chore(deps-dev): bump laravel-vite-plugin from 2.1.0 to 3.1.3 by dependabot[bot] · Pull Request #13 · vickymaulana/laravel13-stisla

dependabot · 2026-07-21T23:58:00Z

Bumps laravel-vite-plugin from 2.1.0 to 3.1.3.

Release notes

Sourced from laravel-vite-plugin's releases.

v3.1.3

Full Changelog: laravel/vite-plugin@v3.1.2...v3.1.3

v3.1.2

What's Changed

Bump publish workflow node version by @joetannenbaum in laravel/vite-plugin#383

Full Changelog: laravel/vite-plugin@v3.1.1...v3.1.2

v3.1.1

What's Changed

Bump fontaine peer dependency by @joetannenbaum in laravel/vite-plugin#354

Pin GitHub Actions to commit SHAs and add Dependabot config by @joetannenbaum in laravel/vite-plugin#355

GitHub Actions hardening by @nunomaduro in laravel/vite-plugin#362

Add Dependabot cooldown of 5 days by @nunomaduro in laravel/vite-plugin#363

Bump github/codeql-action from 3.35.4 to 4.36.0 in the github-actions group across 1 directory by @dependabot[bot] in laravel/vite-plugin#358

Enable Dependabot auto-merge by @nunomaduro in laravel/vite-plugin#364

Bump the github-actions group with 2 updates by @dependabot[bot] in laravel/vite-plugin#367

Bump esbuild from 0.27.4 to 0.28.1 by @dependabot[bot] in laravel/vite-plugin#376

[3.x] Sanitize variable font weight ranges in emitted asset filenames by @naveentehrpariya in laravel/vite-plugin#375

[3.x] Respect the resolved Vite base in generated font CSS URLs by @naveentehrpariya in laravel/vite-plugin#372

[3.x] Use spec-compliant format() keywords for ttf, otf, and eot fonts by @naveentehrpariya in laravel/vite-plugin#371

[3.x] Honor the subsets option for google and bunny providers by @naveentehrpariya in laravel/vite-plugin#374

[3.x] Warn when optimized font fallbacks cannot be generated by @naveentehrpariya in laravel/vite-plugin#373

[3.x] Small fix in v3 upgrade guide by @gdebrauwer in laravel/vite-plugin#346

Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in laravel/vite-plugin#381

Bump the github-actions group with 3 updates by @dependabot[bot] in laravel/vite-plugin#382

New Contributors

@nunomaduro made their first contribution in laravel/vite-plugin#362

@naveentehrpariya made their first contribution in laravel/vite-plugin#375

@gdebrauwer made their first contribution in laravel/vite-plugin#346

Full Changelog: laravel/vite-plugin@v3.1.0...v3.1.1

v3.1.0

Full Changelog: laravel/vite-plugin@v3.0.3...v3.1.0

v3.0.3

What's Changed

Add font optimization plugin by @WendellAdriel in laravel/vite-plugin#348

Add release script and publish workflow by @joetannenbaum in laravel/vite-plugin#351

New Contributors

@WendellAdriel made their first contribution in laravel/vite-plugin#348

@joetannenbaum made their first contribution in laravel/vite-plugin#351

Full Changelog: laravel/vite-plugin@v3.0.1...v3.0.3

... (truncated)

Changelog

Sourced from laravel-vite-plugin's changelog.

v3.1.3 - 2026-07-13

Full Changelog: laravel/vite-plugin@v3.1.2...v3.1.3

v3.1.2 - 2026-07-13

What's Changed

Bump publish workflow node version by @joetannenbaum in laravel/vite-plugin#383

Full Changelog: laravel/vite-plugin@v3.1.1...v3.1.2

v3.1.1 - 2026-07-13

What's Changed

Bump fontaine peer dependency by @joetannenbaum in laravel/vite-plugin#354

Pin GitHub Actions to commit SHAs and add Dependabot config by @joetannenbaum in laravel/vite-plugin#355

