diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d167d77f6442a8..8a37bb1f6685ae 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,6 +12,9 @@ jobs:
     # prevents this action from running on forks
     if: github.repository == 'vitejs/vite'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     environment: Release
     steps:
       - name: Checkout
diff --git a/docs/guide/features.md b/docs/guide/features.md
index 0e654cef4e2a0f..c9e658076b677d 100644
--- a/docs/guide/features.md
+++ b/docs/guide/features.md
@@ -541,7 +541,7 @@ import MyWorker from './worker?worker'
 const worker = new MyWorker()
 ```
 
-The worker script can also use `import` statements instead of `importScripts()` - note during dev this relies on browser native support and currently only works in Chrome, but for the production build it is compiled away.
+The worker script can also use ESM `import` statements instead of `importScripts()`. **Note**: During dev this relies on [browser native support](https://caniuse.com/?search=module%20worker) (currently not supported in Firefox), but for the production build it is compiled away.
 
 By default, the worker script will be emitted as a separate chunk in the production build. If you wish to inline the worker as base64 strings, add the `inline` query:
 
diff --git a/package.json b/package.json
index 907405ddea2d4d..d6f2e7fe7aefc9 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,10 @@
     "node": "^14.18.0 || >=16.0.0"
   },
   "homepage": "https://vitejs.dev/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vitejs/vite.git"
+  },
   "keywords": [
     "frontend",
     "hmr",
@@ -60,7 +64,7 @@
     "@types/ws": "^8.5.4",
     "@typescript-eslint/eslint-plugin": "^5.59.0",
     "@typescript-eslint/parser": "^5.59.0",
-    "@vitejs/release-scripts": "^1.1.0",
+    "@vitejs/release-scripts": "^1.2.0",
     "conventional-changelog-cli": "^2.2.2",
     "eslint": "^8.38.0",
     "eslint-define-config": "^1.18.0",
diff --git a/packages/vite/CHANGELOG.md b/packages/vite/CHANGELOG.md
index 0d4c30b8e07ad4..b468dcdaea91df 100644
--- a/packages/vite/CHANGELOG.md
+++ b/packages/vite/CHANGELOG.md
@@ -1,3 +1,10 @@
+## <small>4.3.8 (2023-05-18)</small>
+
+* fix: avoid outdated module to crash in importAnalysis after restart (#13231) ([3609e79](https://github.com/vitejs/vite/commit/3609e79)), closes [#13231](https://github.com/vitejs/vite/issues/13231)
+* fix(ssr): skip updateCjsSsrExternals if legacy flag disabled (#13230) ([13fc345](https://github.com/vitejs/vite/commit/13fc345)), closes [#13230](https://github.com/vitejs/vite/issues/13230)
+
+
+
 ## <small>4.3.7 (2023-05-16)</small>
 
 * fix: revert only watch .env files in envDir (#12587) (#13217) ([0fd4616](https://github.com/vitejs/vite/commit/0fd4616)), closes [#12587](https://github.com/vitejs/vite/issues/12587) [#13217](https://github.com/vitejs/vite/issues/13217)
diff --git a/packages/vite/package.json b/packages/vite/package.json
index b3d0eca6816e2f..13356c846cae99 100644
--- a/packages/vite/package.json
+++ b/packages/vite/package.json
@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "4.3.7",
+  "version": "4.3.8",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",
diff --git a/packages/vite/src/node/plugins/importAnalysis.ts b/packages/vite/src/node/plugins/importAnalysis.ts
index 119f0192cabb43..21f8b807fa13c7 100644
--- a/packages/vite/src/node/plugins/importAnalysis.ts
+++ b/packages/vite/src/node/plugins/importAnalysis.ts
@@ -254,9 +254,9 @@ export function importAnalysisPlugin(config: ResolvedConfig): Plugin {
       // since we are already in the transform phase of the importer, it must
       // have been loaded so its entry is guaranteed in the module graph.
       const importerModule = moduleGraph.getModuleById(importer)!
