build(deps-dev): bump vite from 6.0.3 to 6.0.10

[dependabot]

Bumps vite from 6.0.3 to 6.0.10.

Release notes

Sourced from vite's releases.

v6.0.10

Please refer to CHANGELOG.md for details.

v6.0.9

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v6.0.8

Please refer to CHANGELOG.md for details.

v6.0.7

Please refer to CHANGELOG.md for details.

v6.0.6

Please refer to CHANGELOG.md for details.

v6.0.5

Please refer to CHANGELOG.md for details.

v6.0.4

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.0.10 (2025-01-20)

• fix: try parse server.origin URL (#19241) (2495022), closes #19241

6.0.9 (2025-01-20)

• fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (bd896fb)
• fix!: default server.cors: false to disallow fetching from untrusted origins (b09572a)
• fix: verify token for HMR WebSocket connection (029dcd6)

6.0.8 (2025-01-20)

• fix: avoid SSR HMR for HTML files (#19193) (3bd55bc), closes #19193
• fix: build time display 7m 60s (#19108) (cf0d2c8), closes #19108
• fix: don't resolve URL starting with double slash (#19059) (35942cd), closes #19059
• fix: ensure server.close() only called once (#19204) (db81c2d), closes #19204
• fix: resolve.conditions in ResolvedConfig was defaultServerConditions (#19174) (ad75c56), closes #19174
• fix: tree shake stringified JSON imports (#19189) (f2aed62), closes #19189
• fix: use shared sigterm callback (#19203) (47039f4), closes #19203
• fix(deps): update all non-major dependencies (#19098) (8639538), closes #19098
• fix(optimizer): use correct default install state path for yarn PnP (#19119) (e690d8b), closes #19119
• fix(types): improve ESBuildOptions.include / exclude type to allow readonly (string | RegExp)[] (ea53e70), closes #19146
• chore(deps): update dependency pathe to v2 (#19139) (71506f0), closes #19139

6.0.7 (2025-01-02)

• fix: fix minify when builder.sharedPlugins: true (#19025) (f7b1964), closes #19025
• fix: skip the plugin if it has been called before with the same id and importer (#19016) (b178c90), closes #19016
• fix(html): error while removing vite-ignore attribute for inline script (#19062) (a492253), closes #19062
• fix(ssr): fix semicolon injection by ssr transform (#19097) (1c102d5), closes #19097
• perf: skip globbing for static path in warmup (#19107) (677508b), closes #19107
• feat(css): show lightningcss warnings (#19076) (b07c036), closes #19076

6.0.6 (2024-12-26)

• fix: replace runner-side path normalization with fetchModule-side resolve (#18361) (9f10261), closes #18361
• fix(css): resolve style tags in HTML files correctly for lightningcss (#19001) (afff05c), closes #19001
• fix(css): show correct error when unknown placeholder is used for CSS modules pattern in lightningcs (9290d85), closes #19070
• fix(resolve): handle package.json with UTF-8 BOM (#19000) (902567a), closes #19000
• fix(ssrTransform): preserve line offset when transforming imports (#19004) (1aa434e), closes #19004
• chore: fix typo in comment (#19067) (eb06ec3), closes #19067
• chore: update comment about build.target (#19047) (0e9e81f), closes #19047

... (truncated)

Commits

• 9654348 release: v6.0.10
• 2495022 fix: try parse server.origin URL (#19241)
• a55f8ba release: v6.0.9
• bd896fb fix!: check host header to prevent DNS rebinding attacks and introduce `serve...
• 029dcd6 fix: verify token for HMR WebSocket connection
• b09572a fix!: default server.cors: false to disallow fetching from untrusted origins
• c0f72a6 release: v6.0.8
• f2aed62 fix: tree shake stringified JSON imports (#19189)
• db81c2d fix: ensure server.close() only called once (#19204)
• 47039f4 fix: use shared sigterm callback (#19203)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

PR-Codex overview

This PR focuses on updating dependencies in the package.json and pnpm-lock.yaml files, primarily upgrading the vite package and various other libraries to newer versions, ensuring compatibility and potentially improved performance.

Detailed summary

• Updated vite from 6.0.3 to 6.0.10 in package.json.
• Updated @noble/hashes from 1.7.0 to 1.7.1 in pnpm-lock.yaml.
• Updated @aws-sdk/credential-providers version specification in pnpm-lock.yaml.
• Updated multiple rollup related packages to 4.31.0 in pnpm-lock.yaml.
• Updated @scure/base from 1.2.1 to 1.2.4 in pnpm-lock.yaml.
• Updated zustand from 5.0.0 to 5.0.3 in pnpm-lock.yaml.
• Updated @types/connect from 3.4.36 to 3.4.38 in pnpm-lock.yaml.
• Updated readable-stream from 4.6.0 to 4.7.0 in pnpm-lock.yaml.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
docs-v2	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 21, 2025 1:28am
thirdweb_playground	🛑 Canceled (Inspect)			Jan 21, 2025 1:28am
thirdweb-www	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 21, 2025 1:28am
wallet-ui	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 21, 2025 1:28am

[changeset-bot]

⚠️ No Changeset found

Latest commit: e91e1b2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[graphite-app]

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• merge-queue - adds this PR to the back of the merge queue
• hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

[socket-security]

New and updated dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/[email protected] 🔁 npm/[email protected]	None	+3	5.6 MB	antfu, patak, soda, ...2 more

View full report↗︎