GitHub Actions hardening by @nunomaduro in laravel/vite-plugin#362

Add Dependabot cooldown of 5 days by @nunomaduro in laravel/vite-plugin#363

Bump github/codeql-action from 3.35.4 to 4.36.0 in the github-actions group across 1 directory by @dependabot[bot] in laravel/vite-plugin#358

Enable Dependabot auto-merge by @nunomaduro in laravel/vite-plugin#364

Bump the github-actions group with 2 updates by @dependabot[bot] in laravel/vite-plugin#367

Bump esbuild from 0.27.4 to 0.28.1 by @dependabot[bot] in laravel/vite-plugin#376

[3.x] Sanitize variable font weight ranges in emitted asset filenames by @naveentehrpariya in laravel/vite-plugin#375

[3.x] Respect the resolved Vite base in generated font CSS URLs by @naveentehrpariya in laravel/vite-plugin#372

[3.x] Use spec-compliant format() keywords for ttf, otf, and eot fonts by @naveentehrpariya in laravel/vite-plugin#371

[3.x] Honor the subsets option for google and bunny providers by @naveentehrpariya in laravel/vite-plugin#374

[3.x] Warn when optimized font fallbacks cannot be generated by @naveentehrpariya in laravel/vite-plugin#373

[3.x] Small fix in v3 upgrade guide by @gdebrauwer in laravel/vite-plugin#346

Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in laravel/vite-plugin#381

Bump the github-actions group with 3 updates by @dependabot[bot] in laravel/vite-plugin#382

New Contributors

@nunomaduro made their first contribution in laravel/vite-plugin#362

@naveentehrpariya made their first contribution in laravel/vite-plugin#375

@gdebrauwer made their first contribution in laravel/vite-plugin#346

Full Changelog: laravel/vite-plugin@v3.1.0...v3.1.1

v3.1.0 - 2026-04-29

Full Changelog: laravel/vite-plugin@v3.0.3...v3.1.0

v3.0.3 - 2026-04-29

What's Changed

Add font optimization plugin by @WendellAdriel in laravel/vite-plugin#348

... (truncated)

Upgrade guide

Sourced from laravel-vite-plugin's upgrade guide.

Upgrade Guide

2.x to 3.x

Adds support for Vite 8

Upgrade Path

If you are using import.meta.glob to add static assets into your build, you will need to migrate them to the new assets config option, e.g.,
// file: ./resources/js/app.js
import './bootstrap';

import.meta.glob([

'../images/**',



'../favicons/**',


])
// file: ./vite.config.js
import { defineConfig } from 'vite';
import laravel from 'laravel-vite-plugin';
export default defineConfig({
plugins: [
laravel({
input: ['resources/css/app.css', 'resources/js/app.js'],
refresh: true,


      assets: [



          'resources/images/**',



          'resources/favicons/**',



      ],
  }),

],
});
0.x to 1.x

Adds support for Vite 5 and removes support for Vite 3 and 4.

Introduces an npx clean-orphaned-assets command to clean orphaned assets in Vite's build directories.

Introduces Valet / Herd TLS certificate auto detection.

Adds app/Livewire/** to the default "refresh" paths.

Adds output of SSR manifest for SSR builds.

Notable Changes

... (truncated)

Commits

a6987d3 v3.1.3
b0e75e6 Update package.json
ec3f849 Update CHANGELOG
0bc07e2 Update publish.yml (#383)
a81e392 Update CHANGELOG
ec233de v3.1.1
cd604c0 Bump the github-actions group with 3 updates (#382)
e3e3db3 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (#381)
596b51e Merge pull request #346 from gdebrauwer/fix-v3-upgrade-guide
5f4b5b6 [3.x] Warn when optimized font fallbacks cannot be generated (#373)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for laravel-vite-plugin since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Refresh backend (Composer) and frontend (npm) lockfiles within their existing version constraints to pull in security patches. - laravel/framework 13.6.0 -> 13.21.1 (fixes high-severity advisories) - symfony/* and guzzlehttp/* patched - axios 1.15.2 -> 1.18.1 plus transitive npm fixes composer audit and npm audit now report no known vulnerabilities.

- Add Larastan/PHPStan (level 5) via phpstan.neon and `composer analyse`. - Add explicit pint.json (Laravel preset) plus `composer lint`/`lint:test`. - Enforce Pint style check and PHPStan analysis in the CI pipeline. - Add Dependabot config (Composer, npm, GitHub Actions; weekly). - Add a pull request template and un-ignore both new .github files. - Resolve all PHPStan level 5 findings: guard ReflectionNamedType before getName(), correct model factory return types, and use list<string> for the User $fillable/$hidden annotations.

- Gate admin routes with role_or_permission:superadmin|<permission> so non-superadmin roles can be granted specific capabilities. Superadmin behaviour is unchanged (it retains all permissions). - Adopt route-model binding for user, activity-log, and file routes. The {file} binding is scoped to the authenticated user, so foreign files resolve to a 404 (existence is never leaked across accounts). - Restrict the file manager show endpoint to an explicit safe field subset (no storage path or owner id in the JSON response). - Enforce authorization in the settings, notification, and role Form Requests instead of returning true. - Add feature tests for the permission gates and the hardened show response.

Update README (Testing & Quality, CI Pipeline) and add a 4.2.0 CHANGELOG entry covering the dependency/security refresh, static analysis, granular permissions, and file manager hardening.

Bumps [laravel-vite-plugin](https://github.com/laravel/vite-plugin) from 2.1.0 to 3.1.3. - [Release notes](https://github.com/laravel/vite-plugin/releases) - [Changelog](https://github.com/laravel/vite-plugin/blob/3.x/CHANGELOG.md) - [Upgrade guide](https://github.com/laravel/vite-plugin/blob/3.x/UPGRADE.md) - [Commits](laravel/vite-plugin@v2.1.0...v3.1.3) --- updated-dependencies: - dependency-name: laravel-vite-plugin dependency-version: 3.1.3 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

chatgpt-codex-connector · 2026-07-21T23:58:03Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

dependabot · 2026-07-22T00:07:26Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

vickym1010 and others added 5 commits July 21, 2026 23:56

docs: document tooling, security, and permission updates

eb51b1c

Update README (Testing & Quality, CI Pipeline) and add a 4.2.0 CHANGELOG entry covering the dependency/security refresh, static analysis, granular permissions, and file manager hardening.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026

vickymaulana force-pushed the main branch from eb51b1c to 4d44ea5 Compare July 22, 2026 00:06

vickymaulana closed this Jul 22, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/laravel-vite-plugin-3.1.3 branch July 22, 2026 00:07

Navigation Menu

chore(deps-dev): bump laravel-vite-plugin from 2.1.0 to 3.1.3 - #13

chore(deps-dev): bump laravel-vite-plugin from 2.1.0 to 3.1.3#13
dependabot[bot] wants to merge 5 commits into
mainfrom
dependabot/npm_and_yarn/laravel-vite-plugin-3.1.3

dependabot Bot commented on behalf of github Jul 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 21, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Jul 21, 2026

v3.1.3

v3.1.2

What's Changed

v3.1.1

What's Changed

New Contributors

v3.1.0

v3.0.3

What's Changed

New Contributors

v3.1.3 - 2026-07-13

v3.1.2 - 2026-07-13

What's Changed

v3.1.1 - 2026-07-13

What's Changed

New Contributors

v3.1.0 - 2026-04-29

v3.0.3 - 2026-04-29

What's Changed

Upgrade Guide

2.x to 3.x

Upgrade Path

0.x to 1.x

Notable Changes

Uh oh!

chatgpt-codex-connector Bot commented Jul 21, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`2.x` to `3.x`

`0.x` to `1.x`