-      if (!importerModule && depsOptimizer?.isOptimizedDepFile(importer)) {
-        // Ids of optimized deps could be invalidated and removed from the graph
-        // Return without transforming, this request is no longer valid, a full reload
+      if (!importerModule) {
+        // When the server is restarted, the module graph is cleared, so we
+        // return without transforming. This request is no longer valid, a full reload
         // is going to request this id again. Throwing an outdated error so we
         // properly finish the request with a 504 sent to the browser.
         throwOutdatedRequest(importer)
diff --git a/packages/vite/src/node/server/index.ts b/packages/vite/src/node/server/index.ts
index c6ad6740bd6f05..17f10e5e8676ab 100644
--- a/packages/vite/src/node/server/index.ts
+++ b/packages/vite/src/node/server/index.ts
@@ -404,7 +404,9 @@ export async function _createServer(
       if (isDepsOptimizerEnabled(config, true)) {
         await initDevSsrDepsOptimizer(config, server)
       }
-      await updateCjsSsrExternals(server)
+      if (config.legacy?.buildSsrCjsExternalHeuristics) {
+        await updateCjsSsrExternals(server)
+      }
       return ssrLoadModule(
         url,
         server,
diff --git a/packages/vite/src/node/server/middlewares/indexHtml.ts b/packages/vite/src/node/server/middlewares/indexHtml.ts
index 9c7d6727f6fd9d..a063bc91bdbaf9 100644
--- a/packages/vite/src/node/server/middlewares/indexHtml.ts
+++ b/packages/vite/src/node/server/middlewares/indexHtml.ts
@@ -28,6 +28,7 @@ import {
   ensureWatchedFile,
   fsPathFromId,
   injectQuery,
+  isJSRequest,
   joinUrlSegments,
   normalizePath,
   processSrcSetSync,
@@ -35,6 +36,7 @@ import {
   unwrapId,
   wrapId,
 } from '../../utils'
+import { isCSSRequest } from '../../plugins/css'
 import { checkPublicFile } from '../../plugins/asset'
 import { getCodeWithSourcemap, injectSourcesContent } from '../sourcemap'
 
@@ -82,6 +84,12 @@ function getHtmlFilename(url: string, server: ViteDevServer) {
   }
 }
 
+function shouldPreTransform(url: string, config: ResolvedConfig) {
+  return (
+    !checkPublicFile(url, config) && (isJSRequest(url) || isCSSRequest(url))
+  )
+}
+
 const processNodeUrl = (
   attr: Token.Attribute,
   sourceCodeLocation: Token.Location,
@@ -104,7 +112,7 @@ const processNodeUrl = (
     // prefix with base (dev only, base is never relative)
     const fullUrl = path.posix.join(devBase, url)
     overwriteAttrValue(s, sourceCodeLocation, fullUrl)
-    if (server && !checkPublicFile(url, config)) {
+    if (server && shouldPreTransform(url, config)) {
       preTransformRequest(server, fullUrl, devBase)
     }
   } else if (
@@ -116,7 +124,7 @@ const processNodeUrl = (
     // prefix with base (dev only, base is never relative)
     const replacer = (url: string) => {
       const fullUrl = path.posix.join(devBase, url)
-      if (server && !checkPublicFile(url, config)) {
+      if (server && shouldPreTransform(url, config)) {
         preTransformRequest(server, fullUrl, devBase)
       }
       return fullUrl
