[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: vite.

Updates vite from 7.3.5 to 7.3.7

Release notes

Sourced from vite's releases.

v7.3.7

Please refer to CHANGELOG.md for details.

v7.3.6

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.7 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (a0a3339)
• html: filename passed to transformIndexHtml should not include queries (#23653) (8d479f9)
• server: store ids to safeModulePaths rather than URLs (#23656) (f0d76c7)

7.3.6 (2026-06-25)

Features

• allow esbuild 0.28 (#22743) (a24931e)

Commits

• 284f6b5 release: v7.3.7
• f0d76c7 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• a0a3339 fix(deps): update launch-editor to v2.14.2 (#23654)
• 8d479f9 fix(html): filename passed to transformIndexHtml should not include queries (...
• 0a7b53b release: v7.3.6
• a24931e feat: allow esbuild 0.28 (#22743)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary

• Dependency-only Dependabot update: set the Vite development tooling dependency from 7.3.5 to 7.3.7 in the twelve surviving workspace package manifests, with the corresponding pnpm lockfile resolution changes.
• This is the current post-MCP-retirement successor to superseded PR chore(deps-dev): bump the npm_and_yarn group across 14 directories with 1 update #981. It does not recreate either retired MCP package, edit runtime library code, or add CLI/scaffold functionality.

Verification

• CI run 39704649787: completed/success; Node 20/22/24 core and all three OS customer-consumer guards passed. The PR-only benchmark is skipped by its unchanged trigger.
• Release Readiness run 39704649864: completed/success.
• Initial PR Check 39704649780: failed at the PR-body readiness gate because these metadata fields were absent in the Dependabot-generated description; repository code/test failure was not reported. A new PR Check on this body edit is required and its result must be reviewed before any merge.
• Scope review: twelve existing manifests change only the Vite dev dependency; the thirteenth file is pnpm-lock.yaml. No library source, public API, SQL/AST code, existing CLI, scaffold, or MCP implementation is modified.

Merge Readiness

• No baseline exception requested.
• Baseline exception requested and linked below.

Tracking issue: not required; no baseline exception requested.
Scoped checks run: GitHub CI and Release Readiness passed on the current head; PR readiness rerun required after this description edit.
Why full baseline is not required: No exception to the normal required CI is requested. Do not merge if the refreshed PR Check fails.

Self Review

Self-review workflow: Manual Chat consistency review and human-acceptance review using .agents/skills/self-review/SKILL.md criteria and PR-readiness template; evaluated changed manifests/lockfile, prior workflow evidence, CI scope, and final PR description.
Self-review result: No unresolved source/API/test blocker found in this dev-tooling version bump. The missing PR-body contract is corrected here; final PR readiness is conditional on the new GitHub PR Check completing successfully.
Concept-review workflow: Package-concept/ownership boundary review of the twelve retained package manifests and root pnpm lockfile; Vite is a development dependency, and no source/API/CLI/scaffold or generated asset was changed.
Concept-review result: No package-boundary or concept violation identified. No release Changeset is proposed for development-tooling-only maintenance; no public package behavior or contract changed.

CLI Surface Migration

• No migration packet required for this CLI change.
• CLI/user-facing surface change and migration packet completed.

No-migration rationale: No CLI-facing file, command, user-visible CLI contract, or workflow was changed; the repository classifier has no CLI migration requirement for this diff.
Upgrade note: No CLI migration.
Deprecation/removal plan or issue: No CLI removals.
Docs/help/examples updated: No CLI documentation change needed.
Release/changeset wording: Dev dependency maintenance only; no CLI release note.

Scaffold Contract Proof

• No scaffold contract proof required for this PR.
• Scaffold contract proof completed.

No-proof rationale: No scaffold files, generated outputs, templates, or scaffold contracts are modified.
Non-edit assertion: No scaffold assets or generated files changed in this PR.
Fail-fast input-contract proof: Not applicable; no scaffold input changes.
Generated-output viability proof: Not applicable; no scaffold output changes.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fdfa7152-ca7a-49cd-ab08-03fed06ec153

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mk3008]

Maintenance follow-up for this Dependabot update: obsolete #981 was closed as a duplicate because it included the retired MCP package and demo. Kept this post-retirement PR #982. The earlier Check PR readiness contract failure was caused by absent template sections in the bot-generated description, not by a code/test failure. The required Merge Readiness, Self Review, CLI/Scaffold impact sections and evidence were added without changing any commit, dependency manifest or lockfile. PR Check rerun now completed successfully, including the readiness contract, lint, build, core tests, lightweight benchmark and package checks. CI and Release Readiness also passed on this same head 96d6a2b1de5f373d9aea29aa32d3ae1318713dd4. No merge or release was performed.

[mk3008]

Independent Chat review — current head 66a50a62b32705d97bd0e9adc1e710ce2585a0c5

Review result: No code, packaging, or PR-readiness blocker remains. This review does not independently authorize merging into main.

• Superseded Dependabot PR #981 was closed without merging. The surviving PR #982 updates Vite from 7.3.5 to 7.3.7 in 12 retained package manifests plus pnpm-lock.yaml; no runtime source, CLI/API, SQL parser/AST, scaffold, retired MCP files, or release files are changed. The regenerated lockfile also updates an incidental @types/node 22.x resolution and adds Rollup platform libc metadata; these are lockfile-only changes, not independently edited package manifests.
• Merged CI runtime fix PR #983 is already in main as d2f47c21. The PR branch was synchronized with that current main by a verified two-parent merge commit. Old-to-new head difference consists only of the nine already-merged CI workflow/action files; the review diff against current main is still exactly 13 Vite-related dependency files.
• Actual new-head CI run 39727094679 completed successfully, with patched Node 22.23.4/24.22.1 core and Linux/macOS/Windows consumer checks. PR Check 39727094595 and Release Readiness 39727094591 also completed successfully. The PR-only benchmark was skipped by its existing trigger. The earlier PR Readiness failure was fixed by adding required documentation to this PR body, without changing the original Dependabot dependency patch.
• No release, npm registry operation, or merge of PR #982 is included in this review. Follow repository human-approval policy for merging; after a separately authorized merge, verify main CI and stop if anything fails.