[dependabot]

Bumps vite from 8.3.0 to 8.3.3.

Release notes

Sourced from vite's releases.

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

v8.3.1

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

8.3.1 (2026-09-24)

... (truncated)

Commits

• fea5b21 release: v8.3.3 (#23657)
• c3e06f9 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• ba8b7ab fix(server): check fs.serve for ?vite-wasm-instance (#23655)
• 22fd1d5 fix(deps): update launch-editor to v2.14.2 (#23654)
• 7dafd8e fix(html): filename passed to transformIndexHtml should not include queries (...
• 1003321 release: v8.3.2 (#23623)
• 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
• 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
• 89574f6 perf: avoid encoding intermediate source maps (#23461)
• 5a3a010 fix(server): release previous environments after initialization (#23499)
• Additional commits viewable in compare view

[dbhagen]

paydown evidence

Change summary

vite 8.3.0 → 8.3.3 (patch, devDependency). Bug-fix and performance releases of the 8.3 line (8.3.1, 8.3.2, 8.3.3). Vite is the bundler under the desktop UI and the dev server, and also reaches the extension through WXT.

Changelog review

Read every entry for 8.3.1, 8.3.2 and 8.3.3 in the CHANGELOG. No breaking changes, deprecations or removals. All entries are bug fixes, perf or chores.

• 8.3.1: server.ws: false in mergeConfig, merge of build.rolldownOptions.output.comments, optimizer and watcher fixes, sourcemap source-root fix, dependency updates (rolldown).
• 8.3.2: merge of build.rolldownOptions.output.minify, renderBuiltUrl now receives queries, CSS preload fix, percent-encoded srcset URLs, watcher errors no longer crash the server, worker URL alignment with terser, perf work (source maps, preload helper), rolldown dependency bump.
• 8.3.3: transformIndexHtml filename no longer includes queries (#23653), fs.serve now checked for ?vite-wasm-instance (#23655), safeModulePaths stores ids rather than URLs (#23656), launch-editor update.

The GitHub release pages (gh release view) were not read because the shell was denied. The changelog covers the same range. I did not read the part of the changelog beyond the first 100k characters, which holds older versions.

Call sites

• apps/desktop/vite.config.ts:4: defineConfig with root, plugins (react, tailwindcss), resolve.alias, clearScreen, server (port 1420, strictPort, host 127.0.0.1), build (outDir, emptyOutDir, target es2022). Uses no renderBuiltUrl, transformIndexHtml, rolldownOptions or server.ws.
• apps/desktop/tsconfig.json:5 and packages/ui/tsconfig.json:17: vite/client types only.
• apps/desktop/package.json:11: script ui:dev runs vite.
• apps/desktop/package.json:45 and packages/ui/package.json:57: declare ^8.3.3.
• extensions/web/wxt.config.ts:162: a vite: () => ({ define, plugins, resolve.alias }) hook. WXT drives Vite and the config uses only define, plugins and alias. Plugins are tailwindcss, dedupeOrtWasm and vadUsesTransformersOrt.
• extensions/web/vitest.config.ts: uses vitest/config, not vite directly. Vitest 5 pulls vite in as a peer.

The other .vite/deps matches in the grep are test fixture strings and ADR prose, not imports.

Build and tests

paydown's output shows pnpm install --frozen-lockfile --ignore-scripts exit 0 (lockfile passed the supply-chain policy check), pnpm run build exit 0 (WXT chrome-mv3 build succeeded, 33.59 MB total), and pnpm run test exit 0 (123 files, 1671 tests passed). The only warning is the existing chunk-size warning (>500 kB). The stderr from the ElevenLabs test comes from a stub drop that the test expects. CI on the PR is green. The build output did not exercise the desktop UI (apps/desktop vite build) or the dev server explicitly, so those paths are covered only by CI.

Risk

Low. These are patch fixes with nothing breaking or deprecated, and the repo uses only basic defineConfig options and plugin hooks. No call site uses an API that the changelog touches. It is low and not none because the patch range includes rolldown dependency bumps and a changed build.rolldownOptions.output.minify merge, which affect the build output for both the desktop UI and the extension. The build, tests and CI passed. The 8.3.3 fs.serve and safeModulePaths fixes affect only the dev server. Class stays patch.

Gate decision

Needs review (class patch):

• agent risk is "low"

_{paydown · model cost $0.1343 · contract: docs/adr/0001-mandate-and-change-classes.md}