[dependabot]

Bumps vite and vite-plugin-static-copy. These dependencies needed to be updated together.
Updates vite from 5.4.6 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates vite-plugin-static-copy from 1.0.5 to 4.1.1

Release notes

Sourced from vite-plugin-static-copy's releases.

[email protected]

Patch Changes

• #240 671579b Thanks @​saif-shines! - Use each environment's resolved build.outDir when copying static assets during build. Previously the plugin kept only the last configResolved config, so multi-environment setups (for example Astro with separate client and SSR output directories) could copy files into the wrong folder.

[email protected]

Minor Changes

• #251 7672842 Thanks @​sapphi-red! - Add name property to the rename object form and allow rename functions to return a RenameObject. The name property replaces the file's basename (filename + extension), and can be combined with stripBase to both flatten directory structure and rename the file in one step. Rename functions can now return { name, stripBase } objects instead of only strings, making it easier to declaratively control output paths from dynamic rename logic.

  // node_modules/lib/dist/index.js → vendor/lib.js
  { src: 'node_modules/lib/dist/index.js', dest: 'vendor', rename: { name: 'lib.js', stripBase: true } }
  // src/pages/events/test.html → dist/events/index.html
  { src: 'src/pages/**/*.html', dest: 'dist/', rename: { stripBase: 2, name: 'index.html' } }

[email protected]

Patch Changes

• #249 c6bf44c Thanks @​sapphi-red! - Fix absolute dest paths being nested under the output directory

  When dest was an absolute path and the source file had a directory component (structured output), the path was incorrectly converted to a relative path, causing files to be nested under the build output directory instead of being copied to the specified absolute path.

  { src: 'foo/foo.txt', dest: '/home/user/my-repo/bar' }

  Before: /home/user/my-repo/dist/home/user/my-repo/bar/foo/foo.txt After: /home/user/my-repo/bar/foo/foo.txt

• #247 d3af79e Thanks @​sapphi-red! - Fix rename.stripBase to work correctly with ../ paths

  Previously, stripBase counted .. as directory segments, causing incorrect output paths when copying from parent directories.

  { src: '../../src/pages/**/*.html', dest: 'dist/', rename: { stripBase: 2 } }

  Before: dist/src/pages/events/test.html After: dist/events/test.html

  { src: '../../src/pages/**/*.html', dest: 'dist/', rename: { stripBase: true } }

  Before: dist/src/pages/events/test.html After: dist/test.html

... (truncated)

Changelog

Sourced from vite-plugin-static-copy's changelog.

4.1.1

Patch Changes

• #240 671579b Thanks @​saif-shines! - Use each environment's resolved build.outDir when copying static assets during build. Previously the plugin kept only the last configResolved config, so multi-environment setups (for example Astro with separate client and SSR output directories) could copy files into the wrong folder.

4.1.0

Minor Changes

• #251 7672842 Thanks @​sapphi-red! - Add name property to the rename object form and allow rename functions to return a RenameObject. The name property replaces the file's basename (filename + extension), and can be combined with stripBase to both flatten directory structure and rename the file in one step. Rename functions can now return { name, stripBase } objects instead of only strings, making it easier to declaratively control output paths from dynamic rename logic.

  // node_modules/lib/dist/index.js → vendor/lib.js
  { src: 'node_modules/lib/dist/index.js', dest: 'vendor', rename: { name: 'lib.js', stripBase: true } }
  // src/pages/events/test.html → dist/events/index.html
  { src: 'src/pages/**/*.html', dest: 'dist/', rename: { stripBase: 2, name: 'index.html' } }

4.0.1

Patch Changes

• #249 c6bf44c Thanks @​sapphi-red! - Fix absolute dest paths being nested under the output directory

  When dest was an absolute path and the source file had a directory component (structured output), the path was incorrectly converted to a relative path, causing files to be nested under the build output directory instead of being copied to the specified absolute path.

  { src: 'foo/foo.txt', dest: '/home/user/my-repo/bar' }

  Before: /home/user/my-repo/dist/home/user/my-repo/bar/foo/foo.txt After: /home/user/my-repo/bar/foo/foo.txt

• #247 d3af79e Thanks @​sapphi-red! - Fix rename.stripBase to work correctly with ../ paths

  Previously, stripBase counted .. as directory segments, causing incorrect output paths when copying from parent directories.

  { src: '../../src/pages/**/*.html', dest: 'dist/', rename: { stripBase: 2 } }

  Before: dist/src/pages/events/test.html After: dist/events/test.html

  { src: '../../src/pages/**/*.html', dest: 'dist/', rename: { stripBase: true } }

... (truncated)

Commits

• 63dd788 chore: update versions (#259)
• 671579b fix: use environment-specific outDir in build plugin for Vite 6 (#240)
• 01757de chore(deps): update pnpm to v11
• 707a0fe ci: pin actions
• f0df2ad fix(deps): update all non-major dependencies (#257)
• efb0d50 fix(deps): update all non-major dependencies (#255)
• e95cd6e chore: update versions (#253)
• 7672842 feat: add name property to RenameObject and allow RenameFunc to return ...
• 7ae0134 chore: update versions (#248)
• de515fa chore(deps): update dependency typescript to v6 (#245)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite-plugin-static-copy since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.