Skip to content

chore(deps): update vite-plus - #961

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/vite-plus
Open

chore(deps): update vite-plus#961
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/vite-plus

Conversation

@renovate

@renovate renovate Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@vitest/coverage-v8 (source) 5.0.5 → 5.1.0 age confidence
vite (source) 1.3.0 → 1.5.0 age confidence
vite-plus (source) 1.3.0 → 1.5.0 age confidence
vitest (source) 5.0.5 → 5.1.0 age confidence

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v5.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
voidzero-dev/vite-plus (vite)

v1.5.0: vite-plus v1.5.0

Compare Source

Vite+ 1.5 adds an official Homebrew tap, runs TypeScript through Node.js with node --import vite-plus/register, and lets vp migrate move oxnode and transpile-only ts-node scripts to vpx.

Features
  • Install vp from the official Homebrew tap on macOS and glibc Linux (docs) (#​2740), by @​fengmk2: 
    brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp
  • node --import vite-plus/register runs TypeScript with the same loader as vpx, so tools that start Node.js themselves, such as the Node.js test runner, AVA, or a NODE_OPTIONS setting, can run TypeScript files (docs) (#​3208), by @​fengmk2.
  • vp migrate moves oxnode commands and transpile-only ts-node commands to vpx, and moves their Node.js preloads and literal NODE_OPTIONS values to vite-plus/register. ts-node commands that type-check stay unchanged with a warning, and the ts-node dependency is removed only when nothing still uses it. A project already on Vite+ gets this migration with vp migrate --full (docs) (#​3209, #​3210), by @​fengmk2.
  • vp migrate warns when it finds Rollup, Rolldown, or Jest dependencies with matching configuration, and explains how to move them to Vite, tsdown, or Vitest. The warnings show during the first migration, or with vp migrate --full in a project already on Vite+ (#​3275), by @​KTrain5169 and @​fengmk2.
  • vite-plus exports resolveConfigFromFile(configFile, options?), which resolves a config relative to the config file's directory instead of process.cwd(), so editor plugins with several workspace folders load the files of the right project (#​3249), by @​leaysgur and @​fengmk2.
  • Security: the CLI ships minimatch@11.0.4, which fixes a denial of service through glob pattern amplification (GHSA-g3hv-75wg-m249, medium), and zstd@0.13.4, which fixes RUSTSEC-2026-0391, RUSTSEC-2026-0398, and RUSTSEC-2026-0403 (#​3328, #​3331), by @​renovate[bot] and @​wan9chi.
  • Upgrade the bundled tools (#​3205, #​3236, #​3261, #​3206, #​3330, #​3338), by @​voidzero-guard[bot] and @​fengmk2:
    • rolldown@1.2.15 to rolldown@1.2.16, with experimentalInlineCommonChunks in dev mode and no crash when the working directory was deleted.
    • tsdown@0.23.1 to tsdown@0.23.4: vp pack --env-file can be repeated to load several env files, the config has a JSON schema, and ?inline CSS imported from dependencies is inlined.
    • vitest@5.0.5 to vitest@5.1.0, with --last-failed and --since-last-run, fake timers for node:timers, and interactive review of failed snapshots. Browser mode now uses port 23315 by default.
    • oxlint@1.89.0 to oxlint@1.91.0 and oxlint-tsgolint@7.0.2004 to oxlint-tsgolint@7.0.2005, with the new type-aware rule typescript/no-unsafe-enum-assignment, wider checks in rules such as array-callback-return, no-useless-concat, and no-control-regex, and two rules moved into the suspicious category.
    • oxfmt@0.74.0 to oxfmt@0.76.0, with a new HTML formatter and JavaScript and TypeScript fixes for parentheses, array layout, and line width with wide characters.
    • The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
    • Known issue: oxlint@1.91.0 can report react/immutability for a let declared inside an effect and reassigned by a closure in that effect (oxc#28401).
    • vpx and vite-plus/register run on oxc-node@1.0.1, which resolves a .jsx specifier to its .tsx or .ts source.
Fixes & Enhancements
  • vp create into a target path that is a symbolic link removes only the link after confirmation, instead of deleting the contents of the linked directory, and the overwrite prompt names symbolic links and files (#​2418), by @​leslieeilsel and @​fengmk2.
  • vp implode removes only directories and shims that it can verify as Vite+ installations, and refuses the home directory, its parents, and filesystem roots even with --yes, so a VP_HOME that points at another directory cannot delete unrelated files (#​3228), by @​jong-kyung.
  • vp run starts faster in workspaces whose tasks share cache input and output patterns, because each pattern is parsed once. In a 138-package workspace this saves about 2 seconds of CPU on every run (vite-task#887, vite-task#890), by @​jasonkuhrt and @​wan9chi.
  • vp run and package-manager commands in npm projects start about 110 ms sooner, because vp reads the npm version from npm's package.json instead of running npm --version (#​3259), by @​magurotuna.
  • vp migrate checks Vitest prerequisites faster in workspaces, because it parses each lockfile once (#​3212), by @​jong-kyung.
  • The installer and vp upgrade install the global CLI's dependencies with the Node.js version that the release pins (24.22.2 for this release), instead of the latest LTS (docs) (#​3269), by @​fengmk2.
  • The Node.js latest alias in vp env use, vp env default, vp env pin, vp env install, and .nvmrc resolves to the newest stable release instead of a 27.0.0-alpha build, and vp env list-remote marks that stable release as latest (#​3335), by @​voidzero-bot[bot] and @​fengmk2.
  • VP_NODE_VERSION=22 and other partial versions work for project commands such as vp build, vp run, and vp list, instead of failing with a 404 download error (#​3341), by @​jong-kyung.
  • Two vp install -g commands that run at the same time no longer delete each other's active package, and a command that starts while a package manager is being installed no longer runs its shim before the shim is executable (#​3185, #​3248), by @​jong-kyung.
  • vp config waits and retries when another linked git worktree holds the shared git config lock, so a prepare script no longer fails when two worktrees install at the same time (#​3199), by @​naokihaba.
  • vp env doctor reports Node.js resolution failures, unreadable config, a failing system node, and missing shims as errors and exits with code 1. When it finds only warnings, the summary says Some warnings found instead of All checks passed (#​3215, #​3222), by @​liangmiQwQ.
  • Nushell completions for vp and vpr use the named completer input, so Nushell 0.116 shows no deprecation warning, and they fall back to file completion when fish is not installed. Run vp env setup --refresh to regenerate env.nu (#​3267, #​3276), by @​naokihaba.
  • vp migrate removes the tsx dependency even when a comment still contains a tsx command or code fence, and keeps it for JSDoc type imports that need it (#​3299), by @​voidzero-bot[bot] and @​fengmk2.
  • The prefer-vite-plus-imports lint rule and its autofix leave the vite and vitest imports that vp migrate keeps, such as vitest imports in a package that lists vitest in peerDependencies, so vp lint --fix no longer breaks the package for its plain Vitest users (#​3192), by @​Dunqing.
  • Generated Zed settings no longer force typeAware and unusedDisableDirectives, so editor diagnostics follow the lint.options in vite.config.ts. Existing editor settings stay unchanged (#​2357), by @​pweyck.
  • vp dlx with npm runs the right executable for scoped packages such as @angular/cli (#​3229), by @​jong-kyung.
  • vp outdated -r in npm projects checks the workspaces instead of transitive dependencies, and requires npm 7.14.0 or later (#​3240), by @​jong-kyung.
  • Dependency filters such as --prod and --dev work with npm 6, and filters that npm 6 cannot apply are rejected instead of passed through (#​3251), by @​jong-kyung.
  • Package-manager commands that the selected version does not have, such as vp pm stage before npm 11.15.0, are skipped with a warning. Unsupported pnpm dlx and pnpm pack options, and project-only flags on managed global commands such as vp install -g, are rejected instead of silently ignored (#​3286, #​3285), by @​jong-kyung.
  • vp toolchain -g is short for vp toolchain --global (#​3189), by @​jong-kyung.
  • On Linux and macOS, programs in tasks with automatic file-access tracking no longer abort when they call exec with an empty path or execl with 32 or more arguments (vite-task#896, vite-task#865), by @​wan9chi and @​tlq5l.
Refactor
Docs
  • Explain that vp check stops at formatting failures, and that vp check flags go before file paths (#​3262), by @​SaKaNa-Y.
  • Show how to align an existing vite dependency with its override during a manual npm installation, to avoid EOVERRIDE (#​3157), by @​SaKaNa-Y.
  • Explain how environment variable prefixes such as FOO=bar command work in task commands on every platform (#​3161), by @​tartelettie.
  • Restore the /vp-setup redirect and the redirects for moved guide pages (#​3271), by @​fengmk2.
  • Align the labels of "See [...]" section links with their target titles (#​3231), by @​yamaurakazuto.
Chore
Bundled Versions
Tool Version Source Changelog
vite 8.3.5 981f07f unchanged
rolldown 1.2.16 de6facf 1.2.16
oxc-node 1.0.1 7ff14c3 1.0.1
tsdown 0.23.4 npm 0.23.2, 0.23.3, 0.23.4
vitest 5.1.0 npm 5.1.0
oxlint 1.91.0 npm 1.90.0, 1.91.0
oxlint-tsgolint 7.0.2005 npm 7.0.2005
oxfmt 0.76.0 npm 0.75.0, 0.76.0
Upgrade
vp upgrade
New Contributors

@​yamaurakazuto, @​tartelettie, @​pweyck, @​jasonkuhrt

Full Changelog: voidzero-dev/vite-plus@v1.4.0...v1.5.0

Published Packages
  • @voidzero-dev/vite-plus-core@1.5.0
  • vite-plus@1.5.0
  • create-vite-plus@1.5.0
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Homebrew (macOS/Linux):

brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp

See the Homebrew guide to switch from the script installer or the Homebrew Core vite-plus formula.

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.5.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

v1.4.0: vite-plus v1.4.0

Compare Source

Vite+ 1.4 runs TypeScript and JavaScript files with vpx, and vp migrate can move tsx scripts to it. It also adds vp check --deny-warnings and vp pm team, and installs the global CLI's dependencies from a lockfile published with each release.

Features
  • vpx <file> runs a TypeScript or JavaScript file on the project's Node.js with the oxc-node loader that ships with Vite+, and vpx --watch <file> reruns it when a file it uses changes. In package.json scripts, the vpx bin of the vite-plus package runs scripts without the global CLI and runs package binaries only from node_modules/.bin, pointing to vp dlx for anything not installed (docs) (#​2936, #​3164), by @​Brooooooklyn and @​fengmk2.
  • vp migrate offers to move tsx scripts to vpx: tsx a.ts, npx tsx a.ts, node --import tsx a.ts, and tsx watch a.ts in package.json scripts, lint-staged tasks, and #!/usr/bin/env tsx shebangs become vpx a.ts or vpx --watch a.ts. A project already on Vite+ gets the offer with vp migrate --full (docs) (#​3179), by @​fengmk2.
  • vp check --deny-warnings fails the check on lint warnings, so CI no longer needs a separate vp lint --deny-warnings run (docs) (#​3075), by @​acalvino4.
  • vp pm team creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun (#​3040), by @​jong-kyung.
  • Security: vp no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades (RUSTSEC-2026-0382, RUSTSEC-2026-0383), and it ships tokio 1.54.1, which fixes a race in tokio::time::Interval (RUSTSEC-2026-0384) (#​3159, #​3202), by @​wan9chi and @​fengmk2.
  • vp pm registry commands (login, logout, whoami, owner, token, dist-tag, deprecate, search, ping, and publish) run pnpm's own commands on pnpm 11 and later (token from 12.13.0), and vp pm owner and vp pm publish run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm (#​3044), by @​jong-kyung.
  • The installer and vp upgrade install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to resolve them again if that installation fails (docs) (#​3117), by @​fengmk2.
  • Upgrade the bundled tools (#​3133, #​3158, #​3175), by @​voidzero-guard[bot] and @​fengmk2:
    • vite@8.3.4 to vite@8.3.5, with fixes for bundled dev mode, chunk import maps, CSS url() values containing %, and subpath imports with several # characters.
    • rolldown@1.2.14 to rolldown@1.2.15, with fixes for this.resolve recursion between plugins using skipSelf: true, strict execution order, and chunk import maps.
    • oxlint@1.88.0 to oxlint@1.89.0, with rule fixes that report cases missed before, for example in prefer-const, no-param-reassign, and sort-imports.
    • oxfmt@0.73.0 to oxfmt@0.74.0, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown.
    • The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
    • vpx scripts run on oxc-node@1.0.0.
    • @vitejs/devtools 0.8 is accepted as a peer dependency, alongside 0.7.
Fixes & Enhancements
  • The standalone vp executable binary size is ~30% smaller (#​3086), by @​fengmk2.
