npm / vite
vite
What changed in vite 7 to 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
vite 843 changes
Breaking changes 1
Input option unescaping is removed for now.
Security 6
The server checks fs.serve for requests using this query, ensuring the serving restriction is applied.
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
vite:
server.fs.denybypass on Windows alternate pathsVite:
server.fs.denybypassed with queriesVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Vite Vulnerable to Path Traversal in Optimized Deps
.mapHandling
New APIs and options 1
Bundled dev supports import.meta.hot.acceptExports.
Performance 2
Avoids settling seen preload dependencies to improve build performance.
Pre-compiles context matchers at server creation to improve proxy performance.
Fixes and other changes 33
Skips rewriting adopted styles that have not changed.
Corrects preloads when chunkImportMap is enabled with a non-root base.
Skips caching CSS of chunks in a cycle.
The optimizer scans deep imports with custom extensions.
Normalizes the file before the root check in ensureWatchedFile.
HTML handling no longer adds the filesystem root to the watcher.
Vite no longer mutates HMR defaults.
Modules ending with a js-like query are no longer treated as JavaScript.
Resolves imported preprocessors from their file path when using lightningcss.
Waits for in-flight stylesheets in the preload helper.
A restart requested during another restart is no longer dropped.
Static aliases are matched on path boundaries.
Bundled dev serves /@vite/client.
Bundled dev stubs @vite/env.
The filename passed to transformIndexHtml no longer includes queries, so plugins receive the expected filename.
Browser:false mappings no longer produce unsupported warnings during dependency optimization.
The minify option is now merged correctly.
CSS is preloaded correctly when renderBuiltUrl returns URLs with queries.
The server handles file watcher errors without crashing.
Object and array printing is limited in size when using forwardConsole.
Bundled dev now serves sourcemaps for lazy chunks.
Whitespace is encoded in the SSR module runner sourceURL.
Excluded optional peer require fallbacks are now preserved by the optimizer.
Queries are now passed to renderBuiltUrl, allowing URL handling to account for query strings.
Bundled dev serves the rolldown runtime from the installed rolldown.
Percent-encoded srcset URLs are now resolved correctly.
Worker URLs are aligned between client and server when using terser.
The build configuration now merges build.rolldownOptions.output.comments correctly.
The optimizer no longer skips imports whose binding starts with type.
mergeConfig now handles server.ws: false correctly.
Source-map generation now skips URL source roots when injecting sources content.
Handles CRLF line endings when calculating code frame positions.
Treats only whole node_modules path segments as dependencies.
vite 71 changes
Security 1
vite allows server.fs.deny bypass via backslash on Windows