fix(app): pin vite to 8.0.16 — rolldown 8.1.5 bundle broke anyplot.ai (white-screen outage)#9670
Merged
Merged
Conversation
…k (site outage) The npm-minor group (#9657) bumped vite to 8.1.5; its rolldown 1.1.5 codegen breaks our manualChunks mui/@emotion chunk at init ('TypeError: t is not a function') and anyplot.ai white-screened while HTTP stayed 200 and CI stayed green (jsdom tests don't run the bundle). Verified by bisect: builds at #8330 (vite 8.0.16) boot, current main (8.1.5) crashes, and re-pinning 8.0.16 reproduces the known-good mui chunk hash byte-exactly (mui-DhJTAfML.js) with the app rendering in a real browser. Dependabot now ignores vite minor/major bumps until the upstream issue is confirmed fixed browser-side. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Pins the frontend build toolchain to a known-good Vite version to stop a production “white screen” outage caused by a Vite/Rolldown minor upgrade, and prevents Dependabot from reintroducing the breaking bump automatically.
Changes:
- Pin
viteto8.0.16to restore the previously working production bundle output. - Add a Dependabot ignore rule for Vite minor/major updates (to avoid repeat auto-merge outages).
- Document the incident and mitigation in
CHANGELOG.md.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
app/package.json |
Pins Vite to 8.0.16 to avoid the breaking 8.1.x bundler output. |
app/yarn.lock |
Updates lockfile to include the pinned Vite version and associated dependency graph changes. |
.github/dependabot.yml |
Adds an ignore rule intended to stop Dependabot from bumping Vite back to 8.1.x. |
CHANGELOG.md |
Adds a Fixed entry documenting the outage and mitigation. |
Comment on lines
+56
to
+63
| ignore: | ||
| # vite 8.1.x (rolldown 1.1.x) emits a broken mui/emotion chunk with our | ||
| # manualChunks split — the app white-screens with "TypeError: t is not a | ||
| # function" at chunk init (took anyplot.ai down on 2026-07-23, see CHANGELOG). | ||
| # jsdom tests can't catch a broken bundle, so a bump would auto-merge | ||
| # green again. Pinned to 8.0.16; re-test in a browser before lifting. | ||
| - dependency-name: "vite" | ||
| update-types: ["version-update:semver-minor", "version-update:semver-major"] |
Owner
Author
There was a problem hiding this comment.
Applied — vite is now fully frozen (patch/minor/major all ignored) until a fixed rolldown is verified browser-side.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…nge the bundler) Copilot review: an 8.0.x patch bump would still auto-merge green while altering rolldown, and CI doesn't exercise the built bundle. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Open
3 tasks
Comment on lines
+64
to
+68
| [ | ||
| "version-update:semver-patch", | ||
| "version-update:semver-minor", | ||
| "version-update:semver-major", | ||
| ] |
Comment on lines
+138
to
+139
| reverts to the known-good build's. Dependabot now ignores vite minor/major bumps until the | ||
| upstream codegen issue is verified fixed in a real browser. |
Comment on lines
+132
to
+133
| - **anyplot.ai white-screen outage (2026-07-23, ~22:15–23:00 UTC): vite pinned back to | ||
| 8.0.16** — the npm-minor Dependabot group (#9657) bumped vite 8.0.16 → 8.1.5, whose rolldown |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outage
Since ~22:15 UTC anyplot.ai serves a blank page: the
muichunk crashes at init (TypeError: t is not a functionatmui-BsYJ4sJA.js:1:54). HTTP stays 200 everywhere and CI stays green — jsdom tests never execute the built bundle, so nothing caught it.Root cause
The npm-minor Dependabot group (#9657, merged 22:13 UTC) bumped vite 8.0.16 → 8.1.5 (rolldown 1.0.3 → 1.1.5). The new bundler's codegen emits a broken
mui/@emotionchunk under ourmanualChunkssplit.Bisect (each step: clean install + build + real-browser check via Playwright):
28bf851df(pre-react-group)mui-D3S8Baso4d95a747c(#8330 react 19.2.8)mui-DhJTAfMLd56329aa1(#9657 npm-minor) / mainmui-BsYJ4sJAmui-DhJTAfML(react 19.2.8 was initially suspected and is exonerated — pinning react back on main changed nothing; pinning vite alone restores the exact known-good chunk hash.)
Fix
app/package.json:vitepinned to exact8.0.16(build-time dep only, zero runtime surface)..github/dependabot.yml: ignore vite minor/major bumps with an explanatory comment — the next npm-minor group would otherwise re-bump vite and auto-merge green again, since no CI gate executes the built bundle. Lift the ignore once a newer vite is verified in a real browser.Post-merge
Cloud Build deploys the healed bundle (~10 min). If Cloud Run traffic was manually pinned to revision
anyplot-app-00124-vqnduring the incident, reset with--to-latestafter the new revision is live.Follow-up (separate): add a CI smoke gate that loads the built bundle in a headless browser, so a broken chunk can never ship green again.
🤖 Generated with Claude Code