Vite 8.2

Apply the Node.js 24 and TypeScript 7 prompts first. These rules target Vite 8.2 with Node.js 24 and were checked against 8.2.2; Vite's declared Node.js engine range is ^20.19.0 || >=22.12.0. They cover Vite configuration, development and preview servers, transforms, browser output, and SSR integration.

Configuration and build tooling

• Read the security advisories the Vite and launch-editor GitHub repositories publish, and act on one that lists your Vite release even when npm audit is clean. npm audit only flags a release once its advisory reaches the GitHub Advisory Database, which can lag the repository by days, and Vite bundles launch-editor inside its own package, so launch-editor advisories reach you only through the Vite ranges they list.
• Treat vite.config.*, its imports, PostCSS configuration, and plugins as executable code with the build process's authority. Changing --configLoader does not sandbox them; run builds of untrusted projects without privileged credentials or host mounts.
• Keep --config, root, base, top-level input, envDir, plugin selection, proxy targets, and output paths under developer control; never derive them from an incoming request or tenant-controlled build parameter.
• Branch configuration deliberately on command, mode, isSsrBuild, and isPreview, accounting for optional flags being undefined. Inspect the resolved settings for every deployed variant; defineConfig supplies typing, not security validation.
• Review oxc, build.rolldownOptions, worker.rolldownOptions, and optimizeDeps.rolldownOptions