chore(deps): update dependency @vitejs/plugin-react to v6#870
chore(deps): update dependency @vitejs/plugin-react to v6#870renovate[bot] wants to merge 1 commit into
Conversation
Deploying control-layer with
|
| Latest commit: |
f9f9b57
|
| Status: | 🚫 Build failed. |
23c760c to
c3a55e2
Compare
3ecae12 to
f9afee2
Compare
f32aec6 to
2e26c58
Compare
![doubleword-code[bot]](https://avatars.githubusercontent.com/in/3610877?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
This PR attempts to upgrade @vitejs/plugin-react from v5.0.1 to v6.0.0. However, this upgrade is incompatible with the current Vite version and introduces a critical regression by losing important pnpm overrides.
Verdict: BLOCKED - This PR cannot be merged as-is. It requires either:
- A simultaneous Vite 8 upgrade, OR
- Pinning
@vitejs/plugin-reactto v5.x until Vite 8 is upgraded
Research notes
-
plugin-react 6.0.0 changelog (source):
- "Drop Vite 7 and below support" - Vite 8+ is now required
- "Remove Babel Related Features" - Babel is no longer bundled; users needing Babel must install
@rolldown/plugin-babelseparately
-
Current project state:
vite: "^7.3.2"in package.json- pnpm overrides included
rollup: npm:@rollup/wasm-nodefor WASM-based Rollup
-
Lockfile regression: The pnpm-lock.yaml diff shows the
overridessection was completely removed, including:rollup: npm:@rollup/wasm-node→ now using nativerollup@4.61.1- Security overrides for
lodash,minimatch,brace-expansion,mdast-util-to-hast
While the security override versions appear to be satisfied transitively, the rollup override loss is intentional behavior change that should be reviewed.
Suggested next steps
-
Blocking: Decide on Vite version strategy:
- Option A: Upgrade Vite to ^8.0.0 alongside this plugin upgrade (recommended if you want latest)
- Option B: Pin
@vitejs/plugin-reactto^5.2.0until ready for Vite 8
-
Blocking: Restore pnpm overrides in the lockfile by running
pnpm installwith the overrides present in package.json, or explicitly document why the@rollup/wasm-nodeoverride is no longer needed. -
Non-blocking: Verify the build works after resolving the above issues, especially since plugin-react 6.x uses Oxc instead of Babel for React Refresh transforms.
General findings
1. Vite version incompatibility (Blocking)
The upgrade to @vitejs/plugin-react@6.0.0 is incompatible with Vite 7. According to the official changelog:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The project currently specifies "vite": "^7.3.2" in package.json. This mismatch will likely cause runtime errors or unexpected behavior.
2. Lost pnpm overrides in lockfile (Blocking)
The pnpm-lock.yaml previously contained an overrides section:
overrides:
rollup: npm:@rollup/wasm-node
lodash: ^4.18.0
mdast-util-to-hast: ^13.2.1
minimatch@<3.1.3: ^3.1.3
brace-expansion@>=5.0.0 <5.0.6: ^5.0.6This section has been removed in the updated lockfile. While the overrides remain in package.json, the lockfile should reflect them. More importantly:
rollup: npm:@rollup/wasm-nodewas intentionally used to use the WASM version of Rollup. The new lockfile uses nativerollup@4.61.1instead.- This may have been intentional (perhaps the WASM version caused issues), but it should be explicitly documented.
3. Babel removal in plugin-react 6.x (Informational)
plugin-react 6.0.0 removed all Babel-related features because Vite 8+ uses Oxc for React Refresh transforms. If this project uses any custom Babel plugins via the babel option in the react plugin config, those will need to be migrated to use @rolldown/plugin-babel separately.
Checking dashboard/vite.config.ts, the current config is:
plugins: [
react(),
tailwindcss(),
visualizer({...}),
],No custom Babel configuration is present, so this change should not impact the project directly once Vite 8 is upgraded.
4. Peer dependency warnings expected
After merging this PR without upgrading Vite, developers will see peer dependency warnings like:
@vitejs/plugin-react@6.0.2 requires a peer of vite@^8.0.0 but none is installed.
This can confuse team members and may cause CI failures depending on configuration.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version requires Vite 8+, but the project uses Vite 7.3.2.
Why it matters: According to the plugin-react 6.0.0 release notes, this version explicitly dropped support for Vite 7 and below. The peerDependencies specify vite: ^8.0.0. Using this with Vite 7.3.2 will cause peer dependency warnings and may result in runtime errors or missing functionality.
Suggested fix: Either:
- Upgrade Vite: Change line 91 to
"vite": "^8.0.0"(verify compatibility with other dependencies first) - Or pin this to v5.x: Change to
"@vitejs/plugin-react": "^5.2.0"until ready for Vite 8
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Blocking: The pnpm overrides section was removed from the lockfile.
Why it matters: The original lockfile contained important overrides:
rollup: npm:@rollup/wasm-node- Used WASM-based Rollup instead of native- Security patches for
lodash,minimatch,brace-expansion,mdast-util-to-hast
The new lockfile uses native rollup@4.61.1 instead of @rollup/wasm-node. While the security override versions appear satisfied transitively, the rollup change represents an intentional architecture decision that should be reviewed.
Suggested fix: Run pnpm install to regenerate the lockfile with overrides properly included, or explicitly remove the overrides from package.json if they're no longer needed (with explanation in commit message).
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6. However, this update introduces a critical version incompatibility: @vitejs/plugin-react v6 requires Vite 8, but this project currently uses Vite 7.3.2.
Verdict: Blocked - Either downgrade the plugin to v5 (which works with Vite 7) or upgrade Vite to v8 alongside this plugin update.
Research notes
Fetched the following sources:
-
@vitejs/plugin-react v6.0.0 Release Notes: Explicitly states "Drop Vite 7 and below support" and "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
-
Vite 8 Announcement: Confirms that Vite 8 ships with Rolldown as its bundler (replacing the esbuild + Rollup dual-bundler approach). The
@vitejs/plugin-reactv6 uses Oxc for React Refresh transform and no longer includes Babel as a dependency. -
Plugin README: Shows that v6's peerDependencies now require
vite: ^8.0.0.
The diff confirms the peer dependency change:
-peerDependencies:
- vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
+peerDependencies:
+ vite: ^8.0.0Current project state (dashboard/package.json:91): "vite": "^7.3.2"
Suggested next steps
-
Option A (Recommended if staying on Vite 7): Revert the plugin version change in
dashboard/package.json:"@vitejs/plugin-react": "^5.0.1"
-
Option B (If ready to upgrade to Vite 8): Update both dependencies together:
"vite": "^8.0.0", "@vitejs/plugin-react": "^6.0.0"
Then run the Vite 8 migration guide to ensure compatibility.
-
Test whichever option is chosen with
pnpm install && pnpm run buildin the dashboard directory.
General findings
Removed overrides in pnpm-lock.yaml
The diff shows the overrides section was removed from the top of pnpm-lock.yaml. This is likely an artifact of pnpm regenerating the lockfile. Verify these security overrides are still applied through other means:
rollup: npm:@rollup/wasm-node- This override was used to force the WASM version of Rollup. With Vite 8 moving to Rolldown, this may no longer be necessary, but should be verified.lodash: ^4.18.0- Security override for lodash vulnerabilitiesmdast-util-to-hast: ^13.2.1- Security overrideminimatch@<3.1.3: ^3.1.3- Security overridebrace-expansion@>=5.0.0 <5.0.6: ^5.0.6- Security override
These overrides should be explicitly re-added to package.json under the pnpm.overrides field if they're still needed.
Notable dependency changes
The lockfile shows several deprecated packages being removed (@babel/*, gensync, json5, lru-cache@5.x, etc.) as v6 removes Babel from its direct dependencies. This is a positive change for install size, per the Vite 8 announcement.
The recharts package at version 2.15.4 has a deprecation notice: "1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes." Consider upgrading separately.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Version mismatch - @vitejs/plugin-react v6 requires Vite 8, but this project uses Vite 7.3.2 (line 91).
Why it matters: According to the plugin-react v6.0.0 release notes, this version explicitly "Drop[s] Vite 7 and below support". The peer dependencies changed from supporting ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 to only ^8.0.0. Using v6 with Vite 7 will cause runtime errors because v6 expects Vite 8's Rolldown-based architecture and Oxc transforms instead of the esbuild + Rollup setup in Vite 7.
Suggested fix: Either:
- Keep
@vitejs/plugin-reactat^5.0.1if staying on Vite 7, OR - Upgrade
"vite"to^8.0.0alongside this change and follow the Vite 8 migration guide
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Non-blocking: The pnpm overrides section was removed from the lockfile root.
Why it matters: These overrides were security patches for vulnerable transitive dependencies (lodash, minimatch, brace-expansion, mdast-util-to-hast) and a forced WASM Rollup resolution. While some may no longer be needed (the rollup: npm:@rollup/wasm-node override is less relevant with Vite 8's Rolldown), the security overrides should be preserved in package.json's pnpm.overrides field to protect against vulnerable transitive deps.
Suggested fix: Add these back to dashboard/package.json under the existing pnpm section:
"pnpm": {
"overrides": {
"lodash": "^4.18.0",
"mdast-util-to-hast": "^13.2.1",
"minimatch@<3.1.3": "^3.1.3",
"brace-expansion@>=5.0.0 <5.0.6": "^5.0.6"
}
}Verify each override is still necessary by running pnpm why <package> to check current versions.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0. This is a major version upgrade that brings significant architectural changes to how the plugin handles React transforms.
Verdict: Needs changes — There's a critical issue with the pnpm overrides being silently dropped from the lockfile, which could reintroduce security vulnerabilities.
Research notes
Based on the CHANGELOG.md for @vitejs/plugin-react v6:
-
Babel removal: v6 removes Babel as a dependency entirely. Vite 8+ handles React Refresh Transform via Oxc natively. This means the plugin no longer needs
@babel/core,@babel/plugin-transform-react-jsx-self,@babel/plugin-transform-react-jsx-source, etc. -
Vite 8+ required: The peer dependency range changed from
vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0tovite: ^8.0.0. However, this project usesvite@^7.3.2, which is incompatible with v6. -
Node.js requirements: Requires Node 20.19+ or 22.12+, which matches the current
engines.nodespecification. -
Optional peer dependencies: For React Compiler users,
@rolldown/plugin-babelandbabel-plugin-react-compilerare now optional peer dependencies.
Suggested next steps
- Blocking: Either downgrade to
@vitejs/plugin-react@^5.xOR upgradeviteto v8+ (check compatibility with the rest of the ecosystem first) - Non-blocking: Verify that the pnpm overrides in
package.jsonare still being respected after runningpnpm install - Testing: Run frontend tests (
just test ts) and verify dev server works correctly with HMR
General findings
Critical Issues
-
Vite version incompatibility: The upgraded
@vitejs/plugin-react@6.0.0requiresvite@^8.0.0as a peer dependency, but this project usesvite@^7.3.2. This will cause runtime warnings and potential breakage. -
Overrides removed from lockfile: The pnpm overrides section was completely removed from
pnpm-lock.yaml. While the overrides are still defined inpackage.json, pnpm may not be respecting them correctly. These overrides were added to address security vulnerabilities:rollup: npm:@rollup/wasm-node— WASM-based Rollup for cross-platform consistencylodash: ^4.18.0— Security patch for prototype pollutionmdast-util-to-hast: ^13.2.1— Security fixminimatch@<3.1.3: ^3.1.3— ReDoS vulnerability fixbrace-expansion@>=5.0.0 <5.0.6: ^5.0.6— Security fix
Non-blocking Issues
-
Deprecated recharts warning: The lockfile shows a deprecation warning for recharts: "1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes."
-
Security advisory for @ungap/structured-clone: The lockfile contains a deprecated notice: "Potential CWE-502 - Update to 1.3.1 or higher" for
@ungap/structured-clone@1.3.0.
General findings (auto-demoted from inline due to pre-validation)
- Non-blocking
dashboard/pnpm-lock.yaml:1690— This package has a known security issue.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:1690: diff has
deprecated: Potential CWE-502 - Update to 1.3.1 or higher, model claimed'@ungap/structured-clone@1.3.0':)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:1690: diff has
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This upgrade introduces a peer dependency mismatch.
Why it matters: According to the @vitejs/plugin-react CHANGELOG, v6.0.0 dropped support for Vite 7 and below. The peer dependency is now vite: ^8.0.0, but this project uses vite@^7.3.2 (line 91).
The changelog states:
Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it... Drop Vite 7 and below support
This will cause npm/pnpm peer dependency warnings and may result in runtime errors or missing functionality.
Suggested fix: Either:
- Downgrade to
@vitejs/plugin-react@^5.0.1(previous version), OR - Upgrade
viteto^8.0.0and verify all plugins/tools are compatible
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Blocking: Security overrides have been silently removed from the lockfile.
Why it matters: The following pnpm overrides were present in the original lockfile and were put in place to address known security vulnerabilities:
overrides:
rollup: npm:@rollup/wasm-node # Cross-platform WASM build
lodash: ^4.18.0 # Prototype pollution fix (CVE-2026-4800, CVE-2026-2950)
mdast-util-to-hast: ^13.2.1 # Security fix
minimatch@<3.1.3: ^3.1.3 # ReDoS vulnerability
brace-expansion@>=5.0.0 <5.0.6: ^5.0.6 # Security fixThese overrides ensure that even transitive dependencies use patched versions. Their removal from the lockfile means vulnerable versions could be installed if a transitive dependency specifies an older version.
Note: The overrides are still defined in package.json lines 103-109, but pnpm may not be respecting them correctly after regeneration.
Suggested fix:
- Run
pnpm install --lockfile-onlyto regenerate the lockfile with overrides properly applied - Verify the overrides appear in the regenerated lockfile
- If the issue persists, check pnpm version compatibility with the override syntax
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6 via Renovate. However, this update is incompatible with the current Vite version and introduces several issues that block merging.
Verdict: BLOCKED - Cannot merge until Vite is upgraded to v8 or the dependency constraint is adjusted.
Research Notes
@vitejs/plugin-react v6 Breaking Changes
From the official release notes:
- Babel removed: "Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it... babel is no longer a dependency of this plugin"
- Vite 7 dropped: "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- New peer dependencies: Optional
@rolldown/plugin-babelandbabel-plugin-react-compilerfor React Compiler users
Vite 8 Requirements
Per the Vite 8 announcement:
- Vite 8 uses Rolldown as its unified bundler
- Node.js 20.19+, 22.12+ required (same as Vite 7)
- Install size increased ~15MB due to lightningcss and Rolldown
Security Advisory Found
In the lockfile diff, @ungap/structured-clone@1.3.0 shows a deprecation warning: "Potential CWE-502 - Update to 1.3.1 or higher". This should be addressed separately.
Suggested Next Steps
- Option A (Recommended): Upgrade Vite to v8 first, then apply this PR. This ensures compatibility across the toolchain.
- Option B: Pin
@vitejs/plugin-reactto^5.0.1(stay on v5) until Vite 8 upgrade is ready. - Restore pnpm overrides: The
rollup: npm:@rollup/wasm-nodeoverride was intentionally added to avoid native Rollup bindings. This must be restored regardless of which option is chosen.
General Findings
Critical Issues
-
Version incompatibility between @vitejs/plugin-react v6 and Vite v7
@vitejs/plugin-react@6.0.0explicitly dropped support for Vite 7 and below- Current project uses
"vite": "^7.3.2"(package.json line 91) - This mismatch will cause runtime errors or build failures
-
pnpm overrides were removed
- The following overrides existed in the original
package.jsonpnpm config:rollup: npm:@rollup/wasm-node- Avoids native Rollup bindingslodash: ^4.18.0- Security patch for prototype pollutionmdast-util-to-hast: ^13.2.1- Compatibility fixminimatch@<3.1.3: ^3.1.3- Security patchbrace-expansion@>=5.0.0 <5.0.6: ^5.0.6- Security patch
- These overrides appear to have been stripped from the lockfile, potentially reintroducing vulnerabilities or breaking changes
- The following overrides existed in the original
Non-blocking Issues
-
Security advisory in transitive dependency
@ungap/structured-clone@1.3.0is marked deprecated with "Potential CWE-502" (deserialization of untrusted data)- Should update to 1.3.1+ when possible
-
Recharts deprecation notice
recharts@2.15.4shows deprecation: "1.x and 2.x branches are no longer active"- Not introduced by this PR but worth noting for future planning
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Version incompatibility - @vitejs/plugin-react v6 requires Vite 8+, but this project uses Vite 7.3.2.
Why it matters: Per the official release notes, plugin-react v6 "Drop Vite 7 and below support". The peerDependencies also confirm this requires vite: ^8.0.0. Using v6 with Vite 7 will cause build failures or missing functionality since v6 relies on Oxc for React Refresh transform which is only available in Vite 8.
Suggested fix: Either:
- Upgrade Vite to
^8.0.0first, then apply this change - Or pin this to
"^5.0.1"to stay on the v5 series until Vite 8 upgrade is ready
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Blocking: Critical pnpm overrides were removed, including security patches and intentional workarounds.
Why it matters: The following overrides were intentionally configured and their removal may cause issues:
rollup: npm:@rollup/wasm-node- Forces WASM version of Rollup to avoid native bindings (important for cross-platform builds and certain deployment environments)lodash: ^4.18.0- Security override for prototype pollution vulnerability (CVE-2019-10744)minimatch@<3.1.3: ^3.1.3- Security patch for ReDoS vulnerabilitybrace-expansion@>=5.0.0 <5.0.6: ^5.0.6- Security/compatibility fixmdast-util-to-hast: ^13.2.1- Compatibility fix
These overrides appear to have been stripped when pnpm regenerated the lockfile, potentially reintroducing known vulnerabilities.
Suggested fix: Restore all overrides in dashboard/package.json under the pnpm.overrides section. The overrides section exists at lines 102-109 but appears empty or modified in the new version.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0. However, this upgrade introduces a critical version incompatibility that will break the build.
Verdict: Blocked - This change cannot be merged as-is because @vitejs/plugin-react v6 dropped support for Vite 7, but this project uses vite@^7.3.2.
Research notes
I consulted the official release notes and changelog:
-
@vitejs/plugin-react v6.0.0 release notes: Explicitly states "Drop Vite 7 and below support" and "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
-
Vite 8 Migration Guide: Vite 8 uses Rolldown/Oxc instead of esbuild/Rollup, which is a significant architectural change requiring careful migration testing.
-
@vitejs/plugin-react CHANGELOG: Version 6.0.0 also removed all Babel-related features. The plugin now uses Oxc for React Refresh transforms. Custom Babel plugins must now use
@rolldown/plugin-babelseparately.
Suggested next steps
-
Blocking: Either upgrade
viteto^8.0.0alongside this change, OR pin@vitejs/plugin-reactto^5.0.1(or~5.x.y) to maintain compatibility with Vite 7. -
If upgrading to Vite 8, test thoroughly since it involves the Rolldown/Oxc migration which may affect:
- CSS minification (now uses Lightning CSS by default)
- JavaScript transforms (now uses Oxc instead of esbuild)
- CommonJS interop behavior
- Build output and bundle sizes
-
Consider updating Renovate configuration to group Vite and
@vitejs/plugin-reactupgrades together since they have coupled version requirements.
General findings
-
Lockfile overrides section: The pnpm-lock.yaml diff shows the
overridessection was removed. The overrides are still present inpackage.json(lines 103-109), so this appears to be a lockfile format normalization rather than an actual removal of security patches. Verify that all security overrides (rollup,lodash,mdast-util-to-hast,minimatch,brace-expansion) are still being applied correctly afterpnpm install. -
Rollup package structure change: The native
@rollup/wasm-nodepackage has been replaced with platform-specific rollup binaries (e.g.,@rollup/rollup-linux-x64-gnu). This is expected behavior with newer Rollup versions but should be tested across all target deployment platforms.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version upgrade introduces a critical peer dependency incompatibility.
Why it matters: @vitejs/plugin-react v6.0.0 explicitly dropped support for Vite 7 and below (see release notes): "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8." However, this project uses vite@^7.3.2 (line 91 of this file). This mismatch will cause runtime errors or build failures.
Suggested fix: Either:
- Upgrade
viteto^8.0.0(requires testing the Rolldown/Oxc migration), OR - Pin this dependency to
"@vitejs/plugin-react": "^5.0.1"to maintain Vite 7 compatibility
There was a problem hiding this comment.
Interesting! The package.json still has the pnpm overrides section, but the pnpm-lock.yaml has them removed. This is a discrepancy - the lockfile should reflect what's in package.json.
Wait, looking at the diff more carefully:
-overrides:
- rollup: npm:@rollup/wasm-node
- lodash: ^4.18.0
- mdast-util-to-hast: ^13.2.1
- minimatch@<3.1.3: ^3.1.3
- brace-expansion@>=5.0.0 <5.0.6: ^5.0.6This is being removed from the lockfile, but the package.json still has them. This could be a pnpm version issue or the lockfile wasn't regenerated properly after the upgrade.
Also importantly, I see in the lockfile diff that rollup is now rollup: 4.61.1 directly instead of @rollup/wasm-node. This means the override isn't being respected.
Let me also check if there are any issues with the peer dependency resolution. The changelog clearly states v6 requires Vite 8+, but the project uses Vite 7.3.2.
Now let me formulate my review findings.
Now I have enough information to produce a complete review. Let me summarize the critical findings:
Key Issues Identified:
-
Peer Dependency Mismatch (Blocking):
@vitejs/plugin-reactv6 requires Vite 8+, but the project uses Vite 7.3.2. According to the official changelog, "Vite 7 and below are no longer supported." -
Security Overrides Lost (Blocking): The pnpm-lock.yaml shows the security overrides section was removed, including critical security patches for lodash, minimatch, brace-expansion, and the rollup WASM override. These overrides still exist in package.json but aren't reflected in the lockfile.
-
Rollup Resolution Change (Non-blocking): The lockfile now resolves to native
rollup@4.61.1instead of@rollup/wasm-node, which may affect certain environments.
