build(deps-dev): bump vite from 8.0.16 to 8.1.4 in the development group across 1 directory

[dependabot]

Bumps the development group with 1 update in the / directory: vite.

Updates vite from 8.0.16 to 8.1.4

Release notes

Sourced from vite's releases.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.4 (2026-07-09)

Features

• legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)
• deps: update all non-major dependencies (#22865) (d4295a9)
• deps: update rolldown-related dependencies (#22866) (7cf07e4)
• html: avoid backtracking in import-only check (#22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#22876) (ea22fb3)

Tests

• avoid warnings (#22851) (af21ab6)

Build System

• remove the custom onLog function (#22878) (2c4a217)
• replace deprecated onwarn with onLog (#22741) (c581b55)

8.1.3 (2026-07-02)

Bug Fixes

• css: inject inlined CSS after the shebang line (#22717) (1534d36)
• deps: bump es-module-lexer to 2.3.0 (#22838) (7103c3a)
• preload css for nested dynamic imports (#22759) (2c53054)
• ssr: correct stacktrace column position for first line (#22828) (c4acd69)

8.1.2 (2026-06-30)

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)

... (truncated)

Commits

• a477454 release: v8.1.4
• ab5dafa feat(legacy): prefer oxc as minifier (fix #21973) (#22468)
• 173a1b6 fix(ssr): align named export function call stacktrace column with Node (#22829)
• 575c32c fix(build): add workaround for building on stackblitz (#22840)
• 72a5e21 fix(optimizer): avoid optimizer run for transform request before init (#22852)
• a9539d6 chore(deps): update dependency postcss-modules to v9 (#22867)
• 70435b2 docs: fix incorrect @default for server.cors (#22859)
• 2c4a217 build: remove the custom onLog function (#22878)
• c581b55 build: replace deprecated onwarn with onLog (#22741)
• ea22fb3 refactor: eliminate ineffectiveDynamicImport warn (#22876)
• Additional commits viewable in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 17, 2026, 5:10 AM ET / 09:10 UTC.

Summary
Updates Vite from 8.0.16 to 8.1.4 and refreshes the corresponding Bun lockfile dependency graph.

Reproducibility: not applicable. this is a development-dependency maintenance PR rather than a reported behavioral bug.

Review metrics: 3 noteworthy metrics.

• Dependency scope: 1 direct development dependency updated. The intended change is narrowly limited to Vite.
• Changed files: 2 files; 23 additions and 23 deletions. The package manifest and generated Bun lockfile are the only modified surfaces.
• Validation: 4 relevant checks passed. Repository checks, minimum-Bun validation, CodeQL, and JavaScript analysis found no functional defect.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Review and explicitly accept or reject @emnapi/runtime 1.11.1 before merge.

Risk before merge

• [P1] Merging accepts a newly resolved transitive artifact whose distributed minified code triggered the repository's supply-chain scanner; green CI does not establish whether maintainers consider that artifact trustworthy.

Maintainer options:

1. Review and accept the transitive artifact (recommended)
   Compare @emnapi/runtime 1.11.1's published files with its public source, then merge if the minified distribution is expected and acceptable.
2. Pause for a cleaner dependency graph
   Keep the PR open or close it without merge if maintainers do not want to accept the scanner-flagged artifact.

Next step before merge

• [P2] A maintainer must explicitly accept or reject the flagged transitive artifact; there is no concrete code defect for an automated repair worker.

Maintainer decision needed

• Question: Should this repository accept @emnapi/runtime 1.11.1 as an expected minified upstream artifact in the Vite 8.1.4 dependency graph?
• Rationale: The patch has no demonstrated correctness defect, but accepting a scanner-flagged transitive artifact in the security-sensitive lockfile is a repository trust decision that automation cannot safely make.
• Likely owner: steipete — As the best available repository-level decision owner, @steipete is the most appropriate candidate to accept or reject this supply-chain boundary.
• Options:
  • Accept the reviewed artifact (recommended): Approve the Vite update after confirming that the flagged files correspond to the public emnapi source and expected minified distribution.
  • Postpone the dependency update: Leave Vite at 8.0.16 until a later release resolves the graph without the flagged artifact or provides stronger provenance.

Security
Needs attention: The lockfile adds a scanner-flagged transitive artifact that requires explicit maintainer acceptance despite reassuring upstream provenance.

Review details

Best possible solution:

Merge the narrow Vite update only after a maintainer reviews the upstream @emnapi/runtime 1.11.1 source and published artifact and records whether the scanner alert is acceptable; otherwise postpone the bump until the dependency graph changes.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a development-dependency maintenance PR rather than a reported behavioral bug.

Is this the best way to solve the issue?

Yes, the direct Vite pin plus regenerated Bun lockfile is the narrow maintainable update shape; the remaining question is whether maintainers accept the resulting transitive artifact.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 5167de427da5.

Label changes

Label justifications:

• P3: This is routine development-dependency maintenance with no demonstrated user-facing regression or urgent security fix.
• merge-risk: 🚨 security-boundary: The lockfile introduces @emnapi/runtime 1.11.1, whose distributed code triggered a high-confidence obfuscation warning requiring explicit trust review.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot-authored dependency update, so the external-contributor real-behavior proof gate does not apply; repository and security checks provide supplemental validation.

Evidence reviewed

Security concerns:

• [medium] Review the scanner-flagged transitive runtime — bun.lock:14
  Vite 8.1.4 resolves @emnapi/runtime 1.11.1, which Socket classifies as likely obfuscated; verify that the published minified files match the public upstream source before accepting the lockfile.
  Confidence: 0.93

What I checked:

• Dependency update: The branch changes only package.json and bun.lock, updating one direct development dependency and its resolved transitive graph. (package.json:52, 769ca52ed6fc)
• Current main: Current main still pins Vite 8.0.16, so this PR remains necessary and is not already implemented. (github.com) (package.json:49, 5167de427da5)
• Security-sensitive lockfile change: The update changes @emnapi/runtime from 1.10.0 to 1.11.1; repository policy requires deliberate review of bun.lock as a security-sensitive generated artifact. (bun.lock:14, 769ca52ed6fc)
• Socket alert: Socket reported a high-confidence obfuscated-code warning for @emnapi/runtime 1.11.1 in the new Vite dependency graph. (bun.lock:14, 769ca52ed6fc)
• Upstream context: The package links to the public toyobayashi/emnapi source, is MIT-licensed, and intentionally publishes a minified runtime distribution; vulnerability databases report no known direct vulnerabilities for 1.11.1. (npmjs.com) (bun.lock:14, 769ca52ed6fc)
• Validation: The repository check, minimum-Bun check, CodeQL, and JavaScript analysis all completed successfully on the current PR head. (769ca52ed6fc)

Likely related people:

• steipete: Public OpenClaw ownership identifies @steipete as the project lead and the best available routing candidate for accepting a repository-level dependency supply-chain risk; file-level author history was not exposed in the available GitHub view, so confidence is limited. (role: repository decision owner; confidence: low; files: package.json, bun.lock)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (13 earlier review cycles; latest 8 shown)

• reviewed 2026-07-14T13:04:43.191Z sha c85ab2a :: needs maintainer review before merge. :: none
• reviewed 2026-07-14T13:25:18.630Z sha c85ab2a :: needs maintainer review before merge. :: none
• reviewed 2026-07-16T01:36:45.872Z sha 769ca52 :: needs maintainer review before merge. :: none
• reviewed 2026-07-16T02:16:58.254Z sha 769ca52 :: needs maintainer review before merge. :: none
• reviewed 2026-07-16T03:00:27.447Z sha 769ca52 :: needs maintainer review before merge. :: none
• reviewed 2026-07-16T08:29:23.226Z sha 769ca52 :: needs maintainer review before merge. :: none
• reviewed 2026-07-16T09:10:32.908Z sha 769ca52 :: needs maintainer review before merge. :: none
• reviewed 2026-07-17T08:28:42.525Z sha 769ca52 :: needs maintainer review before merge. :: none

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​8.0.16 ⏵ 8.1.3			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/vite@8.1.3 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dependabot]

Looks like vite is updatable in another way, so this is no longer needed.