sapphi_red

@sapphi.red

@vite.dev core team member.

Vite 8.2 is out 🚀 • Top-level `input` option: No need to use `build.rolldownOptions` • Warnings for config features the native loader can't handle yet • PostCSS config type export for type-safe configs • Dev URLs now labeled by their interfaces More info in the changelog github.com/vitejs/vite/...

github.com

Less than four months after @vite.dev 8 shipped, it already surpassed the weekly downloads of Vite 7! If you weren't one of the 47.3m downloads last week and haven't migrate yet, what is holding you back? 👀

Bar chart showing per-version downloads for 5 major versions of the vite package, from 24 Jun to 30 Jun, 2026 from the v4.x version to the v8.x version. The most downloaded version is v8.x with 47.3m downloads. v7.x version was downloaded 43.7m times, v6.x version was downloaded 19.9m times, v5.x version was downloaded 28.2m times, v4.x version was downloaded 2.5m times.

I'm excited to join Cloudflare! 😀 I'll continue working on Vite and Rolldown just as before, and Vite 8.1 is already on its way with some interesting new features 👀

VoidZero is joining Cloudflare. Our mission stays the same: to make JavaScript developers more productive than ever before. Vite, Vitest, Rolldown, Oxc, and Vite+ remain MIT-licensed. Evan and the VoidZero team will continue leading them.

VoidZero + Cloudflare

We've published two Windows-related security advisories: ◇ If Vite runs with `--host`, denied files may have been reachable over the network. ◇ launch-editor with NTLM enabled may leak NTLMv2 hashes via a malicious page. Update to Vite 8.0.16/7.3.5/6.4.3, Vite+ 0.1.24, and launch-editor 2.14.1.

🚀Rolldown 1.0 is here!🚀 Rust-based high-performance JavaScript bundler. 🏎️ Runs at native speed that’s up 30x faster than Rollup 🤝 Compatible with existing Rollup & Vite plugins ⚡The underlying bunder for Vite After 2 years, Rolldown is officially stable and has 20+M weekly downloads.

We published three security advisories affecting the dev server. Only apps using --host are affected. Update now to the patched versions: - Vite 8.0.5 / 7.3.2 / 6.4.2 - Vite+ 0.1.16 Links to each vulnerability report below.

Announcing Vite+ Alpha. Now open source. To make JavaScript developers more productive than ever before. A single binary that: ◆ Unifies your frontend toolchain ◆ Manages your runtime & pkg manager ◆ Caching & monorepo support Works with every framework and meta framework in the Vite ecosystem.

Announcing Vite+ Alpha

Introducing Vite+, an open-source CLI that unifies your runtime, package manager, and frontend toolchain into one fast, simple development experience.

voidzero.dev

Wondering how Node-compatible runtimes handle vulns in Node. IIRC they use JS code forked from Node, which means they'd have the same vulnerabilities if the vuln exists in the JS side. Does that mean that there's a window where they're vulnerable to 0-day exploits whenever one is discovered?

The State of JS 2025 results are out! 🏆 Most Adopted Tech → Vitest 🏆 Highest Satisfaction → Vite (98%) & Vitest (97%) 🏆 Highest Interest → Vitest (83%) & Rolldown (80%) But that's not all! A thread 🧵

Bild

Rolldown 1.0 RC is here 🎉 🔒 Stable API: No breaking changes planned before 1.0 ⚡ 10-30x faster than Rollup while staying compatible 🧩 Multiple chunking algorithm improvements 📦 3,400+ commits since beta: 749 features, 682 fixes, 109 perf optimizations

Bild

Introducing the Astro 6.0 Beta. - Redesigned dev server: run against the same runtime you deploy to - First-class Cloudflare Workers support with workerd - Stable Content Security Policy and Live Collections It's never been a beta time to try Astro 👀

Bild