{
"summary": "## Summary\n\nThis PR updates `@vitejs/plugin-react` from v5.0.1 to v6.0.0. While dependency upgrades are generally positive, this update introduces **critical compatibility issues** that must be addressed before merging.\n\n**Verdict: Blocked** - Requires changes to resolve peer dependency conflicts and restore security overrides.\n\n## Research Notes\n\nI consulted the [official @vitejs/plugin-react CHANGELOG](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) which documents the following breaking changes in v6.0.0:\n\n1. **Vite 8+ Required**: \"Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite.\"\n2. **Babel Removed**: The plugin no longer includes Babel as a dependency. All Babel-related features were removed. Users needing Babel must install `@rolldown/plugin-babel` separately.\n3. **New Peer Dependencies**: Optional peers for `@rolldown/plugin-babel` (^0.1.7 || ^0.2.0) and `babel-plugin-react-compiler` (^1.0.0)\n\nThe current project configuration shows:\n- `"vite": "^7.3.2"` in package.json (line 91)\n- Lockfile resolves `@vitejs/plugin-react@6.0.2(vite@7.3.2...)` - indicating a peer dependency mismatch\n\n## Suggested Next Steps\n\n1. **Upgrade Vite to v8** (required for plugin-react v6 compatibility)\n2. **Regenerate pnpm-lock.yaml** to properly reflect the security overrides in package.json\n3. **Verify no custom Babel transforms** are being used (plugin-react v6 removed Babel support)\n4. **Test the dev server and build** thoroughly after making the above changes\n\n## General Findings\n\n### Security Overrides Discrepancy\n\nThe `package.json` contains important security overrides (lodash, minimatch, brace-expansion, rollup WASM), but these were removed from `pnpm-lock.yaml`. This suggests the lockfile wasn't properly regenerated after the dependency update, potentially exposing the project to known vulnerabilities.\n\n### Rollup Resolution Change\n\nThe lockfile now resolves to native `rollup@4.61.1` instead of `@rollup/wasm-node`. This may cause issues in environments where the WASM version was specifically needed.",
"comments": [
{
"path": "dashboard/package.json",
"line": 78,
"side": "RIGHT",
"code": " \"@vitejs/plugin-react\": \"^6.0.0\",",
"severity": "Blocking",
"body": "**Blocking**: Peer dependency mismatch - @vitejs/plugin-react v6 requires Vite 8+\n\n**Why it matters**: According to the [official CHANGELOG](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md#600-2026-03-12), version 6.0.0 dropped support for Vite 7 and below: \"Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite.\"\n\nThe project currently specifies `\"vite\": \"^7.3.2\"` (line 91), which is incompatible with this plugin version. The lockfile shows `@vitejs/plugin-react@6.0.2(vite@7.3.2...)` indicating an unsatisfied peer dependency that could cause runtime failures.\n\n**Suggested fix**: Either:\n1. Upgrade Vite to v8: `\"vite\": \"^8.0.0\"` (recommended, but requires testing)\n2. Or pin plugin-react to v5: `\"@vitejs/plugin-react\": \"^5.0.1\"` (safer short-term)"
},
{
"path": "dashboard/pnpm-lock.yaml",
"line": 7,
"side": "LEFT",
"code": "overrides:",
"severity": "Blocking",
"body": "**Blocking**: Security overrides were removed from lockfile\n\n**Why it matters**: The following security-critical overrides present in the original lockfile were removed:\n- `rollup: npm:@rollup/wasm-node` - WASM version for cross-platform compatibility\n- `lodash: ^4.18.0` - Security patch for prototype pollution\n- `minimatch@<3.1.3: ^3.1.3` - Security patch for ReDoS vulnerability \n- `brace-expansion@>=5.0.0 <5.0.6: ^5.0.6` - Security patch\n- `mdast-util-to-hast: ^13.2.1` - Security patch\n\nThese overrides still exist in `package.json` but weren't propagated to the lockfile, suggesting `pnpm install` wasn't run after the update. This could expose the project to known CVEs.\n\n**Suggested fix**: Run `pnpm install` in the `dashboard/` directory to regenerate the lockfile with proper overrides, then verify the overrides section appears correctly in pnpm-lock.yaml"
},
{
"path": "dashboard/pnpm-lock.yaml",
"line": 218,
"side": "RIGHT",
"code": " version: 7.0.1(rollup@4.61.1)",
"severity": "Non-blocking",
"body": "**Non-blocking**: Rollup resolution changed from WASM to native\n\n**Why it matters**: The original lockfile used `@rollup/wasm-node` (via pnpm override), but now resolves to native `rollup@4.61.1`. This change likely occurred because the security overrides weren't properly applied during lockfile generation.\n\nThe WASM version was likely chosen for cross-platform consistency or specific environment requirements. Native rollup may cause issues in certain deployment scenarios.\n\n**Suggested fix**: After regenerating the lockfile with proper overrides (see previous comment), verify that `@rollup/wasm-node` is correctly resolved instead of native rollup"
}
]
}
There was a problem hiding this comment.
Summary
This PR upgrades @vitejs/plugin-react from v5.0.1 to v6.0.0. However, this upgrade is incompatible with the current Vite version and introduces a critical regression in the Rollup override configuration.
Verdict: Blocked - This PR cannot be merged as-is due to breaking compatibility issues that will cause build failures and potential runtime issues.
Research notes
Fetched the official @vitejs/plugin-react v6.0.0 release notes:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The peer dependency range changed from vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 (v5) to vite: ^8.0.0 (v6).
From the CHANGELOG:
Remove Babel Related Features (#1123)
Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.
Suggested next steps
-
Blocking: Either upgrade Vite to v8+ alongside this change, or pin
@vitejs/plugin-reactto^5.1.4(latest v5) to maintain compatibility with Vite 7. -
Blocking: Restore the pnpm overrides in the lockfile. The
rollup: npm:@rollup/wasm-nodeoverride was lost, which may break cross-platform builds. After runningpnpm install, verify the overrides section inpnpm-lock.yamlcorrectly reflects the WASM variant. -
Non-blocking: Review if any custom Babel plugins are used in the codebase (search for
babel:config orbabel-plugin-*dependencies). If so, you'll need to add@rolldown/plugin-babelas a separate plugin since v6 removed built-in Babel support.
General findings
Compatibility matrix for @vitejs/plugin-react versions:
| Plugin Version | Required Vite | Node.js |
|---|---|---|
| v5.x | ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 | ^18.0.0 |
| v6.x | ^8.0.0 | ^20.19.0 || >=22.12.0 |
The current package.json specifies "vite": "^7.3.2", which is incompatible with plugin-react v6.
General findings (auto-demoted from inline due to pre-validation)
- Blocking
dashboard/pnpm-lock.yaml:4— The pnpmoverridessection was removed from the lockfile, including the criticalrollup: npm:@rollup/wasm-nodeoverride.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
autoInstallPeers: true, model claimedoverrides:)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
- Blocking
dashboard/pnpm-lock.yaml:190— This line shows@vitejs/plugin-react@6.0.2resolving againstvite@7.3.2, which violates the peer dependency requirement.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:190: diff has
specifier: ^6.0.0, model claimedversion: 6.0.2(vite@7.3.2(@types/node@24.12.2)(jiti@2.6.1)(lightningcss@1.32.0)))
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:190: diff has
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: @vitejs/plugin-react v6 requires Vite ^8.0.0 as a peer dependency, but this project uses Vite ^7.3.2 (line 91).
Why it matters: According to the v6.0.0 release notes, Vite 7 and below are no longer supported. The plugin will fail to load or produce undefined behavior when used with an incompatible Vite version.
Suggested fix: Choose one of these options:
- Upgrade Vite: Change line 91 to
"vite": "^8.0.0"and test thoroughly - Pin the plugin: Keep
@vitejs/plugin-reactat"^5.1.4"(latest v5) to maintain Vite 7 compatibility
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0. However, there is a critical compatibility issue: @vitejs/plugin-react v6 explicitly drops support for Vite 7 and below (requiring vite: ^8.0.0), but this project still uses vite@^7.3.2. Additionally, the lockfile changes remove important security overrides.
Verdict: Blocked - This update cannot be applied as-is. Either:
- Upgrade Vite to v8+ alongside this change, OR
- Pin
@vitejs/plugin-reactto v5.x until Vite can be upgraded
Research notes
-
The pnpm-lock.yaml diff shows the
overridessection was removed entirely. The original file had these security overrides:rollup: npm:@rollup/wasm-nodelodash: ^4.18.0mdast-util-to-hast: ^13.2.1minimatch@<3.1.3: ^3.1.3brace-expansion@>=5.0.0 <5.0.6: ^5.0.6
Suggested next steps
- High priority: Decide on Vite upgrade path. If upgrading to Vite 8+, test thoroughly as this is a major version bump affecting the entire build pipeline.
- High priority: Restore the
pnpm.overridessection indashboard/package.jsonto maintain security patches for known vulnerabilities. - Consider using Renovate's grouping feature to bundle Vite + plugin-react updates together in the future, since they have tight version coupling.
General findings
- The lockfile shows
@vitejs/plugin-react@6.0.2is being installed withvite@7.3.2, which violates the peer dependency requirement. While pnpm may not enforce peer dependencies strictly by default, this can lead to runtime errors or unexpected behavior. - The recharts package in the lockfile shows a deprecation warning: "1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes." This is unrelated to this PR but worth noting for future maintenance.
General findings (auto-demoted from inline due to pre-validation)
- Blocking
dashboard/pnpm-lock.yaml:4— Security overrides were removed from the lockfile.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
autoInstallPeers: true, model claimedoverrides:)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version requires Vite 8.0.0+ but the project uses Vite 7.3.2.
Why it matters: According to the @vitejs/plugin-react v6.0.0 release notes, this major version "Drop Vite 7 and below support". The peerDependencies changed to vite: ^8.0.0. Installing v6 with Vite 7 will result in a peer dependency mismatch and may cause build failures or runtime issues.
Suggested fix: Either:
- Update Vite to
^8.0.0in the same PR (test thoroughly) - Or constrain this dependency to
"@vitejs/plugin-react": "^5.0.1"until Vite can be upgraded
There was a problem hiding this comment.
Summary
This PR upgrades @vitejs/plugin-react from v5 to v6. However, this upgrade is incompatible with the current Vite version used in this project.
Verdict: Blocked - The PR cannot be merged as-is because plugin-react v6 explicitly drops support for Vite 7, while this project uses Vite 7.3.2.
Research notes
I fetched the official CHANGELOG.md for @vitejs/plugin-react. Key findings:
From v6.0.0 release (2026-03-12):
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
From v6.0.0 release:
Remove Babel Related Features (#1123)
Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.
If you are using Babel, you can use
@rolldown/plugin-babeltogether with this plugin.
The current project configuration shows:
"vite": "^7.3.2"in dashboard/package.json- Lockfile resolves
@vitejs/plugin-react@6.0.2(vite@7.3.2...)
This creates a peer dependency violation that will likely cause runtime issues or build failures.
Suggested next steps
-
Option A (Recommended): Upgrade Vite to v8 alongside this plugin upgrade. Check the Vite 8 migration guide for breaking changes.
-
Option B: Keep
@vitejs/plugin-reactat v5.x if Vite 8 upgrade is not feasible right now. -
After either option, run full frontend test suite (
just ci ts) to verify compatibility.
General findings
Breaking changes in plugin-react v6 that may affect this project:
-
Babel removal: If the project relies on custom Babel transforms via the
babeloption in the react plugin config, those will stop working. The vite.config.ts showsreact()is called without options, so this should be fine. -
Peer dependency on
@rolldown/plugin-babel: Only needed if using React Compiler or custom Babel transforms. Not required for basic usage. -
Installation size reduction: v6 is lighter since Babel is removed as a dependency.
The pnpm-lock.yaml shows significant cleanup of Babel-related packages (e.g., @babel/core, @babel/parser, json5, lru-cache@5, etc.), which is expected behavior for this upgrade.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0. However, this upgrade is incompatible with the current Vite version and will cause build/runtime failures.
Verdict: ❌ BLOCKED - Requires Vite 8 upgrade first
Research notes
Fetched the official release notes from vite-plugin-react releases and CHANGELOG.md:
Key breaking changes in @vitejs/plugin-react v6.0.0:
- Drop Vite 7 and below support - "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- Remove Babel Related Features - Babel is no longer a dependency. Users needing Babel must add
@rolldown/plugin-babelseparately. - Peer dependency change - Now requires
vite: ^8.0.0(was^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0in v5)
The current dashboard/package.json specifies "vite": "^7.3.2", which is incompatible with plugin-react v6.
Suggested next steps
- First: Upgrade Vite from
^7.3.2to^8.0.0(this is a major migration requiring careful testing) - Then: Re-run this dependency update
- Verify: Check that the pnpm overrides (especially
rollup: npm:@rollup/wasm-node) are still being applied correctly - they appear to have been dropped from the lockfile
General findings
pnpm overrides inconsistency
The pnpm-lock.yaml previously had an overrides section at the top of the file that enforced security patches (lodash, minimatch, brace-expansion, etc.) and the rollup: npm:@rollup/wasm-node substitution. This section is missing in the updated lockfile, even though it's still defined in package.json. This could indicate:
- A pnpm version change that handles overrides differently
- The overrides were accidentally dropped during regeneration
- A potential bug in how pnpm processes the overrides
Recommendation: After upgrading Vite, verify that all overrides are correctly applied by checking the lockfile and running pnpm why <package> for affected dependencies.
Note on recharts deprecation: The lockfile shows a deprecation notice for recharts 2.x, but this is unrelated to this PR and should be addressed separately.
General findings (auto-demoted from inline due to pre-validation)
- Non-blocking
dashboard/pnpm-lock.yaml:4— The pnpmoverridessection was removed from the lockfile.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
autoInstallPeers: true, model claimedoverrides:)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Version incompatibility - @vitejs/plugin-react v6 requires Vite 8+, but project uses Vite ^7.3.2.
Why it matters: According to the official release notes, v6.0.0 explicitly "Drop Vite 7 and below support" and changed the peer dependency to vite: ^8.0.0. Using this plugin version with Vite 7 will cause build failures or runtime errors because:
- The plugin removed Babel-related features that Vite 7 relied on
- Vite 8 uses Rolldown/Oxc instead of esbuild/Rollup for transforms
- The plugin's internal API expectations changed
Suggested fix: Either:
- Upgrade Vite to
^8.0.0first (recommended, but requires full migration testing), OR - Pin
@vitejs/plugin-reactto^5.1.4(latest v5) until ready to upgrade Vite
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0. However, this upgrade is incompatible with the current Vite version.
Verdict: Blocked - This change will break the build/dev server.
Research notes
From the @vitejs/plugin-react v6.0.0 release notes:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
From the Vite 8 announcement:
Alongside Vite 8, we are releasing
@vitejs/plugin-reactv6. The plugin uses Oxc for React Refresh transform. Babel is no longer a dependency...
Note that v5 still works with Vite 8, so you can upgrade the plugin after upgrading Vite.
The peer dependencies in the diff confirm this:
- v5:
vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 - v6:
vite: ^8.0.0(with optional@rolldown/plugin-babelandbabel-plugin-react-compiler)
The current project has "vite": "^7.3.2" in dashboard/package.json line 91.
Suggested next steps
-
Do not merge this PR as-is - it will break the development environment and builds.
-
Choose one of these paths:
- Option A (Recommended): Close this PR and wait until the project is ready to upgrade to Vite 8. When ready, upgrade both
viteand@vitejs/plugin-reacttogether in a coordinated PR. - Option B: Modify this PR to also upgrade Vite from 7.3.2 to 8.x, then test thoroughly before merging.
- Option A (Recommended): Close this PR and wait until the project is ready to upgrade to Vite 8. When ready, upgrade both
-
If staying on Vite 7 for now, pin
@vitejs/plugin-reactto^5.2.0(the latest v5) instead of upgrading to v6.
General findings
Additional observation from the lockfile diff:
The pnpm overrides section was removed in this PR (lines 7-13 of the original pnpm-lock.yaml):
overrides:
rollup: npm:@rollup/wasm-node
lodash: ^4.18.0
mdast-util-to-hast: ^13.2.1
minimatch@<3.1.3: ^3.1.3
brace-expansion@>=5.0.0 <5.0.6: ^5.0.6
However, these overrides are still present in package.json (lines 103-109). This appears to be a side effect of pnpm regenerating the lockfile with the new plugin version. The overrides should remain functional since they're defined in package.json, but this change warrants verification that the security patches (lodash, minimatch, brace-expansion) are still being applied correctly.
Also notable: the recharts package shows a deprecation warning in the lockfile:
1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes.
This is unrelated to the current PR but worth noting for future maintenance.
There was a problem hiding this comment.
Summary
This PR attempts to upgrade @vitejs/plugin-react from v5 to v6, but introduces critical compatibility issues that block merging:
- Peer dependency mismatch:
@vitejs/plugin-react@6.xrequiresvite@^8.0.0, but the project currently usesvite@^7.3.5 - Security override removal: The pnpm overrides section containing important security patches is being removed from the lockfile without corresponding changes to
package.json - Breaking API changes: v6 removes Babel-related features, changing how React Fast Refresh works
Verdict: Blocked - requires Vite 8 upgrade first and preservation of security overrides.
Research notes
From the @vitejs/plugin-react CHANGELOG:
Version 6.0.0 breaking changes:
- Drop Vite 7 and below support: "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- Remove Babel Related Features: "Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it... babel is no longer a dependency of this plugin and the related features are removed."
- New peer dependencies: Now requires
vite: ^8.0.0and optionally@rolldown/plugin-babelorbabel-plugin-react-compiler
Security overrides removed:
The diff shows these security-pinning overrides were removed from the lockfile:
lodash: ^4.18.0(prototype pollution fix)minimatch@<3.1.3: ^3.1.3(ReDoS vulnerability)esbuild@>=0.17.0 <0.28.1: ^0.28.1js-yaml@<=4.1.1: ^4.2.0(arbitrary code execution)@babel/core@<=7.29.0: ^7.29.6@ungap/structured-clone@<1.3.1: ^1.3.1
These overrides still exist in dashboard/package.json (lines 103-113) but are not being applied to the lockfile correctly.
Suggested next steps
- Upgrade Vite to v8 first - Create a separate PR to upgrade
vitefrom^7.3.5to^8.0.0or later - Preserve security overrides - Ensure the pnpm overrides in
package.jsonare properly reflected inpnpm-lock.yamlafter runningpnpm install - Verify no custom Babel config - Check if any Babel plugins are being used that would require adding
@rolldown/plugin-babel - Test build and dev server - After upgrading Vite, verify both development HMR and production builds work correctly
General findings
- The changelog indicates v6.0.0 was released on 2026-03-12, with the main change being the removal of Babel-related features since Vite 8+ handles React Refresh via Oxc
- The current project uses React 19 (
react@^19.1.1) which is compatible with both v5 and v6 of the plugin - Node.js engine requirement (
^20.19.0 || >=22.12.0) in package.json already matches what v6 requires, so that's compatible
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Peer dependency version mismatch.
Why it matters: According to the @vitejs/plugin-react v6.0.0 release notes, this version drops support for Vite 7 and below, requiring vite: ^8.0.0. The project currently uses vite@^7.3.5 (line 91). This will cause peer dependency warnings and may result in runtime errors or broken HMR.
Suggested fix: Either:
- Upgrade Vite to v8+ first:
"vite": "^8.0.0"(requires testing for Vite 8 breaking changes) - Or pin this to v5:
"@vitejs/plugin-react": "^5.2.0"to maintain compatibility with current Vite version
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Blocking: Security overrides being removed without explicit decision.
Why it matters: The following security-related pnpm overrides are being removed from the lockfile:
lodash: ^4.18.0- fixes prototype pollution (CVE-2020-8203)minimatch@<3.1.3: ^3.1.3- fixes ReDoS vulnerabilityjs-yaml@<=4.1.1: ^4.2.0- fixes arbitrary code executionesbuild@>=0.17.0 <0.28.1: ^0.28.1- various security fixes@babel/core@<=7.29.0: ^7.29.6- security patches@ungap/structured-clone@<1.3.1: ^1.3.1- security fixes
These overrides still exist in package.json (lines 103-113) but are not being applied. This could expose the project to known vulnerabilities.
Suggested fix: Run pnpm install after ensuring package.json overrides are correct, or explicitly remove these overrides from package.json if they're no longer needed (with security team approval)
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from ^5.0.1 to ^6.0.0 (a major version upgrade). However, this change introduces a critical compatibility issue: @vitejs/plugin-react@6.x requires Vite 8+, but this project is currently using vite@^7.3.5.
Verdict: Blocked - This PR cannot be merged as-is because it creates an incompatible dependency chain. Either the plugin must stay at v5.x, or Vite must also be upgraded to v8+ alongside this change.
Research notes
I consulted the official @vitejs/plugin-react CHANGELOG:
Version 6.0.0 breaking changes:
- Drop Vite 7 and below support - "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- Remove Babel-related features - Babel is no longer a dependency; Vite 8+ handles React Refresh via Oxc. Users who need custom Babel plugins must now install
@rolldown/plugin-babelseparately. - New peer dependencies - Optional
@rolldown/plugin-babelandbabel-plugin-react-compilerfor React Compiler users.
Current project state:
vite:^7.3.5(line 91 ofdashboard/package.json)@vitejs/plugin-react: being updated to^6.0.0
This creates a peer dependency violation that will cause build/runtime failures.
Suggested next steps
-
Option A (Recommended): Upgrade Vite to v8+ in the same PR:
- Update
"vite": "^7.3.5"→"vite": "^8.0.0"(or latest v8) - Test the full build pipeline, dev server, and test suite
- Review Vite 8 migration guide for any other breaking changes
- Update
-
Option B: Keep
@vitejs/plugin-reactat v5.x until Vite can be upgraded:- Change specifier back to
"@vitejs/plugin-react": "^5.0.1" - Create a separate PR for coordinated Vite + plugin upgrade
- Change specifier back to
-
If upgrading to Vite 8: Check if pnpm overrides in
package.json(lines 103-113) need adjustment, particularly the esbuild override which references version ranges that may conflict with Vite 8's requirements.
General findings
Critical Issue: Peer Dependency Mismatch
The lockfile shows the new plugin version (6.0.2) is being installed, but the Vite version constraint in package.json (^7.3.5) does not satisfy the plugin's peer dependency requirement (vite: ^8.0.0). This will result in:
- npm/pnpm warnings about unmet peer dependencies
- Potential runtime errors if Vite 7 APIs that the plugin relied on were removed or changed in Vite 8
- Build failures if the plugin uses Vite 8-only features
Removed Overrides in Lockfile
The diff shows that several pnpm overrides were removed from the lockfile:
- overrides:
- rollup: npm:@rollup/wasm-node
- lodash: ^4.18.0
- ...
These overrides still exist in package.json (lines 103-113), so this appears to be a lockfile normalization. However, verify that:
- The esbuild override (
esbuild@>=0.17.0 <0.28.1: ^0.28.1) doesn't conflict with Vite 8's esbuild requirements - The
@babel/coreoverride is still needed (v6 of the plugin no longer includes Babel by default)
Node.js Version Requirement
The engine requirement in package.json (line 95) is "node": "^20.19.0 || >=22.12.0", which aligns with @vitejs/plugin-react@6.x requirements. This is correct and needs no change.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This major version upgrade introduces a critical peer dependency incompatibility.
Why it matters: According to the official @vitejs/plugin-react CHANGELOG, version 6.0.0 dropped support for Vite 7 and below: "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8." The current project uses "vite": "^7.3.5" (line 91), which violates the plugin's peer dependency requirement of vite: ^8.0.0. This will cause build failures or runtime errors.
Suggested fix: Either:
- Upgrade Vite alongside this plugin: change line 91 to
"vite": "^8.0.0"(verify latest v8 version first), OR - Keep the plugin at v5.x until Vite can be upgraded:
"@vitejs/plugin-react": "^5.0.1"
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0 in the dashboard frontend. While dependency updates are routine, this major version upgrade introduces a breaking change that is incompatible with the current Vite version in use.
Verdict: Blocked - This PR cannot be merged as-is due to a peer dependency mismatch.
Research notes
According to the official CHANGELOG for @vitejs/plugin-react v6.0.0:
Breaking Changes in v6.0.0:
-
Drop Vite 7 and below support - "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
-
Remove Babel Related Features - "Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it... babel is no longer a dependency of this plugin and the related features are removed."
-
New peer dependencies: The package now declares:
peerDependencies: vite: ^8.0.0 @rolldown/plugin-babel: ^0.1.7 || ^0.2.0 (optional) babel-plugin-react-compiler: ^1.0.0 (optional)
Current Project State:
The dashboard's package.json (line 91) specifies:
"vite": "^7.3.5"This is incompatible with @vitejs/plugin-react@6.0.0 which requires vite: ^8.0.0.
Suggested next steps
Option 1 (Recommended): Upgrade Vite to v8 alongside this plugin update:
- Update
"vite": "^7.3.5"→"vite": "^8.0.0"(or latest v8.x) indashboard/package.json - Review Vite 8 migration guide for any breaking changes that may affect the dashboard
- Test the dev server, build process, and HMR thoroughly
Option 2: Pin @vitejs/plugin-react to the latest v5.x version if Vite 8 upgrade needs to be deferred:
- Change the specifier to
"@vitejs/plugin-react": "^5.2.0"instead of"^6.0.0"
General findings
The pnpm lockfile changes appear to be standard dependency tree updates resulting from the plugin version change. Notable observations:
-
esbuild downgraded: The lockfile shows esbuild changing from 0.28.1 to 0.27.7, which is consistent with the plugin no longer bundling Babel-related dependencies.
-
Rollup changes: The lockfile now includes explicit rollup platform-specific packages (
@rollup/rollup-*) instead of the WASM-based@rollup/wasm-node, which is expected behavior. -
Removed overrides: The pnpm overrides section was removed from the lockfile header, which may indicate pnpm re-resolved dependencies. Ensure the security patches these overrides were meant to address are still satisfied by the new dependency versions.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version of @vitejs/plugin-react requires Vite 8+, but the project currently uses Vite 7.3.5 (line 91).
