feat: upgrade vite to v8, plugin-react to v6, vite-node to v6

[stipsan]

Description

Builds upon #698

FIXES SDK-1254
FIXES SAPP-3887

What to review

Testing

[claude]

Claude finished @stipsan's task in 3m 20s —— View job

---

Review

• Read PR diff and changed files
• Review code quality, bugs, and tests
• Verify changeset
• Post review

---

Issues that need fixing

1. Failing test — getViteConfig.test.ts:191 still expects 'esbuild'

getViteConfig.ts:200 was changed to minify: minify ? 'oxc' : false, but the test still asserts:

expect(config.build).toMatchObject({
  …
  minify: 'esbuild',
  …
})

This will fail CI for the should create production config with minification test.

-      minify: 'esbuild',
+      minify: 'oxc',

Fix this →

2. fixtures/nextjs-app/tsconfig.json changed jsx from "preserve" to "react-jsx"

This looks unintentional. Next.js apps almost always set jsx: "preserve" so the SWC/Next compiler handles the JSX transform; switching to react-jsx makes TS emit _jsx(...) calls and can break Next's own pipeline assumptions (and any consumer relying on next dev/next build reading this file).

If the goal was just to pick up new .next/types/** files in include, restore the jsx value.

-    "jsx": "react-jsx",
+    "jsx": "preserve",

3. fixtures/nextjs-app/tsconfig.json reformatting noise

The bulk of the diff is an auto-formatter expanding every array/object to one-element-per-line (e.g. "lib": ["dom", "dom.iterable", "esnext"] → multi-line). Either revert the formatting, or apply that formatter consistently across the repo's other tsconfigs in a separate PR. Mixing a real change with whole-file reformatting hides the actual change.

Notes (not blockers)

• promisifyWorker.ts:38-43: the timeout path calls worker.terminate() + removeAllListeners() inline but bypasses cleanup(), so it skips the unref() + deferred-terminate safety net that the rest of the handlers use. Functionally fine (terminate is sufficient on timeout), but it's a small inconsistency — calling cleanup() after terminate() (or extracting the unref/listener-removal into a shared helper) would keep the four exit paths uniform.
• Vendor named-exports plugin and getCjsNamedExports are well-scoped, well-tested, and the rationale comments explain the Rolldown/Vite 8 constraints clearly. The fail-loud behavior on Rolldown codegen drift is the right call.
• New cjs-module-lexer dependency is justified — it's the same lexer Node uses for CJS↔ESM interop, and there's no equivalent existing dep.
• Changeset (.changeset/pr-698.md) is present and minor is appropriate for the bump.
  · Branch

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​oclif/​plugin-not-found@​3.2.86
	npm/​@​rolldown/​plugin-babel@​0.2.3
	npm/​typescript-eslint@​8.59.4
	npm/​vitest@​4.1.7
	npm/​tsx@​4.22.3
	npm/​@​vitest/​coverage-istanbul@​4.1.7
	npm/​react@​19.2.5
	npm/​cjs-module-lexer@​2.2.0
	npm/​eslint@​10.4.0
	npm/​vite-node@​6.0.0
	npm/​@​vitejs/​plugin-react@​6.0.2
	npm/​@​swc/​core@​1.15.40
	npm/​@​eslint/​compat@​2.1.0
	npm/​react-dom@​19.2.5
	npm/​knip@​6.14.2
	npm/​@​sanity/​vision@​5.28.0
	npm/​nock@​14.0.15
	npm/​@​inquirer/​prompts@​8.4.3
	npm/​@​sanity/​pkg-utils@​10.5.1
	npm/​react-is@​19.2.6

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Install-time scripts: npm @swc/core during postinstall Install script: postinstall Source: node postinstall.js From: packages/@sanity/cli-build/package.json → npm/@swc/core@1.15.40 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@swc/core@1.15.40. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (52a0c789)

@sanity/cli

Metric	Value	vs main (52a0c78)
Internal (raw)	2.1 KB	-
Internal (gzip)	799 B	-
Bundled (raw)	11.13 MB	-
Bundled (gzip)	2.09 MB	-
Import time	908ms	-5ms, -0.6%

bin:sanity

Metric	Value	vs main (52a0c78)
Internal (raw)	1023 B	-
Internal (gzip)	486 B	-
Bundled (raw)	9.87 MB	-
Bundled (gzip)	1.77 MB	-
Import time	2.03s	-25ms, -1.2%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (52a0c789)

Metric	Value	vs main (52a0c78)
Internal (raw)	97.1 KB	+819 B, +0.8%
Internal (gzip)	23.0 KB	+302 B, +1.3%
Bundled (raw)	21.69 MB	+819 B, +0.0%
Bundled (gzip)	3.44 MB	+222 B, +0.0%
Import time	818ms	+6ms, +0.7%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (52a0c789)

Metric	Value	vs main (52a0c78)
Internal (raw)	908 B	-
Internal (gzip)	483 B	-
Bundled (raw)	931 B	-
Bundled (gzip)	491 B	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[github-actions]

Preview this PR with pkg.pr.new

Run the Sanity CLI

npx https://pkg.pr.new/sanity-io/cli/@sanity/cli@478995d <command>

...Or upgrade project dependencies

📦 @sanity/cli

pnpm install https://pkg.pr.new/@sanity/cli@478995d

📦 @sanity/cli-build

pnpm install https://pkg.pr.new/@sanity/cli-build@478995d

📦 @sanity/cli-core

pnpm install https://pkg.pr.new/@sanity/cli-core@478995d

📦 @sanity/cli-test

pnpm install https://pkg.pr.new/@sanity/cli-test@478995d

📦 @sanity/eslint-config-cli

pnpm install https://pkg.pr.new/@sanity/eslint-config-cli@478995d

View Commit (478995d)