Add Vite 8 support to peerDependencies

[leeobrum]

Add Vite 8 to the supported peer dependencies range.

Vite 8 was recently released and users trying to upgrade are getting peer dependency conflicts since the current peerDependencies only covers up to ^7.0.0.

Current:
"vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"

Proposed:
"vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"

Update peerDependencies in package.json to include ^8.0.0
Test compatibility with Vite 8 internals (if any breaking changes affect the plugin)

[leeobrum]

Can you help us? @antfu

[userquin]

Still not sure if we should just add it to peers, we need to check integrations (can break them), the plugin is working fine with Vite 8, just the warning when installing it, maybe I can release a minor (1.3.0).

I will try to add Vite 8 this week, maybe tmr.

[vincentdev15]

After the installation, there are 4 high severity vulnerabilities.

npm install --legacy-peer-deps vite-plugin-pwa
npm warn deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
npm warn deprecated source-map@0.8.0-beta.0: The work that was done in this beta branch won't be included in future versions
npm warn deprecated glob@11.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

added 332 packages, removed 2 packages, and audited 487 packages in 8s

135 packages are looking for funding
run npm fund for details

4 high severity vulnerabilities

To address all issues, run:
npm audit fix

Run npm audit for details.

[vincentdev15]

npm audit

npm audit report

serialize-javascript <=7.0.2
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - GHSA-5c6j-r48x-rmvq
fix available via npm audit fix --force
Will install vite-plugin-pwa@0.19.8, which is a breaking change
node_modules/serialize-javascript
@rollup/plugin-terser 0.2.0 - 0.4.4
Depends on vulnerable versions of serialize-javascript
node_modules/@rollup/plugin-terser
workbox-build >=7.1.0
Depends on vulnerable versions of @rollup/plugin-terser
node_modules/workbox-build
vite-plugin-pwa >=0.20.0
Depends on vulnerable versions of workbox-build
node_modules/vite-plugin-pwa

4 high severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

[userquin]

Add to dev dependencies or dependencies the pwa plugin (1.2.0), then add also workbox-build (7.4.0) and workbox-window (7.4.0) if using any virtual: from vite-pwa-plugin/client or vite-pwa-plugin/<framework> (virtual:pwa-register or virtual:pwa-register/<framework> respectivelly).

I use it with nuxt 4.2.1 (draft PR at npmx.dev GH repo), vite-ssg (some project at work) and with vitepress integration at vuetify nuxt module (pnpm as package manager => check https://github.com/vuetifyjs/nuxt-module/blob/main/package.json#L34-L39 , https://github.com/vuetifyjs/nuxt-module/blob/main/docs/package.json#L17-L29 and https://github.com/vuetifyjs/nuxt-module/blob/main/pnpm-workspace.yaml#L6-L80).

If you're using npm use resolutions instead pnpm.overrides for vite-plugin-pwa.

[userquin]

@leeobrum @vincentdev15 I'm using pnpm in this repo I'm preparing to test the environment api with Vite 8 (using Vite+), running the audit reports no vulnerabilities:

package.json

{
  "name": "vite-plus-vue-ts-test",
  "version": "0.0.0",
  "private": true,
  "type": "module",
  "scripts": {
    "dev": "vp dev",
    "build": "vue-tsc -b && vp build",
    "preview": "vp preview",
    "prepare": "vp config",
    "typecheck": "vue-tsc -b --noEmit"
  },
  "dependencies": {
    "vue": "^3.5.30"
  },
  "devDependencies": {
    "@types/node": "^24.12.0",
    "@vite-pwa/assets-generator": "^1.0.2",
    "@vitejs/plugin-vue": "^6.0.5",
    "@vue/tsconfig": "^0.9.0",
    "serialize-javascript": "7.0.4",
    "typescript": "~5.9.3",
    "vite": "npm:@voidzero-dev/vite-plus-core@latest",
    "vite-plugin-pwa": "https://pkg.pr.new/vite-plugin-pwa@8f1c4a0",
    "vite-plus": "latest",
    "vue-tsc": "^3.2.5",
    "workbox-build": "^7.4.0",
    "workbox-window": "^7.4.0"
  },
  "packageManager": "pnpm@10.32.1",
  "pnpm": {
    "overrides": {
      "serialize-javascript": "7.0.4",
      "vite": "npm:@voidzero-dev/vite-plus-core@latest",
      "vitest": "npm:@voidzero-dev/vite-plus-test@latest"
    },
    "onlyBuiltDependencies": [
      "sharp"
    ]
  }
}

This is the output running pnpm audit:

> pnpm audit
> No known vulnerabilities found

You can use resolutions (if using npm) to override serialize-javascript instead using pnpm.overrides.

[userquin]

Here the repo, I will add some new branches to test injectManifest using vite 8 build:
https://github.com/userquin/vite-plus-vue-ts-test

[mrjohnr]

is there any fix? I still got errors when updating

[serlopDev]

is there any fix? I still got errors when updating

You can temporarily add this to your package.json to avoid errors.

"overrides": { "serialize-javascript": "^7.0.3" },

[BiFangKNT]

I'm really looking forward to this feature, please let me know if there is any progress!

[userquin]

This is not a vulneravity at pwa plugin, since that library is used at build time to run some code at node process: run manifest transforms to generate the sw precache manifest and preparing service worker code (adding runtime caching entries) when using generateSW via workbox-build.

You can use your package manager in your repos to remove the vulnerability, this should be fixed at workbox. We cannot do anything here, just patching pwa plugin here.

GoogleChrome/workbox#3470

[keenanpayne]

Adding this to my package.json solved the problem until Vite 8 is added to peer dependencies:

"overrides": {
    "vite-plugin-pwa": {
      "vite": "$vite"
    }
  }

[vincentdev15]

I have tried this => EDIT but not together (see my next comment).

"overrides": { "serialize-javascript": "^7.0.3" },

"overrides": {
    "vite-plugin-pwa": {
      "vite": "$vite"
    }
  }

None of both work for me.

I get these vulerabilities.

npm audit report

serialize-javascript <=7.0.4
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - GHSA-5c6j-r48x-rmvq
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - GHSA-qj8w-gfj5-8c6v
fix available via npm audit fix --force
Will install vite-plugin-pwa@0.19.8, which is a breaking change
node_modules/serialize-javascript
@rollup/plugin-terser 0.2.0 - 0.4.4
Depends on vulnerable versions of serialize-javascript
node_modules/@rollup/plugin-terser
workbox-build >=7.1.0
Depends on vulnerable versions of @rollup/plugin-terser
node_modules/workbox-build
vite-plugin-pwa >=0.20.0
Depends on vulnerable versions of workbox-build
node_modules/vite-plugin-pwa

4 high severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

[vincentdev15]

Oh ok it works.

I need to add both packages together.

"overrides": {
    "serialize-javascript": "^7.0.3",
    "vite-plugin-pwa": {
        "vite": "$vite"
    }
}