chore(deps): update dependency vite to v8.2.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	8.1.3 → 8.2.1

---

Release Notes

vitejs/vite (vite)

v8.2.1

Compare Source

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#​23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#​23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #​23146) (#​23147) (de041a7)
• deps: update all non-major dependencies (#​23136) (14454fd)
• deps: update rolldown-related dependencies (#​23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#​23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#​23038) (17f7b2f)
• server: use a random port when port is 0 (#​23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#​23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#​23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#​23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#​23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#​22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#​23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#​23080) (c2155fe)
• reduce logs (#​23138) (7673c02)

v8.2.0

Compare Source

Features

• add input to server.fs.allow (#​23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#​23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#​23068) (0d04351)
• config: include column in config incompatibility location (#​23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#​22965) (3ac77d9)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#​23024) (41c4658)
• deps: update all non-major dependencies (#​23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#​22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#​23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#​23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#​22932) (fa005d1)
• support resolving top-level input option with plugins (#​23101) (41df81a)

Documentation

• config: correct cacheDir default fallback description (#​23060) (aafa103)

Tests

• config CJS module vars in ESM case (#​23010) (d8cd388)

v8.1.5

Compare Source

Please refer to CHANGELOG.md for details.

v8.1.4

Compare Source

Features

• legacy: prefer oxc as minifier (fix #​21973) (#​22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#​22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#​22839) (f1f90ed)
• deps: update all non-major dependencies (#​22865) (d4295a9)
• deps: update rolldown-related dependencies (#​22866) (7cf07e4)
• html: avoid backtracking in import-only check (#​22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#​22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#​22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#​22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#​22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#​22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#​22876) (ea22fb3)

Tests

• avoid warnings (#​22851) (af21ab6)

Build System

• remove the custom onLog function (#​22878) (2c4a217)
• replace deprecated onwarn with onLog (#​22741) (c581b55)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.39%. Comparing base (3027de7) to head (3b4098c).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2153   +/-   ##
=======================================
  Coverage   83.38%   83.39%           
=======================================
  Files         395      395           
  Lines       39218    39218           
=======================================
+ Hits        32703    32705    +2     
+ Misses       4575     4574    -1     
+ Partials     1940     1939    -1     

Flag	Coverage Δ
integration	7.29% <ø> (ø)
unit	81.47% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ALRubinger]

Renovate shepherd: needs a human — root cause is repo-level, not this PR

This PR's Webapp Tests / Webapp Integration E2E failures are not a problem with the dependency bump itself:

[ERR_PNPM_OUTDATED_LOCKFILE] Cannot install with "frozen-lockfile"
because pnpm-lock.yaml is not up to date with <ROOT>/package.json
  specifiers in the lockfile don't match specifiers in package.json

What Renovate did wrong. In webapp/ it rewrote pnpm-lock.yaml's specifier: line to the bumped range while leaving webapp/package.json's range untouched — so the lockfile and manifest disagree and CI's pnpm install --frozen-lockfile refuses to install. In ui/ and docs/ the same bump is written correctly (only the resolved version: moves). Only webapp/ is affected.

Why only webapp/. webapp/ is the one workspace that has both pnpm-lock.yaml and a stray, tracked webapp/package-lock.json. Renovate therefore runs both its npm and pnpm managers over the same webapp/package.json, and the npm manager's range-bumping leaks into the pnpm lockfile's specifier: field without the corresponding manifest edit surviving.

Nothing reads webapp/package-lock.json — it is referenced by no workflow in .github/ and by no target in Taskfile.yml. webapp/ is a pnpm workspace (webapp/pnpm-workspace.yaml), and CI installs with pnpm install --frozen-lockfile at pnpm 11.21.0.

Recommended fix (one change, unblocks every PR in this class): delete the tracked webapp/package-lock.json and add it to webapp/.gitignore. Renovate will then treat webapp/ as pnpm-only and generate correct lockfile-only updates. This PR and its siblings should then rebase clean.

Why the shepherd is not auto-fixing this PR. The per-PR repair is a multi-workspace lockfile regeneration on top of a conflicted rebase. Re-deriving the conflicted lockfiles pulls in incidental transitive drift beyond what this PR claims to change (in one trial, docs/pnpm-lock.yaml also moved shiki, js-yaml, smol-toml, remark-smartypants, and @napi-rs/wasm-runtime). Deciding what drift may ride along in a single-dependency PR is a judgment call, so it is being left to you rather than merged unattended.

The branch is exactly as Renovate authored it; nothing here has been rewritten.

_{Posted by the renovate-shepherd skill.}