# What changed in vite

> 44 changes in vite 7 to 8 from its official release notes, upgrade guides and advisories: 1 breaking, 7 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/vite/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## vite 8

### Breaking changes

- Input option unescaping is removed for now. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)

### Security

- The server checks fs.serve for requests using this query, ensuring the serving restriction is applied. (8.3.3) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.3)
- launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (6.4.3, 7.3.5, 8.0.16) — [security advisory](https://github.com/advisories/GHSA-V6WH-96G9-6WX3)
- vite: `server.fs.deny` bypass on Windows alternate paths (6.4.3, 7.3.5, 8.0.16) — [security advisory](https://github.com/advisories/GHSA-FX2H-PF6J-XCFF)
- Vite: `server.fs.deny` bypassed with queries (7.3.2, 8.0.5) — [security advisory](https://github.com/advisories/GHSA-V2WJ-Q39Q-566R)
- Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket (6.4.2, 7.3.2, 8.0.5) — [security advisory](https://github.com/advisories/GHSA-P9FF-H696-F583)
- Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling (6.4.2, 7.3.2, 8.0.5) — [security advisory](https://github.com/advisories/GHSA-4W7W-66W2-5VF9)

### New APIs and options

- Bundled dev supports import.meta.hot.acceptExports. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)

### Performance

- Avoids settling seen preload dependencies to improve build performance. (8.3.0) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.0)
- Pre-compiles context matchers at server creation to improve proxy performance. (8.3.0) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.0)

### Fixes and other changes

- Skips rewriting adopted styles that have not changed. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Corrects preloads when chunkImportMap is enabled with a non-root base. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Skips caching CSS of chunks in a cycle. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- The optimizer scans deep imports with custom extensions. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Normalizes the file before the root check in ensureWatchedFile. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- HTML handling no longer adds the filesystem root to the watcher. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Vite no longer mutates HMR defaults. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Modules ending with a js-like query are no longer treated as JavaScript. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Resolves imported preprocessors from their file path when using lightningcss. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Waits for in-flight stylesheets in the preload helper. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- A restart requested during another restart is no longer dropped. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Static aliases are matched on path boundaries. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Bundled dev serves /@vite/client. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- Bundled dev stubs @vite/env. (8.3.4) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.4)
- The filename passed to transformIndexHtml no longer includes queries, so plugins receive the expected filename. (8.3.3) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.3)
- Browser:false mappings no longer produce unsupported warnings during dependency optimization. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- The minify option is now merged correctly. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- CSS is preloaded correctly when renderBuiltUrl returns URLs with queries. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- The server handles file watcher errors without crashing. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Object and array printing is limited in size when using forwardConsole. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Bundled dev now serves sourcemaps for lazy chunks. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Whitespace is encoded in the SSR module runner sourceURL. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Excluded optional peer require fallbacks are now preserved by the optimizer. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Queries are now passed to renderBuiltUrl, allowing URL handling to account for query strings. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Bundled dev serves the rolldown runtime from the installed rolldown. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Percent-encoded srcset URLs are now resolved correctly. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- Worker URLs are aligned between client and server when using terser. (8.3.2) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.2)
- The build configuration now merges build.rolldownOptions.output.comments correctly. (8.3.1) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.1)
- The optimizer no longer skips imports whose binding starts with type. (8.3.1) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.1)
- mergeConfig now handles server.ws: false correctly. (8.3.1) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.1)
- Source-map generation now skips URL source roots when injecting sources content. (8.3.1) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.1)
- Handles CRLF line endings when calculating code frame positions. (8.3.0) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.0)
- Treats only whole node_modules path segments as dependencies. (8.3.0) — [release notes](https://github.com/vitejs/vite/releases/tag/v8.3.0)

## vite 7

### Security

- vite allows server.fs.deny bypass via backslash on Windows (5.4.21 … 7.1.11) — [security advisory](https://github.com/advisories/GHSA-93M4-6634-74Q7)