build(deps-dev): bump vite from 8.0.14 to 8.0.16 in /apps/web in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /apps/web directory: vite.

Updates vite from 8.0.14 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

• deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)
• reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

• send 408 on request timeout (#22476) (c85c9ee)
• update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

• capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)
• deps: update all non-major dependencies (#22511) (2686d7d)
• dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)
• glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)
• optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)
• resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#22566) (3052a67)

Code Refactoring

• correct logic in collectAllModules function (#22562) (6978a9c)

Commits

• f94df87 release: v8.0.16
• dc245c7 fix: reject windows alternate paths (#22572)
• 50b9512 fix(deps): reject UNC paths for launch-editor-middleware (#22571)
• 8d1b019 release: v8.0.15
• 2686d7d fix(deps): update all non-major dependencies (#22511)
• 3052a67 chore(deps): update rolldown-related dependencies (#22566)
• e3cfb9d fix(optimizer): close the rolldown bundle when write() rejects (#22528)
• 6978a9c refactor: correct logic in collectAllModules function (#22562)
• 646dbed feat: update rolldown to 1.0.3 (#22538)
• 85a0eff fix: capitalize error messages and remove spurious space in parse error (#22488)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

This PR bumps vite from 8.0.14 to 8.0.16 in apps/web/package.json as an automated Dependabot update.

• The 8.0.16 patch includes two security-relevant fixes: rejecting UNC paths and Windows alternate paths in the dev server middleware, which prevents potential path traversal during development.
• The 8.0.15 intermediate release adds a 408 response on request timeout and several bug fixes (html-proxy cache key mismatch, glob error handling, optimizer bundle cleanup).

Confidence Score: 5/5

Safe to merge — this is a patch-level devDependency update that only affects the local dev server and build tooling, not production runtime code.

The change is a single-line version bump of a devDependency. Both intermediate releases are patch-level with bug and security fixes in the Vite dev server. There is no production runtime impact and the update is straightforward.

No files require special attention.

Important Files Changed

Filename	Overview
apps/web/package.json	Single-line patch bump of vite devDependency from 8.0.14 to 8.0.16; no other changes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["apps/web/package.json"] -->|"vite devDependency"| B["8.0.14 → 8.0.16"]
    B --> C["8.0.15: bug fixes + features"]
    B --> D["8.0.16: security fixes"]
    C --> C1["408 on request timeout"]
    C --> C2["html-proxy cache key fix"]
    C --> C3["optimizer bundle cleanup"]
    D --> D1["Reject UNC paths in dev server"]
    D --> D2["Reject Windows alternate paths"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["apps/web/package.json"] -->|"vite devDependency"| B["8.0.14 → 8.0.16"]
    B --> C["8.0.15: bug fixes + features"]
    B --> D["8.0.16: security fixes"]
    C --> C1["408 on request timeout"]
    C --> C2["html-proxy cache key fix"]
    C --> C3["optimizer bundle cleanup"]
    D --> D1["Reject UNC paths in dev server"]
    D --> D2["Reject Windows alternate paths"]

Loading

_{Reviews (1): Last reviewed commit: "build(deps-dev): bump vite" | Re-trigger Greptile}