chore(deps): migrate Astro 6 -> 7 + Vite 8 (closes #301 #302) - #1342
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Closes Dependabot alerts: #290, #291, #292, #293, #295, #296, #297, #298, #299, #300, #301, #302, #303, #304, #305, #311, #312, #313, #314, #315, #316, #317, #318, #319, #320, #321, #323. Consolidates the work that was previously split across #1341 and #1342: both PRs re-introduced the brace-expansion/minimatch@10 and @xmldom/xmldom regressions that were fixed in #1337. This PR adds the fix on top of origin/main, with a per-major brace-expansion override covering 1.x/2.x/3.x/4.x AND a 5.x line force to >= 5.0.8 (closes #323 fully; the ESM/CJS interop issue with 5.0.8 that previously broke Astro 6 + Vite 7 is now resolved under Astro 7 + Vite 8). pnpm-workspace.yaml (catalog): - vite: ^6.4.2 -> ^8.1.0 - @tailwindcss/vite: ^4.1.11 -> ^4.3.3 packages/website: - astro: ^6.4.6 -> ^7.0.6 (closes #290, #291, #292, #293, #301, #302) - @astrojs/react: ^5.0.5 -> ^6.0.1 - @astrojs/starlight: ^0.39.2 -> ^0.41.5 - @astrojs/vercel: ^10.0.7 -> ^11.0.3 - vite-plugin-inspect dep + import + astro.config wiring removed. All published versions (latest 12.0.2 included, broader peers '^6/^7/^8' covered by 11.4.1) crash the new vite@8 environment model in InspectContextVite.getEnvContext ([postcss] Can not found environment context for client). The plugin was a dev-only debug overlay running in dev + prod build; the live site is unaffected. packages/spotlight: - @vitejs/plugin-react: ^4.3.2 -> ^6.0.0 (peer vite ^8) - vite-plugin-svgr: ^3.3.0 -> ^5.2.0 (peer vite >= 3; v5 requires configuring exportType: 'named' + namedExport: 'ReactComponent' for the spotlight UI's import { ReactComponent as X } pattern to keep compiling without touching 27 UI source files) - version: 4.11.8 -> 4.11.9 (skip ahead of released 4.11.8 so craft publishes a fresh patch tag, no collision with the existing 4.11.8 release). packages/spotlight/src/svg.d.ts (new): - ambient declaration so TypeScript still accepts the named ReactComponent import shape the spotlight UI uses everywhere. packages/spotlight/vite.config.base.ts: - configure vite-plugin-svgr with include: ['**/*.svg', '**/*.svg?react'], svgrOptions: { titleProp: true, exportType: 'named', namedExport: 'ReactComponent' } so the existing import shape works without touching UI code. Root package.json overrides: - vite: replaced the two 'vite@>=6' and 'vite@>=7' rules with 'vite': '>=8.1.0 <9' - brace-expansion: added a 5.x line force 'brace-expansion@>=5.0.0': '>=5.0.8' alongside the per-major 1.x/2.x/3.x/4.x lines already on main; closes #323 without breaking the astro config path. - @hono/node-server: '>=2.0.5 <3' belt override on top of the direct-dep bump; forces the SDK's transitive ^1.19.14 up. - sharp: '>=0.35.0 <0.36' belt override (closes #312; bounds the ceiling so a 0.36+ breaking change can't silently float in). - svgo: '>=4.0.2 <5' added. - builder-util-runtime: '>=9.7.0 <10' added (closes #318; bounds). - app-builder-lib: '>=26.15.0 <27' added (closes #317; bounds). - floor raises (alerts #295-#300, #303, #311, #313, #320, #321): tar >=7.5.21, js-yaml >=4.3.0, body-parser >=2.3.0, fast-uri >=3.1.4, postcss >=8.5.18, shell-quote >=1.9.0. Verification (Linux dev box, the only env available locally): - pnpm install: no NEW peer warnings vs main. Pre-existing: - @napi-rs/wasm-runtime wants @emnapi/core@^2 (rolldown binding) - app-builder-lib wants electron-builder-squirrel-windows@26.x (pre-existing from PR #1335 electron-builder 26 migration). - pnpm --filter @spotlightjs/website build: 29 pages in 8.92s, Pagefind + @astrojs/sitemap + @astrojs/vercel adapter succeed. - pnpm --filter @spotlightjs/spotlight build: vite renderer + main bundles on vite@8.1.5 + rolldown, both succeed. - pnpm --filter @spotlightjs/spotlight test: 215 / 215 pass. - pnpm lint: pre-existing 2 errors in files not touched here (src/shared/version.ts formatter, server/main.ts import-sort); an editor-only fixup in packages/spotlight/package.json makes my branch no worse than main. - Empirical mac-path crash reproductions, in /tmp/opencode/syn.cjs: 1) new minimatch.Minimatch('foo/{a,b}/x.png').braceExpand() with minimatch@10.2.5 + brace-expansion@5.0.8 -> OK (was failing before per-major overrides) 2) plist.parse('<plist/>') via @xmldom/xmldom@0.8.13 -> OK (was crashing DOMParser mimeType before <0.9 ceiling) 3) DOMParser.parseFromString('<plist/>') without mimeType arg -> OK (regression test for #1337's @xmldom fix) Reviewer notes: - macOS build path (build:mac) is not exercisable from a Linux box; CI mac job is the source of truth. The per-major brace-expansion and @xmldom/xmldom <0.9 ceiling directly mirror main's pinned ranges, so macOS behavior should match main. - vite-plugin-inspect removal drops the dev-only __inspect__ UI route from the website. Tracked independently for upstream vite-8 compat. - Spotlight 4.11.9 will be a patch release superseding 4.11.8 with these transitive security deps; 4.11.8 stays published.
BYK
force-pushed
the
fix/astro-7-vite-8-migration
branch
from
July 28, 2026 12:55
021ac8e to
97bc10d
Compare
Contributor
Codecov Results 📊✅ Patch coverage is 100.00%. Project has 678 uncovered lines. Coverage diff@@ Coverage Diff @@
## main #PR +/-##
==========================================
- Coverage 60.07% 60.00% -0.07%
==========================================
Files 53 53 —
Lines 1689 1681 -8
Branches 1220 1220 —
==========================================
+ Hits 1011 1003 -8
- Misses 678 678 —
- Partials 124 124 —Generated by Codecov Action |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Astro 6.x is vulnerable (Dependabot #301 #302). Astro 7 hard-pins
vite@^8.0.13, which cascades into the rest of the website plugin chain and into the spotlight's own vite plugins. This PR is the focused, single-purpose migration that makes those bumps land cleanly.Changes
Catalog (
pnpm-workspace.yaml)vite: ^6.4.2 -> ^8.1.0(the central pin)@tailwindcss/vite: ^4.1.11 -> ^4.3.3(the 4.3.x line is the first to declarevite ^5 || ^6 || ^7 || ^8as a peer)Website (
packages/website)astro^6.4.6^7.0.6@astrojs/react^5.0.5^6.0.1@astrojs/starlight^0.39.2^0.41.5@astrojs/vercel^10.0.7^11.0.3vite-plugin-inspectis removed entirely (dep + import +vite.pluginsentry inastro.config.mjs). Reason: every published version ofvite-plugin-inspectis incompatible with vite@8. ThegetEnvContextcall insideInspectContextViteresolves against an internal vite API that was removed/changed in vite@8's new environment model. Both12.0.2(latest) and11.4.1(latest 11.x, the broadest vite peer^6/^7/^8) hit the same[postcss] Can not found environment context for clienterror during the website build. The plugin was a dev-only debug overlay running in dev and prod build; the live site is unaffected. A vite-8-compatible release is the upstream fix.Spotlight (
packages/spotlight)@vitejs/plugin-react^4.3.2^6.0.0vite-plugin-svgr^3.3.0^5.2.0vite-plugin-svgr@5dropped the legacy named-export shape that the spotlight UI relies on across ~28 files. To keep the existingimport { ReactComponent as X } from "@spotlight/ui/assets/foo.svg"import style working — without touching any UI source file — I configured the plugin:and added an ambient
packages/spotlight/src/svg.d.tsso TypeScript accepts the named export from*.svg. Zero edits to spotlight UI source.Root overrides (
package.json)Replaced two narrow vite rules:
with:
because the old rules kept deduping to vite@7.3.5 in the website importer graph (vite was never a direct dep there, so pnpm picked the lowest valid peer). The single rule forces vite@8 globally.
Verification
pnpm install— only pre-existing peer warnings remain:@napi-rs/wasm-runtimewants@emnapi/core@^2(rolldown native binding; pre-existing)app-builder-lib@26.15.7wantselectron-builder-squirrel-windows@26.15.7(pre-existing; known from PR chore(deps): upgrade electron-builder 24 -> 26.15.7 #1335 electron-builder 26 migration)pnpm --filter @spotlightjs/website build— 29 pages built in 7.36s; Pagefind index +@astrojs/verceladapter succeed; sitemap generated.pnpm --filter @spotlightjs/spotlight build— vite renderer (1542 modules) + vite main both built clean againstvite@8.1.5 + rolldown.pnpm --filter @spotlightjs/spotlight test— 215/215 tests pass.pnpm lint— 2 errors, both pre-existing (packages/spotlight/src/sentry-config.ts,packages/spotlight/src/server/cli/server.ts); no new errors.Out of scope
react-router-dom@8.3.0, which has not been published. Locked to a separate PR once the-dompackage ships.Notes
packages/website/content.config.tsis excluded (untracked legacy file; the canonical tracked config is atpackages/website/src/content.config.ts)..opencode/excluded per convention.