Vite 8.0.16

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover the exact Vite 8.0.16 Rolldown/Oxc toolchain. The 8.0 line is no longer supported and gets no fixes, even for advisories that affect every 8.0 release; migrate existing deployments to a maintained release line.

Exact version and configuration trust

• Keep the Node.js 24 runtime current through the Node.js prompt's release rule. Vite 8.0.16 declares ^20.19.0 || >=22.12.0, but satisfying that engine range does not establish active support: Node.js 20 is end of life.
• Read the security advisories the Vite and launch-editor GitHub repositories publish, and act on one that lists your Vite release even when npm audit is clean. npm audit only flags a release once its advisory reaches the GitHub Advisory Database, which can lag the repository by days, and Vite bundles launch-editor inside its own package, so launch-editor advisories reach you only through the Vite ranges they list.
• Treat Vite configuration, plugin hooks, imported code, and PostCSS/preprocessor configuration as privileged build inputs. Isolate builds of untrusted projects from credentials, signing keys, and writable shared caches; Vite trusts project files and dependencies.
• Never interpolate request, tenant, repository-fork, or user-controlled values into --config, --mode, module IDs, glob roots, plugin arrays, define, proxy targets, or build paths.
• Compare resolved configs for serve, build, preview, SSR, and every supported mode. Preview also uses command: 'serve'; check isPreview and isSsrBuild explicitly and