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c9de720c7662f3..e0c939e96c82cf 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -90,8 +90,8 @@ importers:
         specifier: ^5.59.0
         version: 5.59.0(eslint@8.38.0)(typescript@5.0.2)
       '@vitejs/release-scripts':
-        specifier: ^1.1.0
-        version: 1.1.0
+        specifier: ^1.2.0
+        version: 1.2.0
       conventional-changelog-cli:
         specifier: ^2.2.2
         version: 2.2.2
@@ -3891,15 +3891,15 @@ packages:
       vue: 3.2.47
     dev: true
 
-  /@vitejs/release-scripts@1.1.0:
-    resolution: {integrity: sha512-pxP72AGDRGu6vufj8vrdmFll++N0K7aNDSWWYzPb28NgE5RjOdo99uLgJEpl3Ee/wEOnHKT2zJ9HN2GN44SUPQ==}
+  /@vitejs/release-scripts@1.2.0:
+    resolution: {integrity: sha512-HdLOS/BQtavOis+VvT1517y7a5jYEMuBIybnL1F1Pd7vIXkFYPdo0vSKtnDBILOHhFT27SYist4BFkppDvsBnA==}
     dependencies:
-      execa: 6.1.0
+      execa: 7.1.1
       minimist: 1.2.8
       picocolors: 1.0.0
       prompts: 2.4.2
       publint: 0.1.11
-      semver: 7.3.8
+      semver: 7.5.1
     dev: true
 
   /@vitest/expect@0.30.1:
@@ -5962,21 +5962,6 @@ packages:
     resolution: {integrity: sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==}
     dev: true
 
-  /execa@6.1.0:
-    resolution: {integrity: sha512-QVWlX2e50heYJcCPG0iWtf8r0xjEYfz/OYLGDYH+IyjWezzPNxz63qNFOu0l4YftGWuizFVZHHs8PrLU5p2IDA==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
-    dependencies:
-      cross-spawn: 7.0.3
-      get-stream: 6.0.1
-      human-signals: 3.0.1
-      is-stream: 3.0.0
-      merge-stream: 2.0.0
-      npm-run-path: 5.1.0
-      onetime: 6.0.0
-      signal-exit: 3.0.7
-      strip-final-newline: 3.0.0
-    dev: true
-
   /execa@7.1.1:
     resolution: {integrity: sha512-wH0eMf/UXckdUYnO21+HDztteVv05rq2GXksxT4fCGeHkBhw1DROXh40wcjMcRqDOWE7iPJ4n3M7e2+YFP+76Q==}
     engines: {node: ^14.18.0 || ^16.14.0 || >=18.0.0}
@@ -6610,11 +6595,6 @@ packages:
       - supports-color
     dev: false
 
-  /human-signals@3.0.1:
-    resolution: {integrity: sha512-rQLskxnM/5OCldHo+wNXbpVgDn5A17CUoKX+7Sokwaknlq7CdSnphy0W39GU8dw59XiCXmFXDg4fRuckQRKewQ==}
-    engines: {node: '>=12.20.0'}
-    dev: true
-
   /human-signals@4.3.0:
     resolution: {integrity: sha512-zyzVyMjpGBX2+6cDVZeFPCdtOtdsxOeseRhB9tkQ6xXmGUNrcnBzdEKPy3VPNYz+4gy1oukVOXcrJCunSyc6QQ==}
     engines: {node: '>=14.18.0'}
@@ -8993,6 +8973,14 @@ packages:
     dependencies:
       lru-cache: 6.0.0
 
+  /semver@7.5.1:
+    resolution: {integrity: sha512-Wvss5ivl8TMRZXXESstBA4uR5iXgEN/VC5/sOcuXdVLzcdkz4HWetIoRfG5gb5X+ij/G9rw9YoGn3QoQ8OCSpw==}
+    engines: {node: '>=10'}
+    hasBin: true
+    dependencies:
+      lru-cache: 6.0.0
+    dev: true
+
   /send@0.18.0:
     resolution: {integrity: sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==}
     engines: {node: '>= 0.8.0'}
diff --git a/scripts/publishCI.ts b/scripts/publishCI.ts
index a6d83385739ae6..873b2cec5bbc0a 100644
--- a/scripts/publishCI.ts
+++ b/scripts/publishCI.ts
@@ -1,3 +1,3 @@
 import { publish } from '@vitejs/release-scripts'
 
-publish({ defaultPackage: 'vite' })
+publish({ defaultPackage: 'vite', provenance: true })