Bump Vite to 8.3 for the web package

[kiftio]

What changes are you making?

Bump vite from 8.0.16 to 8.3.4 in platforms/web (rolldown 1.0.3 → 1.2.13). No code changes beyond two forward-compatibility fixes in vite.config.ts that Vite now warns about: a JSON import attribute on package.json and an explicit file extension on the tag-name-map import (for the future native config loader).

Build output compared against 8.0.16 on the same commit:

File	8.0.16	8.3.4	Δ
dist/index.js	307 B	255 B	−52 B
dist/shopify-checkout.js	156 B	156 B	0
dist/chunks/shopify-checkout.js	35,928 B	36,022 B	+94 B
dist/index.d.ts, dist/shopify-checkout.d.ts	—	—	byte-identical

The tag-name augmentation from #958 is unaffected (declarations identical). Peer ranges for vitest, @vitest/coverage-v8 and vite-plugin-dts already cover 8.3.

Context: this removes the Rolldown version blocker noted in #958 for rolldown-plugin-dts. It is deliberately not the plugin swap — the other reasons recorded there (pre-1.0 plugin, protocol-package type workarounds) still apply, and this bump is worth having on its own.

How to test

cd platforms/web
pnpm lint && pnpm test && pnpm build && pnpm verify && pnpm compare-snapshot && pnpm sample:build
pnpm --dir test/e2e test

Validated locally: lint, 337 unit tests, build (no config warnings), 9 built-package tests, snapshot, sample build, 16 Chromium tests.

---

Before you merge

Important

• I've added tests to support my implementation (no behaviour change; existing suites cover it)
• I have read and agree with the Contribution Guidelines
• I have read and agree with the Code of Conduct
• I've updated the relevant platform README (not applicable)

[bitrise]

Bitrise builds

E2E · iOS CI

Checkout Kit E2E results

No native E2E runs were selected for this change.

[github-actions]

Web — Coverage Report

Lines	Statements	Branches	Functions
	95.62% (437/457)	86.86% (238/274)	97.22% (105/108)

[github-actions]

Bundle Size Budgets

Budget	Size	Limits	Result
Web JavaScript (uncompressed)	35.58 KiB (+42 B)	35 KiB soft / 50 KiB hard	✅ Accepted by @kiftio: See Mark's comment - The embedded source code and source-file list are identical. The extra ~7.5 KB is debugging metadata (comment)

• web: accepted 1 exceeded metric(s).

Bundle and package size

Web bundle sizes cover shipped runtime JavaScript. Package sizes cover the full published archive, including any source maps, declarations, and documentation it contains.

Platform	Measurement	Compression	Base	Head	Delta
Web	JavaScript bundle	Uncompressed	35.5 KiB	35.6 KiB	+42 B
Web	JavaScript bundle	gzip	11.1 KiB	11.1 KiB	-8 B
Web	npm package (.tgz)	gzip	95.7 KiB	99.1 KiB	+3.4 KiB

Web package files (uncompressed)

These are uncompressed file sizes; they do not sum to the compressed package size above.

File	Base	Head	Delta
dist/chunks/shopify-checkout.js.map	257.0 KiB	264.3 KiB	+7.3 KiB
dist/custom-elements.json	54.7 KiB	54.7 KiB	0 B
dist/index.d.ts	49.5 KiB	49.5 KiB	0 B
dist/chunks/shopify-checkout.js	35.1 KiB	35.2 KiB	+94 B
README.md	24.5 KiB	24.5 KiB	0 B
package.json	3.9 KiB	3.9 KiB	0 B
LICENSE	1.1 KiB	1.1 KiB	0 B
dist/shopify-checkout.js.map	832 B	850 B	+18 B
dist/index.js	307 B	255 B	-52 B
dist/shopify-checkout.js	156 B	156 B	0 B
dist/shopify-checkout.d.ts	33 B	33 B	0 B

How sizes are measured

Measured from the PR base SHA and PR head SHA. Web bundle rows sum shipped .js, .mjs, and .cjs files under dist/, excluding source maps and declarations. The gzip bundle size sums files compressed individually with gzip -n -9. npm package sizes are gzip-compressed .tgz archives; Android AAR sizes are ZIP archives. Package sizes are not final app binary sizes.

[markmur]

The embedded source code and source-file list are identical. The extra ~7.5 KB is debugging metadata

[kiftio]

/accept-size web See Mark's comment - The embedded source code and source-file list are identical. The extra ~7.5 KB is debugging metadata