build: migrate to vite 8

.github/dependabot.yml

@@ -32,38 +32,25 @@ updates:
         update-types:
           - minor
           - patch
-    # Two majors are deliberate holds rather than open questions, so they are not
-    # reproposed every week. Vite 8 swaps the pipeline to Rolldown and Oxc, which is a
-    # rewrite this milestone does not need, and TypeScript 7 is the native port compiler,
-    # far too large to ride in on a dependency sweep. Minor and patch updates to both
+    # Both entries below are held on purpose, so neither is reproposed every week. The
+    # first is a decision: TypeScript 7 is the native port compiler, far too large to
+    # ride in on a dependency sweep and be read as a routine version bump. The second
+    # is a wait, for the reason written beside it. Minor and patch updates to both
     # still arrive as normal.
     ignore:
-      - dependency-name: vite
-        update-types:
-          - version-update:semver-major
       - dependency-name: typescript
         update-types:
           - version-update:semver-major
-      # Unlike the two above, this one is a wait rather than a decision. ESLint 10
-      # cannot install here at all: eslint-plugin-react declares a peer ceiling of
-      # eslint ^9.7 and 7.37.5 is the newest it has published, so npm ci fails on the
-      # peer conflict before a single rule runs. The rest of the stack is already
-      # ready, react-hooks, typescript-eslint and config-prettier all accept ^10.
-      # Drop this entry once eslint-plugin-react publishes a release that accepts
-      # eslint 10, and expect @eslint/js to move to 10.x in the same change.
+      # This one is blocked rather than judged. ESLint 10 cannot install here at all:
+      # eslint-plugin-react declares a peer ceiling of eslint ^9.7 and 7.37.5 is the
+      # newest it has published, so npm ci fails on the peer conflict before a single
+      # rule runs. The rest of the stack is already ready, react-hooks,
+      # typescript-eslint and config-prettier all accept ^10. Drop this entry once
+      # eslint-plugin-react publishes a release that accepts eslint 10, and expect
+      # @eslint/js to move to 10.x in the same change.
       - dependency-name: eslint
         update-types:
           - version-update:semver-major
-      # Not a third decision, a consequence of the vite one above. Every published
-      # 6.x of this plugin declares peer vite ^8, and it carries oxc-transform-react
-      # and @rolldown/plugin-babel as peers besides, so taking it is taking the
-      # Rolldown and Oxc pipeline under another name. There is no 6.x that installs
-      # against vite 7. The pinned 5.2.0 already accepts ^4 through ^8, so it
-      # survives the eventual move and nothing is owed by waiting. Lift this in the
-      # same change that lifts the vite hold, not before and not separately.
-      - dependency-name: "@vitejs/plugin-react"
-        update-types:
-          - version-update:semver-major
 
   # Third-party actions used by the workflow are pinned to commit SHAs. A SHA pin is
   # only a live mitigation while something keeps it current, so the action references

README.md

@@ -91,10 +91,15 @@ The browser target follows the Baseline Widely available rule, taken on
 - Firefox 111 and above
 - Safari 16.4 and above
 
-The `browserslist` field in `package.json` names these versions explicitly
-instead of using a percentage or "not dead" query, so browser support data
-changes cannot move build output. Raising the baseline is a deliberate edit
-to that list and to the date above.
+Two places carry these versions and they have to be edited together. The
+`browserslist` field in `package.json` names them explicitly instead of using
+a percentage or "not dead" query, so browser support data changes cannot move
+build output; it governs which vendor prefixes the stylesheet gets. The
+`build.target` array in `vite.config.ts` repeats them, because the bundler
+does not read `browserslist`, and it governs which syntax is lowered.
+
+Raising the baseline is a deliberate edit to both lists and to the date above.
+Nothing asserts that the two agree.
 
 ## Data attribution