chore(deps): update dependency vite-plus to v0.1.16

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite-plus (source)	0.1.15 → 0.1.16

---

Release Notes

voidzero-dev/vite-plus (vite-plus)

v0.1.16: vite-plus v0.1.16 — Security patches, Volta migration and Windows fixes

Compare Source

A broad release focused on security and ecosystem compatibility: 3 Vite dev server security fixes, Volta migration support, Bun object-form workspaces, JFrog registry support, and a wave of Windows and shell fixes.

Highlights

• Security: 3 Vite dev server vulnerabilities patched — Vite 8.0.5 fixes arbitrary file read via WebSocket (CVE-2026-39363, High — vite#22159), server.fs.deny bypass with query parameters (CVE-2026-39364, High — vite#22160), and path traversal in optimized deps .map handling (CVE-2026-39365, Moderate — vite#22161)
• Volta node version migration — vp migrate now migrates Volta-managed Node.js versions to .node-version (#​1201)
• vp env off disables Node.js management globally — Disables Node.js management for all vp commands, not just the current shell (#​1255)
• Bun object-form workspace support — Workspaces defined as objects in package.json are now properly detected (#​1250)
• Windows install reliability — Fixed PowerShell install errors and scoped CI env vars to child processes (#​1284, #​1292)

Features

• Support volta node version migration to .node-version (#​1201) — @​naokihaba
• Make vp env off disable Node.js management for all vp commands (#​1255) — @​fengmk2
• Add explanations to migration prompts (#​1270) — @​hakshu25
• vp run --cache now supports running without a task specifier and opens the interactive task selector (vite-task#313) — @​HaasStefan

Fixes & Enhancements

• Support JFrog registry metadata JSON format (#​1249) — @​fengmk2
• Support Bun object-form workspaces in package.json (#​1250) — @​fengmk2
• Resolve latest to absolute latest Node.js version (#​1253) — @​fengmk2
• Use bin.js entry point for TypeScript loader in justfile (#​1252) — @​jong-kyung
• Replace deprecated @tanstack/create-start with @tanstack/cli (#​1259) — @​jong-kyung
• Include additional supported config types from lint-staged (#​1263) — @​porada
• Add vitest to devDependencies for peer dep resolution (#​1261) — @​fengmk2
• Do not treat lint warnings as errors in exit code (#​1268) — @​fengmk2
• Resolve tsgolint on Windows with bun package manager (#​1269) — @​fengmk2
• Bypass package manager release age gates during vp upgrade (#​1272) — @​kazupon
• Wrap zsh completion in eval for dash compatibility (#​1280) — @​shaneturner
• Write merged LICENSE directly instead of LICENSE.md (#​1281) — @​fengmk2
• Update .yarnrc template to use node_modules (#​1297) — @​rChaoz
• Scope CI env var to child process in Windows install script (#​1292) — @​fengmk2
• Correctly resolve tsgolint in yarn monorepo packages (#​1310) — @​rChaoz
• Override rolldown panic hook with vite-plus branding (#​1287) — @​fengmk2
• Fix PowerShell install errors on Windows (#​1284) — @​fengmk2

Refactor

• Use .ts import extensions (#​1274) — @​fengmk2
• Migrate CLI build from tsc+rolldown to tsdown (#​1276) — @​fengmk2
  Replaces the split build strategy (tsc for local CLI code + rolldown for global modules) with a unified tsdown configuration. All third-party deps are now inlined at build time, eliminating the rolldown.config.ts and its manual external/path-rewriting plugins. Runtime dependencies dropped from 10 → 6:

  	Before (v0.1.15)	After (v0.1.16)
  dependencies	10	6
  Removed	cac, cross-spawn, jsonc-parser, picocolors	(inlined by tsdown)

Docs

• Document aliased package update steps (#​1266) — @​fengmk2
• Add custom Node.js mirror docs and rename VITE_NODE_DIST_MIRROR to VP_NODE_DIST_MIRROR (#​1254) — @​kazupon
• Add info about bun as pkg manager (#​1294) — @​TheAlexLichter
• Improve docs for core commands (#​1304) — @​connorshea
• Soften troubleshooting claims around vite config loading (#​1313) — @​FleetAdmiralJakob
• Remove redirect (#​1306) — @​connorshea

Chore

• Upgrade upstream dependencies: oxc 0.123.0, rolldown 1.0.0-rc.13, vite 8.0.5, esbuild 0.28.0, TypeScript 6.0.2, sass 1.99.0, oxlint-tsgolint 0.20.0, rolldown-plugin-dts 0.23.2, @​vitejs/devtools 0.1.13, Vue 3.5.31 (#​1267, #​1279, #​1319) — @​Brooooooklyn
• Bump vite-task to 076cef4 (#​1320) — @​fengmk2
• Use matchDepNames for vite-task crates in renovate config (#​1217) — @​fengmk2
• Clarify Node.js version management prompt (#​1273) — @​fengmk2
• Update crate-ci/typos action to v1.45.0 (#​1262)

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16
• @voidzero-dev/vite-plus-test@0.1.16
• vite-plus@0.1.16

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Upgrade:

vp upgrade

New Contributors

Welcome to all new contributors! 🎉

@​porada, @​hakshu25, @​shaneturner, @​rChaoz, @​FleetAdmiralJakob

Full Changelog: voidzero-dev/vite-plus@v0.1.15...v0.1.16

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.