chore(deps): bump the framework-stack group across 1 directory with 2 updates

[dependabot]

Bumps the framework-stack group with 2 updates in the / directory: vite and astro.

Updates vite from 8.1.0 to 8.1.2

Release notes

Sourced from vite's releases.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.2 (2026-06-30)

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

8.1.1 (2026-06-30)

Features

• update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#22775) (ef0b891)
• deps: update all non-major dependencies (#22734) (e635f49)
• deps: update all non-major dependencies (#22804) (8837400)
• deps: update rolldown-related dependencies (#22591) (2ce6677)
• escape ids with multiple null bytes (#22687) (833fc30)
• hide console window when running 'net use' on Windows (#22698) (92b63f2)
• ignore bundled config temp dir (#22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)
• optimizer: scanner should resolve input from root (#22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

Tests

• enable "manual chunk path" test and remove "worker.format error" test (#22824) (c088511)

Commits

• ba31193 release: v8.1.2
• 0d3bd7c fix(deps): revert es-module-lexer to 2.1.0 (#22827)
• efb98cc fix: restore, "fix: resolve pnpm .modules.yaml from workspace root instead of...
• cf97711 fix: revert, "fix: resolve pnpm .modules.yaml from workspace root instead of ...
• cccef55 fix: revert, "fix: escape ids with multiple null bytes (#22687)"
• 4ae9e14 release: v8.1.1
• 8f925e2 fix(bundledDev): skip plugin transform hooks for rolldown-lazy stub modules (...
• c088511 test: enable "manual chunk path" test and remove "worker.format error" test (...
• 62bd7af feat: update dynamic import warning to link to Vite docs (#22823)
• 2dafd3b refactor(css): remove lightningcss null byte bug workaround (#22822)
• Additional commits viewable in compare view

Updates astro from 7.0.3 to 7.0.4

Release notes

Sourced from astro's releases.

astro@7.0.4

Patch Changes

• #17212 7ba0bb1 Thanks @​matthewp! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands

• #17224 dc5e52f Thanks @​astrobot-houston! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., src/pages/api/[name].json.ts) with trailingSlash: "always" incorrectly required a trailing slash in dev mode, returning 404 for /api/bar.json and 200 for /api/bar.json/.

• #17067 23f9446 Thanks @​fkatsuhiro! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.

• #17234 d5fbee8 Thanks @​ocavue! - Adds support for sharp v0.35. pnpm users no longer need to approve sharp's build script (see allowBuilds) when on v0.35.

• #17223 5970ef4 Thanks @​astrobot-houston! - Fixes getCollection() returning empty in dev mode for large content collections (500k+ entries)

• #17184 799e5cd Thanks @​Princesseuh! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.

• #17208 da8b573 Thanks @​matthewp! - Hardens forwarded header handling so the internal request helper validates X-Forwarded-Host against security.allowedDomains before trusting X-Forwarded-For for clientAddress. Previously it only checked that the header was present, which was inconsistent with the public createRequest helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.

Changelog

Sourced from astro's changelog.

7.0.4

Patch Changes

• #17212 7ba0bb1 Thanks @​matthewp! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands

• #17224 dc5e52f Thanks @​astrobot-houston! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., src/pages/api/[name].json.ts) with trailingSlash: "always" incorrectly required a trailing slash in dev mode, returning 404 for /api/bar.json and 200 for /api/bar.json/.

• #17067 23f9446 Thanks @​fkatsuhiro! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.

• #17234 d5fbee8 Thanks @​ocavue! - Adds support for sharp v0.35. pnpm users no longer need to approve sharp's build script (see allowBuilds) when on v0.35.

• #17223 5970ef4 Thanks @​astrobot-houston! - Fixes getCollection() returning empty in dev mode for large content collections (500k+ entries)

• #17184 799e5cd Thanks @​Princesseuh! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.

• #17208 da8b573 Thanks @​matthewp! - Hardens forwarded header handling so the internal request helper validates X-Forwarded-Host against security.allowedDomains before trusting X-Forwarded-For for clientAddress. Previously it only checked that the header was present, which was inconsistent with the public createRequest helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.

Commits

• 5978993 [ci] release (#17213)
• b1c9d41 chore(seo): remove redundant twitter metadata tags (#17179)
• 799e5cd chore: bump compiler to latest (#17184)
• 734739d [ci] format
• d5fbee8 chore(deps): update sharp to v0.35 (#17234)
• 23f9446 FIx: inverted logic in a11y-no-redundant-roles rule (#17067)
• 2bfb179 chore: simpler package.json types (#17229)
• 7ba0bb1 Harden transition directive attribute rendering (#17212)
• 2f39a99 Document route cache invalidation behavior (#17215)
• efd16e9 Stabilize client prerender prefetch E2E test (#17219)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Greptile Summary

This PR updates the framework dependency stack for Astro and Vite. The main changes are:

• Astro manifests now target 7.0.4 across examples, package fixtures, and integration tests.
• Vite manifests now target 8.1.2 across the root package, Vite package, and Vite integration test fixture.
• pnpm-lock.yaml refreshes the resolved dependency graph for these patch updates.

Confidence Score: 5/5

The dependency patch updates appear merge-safe based on the manifest-only version bumps and lockfile refresh.

The changes are limited to Astro and Vite patch updates propagated through package manifests and the lockfile, with no application logic changes identified.

T-Rex Logs

What T-Rex did

• Compared the Vite bump proof to verify base and head results, confirming base resolves Vite 8.1.0 and head resolves Vite 8.1.2, and that the Vite workflow passes in both cases.
• Compared the Astro bump proof to verify base and head results, confirming base resolves Astro 7.0.3 and head resolves Astro 7.0.4, with the same internal workspace module errors in the workflow; because the dependency-resolution contract holds on head and the failure reproduces on base, no contract-mismatch finding was filed.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "chore(deps): bump the framework-stack gr..." | Re-trigger Greptile}

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml