Skip to content

chore: Update front end to vite 8 and related upgrades#11766

Merged
thomasheartman merged 12 commits into
mainfrom
chore/vite8
May 4, 2026
Merged

chore: Update front end to vite 8 and related upgrades#11766
thomasheartman merged 12 commits into
mainfrom
chore/vite8

Conversation

@chriswk

@chriswk chriswk commented Apr 9, 2026

Copy link
Copy Markdown
Member

(AI-generated summary; checked by @thomasheartman):

Brings the frontend onto the current Vite generation. The bulk of the diff is sweep-mechanical (svgr import format, snapshot prefix updates) but two upgrades introduced behaviour changes that needed code-level adjustments.

Headline upgrades

  • vite 5 → 8 (Rolldown-based)
  • vitest 3 → 4
  • @vitejs/plugin-react 4 → 6
  • vite-plugin-svgr 3 → 5
  • cypress 14 → 15, cypress-vite → 1.8.0 (patched, see below)
  • New: @rolldown/plugin-babel, @emotion/babel-plugin, @babel/core
  • Drops vite-tsconfig-paths in favour of Vite 8's built-in resolve.tsconfigPaths

Code changes that were not just mechanical

  • MUI icons workaround. Vite 8 enforces Node-style CJS interop for ESM importers (the documented "Consistent CommonJS Interop" change). @mui/icons-material 5.x has no exports field and would otherwise return the raw module.exports object instead of the icon component. A small resolveId plugin in vite.config.mts redirects deep imports to the package's published esm/ build. Drop when MUI icons is upgraded to v6+.
  • CJS default-imports converted to named imports for the same Vite 8 reason: millify (2 sites) and react-activity-calendar (1 site).
  • @emotion/babel-plugin moved from being passed inline to react() (no longer supported by @vitejs/plugin-react 6) into a dedicated @rolldown/plugin-babel plugin in dev mode.
  • SVG imports: import { ReactComponent as X }import X from '...?react' across ~50 files, matching the new vite-plugin-svgr default. Also fixed a longstanding typo (CelebatoryCelebratory).
  • tsconfig.json: added "node" to compilerOptions.types. Vitest 3 had been transitively pulling Node ambient types into scope; Vitest 4 stopped, leaving process, global, NodeJS.Timeout undeclared. Explicit opt-in is the right thing anyway.

Snapshot churn

All *.snap updates are emotion's cache-key prefix changing from css-mui-, with hashes unchanged. The app already uses createCache({ key: 'mui' }) in ThemeProvider; under Vite 5 / Vitest 3, @emotion/react was loading as two module instances in the test env, so the CacheProvider was silently bypassed and tests fell back to emotion's default css- cache. Vite 8 deduplicates the dep graph differently, so tests now match what the browser actually renders. Net: snapshots are now consistent with prod, not regressed.

cypress-vite patch

Cypress can't compile any spec under Vite 8 because cypress-vite 1.8.0 hardcodes output.manualChunks = false for its UMD spec build, which Rolldown rejects when codeSplitting: false is implied. The patch (frontend/.yarn/patches/cypress-vite-npm-1.8.0-5384b5466c.patch) just deletes that override — same fix as upstream PR mammadataei/cypress-vite#137 (open since 2025-10-28, no maintainer activity). Reported as issue #140. Drop the patch when cypress-vite ships a Rolldown-compatible release.

pnpm migration note

The patch content is portable, but its wiring is yarn-specific. When the in-flight pnpm migration lands:

  1. Copy .yarn/patches/cypress-vite-npm-1.8.0-5384b5466c.patch to patches/cypress-vite@1.8.0.patch.
  2. Remove the "cypress-vite": "patch:..." resolution from package.json.
  3. Add a pnpm.patchedDependencies block:
    "pnpm": {
      "patchedDependencies": {
        "cypress-vite@1.8.0": "patches/cypress-vite@1.8.0.patch"
      }
    }
  4. Run pnpm install so it hashes and applies the patch.

pnpm 9+ applies patches natively; older versions need patch-package as a postinstall step.


Original PR description:

I've fixed the svgr plugin changing how it did its exports. I've not been able to reproduce our babel config of emotion. Anyone wants to give it a go?

@github-actions

github-actions Bot commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.
See the Details below.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@babel/core ^7.29.0 UnknownUnknown
npm/@emotion/babel-plugin ^11.13.5 UnknownUnknown
npm/@types/babel__core ^7 UnknownUnknown
npm/cypress-vite patch:cypress-vite@npm%3A1.8.0#~/.yarn/patches/cypress-vite-npm-1.8.0-5384b5466c.patch UnknownUnknown
npm/@babel/parser 7.29.2 🟢 7
Details
CheckScoreReason
Code-Review🟢 8Found 24/30 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@emnapi/core 1.10.0 🟢 3.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1024 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/core 1.9.2 🟢 3.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1024 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/runtime 1.10.0 🟢 3.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1024 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/runtime 1.9.2 🟢 3.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1024 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/wasi-threads 1.2.1 🟢 3.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1024 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@napi-rs/wasm-runtime 1.1.3 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 3Found 7/20 approved changesets -- score normalized to 3
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
npm/@napi-rs/wasm-runtime 1.1.4 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 3Found 7/20 approved changesets -- score normalized to 3
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
npm/@oxc-project/types 0.124.0 UnknownUnknown
npm/@oxc-project/types 0.127.0 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-wasm32-wasi 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-wasm32-wasi 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/plugin-babel 0.2.2 UnknownUnknown
npm/@rolldown/pluginutils 1.0.0-rc.15 UnknownUnknown
npm/@rolldown/pluginutils 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/pluginutils 1.0.0-rc.7 UnknownUnknown
npm/@standard-schema/spec 1.1.0 UnknownUnknown
npm/@tybys/wasm-util 0.10.1 UnknownUnknown
npm/@types/tmp 0.2.6 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 25/29 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@vitejs/plugin-react 6.0.1 🟢 7.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 3Found 6/20 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 7detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
npm/@vitest/expect 4.1.2 UnknownUnknown
npm/@vitest/mocker 4.1.2 UnknownUnknown
npm/@vitest/pretty-format 4.1.2 UnknownUnknown
npm/@vitest/runner 4.1.2 UnknownUnknown
npm/@vitest/snapshot 4.1.2 UnknownUnknown
npm/@vitest/spy 4.1.2 UnknownUnknown
npm/@vitest/utils 4.1.2 UnknownUnknown
npm/chai 6.2.2 🟢 5.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 5Found 3/6 approved changesets -- score normalized to 5
Maintained🟢 1023 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/cypress 15.13.1 🟢 4.8
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool detected
npm/es-module-lexer 2.0.0 ⚠️ 2.9
Details
CheckScoreReason
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 9binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/lightningcss 1.32.0 UnknownUnknown
npm/lightningcss-android-arm64 1.32.0 UnknownUnknown
npm/lightningcss-darwin-arm64 1.32.0 UnknownUnknown
npm/lightningcss-darwin-x64 1.32.0 UnknownUnknown
npm/lightningcss-freebsd-x64 1.32.0 UnknownUnknown
npm/lightningcss-linux-arm-gnueabihf 1.32.0 UnknownUnknown
npm/lightningcss-linux-arm64-gnu 1.32.0 UnknownUnknown
npm/lightningcss-linux-arm64-musl 1.32.0 UnknownUnknown
npm/lightningcss-linux-x64-gnu 1.32.0 UnknownUnknown
npm/lightningcss-linux-x64-musl 1.32.0 UnknownUnknown
npm/lightningcss-win32-arm64-msvc 1.32.0 UnknownUnknown
npm/lightningcss-win32-x64-msvc 1.32.0 UnknownUnknown
npm/obug 2.1.1 UnknownUnknown
npm/postcss 8.5.12 🟢 6
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7
npm/rolldown 1.0.0-rc.15 UnknownUnknown
npm/rolldown 1.0.0-rc.17 UnknownUnknown
npm/std-env 4.0.0 UnknownUnknown
npm/systeminformation 5.31.5 🟢 4.8
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1018 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 4security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
SAST🟢 10SAST tool detected: CodeQL
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
npm/tinyexec 1.1.1 UnknownUnknown
npm/tinyglobby 0.2.16 UnknownUnknown
npm/tinyrainbow 3.1.0 UnknownUnknown
npm/vite 8.0.8 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 20/26 approved changesets -- score normalized to 7
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 5detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
npm/vite 8.0.10 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 20/26 approved changesets -- score normalized to 7
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 5detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
npm/vite-plugin-svgr 5.2.0 🟢 3.9
Details
CheckScoreReason
Maintained🟢 1014 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 1Found 5/30 approved changesets -- score normalized to 1
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/vitest 4.1.2 UnknownUnknown

Scanned Files

  • frontend/package.json
  • frontend/yarn.lock

@gastonfournier gastonfournier moved this from New to In Progress in Issues and PRs Apr 10, 2026
cypress-vite 1.8.0 hardcodes `output.manualChunks = false` in its
UMD spec build config. Vite 8's Rolldown bundler rejects any
`manualChunks` value when `codeSplitting: false` is implied (which
it is for `lib`/`umd` builds), so Cypress fails to compile any spec
under our Vite 8 upgrade.

The patch deletes the hardcoded override, matching the fix proposed
upstream in mammadataei/cypress-vite#137 (open since 2025-10-28, no
maintainer response). See also mammadataei/cypress-vite#140 for the
report of the same incompatibility.

Drop this patch once cypress-vite ships a Rolldown-compatible
release.

Note for the pnpm migration:
The patch file content is portable, but the wiring is yarn-specific.
When the migration lands:

1. Copy `.yarn/patches/cypress-vite-npm-1.8.0-5384b5466c.patch`
   to `patches/cypress-vite@1.8.0.patch`.
2. Remove the `"cypress-vite": "patch:..."` resolution from
   `package.json`.
3. Add a `pnpm.patchedDependencies` block:

       "pnpm": {
         "patchedDependencies": {
           "cypress-vite@1.8.0": "patches/cypress-vite@1.8.0.patch"
         }
       }

4. Run `pnpm install` so pnpm hashes and applies the patch.

pnpm 9+ applies patches natively; older versions need `patch-package`
as a postinstall step.
Two unrelated bits of fallout from the upgrade caused `yarn ts:check`
to fail in CI:

1. Vitest 3 had been transitively pulling `@types/node` into the
   ambient global scope, which `tsconfig.json`'s `types: ["cypress"]`
   would otherwise have excluded. Vitest 4 stopped doing this, leaving
   `process`, `global`, and `NodeJS.Timeout` undeclared in src and
   test files alike. Add `"node"` to `compilerOptions.types` to opt
   in explicitly.

2. The Vite 8 / vite-plugin-svgr 5 migration sweep changed
   `import { ReactComponent as X } from 'foo.svg'` to
   `import X from 'foo.svg?react'` across the codebase, but missed
   three files. Convert them to match.

Runtime behaviour unchanged - both were checker-only issues.
@gastonfournier gastonfournier marked this pull request as ready for review May 4, 2026 07:52
Copilot AI review requested due to automatic review settings May 4, 2026 07:52
@thomasheartman thomasheartman self-assigned this May 4, 2026
Comment thread frontend/package.json
"cypress": "14.5.4",
"cypress-vite": "^1.4.0",
"cypress": "15.13.1",
"cypress-vite": "patch:cypress-vite@npm%3A1.8.0#~/.yarn/patches/cypress-vite-npm-1.8.0-5384b5466c.patch",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cypress has an incompatibility with rolldown so we need this custom patch. It's a test library, so not too worried about it.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR upgrades the frontend build/test toolchain to Vite 8 (plus related ecosystem upgrades), updates Vite configuration accordingly, and migrates SVG imports to the newer SVGR usage pattern so the codebase continues to compile under the new tooling.

Changes:

  • Upgrade Vite to v8 and update related tooling (Vitest v4, Cypress v15, @vitejs/plugin-react v6, vite-plugin-svgr v5) with corresponding lockfile updates.
  • Update vite.config.mts to accommodate Vite 8 behavior (built-in tsconfig paths resolution, MUI icons ESM redirect, dev-only Babel plugin usage for Emotion).
  • Migrate many SVG imports from ReactComponent exports to ?react imports and update affected snapshots.

Reviewed changes

Copilot reviewed 67 out of 68 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
frontend/yarn.lock Locks updated dependency graph for Vite 8 + related upgrades.
frontend/vite.config.mts Updates Vite/Vitest config; adds MUI icons redirect plugin; switches tsconfig paths handling; configures Emotion Babel plugin via rolldown Babel plugin.
frontend/tsconfig.json Adds node types alongside cypress.
frontend/package.json Bumps Vite/Vitest/Cypress/SVGR/plugin-react versions and adds Babel/Emotion Babel deps.
frontend/.yarn/patches/cypress-vite-npm-1.8.0-5384b5466c.patch Applies a patch to cypress-vite build config for compatibility.
frontend/src/utils/strategyNames.tsx Migrates SVG import to ?react.
frontend/src/component/user/StandaloneBanner.tsx Migrates SVG imports to ?react.
frontend/src/component/user/DemoAuth/DemoAuth.tsx Migrates SVG import to ?react.
frontend/src/component/user/common/AuthPageLayout.tsx Migrates SVG imports to ?react.
frontend/src/component/splash/SplashPageReleaseManagement.tsx Migrates SVG import to ?react.
frontend/src/component/splash/SplashOverlay/ReleaseManagementSplash.tsx Migrates SVG imports to ?react.
frontend/src/component/signup/SignupDialog/SignupDialog.tsx Migrates SVG import to ?react.
frontend/src/component/releases/ReleasePlanTemplate/TemplateForm/TemplateFormDescription.tsx Migrates SVG import to ?react.
frontend/src/component/releases/ReleaseManagement/ReleasePlanTemplateCard/ReleasePlanTemplateCard.tsx Migrates SVG import to ?react.
frontend/src/component/releases/ReleaseManagement/EmptyTemplatesListMessage.tsx Migrates SVG import to ?react.
frontend/src/component/project/ProjectList/ProjectCreationButton/ProjectCreationButton.tsx Migrates SVG imports to ?react.
frontend/src/component/project/ProjectCard/ProjectLastSeen/ProjectLastSeen.tsx Migrates SVG imports to ?react.
frontend/src/component/project/Project/ProjectStatus/ProjectStatusModal.tsx Migrates SVG import to ?react.
frontend/src/component/project/Project/ProjectStatus/ProjectActivity.tsx Adjusts react-activity-calendar import style for updated module exports.
frontend/src/component/project/Project/ProjectSettings/ProjectActions/ProjectActionsTable/ProjectActionsModal/ProjectActionsForm/ProjectActionsFormStep/ProjectActionsFormStepSource/StyledToggleButton/InvertedOperatorButton/InvertedOperatorButton.tsx Migrates SVG imports to ?react.
frontend/src/component/project/Project/ProjectSettings/ProjectActions/ProjectActionsTable/ProjectActionsModal/ProjectActionsForm/ProjectActionsFormStep/ProjectActionsFormStepSource/StyledToggleButton/CaseSensitiveButton/CaseSensitiveButton.tsx Migrates SVG imports to ?react.
frontend/src/component/project/Project/ProjectSettings/ChangeRequestConfiguration/ChangeRequestProcessHelp/ChangeRequestProcessHelp.tsx Migrates SVG import to ?react.
frontend/src/component/project/Project/Project.tsx Migrates SVG import to ?react.
frontend/src/component/project/Project/PaginatedProjectFeatureToggles/ProjectFeatureTogglesHeader/ImportButton/ImportButton.tsx Migrates SVG import to ?react.
frontend/src/component/playground/Playground/PlaygroundResultsTable/PlaygroundResultChip/PlaygroundResultChip.tsx Migrates SVG imports to ?react.
frontend/src/component/personalDashboard/WelcomeDialog.tsx Migrates SVG imports to ?react.
frontend/src/component/personalDashboard/InfoSection.tsx Migrates SVG imports to ?react.
frontend/src/component/menu/Header/DrawerMenu/DrawerMenu.tsx Migrates SVG imports to ?react.
frontend/src/component/layout/MainLayout/NavigationSidebar/NewInUnleash/NewInUnleashTooltip.tsx Migrates SVG import to ?react.
frontend/src/component/layout/MainLayout/NavigationSidebar/NewInUnleash/LegacyNewInUnleash.tsx Migrates SVG import to ?react.
frontend/src/component/layout/MainLayout/NavigationSidebar/NavigationSidebar.tsx Migrates SVG imports to ?react and renames the “celebratory” logo identifiers.
frontend/src/component/layout/components/NewFeatureBadge/NewFeatureBadge.tsx Migrates SVG import to ?react.
frontend/src/component/insights/componentsStat/HealthStats/HealthStats.tsx Migrates SVG import to ?react.
frontend/src/component/impact-metrics/ImpactMetricsEmptyState.tsx Migrates SVG import to ?react.
frontend/src/component/feedback/FeedbackNPS/FeedbackNPS.tsx Migrates SVG imports to ?react.
frontend/src/component/feature/FeatureView/FeatureOverview/FeatureLifecycle/FeatureLifecycleTooltip.tsx Migrates SVG import to ?react.
frontend/src/component/feature/FeatureView/FeatureEnvironmentSeen/FeatureEnvironmentSeen.tsx Migrates SVG imports to ?react.
frontend/src/component/feature/FeatureStrategy/FeatureStrategyMenu/FeatureStrategyMenuCards/FeatureStrategyMenuCardsReleaseTemplates.tsx Migrates SVG import to ?react.
frontend/src/component/feature/FeatureStrategy/FeatureStrategyMenu/FeatureStrategyMenuCard/FeatureStrategyMenuCardIcon.tsx Migrates SVG imports to ?react.
frontend/src/component/feature/FeatureStrategy/FeatureStrategyConstraints/EditableConstraint/ToggleConstraintInverted.tsx Migrates SVG imports to ?react.
frontend/src/component/feature/FeatureStrategy/FeatureStrategyConstraints/EditableConstraint/ToggleConstraintCaseSensitivity.tsx Migrates SVG imports to ?react.
frontend/src/component/environments/CreateEnvironmentButton/CreateEnvironmentButton.tsx Migrates SVG imports to ?react.
frontend/src/component/demo/DemoTopics/DemoTopics.tsx Migrates SVG import to ?react.
frontend/src/component/demo/DemoNotice.tsx Migrates SVG import to ?react.
frontend/src/component/common/Table/PaginationBar/PaginationBar.tsx Migrates SVG imports to ?react.
frontend/src/component/common/ProjectIcon/ProjectIcon.tsx Migrates SVG import to ?react.
frontend/src/component/common/PrettifyLargeNumber/formatLargeNumber.ts Updates millify import style to match updated module exports.
frontend/src/component/common/PremiumFeature/PremiumFeature.tsx Migrates SVG imports to ?react.
frontend/src/component/common/NotFound/NotFound.tsx Migrates SVG import to ?react.
frontend/src/component/common/NoItems/NoItems.tsx Migrates SVG import to ?react.
frontend/src/component/common/InstanceStatus/UpgradeTrialDialog.tsx Migrates SVG imports to ?react.
frontend/src/component/common/FormTemplate/FormTemplate.tsx Migrates SVG import to ?react.
frontend/src/component/common/FeatureLifecycle/FeatureLifecycleStageIcon.tsx Migrates lifecycle SVG imports to ?react.
frontend/src/component/common/EnterpriseBadge/EnterpriseBadge.tsx Migrates SVG imports to ?react.
frontend/src/component/common/ConstraintsList/ConstraintItemHeader/ConstraintItemHeader.tsx Migrates SVG import to ?react.
frontend/src/component/common/AvatarGroup/AvatarGroup.tsx Updates millify import style to match updated module exports.
frontend/src/component/admin/users/LinkField/ConfirmUserEmail/ConfirmUserEmail.tsx Migrates SVG import to ?react.
frontend/src/component/admin/users/ConfirmUserAdded/ConfirmUserEmail/ConfirmUserEmail.tsx Migrates SVG import to ?react.
frontend/src/component/admin/network/NetworkOverview/NetworkOverview.tsx Migrates SVG imports to ?react.
frontend/src/component/admin/enterprise-edge/EnterpriseEdgeInstances/EnterpriseEdgeInstances.tsx Migrates SVG imports to ?react.
frontend/src/component/admin/enterprise-edge/EnterpriseEdgeExplanation.tsx Migrates SVG imports to ?react.
frontend/src/component/admin/enterprise-edge/EnterpriseEdgeDismissibleAlert.tsx Migrates SVG import to ?react.
frontend/src/component/admin/billing/TrialUpsell/TrialUpsell.tsx Migrates SVG imports to ?react.
frontend/src/component/tags/TagTypeList/tests/snapshots/TagTypeList.test.tsx.snap Updates snapshots due to className/output changes from dependency/tooling upgrades.
frontend/src/component/menu/Footer/ApiDetails/snapshots/ApiDetails.test.tsx.snap Updates snapshots due to className/output changes from dependency/tooling upgrades.
frontend/src/component/menu/Footer/snapshots/Footer.test.tsx.snap Updates snapshots due to className/output changes from dependency/tooling upgrades.
frontend/src/component/feedback/FeedbackCES/snapshots/FeedbackCESForm.test.tsx.snap Updates snapshots due to className/output changes from dependency/tooling upgrades.
frontend/src/component/common/InstanceStatus/snapshots/InstanceStatusBar.test.tsx.snap Updates snapshots due to className/output changes from dependency/tooling upgrades.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread frontend/package.json
Comment on lines 138 to +143
"use-query-params": "^2.2.1",
"vanilla-jsoneditor": "^3.11.0",
"vite": "5.4.21",
"vite": "^8.0.10",
"vite-plugin-env-compatible": "2.0.1",
"vite-plugin-svgr": "3.3.0",
"vite-tsconfig-paths": "4.3.2",
"vitest": "3.2.4",
"vite-plugin-svgr": "5.2.0",
"vitest": "4.1.2",
Comment on lines 96 to 99
const StyledUnleashLogo = styled(UnleashLogo)({ width: '150px' });