Why it matters: According to the official CHANGELOG, v6.0.0 explicitly dropped support for Vite 7 and below. The peer dependency is now vite: ^8.0.0. Using incompatible versions may cause:
- Plugin initialization failures at runtime
- Missing React Fast Refresh functionality during development
- Build errors or incorrect JSX transformation
Suggested fix: Either:
- Upgrade Vite: Change line 91 to
"vite": "^8.0.0"(test thoroughly for breaking changes) - Or pin the plugin: Change this line to
"@vitejs/plugin-react": "^5.2.0"to stay compatible with Vite 7
There was a problem hiding this comment.
Summary
This PR upgrades @vitejs/plugin-react from v5.0.1 to v6.0.0. However, this major version upgrade introduces a critical compatibility issue that blocks merging.
Verdict: Blocked - Requires Vite 8 upgrade before this can be merged.
Research notes
Fetched the official vite-plugin-react CHANGELOG which clearly states for v6.0.0:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The release notes also explain that v6 removes Babel-related features and requires vite@^8.0.0 as a peer dependency.
Suggested next steps
- Upgrade Vite to v8 - Update
viteindashboard/package.jsonfrom^7.3.5to^8.0.0(or latest v8 version) - Regenerate lock file - Run
pnpm installafter upgrading Vite to ensure pnpm overrides are properly applied - Test thoroughly - Verify dev server, build, and tests work with Vite 8 + plugin-react 6
- Consider bundling changes - If upgrading Vite, consider doing both upgrades in a single PR or splitting into:
- First PR: Upgrade Vite to v8
- Second PR: Upgrade @vitejs/plugin-react to v6
General findings
pnpm overrides removed from lock file
The security-focused pnpm overrides (for lodash, minimatch, esbuild, js-yaml, @babel/core, etc.) that were present in the old pnpm-lock.yaml are now missing. While these overrides are still defined in package.json, the lock file should be regenerated to ensure they're properly applied. This is especially important given the esbuild version change.
Breaking changes in @vitejs/plugin-react v6
If the team plans to use any Babel plugins, the migration path has changed:
- Old: Configure via
react({ babel: { plugins: [...] } }) - New: Use separate
@rolldown/plugin-babelpackage
For React Compiler users, the setup also changed to use reactCompilerPreset with @rolldown/plugin-babel.
The current codebase doesn't appear to use custom Babel plugins, so this may not impact the project directly.
General findings (auto-demoted from inline due to pre-validation)
- Blocking
dashboard/package.json:91— Vite 7.3.5 is incompatible with@vitejs/plugin-react@6.xwhich requires Vite 8+.- (demoted: line 91 (side=RIGHT) is not part of any diff hunk in dashboard/package.json)
- Non-blocking
dashboard/package.json:109— This esbuild override may conflict with the new plugin version.- (demoted: line 109 (side=RIGHT) is not part of any diff hunk in dashboard/package.json)
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version of @vitejs/plugin-react requires Vite 8+, but the project currently uses Vite 7.3.5 (line 91).
Why it matters: According to the official CHANGELOG, v6.0.0 explicitly dropped support for Vite 7 and below:
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The peer dependency in the published package is vite: ^8.0.0, which means using it with Vite 7.3.5 will result in peer dependency warnings and potential runtime incompatibilities. The plugin relies on Vite 8's native Oxc-based React Refresh transform, which isn't available in Vite 7.
Suggested fix: Either:
- Upgrade Vite to v8: Change line 91 to
"vite": "^8.0.0"(then runpnpm install) - Or keep
@vitejs/plugin-reactat v5.x if Vite 8 upgrade needs to be deferred
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Non-blocking: The pnpm overrides section was removed from the lock file.
Why it matters: The previous lock file included security-focused overrides for vulnerable packages (lodash, minimatch, esbuild, js-yaml, @babel/core, @ungap/structured-clone). These overrides are still present in package.json but are not reflected in the regenerated lock file. This suggests the lock file may not have been fully regenerated with pnpm install after the dependency update, or there may be conflicts preventing the overrides from being applied.
Suggested fix: Run pnpm install --force or delete pnpm-lock.yaml and regenerate it to ensure all security overrides from package.json are properly encoded in the lock file. Verify with pnpm why <package> that the correct versions are installed.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6. However, this update introduces a critical compatibility issue: @vitejs/plugin-react@6 requires Vite 8+, but this project is still using Vite 7.3.5. Additionally, the pnpm-lock.yaml removes important security-related pnpm overrides that were present in the base branch.
Verdict: Blocked - requires Vite upgrade first or should remain on v5.
Research notes
From the @vitejs/plugin-react v6.0.0 release notes:
Breaking Changes:
- Drop Vite 7 and below support: "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- Remove Babel Related Features: "babel is no longer a dependency of this plugin and the related features are removed." Users needing custom Babel plugins must now install
@rolldown/plugin-babelseparately.
Peer Dependency Change:
The new peer dependencies are:
"peerDependencies": {
"vite": "^8.0.0"
}The current project has "vite": "^7.3.5" in dashboard/package.json line 91, which is incompatible.
Suggested next steps
- Option A (Recommended): Downgrade back to
@vitejs/plugin-react@^5.0.1until the team is ready to upgrade to Vite 8. - Option B: If upgrading to Vite 8, do so in a separate PR first, then update the plugin in a follow-up PR.
- Restore pnpm overrides: The security overrides in
pnpm.overrideswere removed. These should be preserved if the intent is to keep the security patches for lodash, esbuild, js-yaml, etc.
General findings
Missing pnpm overrides
The original package.json contained important security-related pnpm overrides:
"pnpm": {
"overrides": {
"rollup": "npm:@rollup/wasm-node",
"lodash": "^4.18.0",
"mdast-util-to-hast": "^13.2.1",
"minimatch@<3.1.3": "^3.1.3",
"brace-expansion@>=5.0.0 <5.0.6": "^5.0.6",
"esbuild@>=0.17.0 <0.28.1": "^0.28.1",
"js-yaml@<=4.1.1": "^4.2.0",
"@babel/core@<=7.29.0": "^7.29.6",
"@ungap/structured-clone@<1.3.1": "^1.3.1"
}
}These overrides were completely removed in the new lockfile. Many of these address known vulnerabilities (e.g., lodash prototype pollution, esbuild security issues). Removing them without explicit intent could reintroduce security vulnerabilities.
General findings (auto-demoted from inline due to pre-validation)
- Blocking
dashboard/package.json:103— Security-related pnpm overrides were removed.- (demoted: line 103 (side=LEFT) is not part of any diff hunk in dashboard/package.json)
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Version incompatibility with Vite.
Why it matters: @vitejs/plugin-react@6.0.0 requires Vite 8+ as a peer dependency, but this project uses "vite": "^7.3.5" (line 91). According to the v6.0.0 release notes: "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
This will cause peer dependency warnings at minimum, and potentially runtime issues since the plugin expects Vite 8 APIs.
Suggested fix: Either:
- Downgrade to
"@vitejs/plugin-react": "^5.0.1"to match current Vite version - Upgrade Vite to
^8.0.0first in a separate PR, then update this plugin
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6. However, this update introduces a breaking compatibility issue: @vitejs/plugin-react v6 requires Vite 8+, but this project is currently using Vite ^7.3.5.
Verdict: Blocked - This PR cannot be merged as-is due to peer dependency incompatibility.
Research notes
I fetched the official changelog for @vitejs/plugin-react v6.0.0:
Key Breaking Changes in v6.0.0:
-
Drop Vite 7 and below support (#1124)
- Vite 7 and below are no longer supported. Must upgrade to Vite 8+.
-
Remove Babel Related Features (#1123)
- Vite 8+ handles React Refresh Transform by Oxc natively
- Babel is no longer a dependency of the plugin
- The
babelconfiguration option is completely removed - Users needing Babel must now use
@rolldown/plugin-babelas a separate plugin
-
New peer dependencies:
vite: ^8.0.0(was^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0)- Optional:
@rolldown/plugin-babel: ^0.1.7 || ^0.2.0 - Optional:
babel-plugin-react-compiler: ^1.0.0
Current Project State:
vite:^7.3.5(indashboard/package.jsonline 91)@vitejs/plugin-react:^6.0.0(after this PR)
This creates a peer dependency mismatch.
Suggested next steps
-
Option A (Recommended): Downgrade the specifier to
@vitejs/plugin-react: ^5.1.4to match the current Vite 7.x version -
Option B: Upgrade Vite to v8+ alongside this change:
- Update
viteto^8.0.0 - Test thoroughly since Vite major versions can have breaking changes
- Verify all plugins are compatible with Vite 8
- Update
-
If Option B is chosen, also verify that the pnpm overrides in package.json remain valid for the new versions.
General findings
pnpm-lock.yaml structure change: The overrides section was removed from the top-level of pnpm-lock.yaml. This appears to be a lockfile format change - the overrides are still present in package.json under the pnpm key, so this is informational only.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Peer dependency incompatibility - @vitejs/plugin-react v6 requires Vite 8+, but this project uses Vite ^7.3.5.
Why it matters: According to the official changelog, v6.0.0 explicitly "Drop Vite 7 and below support". The release notes state:
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The current vite version in this project is ^7.3.5 (line 91), which is incompatible with this plugin version. This will cause:
- Peer dependency warnings during installation
- Potential runtime failures or build errors
- Missing Babel-related functionality that was removed in v6
Suggested fix: Either:
- Downgrade to
"@vitejs/plugin-react": "^5.1.4"to maintain Vite 7 compatibility, OR - Upgrade Vite to
^8.0.0alongside this change (requires testing all plugins for Vite 8 compatibility)
There was a problem hiding this comment.
Summary
This PR upgrades @vitejs/plugin-react from v5 to v6. While this is a routine dependency update, there's a critical compatibility issue that blocks merging.
Verdict: 🔴 Blocked - Requires Vite upgrade alongside this change.
Research notes
I consulted the official changelog for @vitejs/plugin-react v6.0.0:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The project currently uses "vite": "^7.3.5" in dashboard/package.json (line 91), which is incompatible with @vitejs/plugin-react@6.
Additionally, v6 removes built-in Babel support:
Remove Babel Related Features (#1123)
babel is no longer a dependency of this plugin and the related features are removed. If you are using Babel, you can use
@rolldown/plugin-babeltogether with this plugin.
The current vite config uses react() with no custom Babel plugins, so this specific change wouldn't break the build - but the Vite version mismatch will.
Suggested next steps
- Upgrade Vite to v8 alongside this plugin upgrade, OR
- Pin
@vitejs/plugin-reactto v5.x if Vite 7 must be retained for now
If upgrading Vite:
- Update
"vite": "^8.0.0"in package.json - Test the full build and dev server
- Review Vite 8 breaking changes for any migration issues
General findings
pnpm overrides removal in lockfile: The diff shows pnpm overrides being removed from pnpm-lock.yaml. These overrides include important security patches (lodash prototype pollution, minimatch ReDoS, etc.). Ensure these overrides are intentional and that the upgraded packages include the necessary security fixes, or restore the overrides in package.json if needed.
Inline Comments
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: @vitejs/plugin-react v6 drops support for Vite 7 and below (source: changelog). This project uses "vite": "^7.3.5" (line 91), which is incompatible.
Why it matters: The peer dependency requirement changed from supporting Vite 4.2+ / 5.x / 6.x / 7.x to requiring Vite 8+. Using an unsupported Vite version may cause build failures, runtime errors, or subtle HMR issues.
Suggested fix: Either:
- Upgrade Vite: Change line 91 to
"vite": "^8.0.0"and test thoroughly - Or pin this plugin to v5: Keep
"@vitejs/plugin-react": "^5.0.1"
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Non-blocking: The pnpm overrides section is being removed from the lockfile. These overrides include security patches:
lodash: ^4.18.0- prototype pollution fixminimatch@<3.1.3: ^3.1.3- ReDoS vulnerability fixesbuild@>=0.17.0 <0.28.1: ^0.28.1- various fixesjs-yaml@<=4.1.1: ^4.2.0- code execution vulnerability fix
Why it matters: Removing these overrides may reintroduce known vulnerabilities if the transitive dependencies resolve to vulnerable versions.
