[pull] main from vitejs:main

.github/workflows/ci.yml

@@ -43,6 +43,7 @@ jobs:
         with:
           # Assume PRs are less than 50 commits
           fetch-depth: 50
+          persist-credentials: false
 
       - name: Get changed files
         id: changed-files
@@ -76,6 +77,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
@@ -149,6 +152,8 @@ jobs:
     name: "Lint: node-24, ubuntu-latest"
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6

.github/workflows/copilot-setup-steps.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6

.github/workflows/ecosystem-ci-trigger.yml

@@ -107,9 +107,11 @@ jobs:
       - name: Check Package Existence
         uses: actions/github-script@v9
         id: check-package
+        env:
+          PR_DATA: ${{ steps.get-pr-data.outputs.result }}
         with:
           script: |
-            const prData = ${{ steps.get-pr-data.outputs.result }}
+            const prData = JSON.parse(process.env.PR_DATA)
             const url = `https://pkg.pr.new/vite@${prData.commit}`
             const response = await fetch(url)
             console.log(`Package check URL: ${url}, Status: ${response.status}`)

.github/workflows/issue-template-check.yml

@@ -18,6 +18,8 @@ jobs:
       skip: ${{ steps.detect.outputs.skip }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Detect issue type
         id: detect

.github/workflows/preview-release.yml

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
@@ -52,4 +54,6 @@ jobs:
         working-directory: ./packages/plugin-legacy
         run: pnpm build
 
-      - run: pnpm dlx pkg-pr-new@0.0 publish --pnpm './packages/vite' './packages/plugin-legacy' --packageManager=pnpm,npm,yarn --commentWithDev
+      - name: Publish preview release
+        # zizmor: ignore[use-trusted-publishing]
+        run: pnpm dlx pkg-pr-new@0.0 publish --pnpm './packages/vite' './packages/plugin-legacy' --packageManager=pnpm,npm,yarn --commentWithDev

.github/workflows/publish.yml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6

.github/workflows/pull-request-template-check.yml

@@ -1,10 +1,11 @@
 name: Pull Request Template Check
 
-# SAFETY: pull_request_target is used here because:
-# - The workflow does NOT check out PR code (actions/checkout checks out the base branch)
-# - Only PR metadata (title, body) from the event payload is read
-# - No PR-supplied code is executed
 on:
+  # zizmor: ignore[dangerous-triggers]
+  # SAFETY: pull_request_target is used here because:
+  # - The workflow does NOT check out PR code (actions/checkout checks out the base branch)
+  # - Only PR metadata (title, body) from the event payload is read
+  # - No PR-supplied code is executed
   pull_request_target:
     types: [opened]
 
@@ -20,6 +21,8 @@ jobs:
       agent_output: ${{ steps.agent.outputs.agent_output }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - uses: warpdotdev/oz-agent-action@ce1621abf6a8ed8afdd4e4cc994545ede8fe1c6f # v1
         id: agent

.github/workflows/release-tag.yml

@@ -17,6 +17,8 @@ jobs:
       contents: write # for yyx990803/release-tag to create a release tag
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Get pkgName for tag
         id: tag

.github/workflows/semantic-pull-request.yml

@@ -1,6 +1,11 @@
 name: Semantic Pull Request
 
 on:
+  # zizmor: ignore[dangerous-triggers]
+  # SAFETY: pull_request_target is used here because:
+  # - The workflow does NOT check out PR code
+  # - Only PR title is read
+  # - No PR-supplied code is executed
   pull_request_target:
     types:
       - opened

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: Zizmor
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/**"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

.github/zizmor.yml

@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        github/*: ref-pin
+  cache-poisoning:
+    ignore:
+      - ci.yml # it is not used for publishing

docs/package.json

@@ -14,7 +14,7 @@
     "@voidzero-dev/vitepress-theme": "^4.8.4",
     "feed": "^5.2.1",
     "markdown-it-image-size": "^15.0.1",
-    "oxc-minify": "^0.129.0",
+    "oxc-minify": "^0.130.0",
     "vitepress": "^2.0.0-alpha.17",
     "vitepress-plugin-graphviz": "^0.1.0",
     "vitepress-plugin-group-icons": "^1.7.5",

package.json

@@ -64,7 +64,7 @@
     "oxfmt": "^0.48.0",
     "picocolors": "^1.1.1",
     "playwright-chromium": "^1.59.1",
-    "rolldown": "1.0.0",
+    "rolldown": "1.0.1",
     "rollup": "^4.59.0",
     "simple-git-hooks": "^2.13.1",
     "tsx": "^4.21.0",

packages/vite/package.json

@@ -76,7 +76,7 @@
     "lightningcss": "^1.32.0",
     "picomatch": "^4.0.4",
     "postcss": "^8.5.14",
-    "rolldown": "1.0.0",
+    "rolldown": "1.0.1",
     "tinyglobby": "^0.2.16"
   },
   "optionalDependencies": {

packages/vite/src/node/__tests__/plugins/define.spec.ts

@@ -27,6 +27,9 @@ async function createDefinePluginTransform(
       )
       return result?.code || result
     } else {
+      const nativeDefinePlugin = await (
+        definePlugin(config) as any
+      ).applyToEnvironment(environment)
       const bundler = await rolldown({
         input: 'entry.js',
         plugins: [
@@ -45,9 +48,7 @@ async function createDefinePluginTransform(
           },
           {
             name: 'native:define',
-            options: (definePlugin(config).options! as any).bind({
-              environment,
-            }),
+            options: nativeDefinePlugin.options.bind({ environment }),
           },
         ],
         experimental: {

packages/vite/src/node/build.ts

@@ -512,18 +512,24 @@ export function resolveBuildPlugins(config: ResolvedConfig): {
       ...(isBuild && !config.isWorker ? [prepareOutDirPlugin()] : []),
       perEnvironmentPlugin(
         'vite:rollup-options-plugins',
-        async (environment) =>
-          (
+        async (environment) => {
+          if (!isBuild && !environment.config.isBundled) {
+            return false
+          }
+          return (
             await asyncFlatten(
               arraify(environment.config.build.rollupOptions.plugins),
             )
-          ).filter(Boolean) as Plugin[],
+          ).filter(Boolean) as Plugin[]
+        },
       ),
       ...(config.isWorker ? [webWorkerPostPlugin(config)] : []),
     ],
     post: [
       ...(isBuild ? buildImportAnalysisPlugin(config) : []),
-      ...(config.build.minify === 'esbuild' ? [buildEsbuildPlugin()] : []),
+      ...(isBuild && config.build.minify === 'esbuild'
+        ? [buildEsbuildPlugin()]
+        : []),
       ...(isBuild ? [terserPlugin(config)] : []),
       ...(isBuild && !config.isWorker
         ? [

packages/vite/src/node/config.ts

@@ -303,6 +303,17 @@ export interface SharedEnvironmentOptions {
    * Optimize deps config
    */
   optimizeDeps?: DepOptimizationOptions
+  /**
+   * Whether this environment produces a bundled output.
+   *
+   * During `build`, this defaults to `true` for every environment.
+   * During `serve`, this defaults to `true` only for the client environment
+   * when `experimental.bundledDev` is enabled, and `false` otherwise.
+   * Setting this explicitly on an environment always overrides the default.
+   *
+   * @experimental
+   */
+  isBundled?: boolean
 }
 
 export interface EnvironmentOptions extends SharedEnvironmentOptions {
@@ -326,6 +337,7 @@ export type ResolvedEnvironmentOptions = {
   optimizeDeps: DepOptimizationOptions
   dev: ResolvedDevEnvironmentOptions
   build: ResolvedBuildEnvironmentOptions
+  isBundled: boolean
   plugins: readonly Plugin[]
   /** @internal */
   optimizeDepsPluginNames: string[]
@@ -568,7 +580,11 @@ export interface ExperimentalOptions {
    */
   hmrPartialAccept?: boolean
   /**
-   * Enable full bundle mode.
+   * Enable full bundle mode during `serve`.
+   *
+   * This seeds the default for the client environment's `isBundled` option.
+   * Other environments default to `false` during `serve`. Any environment
+   * can override its `isBundled` value via `environments[name].isBundled`.
    *
    * This is highly experimental.
    *
@@ -654,8 +670,6 @@ export interface ResolvedConfig extends Readonly<
     cacheDir: string
     command: 'build' | 'serve'
     mode: string
-    /** `true` when build or full-bundle mode dev */
-    isBundled: boolean
     isWorker: boolean
     // in nested worker bundle to find the main config
     /** @internal */
@@ -907,6 +921,7 @@ function resolveEnvironmentOptions(
   forceOptimizeDeps: boolean | undefined,
   logger: Logger,
   environmentName: string,
+  isBuild: boolean,
   isBundledDev: boolean,
   // Backward compatibility
   isSsrTargetWebworkerSet?: boolean,
@@ -918,6 +933,9 @@ function resolveEnvironmentOptions(
   const isSsrTargetWebworkerEnvironment =
     isSsrTargetWebworkerSet && environmentName === 'ssr'
 
+  const isBundled =
+    options.isBundled ?? (isBuild || (isClientEnvironment && isBundledDev))
+
   if (options.define?.['process.env']) {
     const processEnvDefine = options.define['process.env']
     if (typeof processEnvDefine === 'object') {
@@ -970,9 +988,10 @@ function resolveEnvironmentOptions(
       options.build ?? {},
       logger,
       consumer,
-      isBundledDev,
+      isBundled && !isBuild,
       isSsrTargetWebworkerEnvironment,
     ),
+    isBundled,
     plugins: undefined!, // to be resolved later
     // will be set by `setOptimizeDepsPluginNames` later
     optimizeDepsPluginNames: undefined!,
@@ -1608,6 +1627,7 @@ export async function resolveConfig(
       inlineConfig.forceOptimizeDeps,
       logger,
       environmentName,
+      isBuild,
       isBundledDev,
       config.ssr?.target === 'webworker',
       config.server?.preTransformRequests,
@@ -1900,7 +1920,6 @@ export async function resolveConfig(
     cacheDir,
     command,
     mode,
-    isBundled: config.experimental?.bundledDev || isBuild,
     isWorker: false,
     mainConfig: null,
     bundleChain: [],

packages/vite/src/node/plugins/asset.ts

@@ -475,7 +475,7 @@ async function fileToBuiltUrl(
 
     if (
       environment.config.command === 'serve' &&
-      environment.config.experimental.bundledDev
+      environment.config.isBundled
     ) {
       const outputFilename = pluginContext.getFileName(referenceId)
       url = toOutputFilePathInJSForBundledDev(environment, outputFilename)

packages/vite/src/node/plugins/clientInjections.ts

@@ -34,6 +34,9 @@ export function clientInjectionsPlugin(config: ResolvedConfig): Plugin {
 
   return {
     name: 'vite:client-inject',
+    applyToEnvironment(environment) {
+      return !environment.config.isBundled
+    },
     async buildStart() {
       injectConfigValues = await createClientConfigValueReplacer(config)
     },

packages/vite/src/node/plugins/css.ts

@@ -491,7 +491,9 @@ export function cssPostPlugin(config: ResolvedConfig): Plugin {
       return path.dirname(
         assetFileNames({
           type: 'asset',
+          name: cssAssetName,
           names: [cssAssetName],
+          originalFileName,
           originalFileNames: originalFileName ? [originalFileName] : [],
           source: '/* vite internal call, ignore */',
         }),
@@ -594,7 +596,7 @@ export function cssPostPlugin(config: ResolvedConfig): Plugin {
 
           const cssContent = await getContentWithSourcemap(css)
           const code = [
-            config.isBundled
+            this.environment.config.isBundled
               ? `const { updateStyle: __vite__updateStyle, removeStyle: __vite__removeStyle } = import.meta.hot._internal`
               : `import { updateStyle as __vite__updateStyle, removeStyle as __vite__removeStyle } from ${JSON.stringify(
                   path.posix.join(config.base, CLIENT_PUBLIC_PATH),
@@ -1175,6 +1177,10 @@ export function cssAnalysisPlugin(config: ResolvedConfig): Plugin {
   return {
     name: 'vite:css-analysis',
 
+    applyToEnvironment(environment) {
+      return !environment.config.isBundled
+    },
+
     transform: {
       filter: {
         id: {