Vite 8.1.0 Stable Adds Bundled Dev Mode (15x Startup on 10k React Components), Ships WASM ESM Imports and Chunk Import Map, Extends server.fs.deny With .npmrc and Private Keys

Vite 8.1.0 stable, published 2026-06-23 by github-actions from the v8.1.0 tag (commit 63b1489, release: v8.1.0), is the first feature release on the Vite 8 stable branch since the 8.1-beta on 2026-06-15. The release ships with the same code line that produced the beta, plus one new documented experimental entry point (Bundled Dev Mode), three weeks of bug-fix patches (the beta CHANGELOG lists 22 commits between v8.1.0-beta.0 and v8.1.0), a tightened default server.fs.deny list, a tilde-pinned Rolldown dependency that lets the bundler ship patch releases without a Vite PR, and a runtime deprecation warning for envFile: false. The same day, Rolldown 1.1.3 ships with ten follow-up fixes including a browser-main-thread crash and a watch-mode close-reentrancy fix.

The release lands eight days after the beta, which is faster than the Vite 7 → Vite 8 cadence. The Vite team's announcement post notes that Vite is now seeing 41.6 million weekly downloads on npm, "almost reaching the total downloads of Vite 7." Bundled Dev Mode is the feature that justifies the new minor line on its own: a 15x cold-start improvement on a 10,000-component React app, and Linear's real-world 3x faster cold start + 10x fewer network requests.

Bundled Dev Mode, the headline

The single biggest addition in 8.1.0 stable is Bundled Dev Mode, which is no longer a flag with no docs. It now has a dedicated CLI entry point, --experimental-bundle, and a documented config option, experimental.bundledDev: true:

import { defineConfig } from 'vite'

export default defineConfig({
  experimental: {
    bundledDev: true,
  },
})

The default Vite dev server is unbundled: each source module is served as its own ESM file, and the browser resolves the import graph. That is what made Vite fast at small scale, but as apps grew past a few thousand modules the per-module request overhead dominated cold start and full reload. Bundled Dev Mode keeps the same dev-server ergonomics (HMR, the plugin pipeline, env vars) but pre-bundles the application with Rolldown and serves the prebuilt chunks. The Vite Team measured 15x faster cold start on a 10,000-component React app, 10x faster full reloads, and instant HMR regardless of app size; the Linear team reported 3x faster cold start rendering, ~40% faster full reloads, and 10x fewer network requests on their app.

The feature is still experimental because the plugin surface is being shaped. The release notes call out that "if you are using a third party plugin, it may not work with this mode" and that the focus is on browser-side core features for now; the design document lays out the planned plugin contract. Two follow-ups are already merged into the next 8.x line: PR #22587 folded bundledDev into DevEnvironment instead of being a separate subclass (it shipped in 8.1-beta.0), and PR #22617 makes sure incremental build errors are surfaced rather than dropped on the floor in bundled-dev mode.

WASM ESM Integration and Chunk Import Map graduate

The two big beta features graduate unchanged from the 8.1-beta.0 branch: PR #21779 implements the WASM ESM Integration draft from the WebAssembly community group as direct .wasm imports with no ?init suffix, and PR #21580 adds build.chunkImportMap, an opt-in build option that uses browser import maps to keep chunk hashes stable when only a single source file changes.

The WASM feature replaces the old import init from './add.wasm?init'; const instance = await init(); pattern with import { add } from './add.wasm'. Vite parses the binary, extracts imports and exports, and emits glue code that returns a properly-typed WebAssembly.Module instance. The legacy ?init, ?url, and ?raw query suffixes still work, so existing projects do not need to migrate in lockstep. The feature is independent of browser support today, because Vite still does the parsing and glue generation; the browser-level spec just standardizes the long-term target.

The chunk import map feature matters at a different scale: it is a real cache-stability improvement for production builds, not a dev-server convenience. In a default Rolldown build, every chunk filename contains a content hash, and import statements point directly at the hashed URL. When a single source file changes, every chunk that imports it (directly or transitively) gets a new hash, which cascades through the import graph and invalidates more chunks than strictly necessary. Import maps decouple the import statement from the chunk URL: the statement says import { x } from '/chunks/x.js', the import map says /chunks/x.js resolves to /chunks/x-abc123.js, and when the chunk content is unchanged the hashed URL stays the same and the browser reuses it. The implementation relies on import.meta.resolve in the browser, so chunkImportMap only works on browsers that support it; the companion plugin-legacy covers older browsers with SystemJS.

Lightning CSS, one step closer to default

PR #21748 makes Vite honor plugin dependencies declared by Lightning CSS itself, and PR #18389 adds support for external CSS files imported inside CSS files. Both pieces were already shipping as Lightning CSS issues (lightningcss#479 and lightningcss#877) and are now wired into Vite. The release notes say the team is "thinking of changing the default CSS preprocessor to Lightning CSS in the next major release." To try it now, set css.transformer: 'lightningcss' in vite.config.js and share feedback in vitejs/vite#13835.

server.fs.deny extension

PR #22707 (sapphi.red, feat: extend server.fs.deny list with common files) tightens the default secure-by-default dev server. The deny list goes from ['.env', '.env.*', '*.{crt,pem}', '**/.git/**'] (Vite 8.0.x) to ['.env', '.env.*', '*.{crt,pem,key,p12,pfx,cer,der}', '.npmrc', '.yarnrc.yml', '**/.git/**'] (Vite 8.1.0). The new entries cover private-key and certificate material in .key, .p12, .pfx, .cer, and .der files (the same family as the existing .crt and .pem coverage) plus the package-manager credential files .npmrc and .yarnrc.yml.

The PR description is explicit that this is not framed as a vulnerability fix: "we do not consider this as a vulnerability as it's not possible to cover every sensitive files possible. But we can add common ones as we go. And the server.fs.deny list is documented, so if you need more than these, you should add as you see fit." In practice this is the kind of change that prevents accidental credential leaks when a developer serves a project's root directory without a custom server.fs.allow configuration, which is the default for new projects. The behavior is the same in dev and SSR mode.

Tilde-pinned Rolldown

PR #22693 (use ~ for Rolldown) is small but worth flagging for ecosystem users. Vite's package.json previously pinned rolldown as "rolldown": "1.1.1" (exact version); 8.1.0 pins it as "rolldown": "~1.1.1" (tilde range, accepts any 1.1.x). The motivation is operational: Rolldown ships patch releases on a faster cadence than Vite, and Vite was having to bump rolldown manually for every patch release. With the tilde range, 1.1.2 (2026-06-18) and 1.1.3 (2026-06-24) flow into Vite users via the lockfile without a Vite PR each time.

The risk is the tilde-range version drift: a Rolldown patch that lands in 1.1.x and changes behavior could land in a Vite user's install without an explicit Vite release. The mitigation is that patch semver is meant to be backwards-compatible, and the Vite team's release cadence is fast enough that they can ship a Vite patch within a day or two if a bad rolldown patch slips through. The 1.1.3 release the same day as this article is the new rhythm: a Rolldown bug fix can be in Vite users' installs within hours of being merged.

envFile: false deprecation warning

PR #22555 adds a runtime deprecation warning when envFile: false is used. The behavior does not change; the existing backward-compatible mapping of envFile: false to envDir: false is preserved. The motivation is that envFile was already marked deprecated in the type definition, but the runtime path stayed silent, which made migration harder for programmatic API users and left behavior inconsistent with other deprecated Vite options that warn when used. The fix is a one-line warning plus the matching config tests; users who already use envDir: false get no warning.

Other changes between beta and stable

The 22-commit CHANGELOG diff between v8.1.0-beta.0 and v8.1.0 is mostly bug fixes plus the Rolldown 1.1.2 bump:

• PR #22714 handles malformed URIs in the memory-files middleware.
• PR #22715 caches falsy values in perEnvironmentState, which is a small correctness fix for environments that previously re-evaluated expensive work on every request.
• PR #22711 makes the glob hmr matcher respect the caseSensitive option.
• PR #22713 omits the nonce attribute on import maps when cspNonce is unset (a small HTML correctness fix).
• PR #22611 skips null-valued exports in expandGlobIds glob resolution.
• PR #22691 keeps resolved build options as a getter so plugins that introspect config.build see the resolved values.
• PR #22706 uses literal envPrefix queries for Vite Task.
• PR #22736 inlines the dev-id value in the CSS selector (a small client-side size optimisation).
• PR #22724 removes the unused removeRawQuery utility.
• PR #22692 renames chunkImportMap related options to use the rolldownOptions property.
• PR #22695 bumps Rolldown to 1.1.2.

Why the timing matters

The Vite team published the announcing-vite8-1 post on the same day as the release, which is a faster-than-usual turnaround from "beta" to "stable + announcement" (eight days for 8.1 vs roughly three weeks for the 8.0 line). The 41.6M weekly downloads stat is a reminder that Vite is now in the same install-base tier as React, and the Bundled Dev Mode metrics are the kind of headline numbers that justify a minor line bump on their own.

For users on the Vite 8 stable line, the upgrade is npm install -D vite@8.1.0 plus a one-time config edit if your project sets any server.hmr WebSocket options. For users still on Vite 7 or earlier, the Vite 8 stable release notes cover the Rolldown migration and the larger plugin surface changes. The 8.1 line is the recommended stable target for new projects today, with 8.2 and 9.0 already open as milestones on the Vite repo.