web-tooling-vite-fdb4b0 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited web-tooling-vite-fdb4b0 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Vite is the build tool for frontend apps. Keep path aliases in sync betweenvite.config.tsandtsconfig.json(or useresolve.tsconfigPathsin Vite 8). Use vendor chunk splitting (manualChunksin Vite 7,codeSplitting.groupsin Vite 8). UseloadEnv()for environment-specific builds. Vite 8 uses Rolldown by default withbuild.rolldownOptions.
>
Current versions: Vite 8 (stable, March 2026) with Rolldown bundler. Vite 7 (June 2025) still widely deployed.
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST keep path aliases in sync between `vite.config.ts` and `tsconfig.json` - mismatches cause import resolution failures)
(You MUST use `build.rolldownOptions` in Vite 8+ - `build.rollupOptions` is a deprecated alias)
(You MUST use `codeSplitting.groups` for chunk splitting in Vite 8 - object-form `manualChunks` is removed, function-form deprecated)
(You MUST use `build.modulePreload.polyfill` instead of deprecated `build.polyfillModulePreload`)
(You MUST use Sass modern API (default in Vite 6+) - legacy API is removed in Vite 7+)
</critical_requirements>
Auto-detection: Vite, vite.config.ts, vite.config.js, manualChunks, advancedChunks, codeSplitting, loadEnv, rolldownOptions, rollupOptions, modulePreload, resolve.alias, resolve.tsconfigPaths, build.target, baseline-widely-available
When to use:
When NOT to use:
Key patterns covered:
resolve.tsconfigPaths)manualChunks for Vite 7, codeSplitting for Vite 8)loadEnv and definebaseline-widely-available)Detailed resources:
<philosophy>
Vite should be fast, zero-config by default, and environment-aware. The build tool stays out of your way during development (instant HMR) and optimizes aggressively for production (chunk splitting, minification, tree-shaking).
When to use this skill:
When NOT to use:
</philosophy>
<patterns>
Configure path aliases in both vite.config.ts and tsconfig.json to eliminate deep relative imports. In Vite 8, use resolve.tsconfigPaths: true instead of manual resolve.alias.
// Vite 7: manual resolve.alias
resolve: {
alias: {
"@": path.resolve(__dirname, "./src"),
"@components": path.resolve(__dirname, "./src/components"),
},
},
// Vite 8: built-in tsconfig path resolution
resolve: {
tsconfigPaths: true, // reads from tsconfig.json automatically
},Key point: resolve.tsconfigPaths is disabled by default (performance cost). Enable only if using tsconfig paths. See examples/core.md for complete configs.
Split vendor dependencies into separate chunks for better caching. API differs between Vite 7 and 8.
// Vite 7: manualChunks (object form)
build: {
rollupOptions: {
output: {
manualChunks: {
"vendor": ["react", "react-dom"],
},
},
},
},
// Vite 8: codeSplitting.groups (regex-based)
build: {
rolldownOptions: {
output: {
codeSplitting: {
groups: [
{ name: "vendor", test: /[\\/]node_modules[\\/]react(-dom)?[\\/]/ },
],
},
},
},
},Key point: In Vite 8, object-form manualChunks is removed and function-form is deprecated. Rolldown generates a runtime.js chunk alongside code-split groups. See examples/core.md for full examples.
Use loadEnv() for environment-aware configuration and define for build-time constants.
export default defineConfig(({ mode }) => {
const env = loadEnv(mode, process.cwd(), "");
return {
define: {
__APP_VERSION__: JSON.stringify(process.env.npm_package_version),
},
build: {
sourcemap: mode === "development",
minify: mode === "production",
},
};
});Key point: The third argument to loadEnv() ("") loads all env vars, not just VITE_-prefixed ones. Use --mode flag for environment selection. See examples/core.md for full config with scripts.
build: {
modulePreload: {
polyfill: false, // disable for modern-only targets
resolveDependencies: (filename, deps, { hostId, hostType }) => {
return deps.filter((dep) => !dep.includes("large-vendor"));
},
},
},Key point: build.polyfillModulePreload is deprecated. Use build.modulePreload.polyfill (current API since Vite 6).
css: {
preprocessorOptions: {
scss: {
// modern API is the default in Vite 6+ — no need to specify
additionalData: `@use "@/styles/variables" as *;`,
},
},
},Key point: Legacy API (api: 'legacy') is removed in Vite 7+. Migrate @import to @use/@forward with namespaced access (variables.$color-primary).
Primarily for framework authors. Remains in RC phase as of Vite 8. Most apps do not need this.
environments: {
client: { build: { outDir: "dist/client" } },
ssr: { build: { outDir: "dist/server", ssr: true } },
},See examples/core.md for full multi-environment config.
const DEV_SERVER_PORT = 3000;
const API_PROXY_TARGET = "http://localhost:8000";
server: {
port: DEV_SERVER_PORT,
proxy: {
"/api": { target: API_PROXY_TARGET, changeOrigin: true },
},
},</patterns>
<decision_framework>
Which Vite version?
├─ New project (March 2026+)?
│ └─ Vite 8 (Rolldown bundler, fastest builds) ✓
├─ Existing Vite 7 project?
│ ├─ Build performance is a bottleneck?
│ │ └─ YES → Migrate to Vite 8 (10-30x faster)
│ └─ NO → Stay on Vite 7 (stable, no migration needed)
└─ Existing Vite 6 project?
└─ Plan upgrade to Vite 7 first, then Vite 8How to split chunks?
├─ Vite 8 (Rolldown)?
│ ├─ Simple vendor separation?
│ │ └─ codeSplitting.groups with regex patterns ✓
│ └─ Complex splitting (size limits, shared modules)?
│ └─ codeSplitting with maxSize/minSize/minShareCount
├─ Vite 7 (Rollup)?
│ ├─ Simple vendor separation?
│ │ └─ manualChunks object form ✓
│ └─ Complex splitting logic?
│ └─ manualChunks function form
└─ Vite 7 with rolldown-vite (experimental)?
└─ advancedChunks.groups (renamed to codeSplitting in Vite 8)How to configure path aliases?
├─ Vite 8?
│ ├─ All aliases match tsconfig paths?
│ │ └─ Use resolve.tsconfigPaths: true ✓
│ └─ Need aliases beyond tsconfig paths?
│ └─ Use resolve.alias (manual configuration)
├─ Vite 7 or earlier?
│ └─ Use resolve.alias + sync with tsconfig.json manually ✓
└─ Any version?
└─ ALWAYS keep tsconfig paths in sync with Vite aliasesChoosing build.target?
├─ Supporting legacy browsers (< Safari 16)?
│ └─ Use @vitejs/plugin-legacy
├─ Modern browsers only?
│ ├─ Smallest possible bundle?
│ │ └─ 'esnext'
│ └─ Otherwise → 'baseline-widely-available' (default) ✓
└─ Specific browser requirements?
└─ Use explicit array: ['chrome111', 'safari16.4']See reference.md for quick-lookup tables and migration checklist.
</decision_framework>
<red_flags>
High Priority Issues:
build.rollupOptions in Vite 8 (deprecated alias for build.rolldownOptions - may warn)manualChunks in Vite 8 (removed; use codeSplitting.groups)build.polyfillModulePreload (use build.modulePreload.polyfill)splitVendorChunkPlugin (removed in Vite 7+)target: 'modules' (removed in Vite 7; use 'baseline-widely-available')api: 'legacy' (removed in Vite 7+)vite.config.ts but not tsconfig.json (or vice versa)Medium Priority Issues:
manualChunks in Vite 8 (deprecated, migrate to codeSplitting)Common Mistakes:
.env files with secrets (use .env.local, add to .gitignore)minify: true in development mode (slows rebuilds significantly)Gotchas & Edge Cases:
build.rollupOptions is a deprecated alias for build.rolldownOptions - works but will warnruntime.js chunk when using codeSplitting.groupsresolve.tsconfigPaths disabled by default due to performance costbuild.commonjsOptions is a no-op (Rolldown handles CJS natively)esbuild config option is deprecated - auto-converts to oxc, but not all options are supported (no property mangling, no supported option)splitVendorChunkPlugin removed'modules' to 'baseline-widely-available'advancedChunks renamed to codeSplitting in Vite 8codeSplitting.maxSize is a target, not a strict limitincludeDependenciesRecursively defaults to true - may pull in more than expected.env files are loaded based on --mode flag, not NODE_ENVloadEnv() third argument ("") loads all env vars, not just VITE_-prefixed ones</red_flags>
<critical_reminders>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST keep path aliases in sync between `vite.config.ts` and `tsconfig.json` - mismatches cause import resolution failures)
(You MUST use `build.rolldownOptions` in Vite 8+ - `build.rollupOptions` is a deprecated alias)
(You MUST use `codeSplitting.groups` for chunk splitting in Vite 8 - object-form `manualChunks` is removed, function-form deprecated)
(You MUST use `build.modulePreload.polyfill` instead of deprecated `build.polyfillModulePreload`)
(You MUST use Sass modern API (default in Vite 6+) - legacy API is removed in Vite 7+)
Failure to follow these rules will cause build failures, broken imports, or deprecated API warnings.
</critical_reminders>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.