Skip to content

chore(deps): bump @vitejs/plugin-react from 5.2.0 to 6.0.2 in /js#1378

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js/vitejs/plugin-react-6.0.2
Open

chore(deps): bump @vitejs/plugin-react from 5.2.0 to 6.0.2 in /js#1378
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js/vitejs/plugin-react-6.0.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 15, 2026

Bumps @vitejs/plugin-react from 5.2.0 to 6.0.2.

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [

react({

 babel: {



   plugins: ['babel-plugin-react-compiler'],



</tr></table>

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 15, 2026
kentwelcome pushed a commit that referenced this pull request May 26, 2026
Closes #1394, #1392, #1384.

## npm minor/patch group (#1394 includes #1392 js-cookie security fix)

- @amplitude/unified 1.1.5 -> 1.1.9 (Dependabot wanted 1.1.8; 1.1.9 latest)
- @codemirror/view ^6.42.1 -> ^6.43.0
- @tanstack/react-query 5.100.10 -> 5.100.14 (Dependabot wanted 5.100.11; .14 latest)
- @uiw/codemirror-theme-github ^4.25.9 -> ^4.25.10
- @uiw/react-codemirror ^4.25.9 -> ^4.25.10
- ag-grid-community ^35.2.1 -> ^35.3.0
- ag-grid-react ^35.2.1 -> ^35.3.0
- date-fns ^4.1.0 -> ^4.2.1 (pinned to ~4.2.1 via override; see below)
- js-cookie ^3.0.5 -> ^3.0.7 (CVE-2026-46625 cookie attribute injection)
- @amplitude/analytics-core ^2.48.1 -> ^2.48.2
- @types/node ^25.7.0 -> ^25.9.1
- @types/react 19.2.14 -> 19.2.15
- @vitest/coverage-v8 ^4.1.6 -> ^4.1.7
- baseline-browser-mapping ^2.10.29 -> ^2.10.31
- postcss ^8.5.14 -> ^8.5.15
- vitest ^4.1.6 -> ^4.1.7
- write-excel-file ^4.0.6 -> ^4.0.7 (Dependabot missed)
- read-excel-file ^9.0.9 -> ^9.0.10 (Dependabot missed)

## Storybook 10.3.6 -> 10.4.0 (#1394)

@storybook/addon-docs, @storybook/addon-vitest, @storybook/react,
@storybook/react-vite, storybook, @vitest/browser-playwright

## Python (#1384 + missed updates)

- idna 3.11 -> 3.16 (CVE-2026-45409 -- Dependabot wanted 3.15; uv resolved to 3.16)
- click 8.3.1 -> 8.4.1
- pydantic 2.12.4 -> 2.13.4 (pydantic-core 2.41.5 -> 2.46.4)
- pygithub 2.8.1 -> 2.9.1
- python-multipart 0.0.28 -> 0.0.29
- requests 2.33.0 -> 2.34.2
- mcp 1.27.0 -> 1.27.1
- dbt-duckdb 1.10.0 -> 1.10.1 (dev)
- pytest-cov 7.0.0 -> 7.1.0 (dev)
- pre-commit 4.4.0 -> 4.6.0 (dev)

## Security fixes via pnpm overrides

- js-cookie@<3.0.7 -> >=3.0.7 (enforces CVE patch through @datarecce/ui)
- ws@>=8.0.0 <8.20.1 -> >=8.20.1 (CVE -- uninitialized memory disclosure;
  reaches the tree via vitest, happy-dom, storybook)

## Migration: date-fns pinned to ~4.2.1

date-fns 4.3.0 added a modularized optimization fallback that breaks
the date-fns vi.mock in TimelineEvent.test.tsx (OSS variant). Pinned to
~4.2.1 (Dependabot's intended target) until the test mock is updated.

## Deferred

- #1378 @vitejs/plugin-react 5.x -> 6.x: chained major bump requiring
  Vite 7 -> 8. Not included.

## Verification

- pnpm audit: 0 vulnerabilities (was 2 high/moderate)
- pip-audit: 0 vulnerabilities
- Python: 1304 passed, 5 skipped (pytest tests)
- Frontend: 3779 passed, 5 skipped (pnpm test)
- Frontend type check: clean (pnpm type:check)
- Frontend lint: clean (pnpm lint)
- Frontend build: clean (pnpm build)
- Python lint: clean (make flake8)
- Python format: clean (make format)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Jared Scott <jared.scott@datarecce.io>
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 5.2.0 to 6.0.2.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.2/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/js/vitejs/plugin-react-6.0.2 branch from 0e9d64f to f85f628 Compare May 26, 2026 12:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants