feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #3416 · voidzero-dev/vite-plus

voidzero-guard · 2026-11-10T09:02:54Z

Upgrade the pnpm installer pin to 10.34.9 across setup, legacy installers, lockfile generation, and pin verification.
Upgrade oxfmt to 0.78.0, Oxlint packages to 1.93.0, oxlint-tsgolint to 7.0.2006, and Oxc parser/runtime/type packages to 0.158.0; refresh pnpm-lock.yaml.
Enable phf macros, disable doctests for vp_cli_help and vp_toolchain, and remove three dependency entries from .github/renovate.json.

Dependency updates

Package	From	To
`pnpm (installer)`	`10.34.7`	`10.34.9`
`oxfmt`	`0.76.0`	`0.78.0`
`oxlint`	`1.91.0`	`1.93.0`
`@oxlint/plugins`	`1.91.0`	`1.93.0`
`oxlint-tsgolint`	`7.0.2005`	`7.0.2006`
`@oxc-project/runtime`	`0.157.0`	`0.158.0`
`@oxc-project/types`	`0.157.0`	`0.158.0`
`oxc-parser`	`0.157.0`	`0.158.0`

Unchanged dependencies

rolldown: v1.2.18 (f9a49d6)
vite: v8.3.7 (5def936)
oxc-node: 7ff14c3
vitest: 5.1.0
@vitest/browser: 5.1.0
@vitest/browser-playwright: 5.1.0
@vitest/browser-preview: 5.1.0
@vitest/mocker: 5.1.0
@vitest/pretty-format: 5.1.0
@vitest/snapshot: 5.1.0
@vitest/spy: 5.1.0
@vitest/utils: 5.1.0
tsdown: 0.23.4
@tsdown/css: 0.23.4
@tsdown/exe: 0.23.4
lightningcss: ^1.33.0
lint-staged: 17.6.0
@oxc-node/cli: 1.0.1
@oxc-node/core: 1.0.1
VITEST_VERSION constant: 5.1.0
Node.js: 24.22.2
yuku-parser: 0.19.0
postcss: ^8.5.32
fsevents: ~2.3.3

Code changes

Cargo.toml: enable the phf macros feature.
crates/vp_cli_help/Cargo.toml and crates/vp_toolchain/Cargo.toml: disable doctests.
.github/renovate.json: remove criterion2, saphyr, and testing_macros entries.

Build status

upgrade-and-sync: failure
build-upstream: failure
kimi-fixups: success

🤖 Generated with Kimi Code

- pnpm (installer): 10.34.7 -> 10.34.9 - oxfmt: 0.76.0 -> 0.78.0 - oxlint: 1.91.0 -> 1.93.0 - @oxlint/plugins: 1.91.0 -> 1.93.0 - oxlint-tsgolint: 7.0.2005 -> 7.0.2006 - @oxc-project/runtime: 0.157.0 -> 0.158.0 - @oxc-project/types: 0.157.0 -> 0.158.0 - oxc-parser: 0.157.0 -> 0.158.0 Code changes: - Enable `phf` macros in `Cargo.toml`. - Disable doctests in `crates/vp_cli_help/Cargo.toml` and `crates/vp_toolchain/Cargo.toml`. - Remove `criterion2`, `saphyr`, and `testing_macros` from `.github/renovate.json`. Co-Authored-By: Kimi Code <noreply@anthropic.com>

voidzero-guard · 2026-11-10T09:02:56Z

✅ No upstream CLI help changes detected

Compared normalized --help output for the upstream CLIs mirrored by Vite+.

➖ Vite: no version update (8.3.7)

No version update was detected, so there is no CLI help diff.

➖ Vitest: no version update (5.1.0)

No version update was detected, so there is no CLI help diff.

✅ Oxlint: no CLI help changes (1.91.0 → 1.93.0)

The version was updated, but the normalized CLI help output has no differences.

✅ Oxfmt: no CLI help changes (0.76.0 → 0.78.0)

The version was updated, but the normalized CLI help output has no differences.

