chore(deps-dev): bump the development group across 1 directory with 2 updates

[dependabot]

Bumps the development group with 2 updates in the / directory: @vitejs/plugin-react and vite.

Updates @vitejs/plugin-react from 6.0.5 to 6.1.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits

• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• See full diff in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 24, 2026, 9:30 AM ET / 13:30 UTC.

ClawSweeper review

What this changes

Updates the pnpm lockfile to resolve @vitejs/plugin-react 6.1.0 and Vite 8.2.2, including Vite’s transitive Rolldown bindings.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open for routine maintainer review: current main still resolves Vite 8.2.1 and the React plugin 6.0.5, while this clean lockfile-only PR moves the replay viewer’s build graph forward. CI passed, but its Build job does not run the separate replay-viewer production build.

Priority: P3
Reviewed head: bf9231fdd27c7488ac17e23f473266c7ecb1394f

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, clean dependency update with passing CI, pending one targeted smoke of its direct replay-viewer consumer.
Proof confidence	🌊 off-meta tidepool	Not applicable: Not applicable: this Dependabot-authored lockfile-only update is exempt from the external-contributor real-behavior-proof gate; CI remains supplemental validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Not applicable: this Dependabot-authored lockfile-only update is exempt from the external-contributor real-behavior-proof gate; CI remains supplemental validation.
Evidence reviewed	5 items	Current main has not absorbed the update: Current main resolves @vitejs/plugin-react 6.0.5 and Vite 8.2.1; the PR head resolves 6.1.0 and 8.2.2, so this work is not implemented on main. Dependency contract is directly used: The replay viewer imports both the React plugin and Vite in its build configuration, establishing that this development dependency graph affects a runnable repository surface. CI does not cover the targeted viewer build: The CI Build matrix entry runs pnpm run build, while the root package separately defines pnpm run viewer:build for the Vite production bundle.
Findings	None	None.
Security	None	None.

How this fits together

The flow replay viewer is an in-repository browser application that renders saved flow-run bundles. Its React/Vite build toolchain is selected from the root development dependency lockfile and produces the viewer’s browser assets.

flowchart LR
A[Saved flow run bundles] --> B[Replay viewer source]
B --> C[Vite and React plugin]
C --> D[Rolldown native bindings]
D --> E[Browser viewer build]

Loading

Before merge

• Resolve merge risk (P1) - The update changes Vite’s Rolldown native-binding graph, but successful CI invokes the root build rather than the separate replay-viewer production build, leaving that direct consumer unverified on this head.
• Complete next step (P2) - A maintainer should obtain or accept the targeted replay-viewer build validation; no mechanical source repair is identified.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Lockfile scope	1 file changed; +87/-74 lines	The patch is confined to two direct development-tool resolutions and their transitive build-tool graph.

Merge-risk options

Maintainer options:

1. Verify the replay viewer build (recommended)
   Run pnpm run viewer:build on the exact PR head and retain the successful Vite output before merging the updated native build-toolchain graph.
2. Accept CI-only coverage
   Merge based on the existing passing checks while accepting that the replay viewer’s dedicated production build was not exercised.

Technical review

Best possible solution:

Retain the narrow lockfile update after a trusted runner records a successful pnpm run viewer:build on the exact PR head.

Do we have a high-confidence way to reproduce the issue?

Not applicable — this is a lockfile maintenance PR rather than a reported defect; the relevant verification is a targeted replay-viewer build.

Is this the best way to solve the issue?

Unclear — a lockfile refresh is the narrow maintainable path, but it should be backed by the direct viewer:build smoke rather than generic CI alone.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d4c16ab32154.

Labels

Label justifications:

• P3: This is a routine development-toolchain refresh with no reported user-facing regression.
• merge-risk: 🚨 compatibility: The resolved Vite and Rolldown versions directly build the replay viewer, so incompatible build behavior could affect that repository surface.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this Dependabot-authored lockfile-only update is exempt from the external-contributor real-behavior-proof gate; CI remains supplemental validation.

Evidence

What I checked:

• Current main has not absorbed the update: Current main resolves @vitejs/plugin-react 6.0.5 and Vite 8.2.1; the PR head resolves 6.1.0 and 8.2.2, so this work is not implemented on main. (pnpm-lock.yaml:57, d4c16ab32154)
• Dependency contract is directly used: The replay viewer imports both the React plugin and Vite in its build configuration, establishing that this development dependency graph affects a runnable repository surface. (examples/flows/replay-viewer/vite.config.ts:2, d4c16ab32154)
• CI does not cover the targeted viewer build: The CI Build matrix entry runs pnpm run build, while the root package separately defines pnpm run viewer:build for the Vite production bundle. (.github/workflows/ci.yml:108, d4c16ab32154)
• Re-review continuity: The PR head is unchanged since the prior ClawSweeper review, which also identified the absent replay-viewer build smoke; no new patch defect was introduced. (pnpm-lock.yaml:57, bf9231fdd27c)
• Likely ownership history: Blame attributes the replay-viewer Vite configuration to the v0.13.1 release commit, and recent main history shows the same author maintaining dependency refreshes. (examples/flows/replay-viewer/vite.config.ts:2, 2d735cf18220)

Likely related people:

• Peter Steinberger: Authored the current-main dependency refresh and the release commit blamed for the replay viewer’s Vite configuration. (role: recent dependency and replay-viewer contributor; confidence: high; commits: d4c16ab32154, 2d735cf18220, bce1c96d9d1a; files: pnpm-lock.yaml, package.json, examples/flows/replay-viewer/vite.config.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record a successful pnpm run viewer:build from the exact PR head before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-23T16:52:12.679Z sha bf9231f :: needs maintainer review before merge. :: none