Bump vite to 5.4.14

[r100-stack]

Changes

After PR TODO from #2256 (#2256 (comment)).

Fixes GHSA-vg6x-rcgg-rjx6. Closed #2409 in favor of this PR.

---

Bumps vite from ~5.1 to ~5.4.14 (after deduping, only 5.4.14 is used atm).

After the bump, the styles.css was not getting generated in styles.js/dist. Looks like it is because of vitejs/vite/#16051 from 5.2.0-beta.0.

To fix it, I added the vite plugin suggested in vitejs/vite#16051 (comment). I had tried it when I had opened this PR too. However, it didn't work back then (which is why I had tried another fix which posed other problems; more info below). But since this vite plugin works now, I went ahead with this.

Old fix

To fix it, I renamed styles.module.css to styles.css. If there is a reason why the file has to be a module.css file, then we'd have to import and use the styles somewhere, or something along these lines.

One problem with using styles.css, however, is that the iui- prefix is not there in the generated styles.css file because the css module part of the vite config file is not applied.

Since I noticed multiple vite versions, especially some that were still in the affected range of the security advisory, I also deduped it to only use 5.4.14 (b50db2a). But this caused the css-workshop tests to all fail. To fix it, I changed the test script to replace astro preview with serve and added a wait-on step so that the tests start up only after serve has started up the server. (more info).

Testing

• CI still passing
• The build script is working in the itwinui-react workspace
• The generated styles.css in packages/itwinui-react is unchanged.

Docs

No changeset as vite is used in dev workspaces or listed as devDependencies in the package workspaces (itwinui-react).

[r100-stack]

Update: I recreated the lock file without deduping vite. This is because trying to dedupe caused all css-workshop tests to fail or timeout. So, I added the deduping part as an after PR TODO.

Just fyi, I tried to dedupe just vite by doing the following:

• Add a resolution in the root package.json to have all vite@5 use [email protected]
• Run pnpm i
• Undo the resolution change
• Run pnpm i

[mayank99]

Update: I recreated the lock file without deduping vite.

Can you clarify which versions of vite we are using now? The PR title is misleading if we don't have a single 5.4.14 version.

[r100-stack]

Update: I recreated the lock file without deduping vite.

Can you clarify which versions of vite we are using now? The PR title is misleading if we don't have a single 5.4.14 version.

Ohh, I see. The versions in the package-lock are:

• [email protected]
• [email protected]
• [email protected] (new)
• [email protected]

I kept the title as-is for now even though 5.1.8 doesn't fall within ~5.4.14 since I guess 5.1.8 is not coming from @itwin/itwinui-react.

PR changed significantly since approval.

[mayank99]

LGTM, just make sure to update PR description

I'm noticing CI is failing for react visual tests, but I think that's caused by #2391; maybe one of the Toast images needs to be updated to be less flaky.

[r100-stack]

LGTM, just make sure to update PR description

Sounds good, updated the PR description. Also updated the PR title for clarity.

I'm noticing CI is failing for react visual tests, but I think that's caused by #2391; maybe one of the Toast images needs to be updated to be less flaky.

Ohh, I see. Will take a look. Added it as an after PR TODO in #2391.