Vite 8.1

Apply the Node.js 24 and TypeScript 7 prompts first. Use these rules for Vite 8.1, including its Rolldown/Oxc pipeline, development and preview servers, WebSocket transport, console forwarding, and SSR integrations; they were checked against 8.1.5.

Supported patch and trusted configuration

• Keep the Node.js 24 runtime current through the Node.js prompt's release rule. Vite 8.1.5 declares ^20.19.0 || >=22.12.0 compatibility; that range does not establish ongoing Node.js support. Check Vite's security-backport policy for whether the 8.1 line still receives security patches.
• Read the security advisories the Vite and launch-editor GitHub repositories publish, and act on one that lists your Vite release even when npm audit is clean. npm audit only flags a release once its advisory reaches the GitHub Advisory Database, which can lag the repository by days, and Vite bundles launch-editor inside its own package, so launch-editor advisories reach you only through the Vite ranges they list.
• Treat vite.config.*, its imports, plugins, PostCSS configuration, and preprocessors as privileged executable code. Changing --configLoader between bundle, runner, and native does not sandbox configuration; explicitly restart after imported config dependencies change when using native.
• Reject request data, tenant values, untrusted pull-request variables, and user paths anywhere they could select --config, --mode, plugins, module IDs, glob roots, define values, network destinations, or build locations.
• Inspect the fully resolved configuration for development,