const StyledCelebatoryLogo = styled(CelebatoryUnleashLogo)({ width: '150px' });
const StyledCelebatoryLogo = styled(CelebratoryUnleashLogo)({ width: '150px' });

@gastonfournier gastonfournier left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, I don't like the patch, but it's a small trade-off until the PR with the fix gets merged

@github-project-automation github-project-automation Bot moved this from In Progress to Approved PRs in Issues and PRs May 4, 2026
@thomasheartman thomasheartman changed the title chore: Update to vite 8 and related upgrades. Builds, but doesn't run chore: Update front end to vite 8 and related upgrades May 4, 2026
@thomasheartman thomasheartman merged commit 71893e2 into main May 4, 2026
14 checks passed
@thomasheartman thomasheartman deleted the chore/vite8 branch May 4, 2026 08:11
@github-project-automation github-project-automation Bot moved this from Approved PRs to Done in Issues and PRs May 4, 2026
thomasheartman added a commit that referenced this pull request May 4, 2026
This is an attempt to fix the Enterprise build issue due to to
theme/app.css not being found. Claude suggests that it may be related to
Vite 8's built-in `resolve.tsconfigPaths: true` not handling
baseUrl-relative resolution reliably.

I'm not positive that this will fix it, but it's a small change and it
goes back to the way we did it before vite8, so it seems worth trying.
It's hard to replicate locally, so this is probably the quickest way to
validate it. For reference, the handling was updated in
#11766.

Running the front end with this plugin makes vite emit this:
> The plugin "vite-tsconfig-paths" is detected. Vite now supports
tsconfig paths resolution natively via the resolve.tsconfigPaths option.
You can remove the plugin and set resolve.tsconfigPaths: true in your
Vite config instead.

However, there may still be some issues left to fix (e.g.
vitejs/vite#21856 ; upstream PR to fix it
oxc-project/oxc-resolver#1080)


Claude's summary:

Vite 8's built-in `resolve.tsconfigPaths: true` only handles `paths`
mappings reliably; baseUrl-relative resolution is fragile in some
environments (we hit it in enterprise's pnpm-driven prepack of OSS,
where `themes/app.css` and similar bare imports failed to resolve).

The pre-Vite-8 `vite-tsconfig-paths` plugin handled both. Re-add it with
the same plugin position as before, and drop the built-in flag to avoid
two resolvers disagreeing on edge cases. Drop the plugin again once the
built-in handler matures.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants