberately.
Why
vitebecomes a direct devDependencyThis matters more here than it did in the apps.
package-lock.jsonis gitignored in this repo — so with vite left transitive, its version is recorded nowhere: no lockfile, nopackage.jsonline, nothing to review, pin, or notice changing. The apps at least had a lockfile diff making the Vite 7→8 move visible; core would have had literally nothing.With a direct entry, the next bundler major arrives titled what it actually is.
One mismatch I deliberately did not "fix"
Core declares
engines: >=22.0.0. vite 8 and plugin-react 6 both want^20.19.0 || >=22.12.0.That gap affects contributors on Node 22.0–22.11, who'll see an
EBADENGINEwarning — npm doesn't enforce engines unlessengine-strictis set, so it's a warning, not a failure. It does not affect consumers, because devDependencies aren't installed by them.So raising the published
enginesrange to satisfy a dev tool would narrow a consumer-facing promise for a reason consumers never encounter. Left alone on purpose. CI is unaffected —node-version: '22'resolves to the latest 22.x, well past 22.12 (released Dec 2024).If you'd rather contributors got a hard signal instead of a warning, the right place is a note in contributor docs, not the
enginesfield.Verification
Full gate on vite 8:
format:check,lint,typecheck,test(43 files, 492 passed / 16 skipped) andbuildall pass.After this
Every repo in the fleet is on the same vite toolchain, and every one of them now has a
vite-toolchainDependabot group, so the next plugin-react/vite major pairing arrives as a single reviewable PR rather than two PRs that block each other.