✅ tsdown: no CLI help changes (0.23.4 → 0.23.7)

The version was updated, but the normalized CLI help output has no differences.

socket-security · 2026-11-10T09:03:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@oxc-project/types@0.150.0 ⏵ 0.158.0
npm/@oxc-project/runtime@0.158.0
npm/oxfmt@0.78.0
npm/oxc-parser@0.157.0 ⏵ 0.158.0			⁺¹
npm/oxlint-tsgolint@7.0.2006
npm/knip@6.39.0 ⏵ 6.44.2			⁺²
npm/minimatch@11.0.4 ⏵ 11.0.5	⁺¹	⁺¹

View full report

cloudflare-workers-and-pages · 2026-11-10T09:04:15Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `e7c499c`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://dac2bd13-viteplus-dev.voidzero-docs.workers.dev	`e7c499c`	2026-11-10T15:09:32.921Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://d1a6cca4-viteplus-dev.voidzero-docs.workers.dev	`d4fa2e4`	2026-11-10T14:08:49.404Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://5b3439b1-viteplus-dev.voidzero-docs.workers.dev	`57191d2`	2026-11-10T12:42:25.846Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://53439f8e-viteplus-dev.voidzero-docs.workers.dev	`ca2e5a7`	2026-11-10T11:54:39.245Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://04749194-viteplus-dev.voidzero-docs.workers.dev	`b10d307`	2026-11-10T11:40:23.214Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://ecb562a5-viteplus-dev.voidzero-docs.workers.dev	`c25cd53`	2026-11-10T09:04:33.690Z	Visit the dashboard ↗

github-actions · 2026-11-10T09:04:48Z

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: e7c499c

github-actions · 2026-11-10T09:13:45Z

CLI artifact sizes (`e7c499c`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.
The dist rows use the Linux build. The core total excludes .node files to match the release artifact.

Artifact	Format	Base	PR	Change
`packages/cli/dist`	Directory total	2.33 MiB	2.33 MiB	+3.71 KiB (+0.16%)
`packages/core/dist`	Directory total	4.09 MiB	4.09 MiB	0 B (0.00%)
Combined package dist	Directory total	6.42 MiB	6.42 MiB	+3.71 KiB (+0.06%)
`vp` (Linux x64)	Binary	8.34 MiB	8.34 MiB	0 B (0.00%)
`vp` (Linux x64)	gzip -9	3.81 MiB	3.81 MiB	-1 B (-0.00%)
NAPI (Linux x64)	Binary	36.77 MiB	36.77 MiB	0 B (0.00%)
NAPI (Linux x64)	gzip -9	14.69 MiB	14.69 MiB	0 B (0.00%)
`vp` (macOS ARM64)	Binary	5.46 MiB	5.46 MiB	0 B (0.00%)
`vp` (macOS ARM64)	gzip -9	3.25 MiB	3.25 MiB	+7 B (+0.00%)
NAPI (macOS ARM64)	Binary	43.42 MiB	43.42 MiB	0 B (0.00%)
NAPI (macOS ARM64)	gzip -9	18.86 MiB	18.86 MiB	0 B (0.00%)
`vp` (Windows x64)	Binary	6.18 MiB	6.18 MiB	0 B (0.00%)
`vp` (Windows x64)	gzip -9	2.86 MiB	2.86 MiB	-1 B (-0.00%)
NAPI (Windows x64)	Binary	32.80 MiB	32.80 MiB	0 B (0.00%)
NAPI (Windows x64)	gzip -9	13.45 MiB	13.45 MiB	-9 B (-0.00%)
Trampoline (Windows x64)	Binary	13.50 KiB	13.50 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	7.09 KiB	7.09 KiB	+1 B (+0.01%)
Installer (Windows x64)	Binary	4.68 MiB	4.68 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.24 MiB	2.24 MiB	-4 B (-0.00%)

github-actions · 2026-11-10T12:16:23Z

Preview binary sizes (`ca2e5a7`)

Compared with the latest stable release, v1.5.1. Preview build.
Each row measures one binary. Negative changes mean a smaller preview binary.

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	5.42 MiB	5.44 MiB	+16.33 KiB (+0.29%)
NAPI (macOS ARM64)	43.01 MiB	43.39 MiB	+388.30 KiB (+0.88%)
`vp` (macOS x64)	6.90 MiB	6.90 MiB	+8.23 KiB (+0.12%)
NAPI (macOS x64)	48.29 MiB	48.75 MiB	+477.55 KiB (+0.97%)
`vp` (Linux ARM64 GNU)	6.88 MiB	6.88 MiB	+4.01 KiB (+0.06%)
NAPI (Linux ARM64 GNU)	32.26 MiB	32.68 MiB	+428.67 KiB (+1.30%)
`vp` (Linux ARM64 musl)	6.95 MiB	6.96 MiB	+3.98 KiB (+0.06%)
NAPI (Linux ARM64 musl)	31.48 MiB	31.89 MiB	+416.48 KiB (+1.29%)
`vp` (Linux x64 GNU)	8.31 MiB	8.31 MiB	0 B (0.00%)
NAPI (Linux x64 GNU)	36.19 MiB	36.69 MiB	+512.67 KiB (+1.38%)
`vp` (Linux x64 musl)	8.38 MiB	8.38 MiB	+4.80 KiB (+0.06%)
NAPI (Linux x64 musl)	35.39 MiB	35.89 MiB	+506.39 KiB (+1.40%)
`vp` (Windows x64)	6.16 MiB	6.17 MiB	+10.50 KiB (+0.17%)
NAPI (Windows x64)	32.02 MiB	32.44 MiB	+436.50 KiB (+1.33%)
Trampoline (Windows x64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows x64)	4.67 MiB	4.67 MiB	+4.00 KiB (+0.08%)
`vp` (Windows ARM64)	5.40 MiB	5.40 MiB	+4.00 KiB (+0.07%)
NAPI (Windows ARM64)	28.31 MiB	28.65 MiB	+348.00 KiB (+1.20%)
Trampoline (Windows ARM64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows ARM64)	3.84 MiB	3.85 MiB	+3.00 KiB (+0.08%)

gzip -9 sizes

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	3.24 MiB	3.24 MiB	+2.79 KiB (+0.08%)
NAPI (macOS ARM64)	18.68 MiB	18.85 MiB	+173.32 KiB (+0.91%)
`vp` (macOS x64)	3.42 MiB	3.42 MiB	-649 B (-0.02%)
NAPI (macOS x64)	19.91 MiB	20.11 MiB	+206.57 KiB (+1.01%)
`vp` (Linux ARM64 GNU)	3.73 MiB	3.73 MiB	+2.94 KiB (+0.08%)
NAPI (Linux ARM64 GNU)	13.74 MiB	13.93 MiB	+195.81 KiB (+1.39%)
`vp` (Linux ARM64 musl)	3.75 MiB	3.76 MiB	+3.72 KiB (+0.10%)
NAPI (Linux ARM64 musl)	13.44 MiB	13.63 MiB	+192.13 KiB (+1.40%)
`vp` (Linux x64 GNU)	3.80 MiB	3.80 MiB	+1.81 KiB (+0.05%)
NAPI (Linux x64 GNU)	14.44 MiB	14.65 MiB	+218.42 KiB (+1.48%)
`vp` (Linux x64 musl)	3.82 MiB	3.83 MiB	+3.25 KiB (+0.08%)
NAPI (Linux x64 musl)	14.11 MiB	14.33 MiB	+218.72 KiB (+1.51%)
`vp` (Windows x64)	2.85 MiB	2.85 MiB	+2.89 KiB (+0.10%)
NAPI (Windows x64)	13.11 MiB	13.30 MiB	+196.40 KiB (+1.46%)
Trampoline (Windows x64)	7.14 KiB	7.14 KiB	+1 B (+0.01%)
Installer (Windows x64)	2.24 MiB	2.24 MiB	+1.06 KiB (+0.05%)
`vp` (Windows ARM64)	2.72 MiB	2.72 MiB	+1.88 KiB (+0.07%)
NAPI (Windows ARM64)	12.45 MiB	12.62 MiB	+178.28 KiB (+1.40%)
Trampoline (Windows ARM64)	6.92 KiB	6.93 KiB	+3 B (+0.04%)
Installer (Windows ARM64)	2.13 MiB	2.13 MiB	+1.69 KiB (+0.08%)

Raw sizes are uncompressed file sizes. gzip sizes recompress each binary at level 9; they are not package or download archive sizes.
The baseline uses published release files, including NAPI packages from npm at the same version. Build versions and toolchains can affect the difference.

github-actions · 2026-11-10T12:18:54Z

Registry bridge build (`ca2e5a7`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f`
`create-vite-plus`	`0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install.sh | VP_PR_VERSION=3416 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install-legacy.sh bash

# Windows (PowerShell)
$env:VP_PR_VERSION="3416"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install.ps1 | iex

Or install with Homebrew (macOS / glibc Linux):

These commands use the formula and binary from this published commit. Replace brew install with brew reinstall if the tap package is already installed.
If Homebrew Core’s vite-plus is installed, run brew uninstall vite-plus first. This keeps your user data; do not run vp implode to switch installations.

(
  set -eu
  export HOMEBREW_NO_AUTO_UPDATE=1
  export HOMEBREW_VP_PR_VERSION=ca2e5a7bac9b1250f003607e30d8af65bffd377f
  brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
  preview_tap="$(brew --repository voidzero-dev/vite-plus)"
  git -C "$preview_tap" fetch --depth=1 https://github.com/voidzero-dev/vite-plus.git "$HOMEBREW_VP_PR_VERSION"
  git -C "$preview_tap" switch --detach "$HOMEBREW_VP_PR_VERSION"
  brew install voidzero-dev/vite-plus/vp
  brew test voidzero-dev/vite-plus/vp
  "$(brew --prefix)/bin/vp"
)

The tap stays at the tested commit. Return it to main after testing:

git -C "$(brew --repository voidzero-dev/vite-plus)" switch main

Or download the standalone Windows installer built from this commit:

Architecture	Installer
x64	`vp-setup-x86_64-pc-windows-msvc.exe`
Arm64	`vp-setup-aarch64-pc-windows-msvc.exe`

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or create a new project from this commit without installing the CLI:

export npm_config_registry=https://registry-bridge.viteplus.dev/ pnpm_config_registry=https://registry-bridge.viteplus.dev/
pnpm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f # or: npm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f

$env:npm_config_registry="https://registry-bridge.viteplus.dev/"; $env:pnpm_config_registry="https://registry-bridge.viteplus.dev/"
pnpm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f # or: npm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f

pnpm 11+ reads pnpm_config_registry, npm and older pnpm read npm_config_registry. The new project pins this build, so keep the registry set for later installs, or configure it as below.

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f"
  }
}

github-actions · 2026-11-10T12:19:53Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-3416`	219MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-3416 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-3416

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-3416 vp --version

See docs/guide/docker.md for usage.

@wan9chi

Vite+ 1.6.0 caches `vp run` tasks that rewrite files they read, previews runs with `vp run --dry-run` and JSON output, lets `vp check --continue-on-error` report every failed check, and sets `VP_USER_AGENT` for the tools that `vp` starts. ### Features - `vp run` caches tasks that read files they also write, such as `tsdown --exports` rewriting `package.json` or `tsc --incremental` reading and writing `tsconfig.tsbuildinfo`. The files a task writes, and folders that hold only those files, may be missing on the next run, as on a fresh clone, and a cache hit restores them with the task's outputs, including the symbolic links the task created ([docs](https://viteplus.dev/guide/automatic-data-tracking#rebuildable-inputs)) ([vite-task#913](voidzero-dev/vite-task#913), [vite-task#914](voidzero-dev/vite-task#914), [vite-task#915](voidzero-dev/vite-task#915), [vite-task#916](voidzero-dev/vite-task#916), [vite-task#917](voidzero-dev/vite-task#917), [vite-task#918](voidzero-dev/vite-task#918)), by @wan9chi. - `vp run --dry-run` shows each command that a run would start and whether it would hit the cache, without running anything or writing to the cache. `vp run --json` prints every package and task in the workspace, and `vp run --dry-run --json` prints the run plan with each step's cache status, as one JSON document for scripts, CI, and coding agents. `vp run -v` lists every change behind a cache miss, including each changed input file, and `-vv` also lists the unchanged inputs and the outputs that a hit restores ([docs](https://viteplus.dev/guide/run#dry-runs-and-json-output)) ([vite-task#948](voidzero-dev/vite-task#948), [vite-task#960](voidzero-dev/vite-task#960), [vite-task#961](voidzero-dev/vite-task#961), [vite-task#963](voidzero-dev/vite-task#963), [vite-task#966](voidzero-dev/vite-task#966), [vite-task#967](voidzero-dev/vite-task#967), [vite-task#968](voidzero-dev/vite-task#968), [vite-task#969](voidzero-dev/vite-task#969)), by @wan9chi. - `vp check --continue-on-error` runs the remaining enabled checks after a failure, so one run reports formatting, lint, and type errors together, and exits with the status of the first failed check. Without the flag, `vp check` still stops at the first failed check ([#3367](#3367)), by @chbaefront. - `vp`, `vpr`, and `vpx` set `VP_USER_AGENT=vp/<version>` for their child processes, so tools can detect that Vite+ started them. When the global CLI delegates to a project's local CLI, the local version is reported ([docs](https://viteplus.dev/guide/global-cli#vp-user-agent)) ([#1958](#1958)), by @fengmk2. - First part of `VP_ENV_FORBIDDEN=1`, for systems such as NixOS that provide Node.js and package managers themselves: with it set, Vite+ never downloads a Node.js or package-manager version, shims and `vpx` use only the system tools on `PATH`, and installers and `vp upgrade` use the system `node` and `pnpm` for Vite+'s own dependencies. In this release, commands that delegate to a package manager, such as `vp install` and `vp run`, fail with `DisabledByEnvForbidden` while it is set. A follow-up change is planned to cover them and document the variable ([#3233](#3233)), by @myuron. - Upgrade the bundled Oxfmt and Oxlint ([#3416](#3416)), by @voidzero-guard[bot]: - `oxfmt@0.76.0` to `oxfmt@0.78.0`. Oxfmt formats Vue files with its own formatter instead of Prettier, so the output for Vue templates can change. It also fixes Tailwind class sorting in several layouts, Less escapes and `%` selectors, and TypeScript in Astro files. - `oxlint@1.91.0` to `oxlint@1.93.0` and `oxlint-tsgolint@7.0.2005` to `oxlint-tsgolint@7.0.2006`. `no-redeclare` gets an `ignoreDeclarationMerge` option, and `promise/prefer-catch` offers a suggestion. - Oxlint and Oxfmt resolve an unset or relative `root` in `vite.config.ts` from the directory of the config file instead of the current directory, so editor integrations in multi-root workspaces load the correct project. - Vite+ installs its own dependencies during setup and `vp upgrade` with `pnpm@10.34.9` (was `pnpm@10.34.7`). - The new Oxfmt and Oxlint can flag code that passed before. If your CI runs `vp check`, run `vp check --fix --continue-on-error` after you upgrade: it formats files, applies the available lint fixes, formats again, and reports every error that remains. For example, `unicorn/prefer-type-error` now also reports a `throw` in an `if` branch without braces, and this command rewrites it. ### Fixes & Enhancements - While a Vite+ spinner is visible, such as `Installing global packages` in `vp install -g`, Vite+ hides the cursor and discards typed keys. Pressing Enter no longer leaves copies of the spinner row, and typed text no longer runs in the shell after the command ends. Ctrl+C during a spinner now ends the command with the usual signal status instead of exit code 0, and the global package spinners show the elapsed time ([#3373](#3373), [#3417](#3417)), by @jong-kyung and @fengmk2. - `vp run` loads a package's `vite.config.*` only when the run reaches one of that package's tasks. A run in one package no longer waits for the configs of other packages, a broken config in another package no longer fails it, and `vp run <task>` in a package that does not define the task reports `Task "<task>" not found` instead of another package's config error ([vite-task#944](voidzero-dev/vite-task#944), [vite-task#988](voidzero-dev/vite-task#988)), by @wan9chi. - `vp run nope#build`, where no workspace package has the name `nope`, fails with `Package 'nope' not found in the workspace` and exits with code 1, instead of running nothing and exiting with code 0. A short name that matches several scoped packages fails as ambiguous ([vite-task#984](voidzero-dev/vite-task#984)), by @wan9chi. - Folder listings no longer skip entries named `dist`, so a `dist` folder that appears or disappears in a folder a task lists makes the next run a cache miss. Exclusions in a task's `input`, such as `"!dist/**"`, now also apply to the folders that the task lists. In a new monorepo from `vp create`, every task hits the cache from the third `vp run ready`, because the first build creates the `dist` folders ([vite-task#919](voidzero-dev/vite-task#919), [vite-task#941](voidzero-dev/vite-task#941)), by @wan9chi. - Fewer unnecessary cache misses and cache failures in `vp run`: on Windows, files that a task deletes or moves are no longer among its inputs. Tasks that read `node_modules/.vite/task-cache`, as Parcel and Gatsby do, hit the cache. A task that writes outside the workspace through `..`, like `cp -r dist ../site`, no longer fails with `Cache update failed` ([vite-task#937](voidzero-dev/vite-task#937), [vite-task#940](voidzero-dev/vite-task#940), [vite-task#980](voidzero-dev/vite-task#980)), by @wan9chi. - A cache hit restores the symbolic links that a task's `output` globs match as links, instead of dropping them ([vite-task#885](voidzero-dev/vite-task#885)), by @jasonkuhrt. - When several tasks become ready at the same time, `vp run` checks their cache entries in parallel, so cache hits start sooner ([vite-task#982](voidzero-dev/vite-task#982)), by @wan9chi. - On macOS, task commands that use `sh` or `bash` behave as on Linux: a `while read` loop with a redirect under `set -e` no longer exits the script, an `EXIT` trap sees the exit status, so a failed task is no longer reported as successful, and `$BASH` is set ([vite-task#939](voidzero-dev/vite-task#939)), by @lifeiscontent. - The helper files that `vp run` writes to the system temp directory go in one folder that only the current user can write to, such as `/tmp/vp_run-1000` on Linux. On Linux, a different Vite+ version run by another user no longer fails ([vite-task#947](voidzero-dev/vite-task#947), [vite-task#974](voidzero-dev/vite-task#974)), by @wan9chi. - A `getEnvs` query from `@voidzero-dev/vite-task-client` that matches every name (`{ prefix: '' }` or `*`) returns nothing and no longer adds every environment variable to the cache key ([vite-task#976](voidzero-dev/vite-task#976)), by @wan9chi. - `vp migrate` no longer writes package specs that the package manager cannot resolve, such as a `@vitest/*` `catalog:` reference without a catalog entry or a top-level catalog on Bun before 1.2.21. Bun projects with an empty `workspaces` field get catalog references, and child packages with a plain `vite-plus` range get the same concrete version as the root when the project cannot use catalogs ([#3397](#3397)), by @jong-kyung. - `vp create` uses the package manager version that `VP_PACKAGE_MANAGER` selects for the generated settings, the installation, and its summary. Standalone pnpm projects get `packages: ['.']` in an existing `pnpm-workspace.yaml` only for pnpm before 10.5.0 ([#3197](#3197)), by @evan-lc and @fengmk2. - `vp` sends a `User-Agent` header on all HTTP requests, so Node.js mirrors that reject requests without one, such as `mirrors.aliyun.com`, work ([#3425](#3425)), by @naokihaba. - `vp env pin` prints `Updated` when it overwrites an existing `.node-version` or `.nvmrc` file and `Created` when it writes a new one ([#3377](#3377)), by @CheHyeonYeong. ### Docs - Describe rebuildable inputs in the Automatic Data Tracking guide, and dry runs, JSON output, and `-vv` in the `vp run` guide ([#3419](#3419), [#3421](#3421)), by @wan9chi. ### Chore - Bump vite-task to `cb1ea8d`, with its user-facing changes listed above, and list `--dry-run`, `--json`, and `-vv` in `vp run --help` ([#3418](#3418)), by @wan9chi. - The daily dependency upgrade also updates the pnpm version that the installers pin, after it checks the release integrity ([#3407](#3407)), by @fengmk2. - Warm up the monorepo cache check in the `vp create` CI job under pnpm and Bun ([#3423](#3423)), by @wan9chi. - Remove an unused CI job that the required `done` check did not cover ([#3403](#3403)), by @jong-kyung. - Remove an incorrect comment about export pattern order in the CLI build script ([#3405](#3405)), by @alexicum. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | vite | `8.3.7` | [`5def936`](vitejs/vite@5def936) | unchanged | | rolldown | `1.2.18` | [`f9a49d6`](rolldown/rolldown@f9a49d6) | unchanged | | oxc-node | `1.0.1` | [`7ff14c3`](oxc-project/oxc-node@7ff14c3) | unchanged | | tsdown | `0.23.4` | [npm](https://npmx.dev/package/tsdown/v/0.23.4) | unchanged | | vitest | `5.1.0` | [npm](https://npmx.dev/package/vitest/v/5.1.0) | unchanged | | oxlint | `1.93.0` | [npm](https://npmx.dev/package/oxlint/v/1.93.0) | [1.92.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.92.0), [1.93.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.93.0) | | oxlint-tsgolint | `7.0.2006` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2006) | [7.0.2006](https://github.com/oxc-project/tsgolint/releases/tag/v7.0.2006) | | oxfmt | `0.78.0` | [npm](https://npmx.dev/package/oxfmt/v/0.78.0) | [0.77.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.77.0), [0.78.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.78.0) | ### Upgrade ```bash vp upgrade ``` If `vp upgrade` must download Node.js and `VP_NODE_DIST_MIRROR` points to a mirror that rejects requests without a `User-Agent` header, such as `mirrors.aliyun.com`, unset it or point it to another mirror for this upgrade. The installed `vp` downloads Node.js and does not send the header yet. ### New Contributors @alexicum, @evan-lc, @CheHyeonYeong **Full Changelog**: v1.5.1...v1.6.0 --- For a stable release, complete the `HomebrewFormula/vp.rb` update after publication by merging the generated `release/homebrew-v1.6.0` PR. Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Merge branch 'main' into deps/upstream-update

b10d307

fengmk2 self-assigned this Nov 10, 2026

fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests test: sfw preview-build Publish this PR's commits to the registry bridge as preview builds labels Nov 10, 2026

Merge branch 'main' into deps/upstream-update

ca2e5a7

fengmk2 added preview-build Publish this PR's commits to the registry bridge as preview builds and removed preview-build Publish this PR's commits to the registry bridge as preview builds labels Nov 10, 2026

Merge branch 'main' into deps/upstream-update

57191d2

fengmk2 mentioned this pull request Nov 10, 2026

chore(deps): automate pnpm installer pins and fix validation #3407

Merged

fengmk2 added 2 commits November 10, 2026 22:07

Merge main into deps/upstream-update

d4fa2e4

Merge branch 'main' into deps/upstream-update

e7c499c

fengmk2 approved these changes Nov 10, 2026

View reviewed changes

fengmk2 merged commit ff957e8 into main Nov 10, 2026
181 of 184 checks passed

fengmk2 deleted the deps/upstream-update branch November 10, 2026 15:45

fengmk2 mentioned this pull request Nov 10, 2026

release: v1.6.0 #3426

Merged

BrewTestBot mentioned this pull request Nov 11, 2026

vite-plus 1.6.0 Homebrew/homebrew-core#324766

Merged

Navigation Menu

Repository navigation

feat(deps): upgrade upstream dependencies - #3416

feat(deps): upgrade upstream dependencies#3416
fengmk2 merged 6 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Nov 10, 2026

Uh oh!

voidzero-guard Bot commented Nov 10, 2026

Uh oh!

socket-security Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

voidzero-guard Bot commented Nov 10, 2026

Dependency updates

Code changes

Build status

Uh oh!

voidzero-guard Bot commented Nov 10, 2026

✅ No upstream CLI help changes detected

Uh oh!

socket-security Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit e7c499c)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Uh oh!

github-actions Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI artifact sizes (e7c499c)

Uh oh!

github-actions Bot commented Nov 10, 2026

Preview binary sizes (ca2e5a7)

Uh oh!

github-actions Bot commented Nov 10, 2026

Registry bridge build (ca2e5a7)

Uh oh!

github-actions Bot commented Nov 10, 2026

🐳 Docker preview image

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security Bot commented Nov 10, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Nov 10, 2026 •

edited

Loading

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `e7c499c`)

github-actions Bot commented Nov 10, 2026 •

edited

Loading

github-actions Bot commented Nov 10, 2026 •

edited

Loading

CLI artifact sizes (`e7c499c`)

Preview binary sizes (`ca2e5a7`)

Registry bridge build (`ca2e5a7`)