Bump @vitejs/plugin-react from 4.7.0 to 6.0.5 by dependabot[bot] · Pull Request #3466 · Runfusion/Fusion

dependabot · 2026-08-16T02:14:07Z

Bumps @vitejs/plugin-react from 4.7.0 to 6.0.5.

Release notes

Sourced from @vitejs/plugin-react's releases.

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

plugin-react@6.0.3

No release notes provided.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

... (truncated)

Changelog

Sourced from @vitejs/plugin-react's changelog.

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

6.0.3 (2026-06-23)

Improve the react compiler preset filter to reduce false-positives (#1138)

Improved the filter in the react compiler babel preset to reduce the false-positives so that less modules are processed by the react compiler.

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



</tr></table>

... (truncated)

Commits

68c0cb8 release: plugin-react@6.0.5 (#1362)
555cdbc fix(react): make the react compiler preset filter linear (#1353)
a00a9f8 fix(deps): update all non-major dependencies (#1327)
f4b5498 release: plugin-react@6.0.4
7a40659 fix(react): $RefreshSig$ is not defined with NODE_ENV=production vite dev ...
98b32d4 fix(deps): update react 19.2.8 (#1298)
8ae5449 fix: babel-plugin-react-compiler cannot be imported when used in a framework ...
f09ea01 fix(deps): update all non-major dependencies (#1282)
640fd35 release: plugin-react@6.0.3
889efb0 fix(deps): update all non-major dependencies (#1249)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @vitejs/plugin-react since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

greptile-apps · 2026-08-16T02:14:11Z

PR author is in the excluded authors list.

Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 4.7.0 to 6.0.5. - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react) --- updated-dependencies: - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.5 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-30T02:33:16Z

A newer version of @vitejs/plugin-react exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

plugin-react 6 requires vite ^8 because it imports vite/internal, which vite 6 does not export. 5.2.0 is the newest 5.x line compatible with this repo's vite ^6; a vite 8 major is out of scope for this bump.

gsxdsm · 2026-09-04T04:54:13Z

Capped @vitejs/plugin-react at 5.2.0 instead of 6.0.5.

plugin-react 6.x requires vite ^8 (it imports vite/internal, which Vite 6 does not export). This repo is on vite ^6 (dashboard and desktop). A Vite 8 major is out of scope for this Dependabot bump. 5.2.0 is the newest 5.x line that still supports Vite 6.

CI Build/Gate/Desktop should now get past the previous ERR_PACKAGE_PATH_NOT_EXPORTED config load failure.

github-actions · 2026-09-04T04:54:15Z

ThreatCrush Security Scan

4589 finding(s)

HIGH/CRITICAL: 43 | MEDIUM: 4057 | LOW: 489

Severity	Rule	Location
HIGH	`secret-database-url`	`.github/workflows/full-suite.yml`:55
HIGH	`secret-generic-credential`	`.github/workflows/full-suite.yml`:56
HIGH	`secret-database-url`	`.github/workflows/full-suite.yml`:241
HIGH	`secret-generic-credential`	`.github/workflows/full-suite.yml`:242
HIGH	`secret-database-url`	`.github/workflows/full-suite.yml`:281
HIGH	`secret-generic-credential`	`.github/workflows/full-suite.yml`:282
HIGH	`secret-database-url`	`.github/workflows/pr-checks.yml`:214
HIGH	`secret-generic-credential`	`.github/workflows/pr-checks.yml`:215
HIGH	`secret-generic-credential`	`.github/workflows/release.yml`:522
HIGH	`secret-generic-credential`	`.github/workflows/release.yml`:524
HIGH	`secret-generic-credential`	`.github/workflows/test-release.yml`:445
HIGH	`secret-generic-credential`	`.github/workflows/test-release.yml`:447
HIGH	`secret-generic-credential`	`docs/cli-reference.md`:80
HIGH	`secret-generic-credential`	`docs/signals-connectors.md`:34
HIGH	`secret-generic-credential`	`docs/signals-connectors.md`:77
HIGH	`secret-generic-credential`	`docs/signals-connectors.md`:94
HIGH	`secret-generic-credential`	`docs/signals-connectors.md`:117
HIGH	`secret-generic-credential`	`docs/signals-connectors.md`:159
HIGH	`secret-generic-credential`	`packages/cli/STANDALONE.md`:71
HIGH	`secret-database-url`	`packages/core/src/postgres/credential-redact.ts`:12
HIGH	`secret-database-url`	`packages/core/src/postgres/credential-redact.ts`:30
HIGH	`secret-database-url`	`packages/core/src/postgres/credential-redact.ts`:31
HIGH	`secret-database-url`	`packages/core/src/postgres/credential-redact.ts`:102
HIGH	`secret-database-url`	`packages/core/src/postgres/credential-redact.ts`:103
HIGH	`secret-generic-credential`	`packages/core/src/postgres/embedded-lifecycle.ts`:843
HIGH	`secret-database-url`	`packages/core/src/postgres/embedded-lifecycle.ts`:1574
HIGH	`secret-database-url`	`packages/core/src/postgres/pg-backup.ts`:715
HIGH	`js-ssrf-outbound-request`	`packages/dashboard/app/public/sw.js`:651
HIGH	`js-ssrf-outbound-request`	`packages/dashboard/app/public/sw.js`:727
HIGH	`js-host-header-trust`	`packages/dashboard/src/cli-session-ws.ts`:81
HIGH	`js-host-header-trust`	`packages/dashboard/src/cli-session-ws.ts`:115
HIGH	`js-ssrf-outbound-request`	`packages/dashboard/src/routes.ts`:1861
HIGH	`js-host-header-trust`	`packages/dashboard/src/server.ts`:2684
HIGH	`js-host-header-trust`	`packages/dashboard/src/server.ts`:2709
HIGH	`js-host-header-trust`	`packages/dashboard/src/server.ts`:3020
HIGH	`js-host-header-trust`	`packages/dashboard/src/server.ts`:3188
HIGH	`secret-slack-webhook`	`plugins/examples/fusion-plugin-notification/README.md`:46
HIGH	`secret-database-url`	`scripts/pg-test-server.mjs`:200
HIGH	`secret-database-url`	`scripts/pg-test-server.mjs`:231
HIGH	`secret-database-url`	`scripts/pg-test-server.mjs`:241
HIGH	`secret-generic-credential`	`scripts/sync-fusion-skill-tools.mjs`:550
HIGH	`secret-generic-credential`	`scripts/verify-windows-elevated-restricted.mjs`:81
HIGH	`secret-generic-credential`	`scripts/verify-windows-encoding-recovery.mjs`:41
MEDIUM	`redos-nested-quantifier`	`docs/agents.md`:1710
MEDIUM	`insecure-temp-file`	`packages/cli/src/__tests__/bin.test.ts`:141
MEDIUM	`insecure-temp-file`	`packages/cli/src/__tests__/dev-with-memory-lib.test.ts`:33
MEDIUM	`insecure-temp-file`	`packages/cli/src/__tests__/dev-with-memory-lib.test.ts`:34
MEDIUM	`insecure-temp-file`	`packages/cli/src/__tests__/dev-with-memory-lib.test.ts`:35
MEDIUM	`insecure-temp-file`	`packages/cli/src/__tests__/dev-with-memory-lib.test.ts`:43
MEDIUM	`insecure-temp-file`	`packages/cli/src/__tests__/dev-with-memory-lib.test.ts`:46

…and 4539 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 16, 2026

gsxdsm force-pushed the dependabot/npm_and_yarn/vitejs/plugin-react-6.0.5 branch from 8b9fc93 to f40ece1 Compare August 23, 2026 22:57

gsxdsm added 2 commits August 23, 2026 19:15

Merge remote-tracking branch 'origin/main' into pr-3466

a9bc167

Merge remote-tracking branch 'origin/main' into pr-3466

0c02268

chore(deps): cap @vitejs/plugin-react at 5.2.0

ac988b1

plugin-react 6 requires vite ^8 because it imports vite/internal, which vite 6 does not export. 5.2.0 is the newest 5.x line compatible with this repo's vite ^6; a vite 8 major is out of scope for this bump.

Navigation Menu

Uh oh!

Bump @vitejs/plugin-react from 4.7.0 to 6.0.5 - #3466

Bump @vitejs/plugin-react from 4.7.0 to 6.0.5#3466
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/npm_and_yarn/vitejs/plugin-react-6.0.5

dependabot Bot commented on behalf of github Aug 16, 2026

Uh oh!

greptile-apps Bot commented Aug 16, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 30, 2026

Uh oh!

gsxdsm commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 16, 2026

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

plugin-react@6.0.3

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

plugin-react@6.0.0

Remove Babel Related Features (#1123)

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

6.0.3 (2026-06-23)

Improve the react compiler preset filter to reduce false-positives (#1138)

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Uh oh!

greptile-apps Bot commented Aug 16, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 30, 2026

Uh oh!

gsxdsm commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

ThreatCrush Security Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Fixed `$RefreshSig$ is not defined` error when running `vite dev` with `NODE_ENV=production`

Expand `@rolldown/plugin-babel` peer dep range (#1146)

Fixed `$RefreshSig$ is not defined` error when running `vite dev` with `NODE_ENV=production`

Expand `@rolldown/plugin-babel` peer dep range (#1146)