Suggested fix: Verify that either:
- The overrides are still present in
package.jsonunderpnpm.overrides(they should be preserved there) - Or the resolved package versions in the new lockfile already include the security fixes
Check dashboard/package.json lines 102-113 to confirm overrides are still configured.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0 (resolving to 6.0.2). However, this upgrade is incompatible with the current Vite version.
Verdict: Blocked - This PR cannot be merged as-is because @vitejs/plugin-react v6 requires Vite 8+, but the project is still using Vite 7.3.5.
Research notes
I consulted the official @vitejs/plugin-react CHANGELOG which clearly states:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
Additionally, the Vite 8 Migration Guide confirms that Vite 8 uses Rolldown and Oxc instead of esbuild and Rollup, which is why @vitejs/plugin-react v6 removed its bundled Babel dependencies and changed its peer dependency requirements.
Suggested next steps
-
Blocking: Either:
- Option A: Also upgrade
vitefrom^7.3.5to^8.0.0indashboard/package.jsonto satisfy the peer dependency requirement, OR - Option B: Keep
@vitejs/plugin-reactat v5.x if Vite 8 upgrade is not planned for this PR
- Option A: Also upgrade
-
Non-blocking: Investigate why the pnpm overrides section was removed from
pnpm-lock.yaml. Thepackage.jsonstill contains the overrides (security patches for lodash, minimatch, esbuild, etc.), but they are no longer reflected in the lockfile. This could indicate:- The overrides are no longer needed due to transitive dependency updates
- A configuration issue during
pnpm install
Verify that all security overrides are still being applied correctly.
General findings
Major version upgrade implications
@vitejs/plugin-react v6 includes significant architectural changes:
- Babel removed: The plugin no longer bundles Babel. If you use custom Babel plugins, you'll need to install
@rolldown/plugin-babelseparately. - Oxc-based: The plugin now uses Oxc for React refresh transformation instead of Babel (when used with Vite 8+).
- Peer dependency change: The peer dependency now specifies
vite: ^8.0.0instead of supporting Vite 4-7.
The current vite.config.ts uses a simple react() call without custom Babel configuration, so the migration should be straightforward once Vite is upgraded.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version of @vitejs/plugin-react requires Vite 8+, but the project uses Vite 7.3.5 (line 91).
Why it matters: According to the official CHANGELOG, v6.0.0 dropped support for Vite 7 and below. The peer dependencies in the lockfile confirm this:
peerDependencies:
vite: ^8.0.0
Using incompatible versions will cause runtime errors or build failures because v6 removed Babel dependencies and relies on Vite 8's Oxc-based transformation pipeline.
Suggested fix: Either:
- Upgrade Vite:
"vite": "^8.0.0"(requires testing for Vite 8 breaking changes) - Or pin this to v5:
"@vitejs/plugin-react": "^5.0.1"
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Non-blocking: The pnpm overrides section was removed from the lockfile, but still exists in package.json (lines 102-113).
Why it matters: The overrides in package.json include important security patches:
lodash: ^4.18.0(prototype pollution fix)minimatch@<3.1.3: ^3.1.3(ReDoS fix)esbuild@>=0.17.0 <0.28.1: ^0.28.1(security fix)js-yaml@<=4.1.1: ^4.2.0(code execution fix)
The lockfile no longer reflects these overrides, which could mean either:
- The transitive dependencies now naturally resolve to safe versions (needs verification)
- The overrides are not being applied (security risk)
Suggested fix: Run pnpm install to regenerate the lockfile with overrides, or verify that all security patches are still being applied through natural dependency resolution. Check with pnpm why <package> for each overridden dependency.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6. However, this upgrade is incompatible with the current Vite version in this project. According to the official changelog, v6.0.0 explicitly drops support for Vite 7 and below, requiring Vite 8+. The project currently uses vite@^7.3.5.
Verdict: Blocked - This PR cannot be merged as-is because it creates a peer dependency mismatch that will cause runtime issues.
Research notes
From the @vitejs/plugin-react v6.0.0 changelog:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The lockfile confirms the peer dependency requirement:
peerDependencies:
vite: ^8.0.0Additionally, v6 removes Babel-related features. If the project relies on any custom Babel configuration in the plugin, it would need to migrate to using @rolldown/plugin-babel separately.
Suggested next steps
- Option A (Recommended): Downgrade the specifier back to
^5.0.1to maintain compatibility with Vite 7. - Option B: If upgrading to Vite 8 is desired, create a separate PR that:
- Updates
viteto^8.0.0(or latest v8) - Updates
@vitejs/plugin-reactto^6.0.0 - Tests the full build and dev server to ensure compatibility
- Reviews any breaking changes in Vite 8 that might affect the project
- Updates
General findings
- The pnpm overrides in
package.jsoncurrently pinesbuild@>=0.17.0 <0.28.1to^0.28.1. With v6, esbuild is downgraded to 0.27.7 in the lockfile, which may or may not be intentional. - The
@rollup/wasm-nodeoverride has been removed from the lockfile (it was in the overrides section previously). This could affect build behavior if the project relies on WASM-based Rollup.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version is incompatible with the current Vite version.
Why it matters: @vitejs/plugin-react v6.0.0+ requires vite@^8.0.0 as a peer dependency (confirmed in pnpm-lock.yaml), but this project uses vite@^7.3.5 (line 91). According to the official changelog, v6 explicitly dropped support for Vite 7. This peer dependency mismatch will cause pnpm to emit warnings and may lead to runtime failures.
Suggested fix: Either:
- Downgrade to
"@vitejs/plugin-react": "^5.0.1"to match Vite 7, OR - Upgrade Vite to
"vite": "^8.0.0"in a separate, properly tested PR
There was a problem hiding this comment.
Summary
This PR upgrades @vitejs/plugin-react from v5.0.1 to v6.0.0. However, there is a critical peer dependency incompatibility that blocks this upgrade:
@vitejs/plugin-react@6.x requires Vite ^8.0.0, but this project uses Vite ^7.3.5.
According to the official changelog, v6.0.0 explicitly dropped support for Vite 7 and below. The plugin will emit peer dependency warnings and may not function correctly without upgrading Vite as well.
Verdict: Blocked - Requires accompanying Vite upgrade to v8+.
Research notes
Fetched the official CHANGELOG from vitejs/vite-plugin-react repository:
-
v6.0.0 breaking changes:
- "Drop Vite 7 and below support" -
peerDependenciesnow requiresvite: ^8.0.0 - "Remove Babel Related Features" - Babel is no longer bundled; React Refresh is handled by Oxc natively in Vite 8+
- New optional peer deps:
@rolldown/plugin-babelandbabel-plugin-react-compiler - Requires Node 20.19+ or 22.12+ (already satisfied by this project's
enginesfield)
- "Drop Vite 7 and below support" -
-
Current project state:
dashboard/package.jsonline 91:"vite": "^7.3.5"dashboard/package.jsonline 78:"@vitejs/plugin-react": "^6.0.0"(after this PR)- This creates a peer dependency mismatch
Suggested next steps
- Upgrade Vite to v8+ alongside this plugin upgrade, OR
- Pin
@vitejs/plugin-reactto^5.0.0if Vite 8 upgrade is not planned - If upgrading to Vite 8, test thoroughly as there may be additional breaking changes in Vite itself
- Review the removed pnpm overrides in
pnpm-lock.yaml- ensure the security patches they provided are no longer needed or are addressed upstream
General findings
Removed pnpm overrides
The diff shows the entire overrides section was removed from the top-level of pnpm-lock.yaml:
-overrides:
- rollup: npm:@rollup/wasm-node
- lodash: ^4.18.0
- ...These overrides were likely added for security patches (e.g., lodash, minimatch, esbuild) or compatibility reasons (rollup). Their removal means:
- Transitive dependencies will now resolve to whatever versions the direct dependencies specify
- Security vulnerabilities that were mitigated by these overrides may resurface
Recommendation: Verify that the versions now resolved by pnpm don't reintroduce known vulnerabilities. Run pnpm audit after the upgrade.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6, but introduces critical compatibility issues that will break the build:
@vitejs/plugin-react@6.xrequires Vite 8, but the project still uses Vite 7.3.5- Security overrides were removed from lockfile while remaining in package.json, creating inconsistency
This PR cannot be merged as-is. It requires either downgrading the plugin version or upgrading Vite to v8.
Research notes
@vitejs/plugin-react@6.0.0release notes: Explicitly states "Drop Vite 7 and below support - Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."- Peer dependency for
@vitejs/plugin-react@6.0.2:vite: ^8.0.0(required, not optional) - Current project:
vite: ^7.3.5indashboard/package.jsonline 91 - Vite v8.0.16 is available as the latest stable version
Suggested next steps
- Option A (Recommended): Also upgrade
viteto^8.0.16inpackage.jsonand regenerate the lockfile with pnpm overrides properly applied - Option B: Downgrade
@vitejs/plugin-reactback to^5.0.1if Vite 8 upgrade isn't ready - Ensure pnpm overrides in
package.jsonare correctly reflected in the regeneratedpnpm-lock.yaml
General findings
Missing pnpm overrides in lockfile
The pnpm-lock.yaml had its entire overrides section removed (lines 7-17 in original), but package.json still declares these security-critical overrides:
"pnpm": {
"overrides": {
"rollup": "npm:@rollup/wasm-node",
"lodash": "^4.18.0",
"minimatch@<3.1.3": "^3.1.3",
"esbuild@>=0.17.0 <0.28.1": "^0.28.1",
...
}
}This inconsistency means the lockfile may resolve to vulnerable versions despite the overrides being declared in package.json. Run pnpm install after fixing the Vite compatibility to regenerate the lockfile with overrides properly applied.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: @vitejs/plugin-react@6.x requires vite ^8.0.0 as a peer dependency, but this project uses vite ^7.3.5 (line 91).
Why it matters: The v6.0.0 release notes explicitly state: "Drop Vite 7 and below support - Vite 7 and below are no longer supported." This peer dependency mismatch will cause build failures or undefined runtime behavior because the plugin expects Vite 8 APIs that don't exist in Vite 7.
Suggested fix: Either:
- Upgrade vite: Change line 91 to
"vite": "^8.0.16"and runpnpm install - Or downgrade this package: Change to
"@vitejs/plugin-react": "^5.0.1"
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Blocking: The entire overrides section was removed from the lockfile, but package.json still declares these security-critical overrides.
Why it matters: The removed overrides include important security patches:
lodash: ^4.18.0(prototype pollution fixes)minimatch@<3.1.3: ^3.1.3(ReDoS vulnerability)esbuild@>=0.17.0 <0.28.1: ^0.28.1(security fixes)rollup: npm:@rollup/wasm-node(architecture-specific builds)
Without these overrides in the lockfile, running pnpm install could resolve to vulnerable versions. The lockfile and package.json must be consistent.
Suggested fix: After resolving the Vite compatibility issue, run pnpm install to regenerate the lockfile with overrides properly applied. Verify the overrides: section appears at the top of pnpm-lock.yaml.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.x to v6.x. However, there is a critical peer dependency mismatch that blocks this upgrade: @vitejs/plugin-react@6.x explicitly requires vite@^8.0.0, but this project is still on vite@^7.3.5. According to the official changelog, v6.0.0 dropped support for Vite 7 and below.
Verdict: Blocked — Cannot merge until either (a) Vite is also upgraded to v8, or (b) the plugin version is pinned to v5.x.
Research notes
- Fetched @vitejs/plugin-react CHANGELOG
- v6.0.0 changes (2026-03-12):
- "Drop Vite 7 and below support (#1124): Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- "Remove Babel Related Features (#1123): babel is no longer a dependency of this plugin"
- New peer dependencies:
vite: ^8.0.0(required),@rolldown/plugin-babel(optional),babel-plugin-react-compiler(optional)
- Current project uses
vite@^7.3.5(package.json line 91)
Suggested next steps
- Option A (Recommended): Also upgrade
viteto^8.0.0in the same PR. Verify that Vite 8 has no breaking changes affecting your build. - Option B: Pin
@vitejs/plugin-reactto^5.0.0instead if Vite 8 upgrade needs separate review. - Verify that pnpm security overrides are still being applied correctly after the lockfile regeneration.
General findings
Missing pnpm overrides in lockfile
The old pnpm-lock.yaml contained an overrides section with security patches for known vulnerabilities (lodash, esbuild, js-yaml, @babel/core, etc.). These overrides are still present in package.json but were removed from the regenerated lockfile. This could indicate:
- The override format changed between pnpm versions
- Some overrides may no longer be necessary due to transitive dependency updates
- Or the overrides aren't being applied as expected
Recommend running pnpm install locally and verifying the overrides section appears correctly in the regenerated lockfile, or confirming that the vulnerable packages have been updated to safe versions through normal dependency resolution.
General findings (auto-demoted from inline due to pre-validation)
- Non-blocking
dashboard/pnpm-lock.yaml:4— pnpm overrides section removed from lockfile.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
autoInstallPeers: true, model claimedsettings:)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:4: diff has
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Peer dependency mismatch with Vite version.
Why it matters: @vitejs/plugin-react@6.0.2 requires vite: ^8.0.0 as a peer dependency, but this project uses vite@^7.3.5 (line 91). According to the official changelog, v6.0.0 explicitly "Drop[s] Vite 7 and below support." This will cause peer dependency warnings at install time and may result in runtime errors or broken HMR.
Suggested fix: Either:
- Upgrade
viteto^8.0.0in the same PR (line 91), or - Pin this to
"@vitejs/plugin-react": "^5.0.0"if Vite 8 upgrade needs separate review.
|
|
||
| '@esbuild/aix-ppc64@0.28.1': | ||
| resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==} | ||
| '@esbuild/aix-ppc64@0.27.7': |
There was a problem hiding this comment.
Nit: esbuild downgraded from 0.28.1 to 0.27.7.
Why it matters: The esbuild version was previously overridden to ^0.28.1 via pnpm overrides (likely for a security fix). Due to the @vitejs/plugin-react v6 update changing the dependency tree, esbuild resolved to 0.27.7 instead. Combined with the missing overrides section noted above, verify this doesn't reintroduce any previously-patched vulnerabilities.
Suggested fix: Verify the esbuild version is acceptable and that no security overrides are being bypassed.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6. However, there is a critical peer dependency incompatibility that will cause issues: @vitejs/plugin-react@6.x explicitly requires vite:^8.0.0, but this project is still on vite:^7.3.5. The changelog for v6 clearly states "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
Additionally, the pnpm security overrides were removed from the lockfile without corresponding changes to package.json, which may reintroduce known vulnerabilities.
Verdict: BLOCKED – This PR cannot be merged as-is because of the Vite version incompatibility.
Research notes
-
Fetched
@vitejs/plugin-reactCHANGELOG:- v6.0.0-beta.0: "Drop Vite 7 and below support. Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- v6.0.0-beta.0: "Remove Babel Related Features. Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it." The plugin now uses Oxc instead of Babel for JSX transforms.
- New peer dependencies:
vite: ^8.0.0(was^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0), with optional@rolldown/plugin-babelandbabel-plugin-react-compilerfor users who need custom Babel plugins.
-
Current project state (
dashboard/package.json:91):"vite": "^7.3.5"— incompatible with plugin-react v6.
Suggested next steps
-
Either upgrade Vite to v8 alongside this plugin update (requires testing for breaking changes in Vite 8), or downgrade the plugin-react update to stay on v5.x which supports Vite 7.
-
If upgrading to Vite 8, verify:
- All Vite plugins are compatible with Vite 8
- Build and dev server work correctly
- Tests pass
-
Review the removal of pnpm overrides — if intentional, ensure the underlying vulnerabilities have been resolved in the new dependency versions. If unintentional, restore the overrides.
General findings
Peer Dependency Incompatibility (Blocking)
The @vitejs/plugin-react@6.0.2 package declares vite: ^8.0.0 as a peer dependency, but the project specifies vite: ^7.3.5. While pnpm may not enforce this strictly, runtime behavior is not guaranteed and the plugin authors explicitly dropped Vite 7 support.
Security Overrides Removal (Non-blocking)
The following pnpm overrides were present in the previous lockfile but removed in this PR:
rollup: npm:@rollup/wasm-nodelodash: ^4.18.0(security fix)minimatch@<3.1.3: ^3.1.3(ReDoS vulnerability)brace-expansion@>=5.0.0 <5.0.6: ^5.0.6(ReDoS vulnerability)esbuild@>=0.17.0 <0.28.1: ^0.28.1js-yaml@<=4.1.1: ^4.2.0(code execution vulnerability)@babel/core@<=7.29.0: ^7.29.6@ungap/structured-clone@<1.3.1: ^1.3.1
These overrides were likely added to patch known vulnerabilities. Their removal should be intentional and verified against the new dependency tree.
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Peer dependency incompatibility.
Why it matters: @vitejs/plugin-react@6.x requires vite: ^8.0.0 as a peer dependency, but this project uses vite: ^7.3.5 (line 91). The v6.0.0 changelog explicitly states: "Drop Vite 7 and below support. Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
While pnpm may install this without error, the plugin's internal behavior relies on Vite 8 APIs (Oxc-based JSX transform) that may not exist in Vite 7, leading to runtime failures or broken HMR.
Suggested fix: Either:
- Upgrade
viteto^8.0.0(and test thoroughly for breaking changes), OR - Keep
@vitejs/plugin-reactat^5.0.1until ready to upgrade Vite
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Non-blocking: Security-related pnpm overrides were removed.
Why it matters: The previous lockfile included overrides for packages with known vulnerabilities (e.g., lodash, minimatch, brace-expansion, js-yaml). These overrides pinned secure versions before they were available as direct dependency updates. Their removal may reintroduce vulnerabilities if transitive dependencies pull in the affected versions.
The removed overrides were:
rollup: npm:@rollup/wasm-nodelodash: ^4.18.0minimatch@<3.1.3: ^3.1.3brace-expansion@>=5.0.0 <5.0.6: ^5.0.6esbuild@>=0.17.0 <0.28.1: ^0.28.1js-yaml@<=4.1.1: ^4.2.0@babel/core@<=7.29.0: ^7.29.6@ungap/structured-clone@<1.3.1: ^1.3.1
Suggested fix: Verify whether these overrides are still needed by running pnpm audit or checking if the vulnerable versions are still pulled in transitively. If overrides are needed, they should remain in package.json (which still has them) and be reflected correctly in the lockfile.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0 (resolving to 6.0.2). However, there is a critical peer dependency incompatibility that blocks this upgrade: @vitejs/plugin-react@6.x requires vite ^8.0.0, but this project is still on vite ^7.3.5. The v6 changelog explicitly states "Drop Vite 7 and below support" as a breaking change.
Verdict: Blocked - This PR cannot be merged as-is. Either Vite must also be upgraded to v8, or the @vitejs/plugin-react version constraint should remain at ^5.0.1.
Research notes
- Fetched @vitejs/plugin-react CHANGELOG: Confirms v6.0.0 removed Babel-related features and dropped Vite 7 support
- Fetched npm registry data for @vitejs/plugin-react@6.0.2: Shows
peerDependencies: { vite: "^8.0.0", ... } - Current project uses
vite: ^7.3.5(package.json line 91)
Suggested next steps
- Blocking: Decide whether to upgrade Vite to v8 alongside this change, or keep
@vitejs/plugin-reactat v5.x - Non-blocking: Review the removed pnpm security overrides and determine if they need to be re-added for v6 dependencies
- Non-blocking: Verify no custom Babel configuration is needed (v6 requires using
@rolldown/plugin-babelseparately if Babel plugins are required)
General findings
-
Security overrides removed: The previous pnpm-lock.yaml contained security overrides for packages like
lodash,minimatch,js-yaml,@babel/core, and@ungap/structured-clone. These are completely absent in the new lockfile, which could reintroduce known vulnerabilities. -
esbuild downgraded: esbuild went from 0.28.1 to 0.27.7, which is unusual for an upgrade PR and may indicate dependency resolution issues.
-
Babel architecture change: v6 removes all built-in Babel support. The project currently uses
react()with no options, so this won't break anything immediately. However, if custom Babel plugins are ever needed, the setup must change to use@rolldown/plugin-babelas a separate plugin.
General findings (auto-demoted from inline due to pre-validation)
- Nit
dashboard/pnpm-lock.yaml:445— esbuild was downgraded from 0.28.1 to 0.27.7.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:445: diff has
engines: {node: '>=18'}, model claimedesbuild@0.27.7:)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:445: diff has
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version requires vite ^8.0.0 as a peer dependency, but the project uses vite ^7.3.5 (line 91).
Why it matters: According to the @vitejs/plugin-react v6.0.0 changelog, this major version explicitly "Drop[s] Vite 7 and below support." The npm registry confirms peerDependencies: { vite: "^8.0.0" }. This mismatch will cause peer dependency warnings and potential runtime failures since the plugin relies on Vite 8 APIs.
Suggested fix: Either:
- Also upgrade Vite:
"vite": "^8.0.0"(check Vite 8 migration guide for breaking changes) - Or keep this at:
"@vitejs/plugin-react": "^5.0.1"
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Non-blocking: Security overrides were removed from the lockfile.
Why it matters: The previous lockfile contained pnpm overrides for known vulnerable packages:
lodash: ^4.18.0(prototype pollution)minimatch@<3.1.3: ^3.1.3(ReDoS)js-yaml@<=4.1.1: ^4.2.0(code execution)@babel/core@<=7.29.0: ^7.29.6@ungap/structured-clone@<1.3.1: ^1.3.1
These overrides are completely absent in the new lockfile, which could reintroduce security vulnerabilities that were previously patched.
Suggested fix: Re-add equivalent overrides in package.json under pnpm.overrides for any vulnerable transitive dependencies, or verify that the new dependency versions already include the security fixes.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6. However, this update introduces a blocking peer dependency incompatibility: plugin-react v6 explicitly dropped support for Vite 7, requiring Vite 8+, while this project uses Vite ^7.3.5.
Verdict: BLOCKED - Cannot merge without also upgrading Vite to v8.
Research notes
From the @vitejs/plugin-react CHANGELOG:
6.0.0 (2026-03-12)
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
The peer dependencies confirm this:
- v5:
vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0 - v6:
vite: ^8.0.0(with optional@rolldown/plugin-babelandbabel-plugin-react-compiler)
Key architectural changes in v6:
- Babel is no longer bundled; users needing Babel must install
@rolldown/plugin-babelseparately - React Refresh transforms now use Oxc instead of Babel for Vite 8+
- Many
@babel/*packages removed from the dependency tree (visible in the lockfile diff)
Suggested next steps
-
Decide on Vite upgrade path: Either:
- Upgrade Vite to ^8.0.0 alongside this change (recommended if you want latest features)
- Pin
@vitejs/plugin-reactto^5.2.0to maintain Vite 7 compatibility
-
If upgrading to Vite 8: Test thoroughly as this is a major version bump that may affect:
- Build output
- HMR behavior
- Any custom Vite plugins
-
Review pnpm overrides: The
pnpm.overrides.esbuildconstraint (^0.28.1) in package.json may conflict with the downgraded esbuild@0.27.7 that comes with the new plugin-react. Consider updating or removing this override.
General findings
- The lockfile shows significant cleanup with removal of Babel-related dependencies (expected for v6)
- Rollup changed from WASM-node variant to native packages (potentially beneficial for performance)
- The pnpm overrides section appears in package.json but was removed from the lockfile header, which may indicate inconsistency
General findings (auto-demoted from inline due to pre-validation)
- Non-blocking
dashboard/package.json:109— pnpm override constraint may conflict with resolved esbuild version.- (demoted: line 109 (side=RIGHT) is not part of any diff hunk in dashboard/package.json)
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Peer dependency incompatibility with Vite version.
Why it matters: @vitejs/plugin-react v6.0.0+ requires vite: ^8.0.0 as a peer dependency, but this project uses vite: ^7.3.5 (line 91). According to the official changelog, v6 explicitly "Drop[s] Vite 7 and below support." This mismatch will cause npm/pnpm peer dependency warnings and may result in runtime errors or broken HMR.
Suggested fix: Either:
- Upgrade Vite: Change line 91 to
"vite": "^8.0.0"and test thoroughly - Or pin this dependency: Change to
"@vitejs/plugin-react": "^5.2.0"to maintain compatibility
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5.0.1 to v6.0.0. However, this update introduces a critical peer dependency incompatibility that will break the build.
Verdict: Blocked — requires Vite upgrade and lockfile consistency fixes before merging.
Research notes
From the @vitejs/plugin-react v6.0.0 changelog:
Drop Vite 7 and below support (#1124)
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
From the npm registry metadata for @vitejs/plugin-react@6.0.3:
"peerDependencies": {
"vite": "^8.0.0"
}The current project uses vite@^7.3.5 (dashboard/package.json line 91), which is incompatible with plugin-react v6.
Suggested next steps
- Update Vite to v8.x alongside this plugin update (both changes should be in the same PR)
- Restore the pnpm overrides in
pnpm-lock.yaml— they were incorrectly dropped during regeneration - Verify the esbuild version conflict — the override
"esbuild@>=0.17.0 <0.28.1": "^0.28.1"conflicts with the esbuild 0.27.7 that plugin-react v6 pulls in - Test the dev server and build after making these changes
General findings
Missing peer dependency resolution
The PR updates only the React plugin without updating Vite itself. This creates an unsatisfiable peer dependency chain.
Lockfile overrides section removed
The pnpm-lock.yaml had its overrides section completely removed. This section contained important security patches:
lodash: ^4.18.0(security fix)minimatch@<3.1.3: ^3.1.3(ReDoS vulnerability fix)esbuild@>=0.17.0 <0.28.1: ^0.28.1(now conflicts with new esbuild 0.27.7)js-yaml@<=4.1.1: ^4.2.0(prototype pollution fix)
These overrides are still declared in package.json but not reflected in the lockfile, creating inconsistency.
Rollup WASM variant lost
The override "rollup": "npm:@rollup/wasm-node" was removed from the lockfile, meaning the project will now use the native Rollup instead of the WASM variant. This may have been intentional but wasn't documented.
General findings (auto-demoted from inline due to pre-validation)
- Non-blocking
dashboard/pnpm-lock.yaml:365— esbuild was downgraded from 0.28.1 to 0.27.7 due to the plugin-react v6 update.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:365: diff has
'@esbuild/aix-ppc64@0.27.7':, model claimedesbuild@0.27.7:)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:365: diff has
- Non-blocking
dashboard/pnpm-lock.yaml:228— The rollup dependency changed from@rollup/wasm-node@4.62.0to standardrollup@4.62.0.- (demoted: line 228 (side=RIGHT) is not part of any diff hunk in dashboard/pnpm-lock.yaml)
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: This version of @vitejs/plugin-react requires vite@^8.0.0 as a peer dependency, but the project uses vite@^7.3.5 (line 91).
Why it matters: According to the v6.0.0 changelog, Vite 7 and below are no longer supported. The npm registry confirms the peer dependency is "vite": "^8.0.0". This mismatch will cause peer dependency warnings and may lead to runtime errors or build failures.
Suggested fix: Update Vite to v8.x in the same PR:
"vite": "^8.0.0"Then regenerate the lockfile with pnpm install.
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Blocking: The entire overrides section was removed from the lockfile, but these overrides are still declared in package.json (lines 103-113).
Why it matters: These overrides provide critical security patches:
lodash: ^4.18.0— prototype pollution fixminimatch@<3.1.3: ^3.1.3— ReDoS vulnerability (CVE-2022-3517)js-yaml@<=4.1.1: ^4.2.0— arbitrary code execution fixesbuild@>=0.17.0 <0.28.1: ^0.28.1— now conflicts with esbuild 0.27.7 being installed
Removing these overrides exposes the project to known vulnerabilities. Additionally, the esbuild override now conflicts with the version that plugin-react v6 installs.
Suggested fix: Run pnpm install to regenerate the lockfile with overrides properly applied. You may need to adjust the esbuild override range to accommodate both the security requirements and the plugin's needs.
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6 via Renovate. However, this update cannot be merged as-is due to a critical peer dependency incompatibility.
Verdict: Blocked - Requires either upgrading Vite to v8 or pinning the plugin to v5.x.
Research notes
I fetched the @vitejs/plugin-react CHANGELOG which documents the breaking changes in v6.0.0:
- Drop Vite 7 and below support: "Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8."
- Remove Babel-related features: Vite 8+ handles React Refresh Transform by Oxc. Babel is no longer a dependency of this plugin.
- New peer dependencies:
vite: ^8.0.0(was^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0)
The current project configuration shows:
vite: ^7.3.5indashboard/package.json(line 91)@vitejs/plugin-react: ^6.0.0(line 78 after this PR)
Suggested next steps
-
Option A (Recommended if ready to upgrade): Also update
viteto^8.0.0in the same PR. This will require testing the full build and dev server to ensure no regressions from the Vite major version upgrade. -
Option B (Safer, minimal change): Configure Renovate to pin
@vitejs/plugin-reactto^5.1.4(the latest v5.x) until the team is ready to upgrade to Vite 8. -
Verify overrides behavior: After resolving the peer dep issue, verify that the pnpm overrides for
rollupandesbuildare working as intended.
General findings
Overrides section removed from lock file
The overrides section was present in the old pnpm-lock.yaml but removed in this PR. The overrides are still defined in package.json (lines 103-113), but the lockfile resolution changed:
rollup: Was@rollup/wasm-node@4.62.0, nowrollup@4.62.0esbuild: Was0.28.1(forced by override), now0.27.7
This suggests the overrides may not be applying correctly after the plugin update. This should be investigated once the peer dependency issue is resolved.
To fix this PR: Either (a) add "vite": "^8.0.0" to the devDependencies and test thoroughly, or (b) ask Renovate to hold this update until Vite 8 is ready.
General findings (auto-demoted from inline due to pre-validation)
- Blocking
dashboard/package.json:91— Vite version incompatible with@vitejs/plugin-react@6.x.- (demoted: line 91 (side=RIGHT) is not part of any diff hunk in dashboard/package.json)
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Peer dependency incompatibility.
Why it matters: @vitejs/plugin-react@6.x requires vite ^8.0.0 as a peer dependency, but this project uses vite ^7.3.5 (line 91). According to the plugin changelog:
Drop Vite 7 and below support
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
This will cause npm/pnpm peer dependency warnings and may result in runtime or build failures.
Suggested fix: Either:
- Update
"vite": "^7.3.5"to"vite": "^8.0.0"on line 91 and test thoroughly, OR - Change this to
"@vitejs/plugin-react": "^5.1.4"to stay compatible with Vite 7
There was a problem hiding this comment.
Summary
This PR updates @vitejs/plugin-react from v5 to v6 via Renovate. However, there is a critical compatibility issue that blocks this update: @vitejs/plugin-react@6.x explicitly dropped support for Vite 7 and requires vite@^8.0.0, but the project currently uses vite@^7.3.5. Additionally, the pnpm overrides in the lock file appear inconsistent with package.json.
Verdict: BLOCKED - Cannot merge until vite is upgraded to v8 or the plugin version constraint is adjusted.
Research notes
From the npm registry data for @vitejs/plugin-react@6.0.3:
"peerDependencies": {
"@rolldown/plugin-babel": "^0.1.7 || ^0.2.0",
"babel-plugin-react-compiler": "^1.0.0",
"vite": "^8.0.0"
}From the CHANGELOG:
6.0.0 - Drop Vite 7 and below support:
Vite 7 and below are no longer supported. If you are using Vite 7, please upgrade to Vite 8.
6.0.0 - Remove Babel Related Features:
Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it... babel is no longer a dependency of this plugin and the related features are removed.
Suggested next steps
-
Blocking: Either upgrade
vitefrom^7.3.5to^8.0.0indashboard/package.json, OR pin@vitejs/plugin-reactto^5.2.0(latest v5) to maintain compatibility. -
Non-blocking: Investigate why the pnpm overrides section disappeared from the lock file. The
pnpm.overridesinpackage.jsonstill specifiesesbuild@>=0.17.0 <0.28.1: ^0.28.1, but the lock file resolved toesbuild@0.27.7. Runpnpm installto regenerate the lock file properly after resolving the vite/plugin-react version conflict. -
If upgrading to Vite 8, review the Vite 8 migration guide for breaking changes that may affect the dashboard build.
General findings
- The diff shows significant cleanup of Babel-related dependencies (
@babel/core,@babel/plugin-transform-react-jsx-*, etc.) which is expected for v6 since it no longer bundles Babel. - Rollup changed from
@rollup/wasm-nodeto the standardrolluppackage, which may affect build behavior on certain platforms. - The removal of security-related overrides (lodash, minimatch, js-yaml, etc.) from the lock file warrants verification that these packages aren't vulnerable in their new versions.
General findings (auto-demoted from inline due to pre-validation)
- Blocking
dashboard/package.json:91— Incompatible with updated plugin.- (demoted: line 91 (side=RIGHT) is not part of any diff hunk in dashboard/package.json)
- Non-blocking
dashboard/pnpm-lock.yaml:455— esbuild version doesn't match pnpm override.- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:455: diff has
'@esbuild/linux-s390x@0.27.7':, model claimedesbuild@0.27.7:)
- (demoted: code self-check failed at dashboard/pnpm-lock.yaml:455: diff has
| "@types/react": "^19.2.2", | ||
| "@types/react-dom": "^19.1.7", | ||
| "@vitejs/plugin-react": "^5.0.1", | ||
| "@vitejs/plugin-react": "^6.0.0", |
There was a problem hiding this comment.
Blocking: Peer dependency incompatibility.
Why it matters: @vitejs/plugin-react@6.0.0+ requires vite@^8.0.0 as a peer dependency, but line 91 specifies "vite": "^7.3.5". According to the official changelog, v6 explicitly "Drop[s] Vite 7 and below support." This will cause peer dependency warnings at minimum, and potential runtime failures if the plugin uses Vite 8-only APIs.
Suggested fix: Either:
- Upgrade vite: change line 91 to
"vite": "^8.0.0"(check Vite 8 migration guide for breaking changes) - Or pin the plugin: change this line to
"@vitejs/plugin-react": "^5.2.0"to stay on the latest v5 which supports Vite 7
| autoInstallPeers: true | ||
| excludeLinksFromLockfile: false | ||
|
|
||
| overrides: |
There was a problem hiding this comment.
Non-blocking: pnpm overrides section removed from lock file.
Why it matters: The previous lock file had an overrides section with security patches (lodash@^4.18.0, minimatch@^3.1.3, js-yaml@^4.2.0, etc.) that were pinned to address known vulnerabilities. While package.json still defines these in pnpm.overrides, their absence in the lock file suggests the lock file may not have been fully regenerated after the dependency update. Additionally, the esbuild override (esbuild@>=0.17.0 <0.28.1: ^0.28.1) appears ineffective since the lock file resolved esbuild@0.27.7.
Suggested fix: Run pnpm install in the dashboard/ directory after resolving the vite/plugin-react version conflict to ensure overrides are properly applied and the lock file is consistent.
This PR contains the following updates:
^5.0.1→^6.0.0Release Notes
vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.0.4Compare Source
Fixed
$RefreshSig$ is not definederror when runningvite devwithNODE_ENV=productionWhen running
vite devwithNODE_ENV=production, the app errored with$RefreshSig$ is not defined.This error is now fixed.
v6.0.3Compare Source
v6.0.2Compare Source
Allow all options in reactCompilerPreset (#1189)
This is a type only change. Only
compilationModeandtargetoptions were available forreactCompilerPreset.v6.0.1Compare Source
Expand
@rolldown/plugin-babelpeer dep range (#1146)Expanded
@rolldown/plugin-babelpeer dep range to include^0.2.0.v6.0.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.