Vite 6.4

Apply the Node.js 24 and TypeScript 7 prompts first. These rules target Vite 6.4, including its Rollup builds, esbuild transforms, development server, preview server, and SSR integration.

Version, runtime, and configuration authority

• Read the advisories published by both Vite and launch-editor and act on affected Vite ranges even when npm audit is clean; repository advisories can precede scanner databases, and Vite bundles the editor dependency. Vite fixes an older major only on its latest minor. This line receives security patches only and leaves support when the next major is released, so plan its migration.
• Treat Vite's engine range ^18.0.0 || ^20.0.0 || >=22.0.0 as compatibility information; it does not restore support to end-of-life Node.js 18 or 20. Use the included runtime baseline for deployment.
• Treat vite.config.*, config imports, the config loader, project root, base, envDir, aliases, entries, publicDir, cache paths, and build destinations as privileged inputs.
• Do not let HTTP data, tenant settings, forked-pull-request variables, or other untrusted values choose a config file, mode, plugin, proxy target, module identifier, or output path.
• Review resolved configuration for each command and mode. --mode selects env files independently of NODE_ENV; neither import.meta.env.MODE nor PROD is an authorization control.
• Run the TypeScript baseline's separate type-check gate alongside vite build: Vite's default esbuild transforms do not type-check. Enable isolatedModules, and verify TypeScript 7 compatibility of the chosen