Update Craft-Vite plugin to support Vite 6.x

[alexkuzmin]

Is your feature request related to a problem? Please describe.

The current Craft-Vite plugin only supports Vite 4.5.3, while Vite 6.2.3 is already available. When using Vite 4.5.3, the build process reports 2 vulnerabilities due to the older version. Attempting to update only the frontend dependencies in package.json breaks compatibility with the Craft-Vite plugin, causing it to stop working.

Describe the solution you would like

Update the Craft-Vite plugin to support the latest Vite version (6.x), ensuring compatibility with newer Vite features and removing the security vulnerabilities present in older versions.

Describe alternatives you have considered

Attempted to update only the frontend dependencies in package.json, but it breaks compatibility with the Craft-Vite plugin.
Staying with the older Vite version despite the vulnerabilities
Attempting to fork and modify the plugin locally to support newer Vite versions
Creating a custom integration between Craft CMS and Vite 6.x

Additional context

Security vulnerabilities in outdated dependencies create unnecessary risk in production environments. Newer versions of Vite offer performance improvements and new features.

Current setup:

Craft-Vite plugin supporting Vite 4.5.3
Vite 6.2.3 is already available but incompatible
Build process reports 2 vulnerabilities with the current version

[khalwat]

This issue doesn't make sense. The Craft Vite plugin doesn't require Vite as a dependency at all; that's on you to do in whatever your frontend buildchain.

Also, the Craft Vite plugin works fine with Vite 6.x

[alexkuzmin]

Maybe will be helpful for someone. The issue was that the Dev Server was not detecting - the plugin didn't recognize 403 as "dev server running".

The Issue:

• Vite 6 changed the HTTP response for /__vite_ping from 404 → 403
• The plugin only accepts 200 or 404 as "dev server running"
• This breaks automatic dev server detection in Vite 6

The Fix:
The plugin should accept 403 as a valid "running" status, since 403 Forbidden still
indicates an active server responding to requests.

Current Workaround:
Set checkDevServer: false and handle detection manually, or modify the local config
to accept 403 responses.

---

So while the plugin "works" with Vite 6, the checkDevServer functionality is broken
due to this HTTP status code change.

I bypassed the plugin's broken checkDevServer by implementing custom detection in
config/vite.php:

// Custom Vite 6 detection - accepts 403 as "running"
$useDevServer = false;
$response = @file_get_contents('http://localhost:3000/__vite_ping', false,
$context);

if (isset($http_response_header)) {
preg_match('/HTTP/\d.\d\s+(\d+)/', $http_response_header[0], $matches);
$statusCode = isset($matches[1]) ? (int)$matches[1] : 0;

  // Accept 200, 404, OR 403 as "server running" (Vite 6 fix)
  $useDevServer = in_array($statusCode, [200, 404, 403]);

}

return [
'useDevServer' => $useDevServer,
'checkDevServer' => false, // Disabled - we do our own check
// ... rest of config
];

[khalwat]

hmmmm. I've been using Vite 6 on my projects, and haven't seen this behavior. Could it be introduced in a newer version of Vite 6?

I will investigate and get this addressed. Thanks for the detailed bug report!

[khalwat]

Weird to me that they would use 403 Forbidden

[khalwat]

Related: vitejs/vite#9051

Refreshed my memory, they removed the explicit support for __vite_ping and instead you can check for the WebSocket URL... but I think this might necessitate adding yet more config to the Craft Vite plugin, which I'd like to avoid.

I'll see if adding the 403 response code as you mention is needed, and if that works to solve the problem.