7.14.0 still requires (depends on) Vite 7

[MonstraG]

Reproduction

This is not a runtime issue, and I believe technically not a bug, but no templates in the repo really fit.

The issue is that @react-router/dev depends on vite-node: ^3.2.2 which depends on vite: 7.3.2, so vite 7 is still pulled.

I don't believe this results in something breaking, just vite 7 (and it's dependencies like esbuild) being downloaded.

System Info

System:
    OS: Linux 6.18 EndeavourOS
    CPU: (20) x64 12th Gen Intel(R) Core(TM) i7-12700H
    Memory: 3.12 GB / 15.29 GB
    Container: Yes
    Shell: 5.9 - /usr/bin/zsh
  Binaries:
    Node: 25.9.0 - /usr/bin/node
    npm: 11.12.1 - /usr/bin/npm
    pnpm: 10.33.0 - /usr/bin/pnpm
  Browsers:
    Firefox: 149.0
    Firefox Developer Edition: 149.0
  npmPackages:
    @react-router/dev: 7.14.0 => 7.14.0 
    @react-router/node: 7.14.0 => 7.14.0 
    @react-router/serve: 7.14.0 => 7.14.0 
    react-router: 7.14.0 => 7.14.0 
    vite: 8.0.5 => 8.0.5

Used Package Manager

pnpm

Expected Behavior

given versions:

    @react-router/dev: 7.14.0 => 7.14.0 
    @react-router/node: 7.14.0 => 7.14.0 
    @react-router/serve: 7.14.0 => 7.14.0 
    react-router: 7.14.0 => 7.14.0 
    vite: 8.0.5 => 8.0.5 

pnpm-lock.yaml shouldn't contain vite@7

Actual Behavior

pnpm-lock.yaml contains vite@7

[timdorr]

Related: #14862

[tats-u]

I wonder if we may override vite-node to the latest v6.0.0 iff we use Vite 8:

https://github.com/antfu-collective/vite-node/releases

[MonstraG]

With pnpm, I do the following:

// .pnpmfile.cjs
module.exports = {
	hooks: {
		readPackage: (pkg) => {
			if (pkg.name === "vite-node") {
				// update vite to not pull old one with esbuild
				pkg.dependencies['vite'] = "^8.0.0"
			}

			return pkg;
		},
	},
};

So, just change the desired vite version for existing's vite-node version.

This, I believe, is enough to remove vite 7, esbuild and rollup from pnpm.lock.

But of course, if/when vite-node would be just dropped from dependency list, this is no longer required and I can be happy again.

[tats-u]

How about this instead in pnpm-workspace.yaml:

overrides:
  'vite-node>vite@^7': ^8

[MonstraG]

Yep, that also works, thanks!

[tats-u]

For readers' information, I'm trying:

overrides:
  '@react-router/dev>vite-node@<6': ^6

[AviVahl]

for those using npm:

{
  "overrides": {
    "@react-router/dev": {
      "vite-node": "^6.0.0"
    }
  }
}