build(deps-dev): Bump @vitejs/plugin-react from 6.0.2 to 6.0.3 in /webui

[dependabot]

Bumps @vitejs/plugin-react from 6.0.2 to 6.0.3.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.3 (2026-06-23)

Commits

• 640fd35 release: plugin-react@6.0.3
• 889efb0 fix(deps): update all non-major dependencies (#1249)
• 6c57dd4 fix(plugin-react): use '/' base in bundledDev preamble to fix non-root base p...
• 3cc33a7 fix(deps): update react-related dependencies (#1245)
• c0f7c7f docs: mention the Biome rule in the "Consistent components exports" section (...
• cd80f0f fix(deps): update all non-major dependencies (#1241)
• e38acca fix(deps): update all non-major dependencies (#1227)
• 9a9bb26 perf(react): improve react compiler preset so that slightly more modules are ...
• See full diff in compare view

[cursor]

Bug Scan Summary

Date: 2026-07-05
Commits inspected: 770dc55..b2a2162 (1 commit — Dependabot @vitejs/plugin-react 6.0.2 → 6.0.3)
Result: No critical bugs found.

Investigation

• Diff scope: webui/package.json and webui/package-lock.json only. No runtime .cs or application .ts/.tsx changes.
• Usage traced: @vitejs/plugin-react is a devDependency used with default react() in vite.config.ts and vitest.config.ts. Production serves the pre-built static bundle from wwwroot; this plugin is not on the production request path.
• Upstream 6.0.3 changes: Fixes bundled-dev preamble for non-root base paths (getPreambleCode('/') instead of getPreambleCode(base)). Torrentarr sets base: "/", so this fix is a no-op here. Also bumps transitive @rolldown/pluginutils to ^1.0.1.
• Validation: npm run build OK (345 modules, manualChunks intact). npx vitest run — 154/154 pass.

Deduplication check

• Open PRs: plugin-react, vitejs/plugin-react, rolldown/pluginutils → only #322 (this PR).
• Recently merged PRs (14d): no competing fix.
• Open issues: none for plugin-react / vite build.

Notes (below critical bar)

• Dev-only dependency bump; no data-loss, auth, crash, or race-condition surface in production paths.
• Prior below-bar items from earlier scans (multi-qBit scoping, SeedingService hash-only tag lookup, ImportPathTracker parity defer, ArrSync dead code) remain unchanged and not introduced by this PR.

  

_{Sent by Cursor Automation: Torrentarr - Find critical bugs}

[cursor]

PR Validation (Cursor Automation)

Recommendation: Merge
Primary reason: Scoped frontend dev-dependency bump merges cleanly with master, keeps package.json and package-lock.json consistent, and passes backend/frontend validation gates.

Gates

Gate	Status	Notes
Merge conflicts	Pass	dependabot/npm_and_yarn/webui/vitejs/plugin-react-6.0.3 merged cleanly into current origin/master; no conflicts.
dotnet build	Pass	dotnet build -c Release succeeded; existing NU1510 pruning warnings only.
dotnet test (non-live)	Pass	dotnet test -c Release --no-build --filter "Category!=Live" passed: 777 total (Core 173, Host 203, Infrastructure 401).
vitest	Pass	npx vitest run passed: 16 files, 154 tests.
npm run build (webui)	Pass	tsc -b && vite build succeeded and emitted the expected generated src/Torrentarr.Host/wwwroot/ assets.

Validation

Axis	Score	Notes
Purpose	Pass	Routine Dependabot maintenance update for @vitejs/plugin-react from 6.0.2 to 6.0.3.
Correctness	Pass	Minimal two-file dependency update; lockfile resolves @vitejs/plugin-react 6.0.3 and its updated dependency range consistently.
Tests	Pass	No source behavior changed; backend tests, frontend tests, and webui production build all passed. Test totals are above the stated baseline.
Hygiene	Pass	Scope is limited to webui/package.json and webui/package-lock.json; no generated, temp, SDK, or unrelated files in the PR diff.
Overlap	Pass	No other open PR found for this Vite React plugin update; known 2026-06-15 duplicate-winner themes are unrelated.

Why

This PR only updates the Vite React plugin dev dependency and its lockfile metadata. The post-merge tree builds and tests successfully across the relevant backend and frontend gates. Torrentarr-specific risk areas (multi-qBit routing, config schema, destructive Arr sync, auth/WebUI config semantics, process isolation, and database filename/schema) are not touched by this diff.

Note: docs/audits/pr-triage-*.md was not present in the fetched/merged repository checkout, so overlap validation used the prompt-provided 2026-06-15 winner table plus open-PR searches.

Overlap

None.

Commands run

• git fetch origin master
• git fetch origin dependabot/npm_and_yarn/webui/vitejs/plugin-react-6.0.3
• git checkout -B pr-validate origin/dependabot/npm_and_yarn/webui/vitejs/plugin-react-6.0.3
• git merge origin/master
• git diff --name-status origin/master...HEAD / git diff --stat origin/master...HEAD / package diff inspection
• gh pr view 322 ...
• gh pr list --state open --search ... overlap checks
• Temporary SDK setup because dotnet was not initially on PATH: dotnet-install.sh --channel 10.0 --install-dir /tmp/dotnet --no-path
• dotnet restore
• dotnet build -c Release
• dotnet test -c Release --no-build --filter "Category!=Live"
• cd webui && npm ci
• cd webui && npx vitest run
• cd webui && npm run build

  

_{Sent by Cursor Automation: Torrentarr PR validation triage}