  • VP_SETUP_NODE_VERSION selects the Node.js version the installer uses for the CLI's dependencies, so setup-vp can use the project's version and avoid downloading a second Node.js in CI (docs) (#​3087), by @​fengmk2.
  • When tasks miss the cache, vp run finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again (vite-task#871), by @​magurotuna.
  • Cached tasks no longer miss the cache when only pnpm's node_modules/.modules.yaml differs, for example after installing with another pnpm version, with --ignore-scripts, or on glibc and musl machines (vite-task#850), by @​wan9chi.
  • vp run in a package that sits inside a workspace folder but is not listed in its pnpm-workspace.yaml packages or package.json workspaces runs that package's own tasks with its own packageManager, instead of treating the enclosing workspace as its root (vite-task#859), by @​liangmiQwQ.
  • A mistyped or misplaced task setting fails with an error that names it, such as unknown field outputs, instead of data did not match any variant of untagged enum UserTaskDefinition (vite-task#815), by @​tlq5l.
  • vp run no longer panics on scripts that contain non-ASCII characters, such as echo こんにちは, and no longer cuts those commands off in its output (vite-task#861), by @​magurotuna.
  • In cached tasks on Linux and macOS, programs that pass -1 as a directory descri

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 687048d5-d1ca-44c9-87d7-b1ae22a7cd48

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@socket-security

socket-security Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​voidzero-dev/​vite-plus-core@​1.3.0 ⏵ 1.5.0981007798 -1100
Updated@​vitest/​coverage-v8@​5.0.5 ⏵ 5.1.09910079 +198100
Updatedvitest@​5.0.5 ⏵ 5.1.098 +110079 +199 +1100
Updatedvite-plus@​1.3.0 ⏵ 1.5.09810010099 -1100

View full report

@pkg-pr-new

pkg-pr-new Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/node-modules/urllib@961

commit: 1b2ca56

@codecov

codecov Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.77%. Comparing base (ea1e101) to head (1b2ca56).

Additional details and impacted files 
@@           Coverage Diff           @@
##           master     #961   +/-   ##
=======================================
  Coverage   94.77%   94.77%           
=======================================
  Files          10       10           
  Lines         746      746           
  Branches      235      235           
=======================================
  Hits          707      707           
  Misses         36       36           
  Partials        3        3

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate
renovate Bot force-pushed the renovate/vite-plus branch from c3efcf8 to 1cd9c74 Compare October 30, 2026 13:39
@coderabbitai

coderabbitai Bot commented Oct 30, 2026

Copy link
Copy Markdown

Add Carrot credits or activate Agent usage billing to use Autofix

@renovate
renovate Bot force-pushed the renovate/vite-plus branch from 1cd9c74 to 0ebe6bb Compare October 30, 2026 13:41
@renovate
renovate Bot force-pushed the renovate/vite-plus branch from 0ebe6bb to c6aaa51 Compare November 2, 2026 22:15
@renovate renovate Bot changed the title chore(deps): update vite-plus to v1.4.0 chore(deps): update vite-plus Nov 2, 2026
Copilot AI requested a review from fengmk2 November 2, 2026 22:27
@renovate
renovate Bot force-pushed the renovate/vite-plus branch from 867a704 to 1b2ca56 Compare November 4, 2026 14:22

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fengmk2 fengmk2 Awaiting requested review from fengmk2

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant