feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #3236 · voidzero-dev/vite-plus

voidzero-guard · 2026-10-26T02:33:38Z

Upgrade tsdown, @tsdown/css, and @tsdown/exe to 0.23.2. Upgrade the vendored oxc-node and its npm packages to 1.0.1.
Keep declaration generation compatible with stable TypeScript and existing tsgo configurations. Scope the rolldown-plugin-dts override to tsdown@0.23.2.
Pass loader settings to the asynchronous ESM thread after the oxc-node update. Preserve configuration diagnostics and watch reports.
Require completed validation before the upgrade workflow creates a ready PR. Retry transient Windows file locks during temporary directory cleanup.

Dependency updates

Package	From	To
`oxc-node`	`4759ced`	`v1.0.1` (`6d5376d`)
`tsdown`	`0.23.1`	`0.23.2`
`@tsdown/css`	`0.23.1`	`0.23.2`
`@tsdown/exe`	`0.23.1`	`0.23.2`
`@oxc-node/cli`	`1.0.0`	`1.0.1`
`@oxc-node/core`	`1.0.0`	`1.0.1`

Unchanged dependencies

rolldown: v1.2.15 (89d821c)
vite: v8.3.5 (981f07f)
vitest: 5.0.5
@vitest/browser: 5.0.5
@vitest/browser-playwright: 5.0.5
@vitest/browser-preview: 5.0.5
@vitest/mocker: 5.0.5
@vitest/pretty-format: 5.0.5
@vitest/snapshot: 5.0.5
@vitest/spy: 5.0.5
@vitest/utils: 5.0.5
lightningcss: ^1.33.0
lint-staged: 17.6.0
oxfmt: 0.74.0
oxlint: 1.89.0
@oxlint/plugins: 1.89.0
oxlint-tsgolint: 7.0.2005
@oxc-project/runtime: 0.155.0
@oxc-project/types: 0.155.0
oxc-minify: 0.155.0
oxc-parser: 0.155.0
oxc-transform: 0.155.0
VITEST_VERSION constant: 5.0.5
yuku-parser: 0.19.0
postcss: ^8.5.30
fsevents: ~2.3.3
typescript: ~7.0.2
rolldown-plugin-dts: ^0.28.0

Code changes

pnpm-workspace.yaml: Pin tsdown@0.23.2>rolldown-plugin-dts to 0.28.8. The beta plugin requires TypeScript 7.1 for its Go API and removes support for @typescript/native-preview.
packages/tools/src/patch-oxc-node.ts: Expose freeze_tsconfig_js and initialize_loader_js without registering upstream NAPI exports.
packages/cli/binding/src/oxc_node.rs and packages/cli/src/script-*.ts: Pass frozen tsconfig settings, their diagnostic source, and dependency policy to the loader thread. Refresh generated declarations in packages/cli/binding/index.d.cts.
.github/workflows/upgrade-deps.yml: Run final validation in a separate workflow step. Failed validation produces a draft PR and a failed workflow.
packages/cli/src/create/__tests__/register-template.spec.ts: Use asynchronous cleanup with bounded retries for transient Windows file locks.
crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/: Add coverage for stable TypeScript, @typescript/native-preview, and asynchronous loader settings.

Build status

Current build and CI status: PR checks.

- oxc-node: 4759ced -> v1.0.1 (6d5376d) - tsdown: 0.23.1 -> 0.23.2 - @tsdown/css: 0.23.1 -> 0.23.2 - @tsdown/exe: 0.23.1 -> 0.23.2 - @oxc-node/cli: 1.0.0 -> 1.0.1 - @oxc-node/core: 1.0.0 -> 1.0.1 - rolldown-plugin-dts: ^0.28.0 -> ^0.29.0-beta.2 - typescript: ~7.0.2 -> 7.1.0-beta Code changes: - pin TypeScript to 7.1.0-beta when Vite's compiler range can only select 7.0.x (packages/tools/src/sync-remote-deps.ts, tests in packages/tools/src/__tests__/sync-remote-yaml.spec.ts and packages/tools/src/__tests__/sync-remote-deps.spec.ts) - switch dts generation to the Oxc generator (packages/cli/tsdown.config.ts, packages/prompts/tsdown.config.ts) - add explicit type annotations required by the Oxc dts generator (packages/prompts/src/, packages/cli/src/define-config.ts, packages/cli/src/version.ts, packages/cli/src/oxlint-plugin.ts) - remove the @typescript/native-preview peer dependency (packages/core/package.json, packages/core/build.ts) - migrate the exports-map test to the TypeScript 7.1 API (packages/cli/src/__tests__/exports-map.spec.ts) - update pack snapshot for the TypeScript Go emit messages (crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack_monorepo/snapshots/command_pack_monorepo.md) - regenerate NAPI binding declarations from the oxc-node sync (packages/cli/binding/index.d.cts)

voidzero-guard · 2026-10-26T02:33:39Z

✅ No upstream CLI help changes detected

Compared normalized --help output for the upstream CLIs mirrored by Vite+.

➖ Vite: no version update (8.3.5)

No version update was detected, so there is no CLI help diff.

➖ Vitest: no version update (5.0.5)

No version update was detected, so there is no CLI help diff.

➖ Oxlint: no version update (1.89.0)

No version update was detected, so there is no CLI help diff.

➖ Oxfmt: no version update (0.74.0)

No version update was detected, so there is no CLI help diff.

✅ tsdown: no CLI help changes (0.23.1 → 0.23.2)

The version was updated, but the normalized CLI help output has no differences.

socket-security · 2026-10-26T02:35:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@tsdown/exe@0.23.1 ⏵ 0.23.2	^-1		⁺¹
npm/@oxc-node/core@1.0.0 ⏵ 1.0.1	⁺¹	⁺¹	⁺²
npm/@tsdown/css@0.23.1 ⏵ 0.23.2			⁺¹
npm/@oxc-node/cli@1.0.0 ⏵ 1.0.1	⁺¹	⁺¹	⁺¹
npm/tsdown@0.23.1 ⏵ 0.23.2			⁺¹

View full report

github-actions · 2026-10-26T02:42:14Z

CLI artifact sizes (`196192f`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.
The dist rows use the Linux build. The core total excludes .node files to match the release artifact.

Artifact	Format	Base	PR	Change
`packages/cli/dist`	Directory total	2.26 MiB	2.26 MiB	+3.55 KiB (+0.15%)
`packages/core/dist`	Directory total	4.07 MiB	4.07 MiB	-965 B (-0.02%)
Combined package dist	Directory total	6.33 MiB	6.33 MiB	+2.61 KiB (+0.04%)
`vp` (Linux x64)	Binary	8.23 MiB	8.23 MiB	0 B (0.00%)
`vp` (Linux x64)	gzip -9	3.76 MiB	3.76 MiB	0 B (0.00%)
NAPI (Linux x64)	Binary	35.45 MiB	35.47 MiB	+15.31 KiB (+0.04%)
NAPI (Linux x64)	gzip -9	14.12 MiB	14.13 MiB	+8.41 KiB (+0.06%)
`vp` (macOS ARM64)	Binary	5.38 MiB	5.38 MiB	0 B (0.00%)
`vp` (macOS ARM64)	gzip -9	3.20 MiB	3.20 MiB	0 B (0.00%)
NAPI (macOS ARM64)	Binary	42.23 MiB	42.25 MiB	+16.17 KiB (+0.04%)
NAPI (macOS ARM64)	gzip -9	18.25 MiB	18.26 MiB	+4.10 KiB (+0.02%)
`vp` (Windows x64)	Binary	6.08 MiB	6.08 MiB	0 B (0.00%)
`vp` (Windows x64)	gzip -9	2.82 MiB	2.82 MiB	+1 B (+0.00%)
NAPI (Windows x64)	Binary	31.50 MiB	31.52 MiB	+17.00 KiB (+0.05%)
NAPI (Windows x64)	gzip -9	12.83 MiB	12.84 MiB	+5.19 KiB (+0.04%)
Trampoline (Windows x64)	Binary	13.50 KiB	13.50 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	7.09 KiB	7.09 KiB	+3 B (+0.04%)
Installer (Windows x64)	Binary	4.67 MiB	4.67 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.24 MiB	2.24 MiB	+2 B (+0.00%)

cloudflare-workers-and-pages · 2026-10-26T02:57:24Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `196192f`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://f9c08674-viteplus-dev.voidzero-docs.workers.dev	`196192f`	2026-10-26T02:58:00.496Z	Visit the dashboard ↗

github-actions · 2026-10-26T04:53:53Z

Preview binary sizes (`196192f`)

Compared with the latest stable release, v1.4.0. Preview build.
Each row measures one binary. Negative changes mean a smaller preview binary.

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	5.38 MiB	5.38 MiB	+96 B (+0.00%)
NAPI (macOS ARM64)	42.20 MiB	42.22 MiB	+16.16 KiB (+0.04%)
`vp` (macOS x64)	6.82 MiB	6.82 MiB	+4.06 KiB (+0.06%)
NAPI (macOS x64)	47.34 MiB	47.35 MiB	+12.05 KiB (+0.02%)
`vp` (Linux ARM64 GNU)	6.81 MiB	6.82 MiB	+4.00 KiB (+0.06%)
NAPI (Linux ARM64 GNU)	31.44 MiB	31.46 MiB	+19.25 KiB (+0.06%)
`vp` (Linux ARM64 musl)	6.88 MiB	6.89 MiB	+7.15 KiB (+0.10%)
NAPI (Linux ARM64 musl)	30.67 MiB	30.68 MiB	+12.06 KiB (+0.04%)
`vp` (Linux x64 GNU)	8.22 MiB	8.23 MiB	+4.00 KiB (+0.05%)
NAPI (Linux x64 GNU)	35.45 MiB	35.47 MiB	+15.31 KiB (+0.04%)
`vp` (Linux x64 musl)	8.29 MiB	8.30 MiB	+3.09 KiB (+0.04%)
NAPI (Linux x64 musl)	34.43 MiB	34.45 MiB	+12.13 KiB (+0.03%)
`vp` (Windows x64)	6.09 MiB	6.10 MiB	+3.50 KiB (+0.06%)
NAPI (Windows x64)	31.16 MiB	31.17 MiB	+14.50 KiB (+0.05%)
Trampoline (Windows x64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows x64)	4.67 MiB	4.67 MiB	0 B (0.00%)
`vp` (Windows ARM64)	5.33 MiB	5.33 MiB	+4.50 KiB (+0.08%)
NAPI (Windows ARM64)	27.57 MiB	27.58 MiB	+15.00 KiB (+0.05%)
Trampoline (Windows ARM64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows ARM64)	3.85 MiB	3.85 MiB	0 B (0.00%)

gzip -9 sizes

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	3.20 MiB	3.20 MiB	+1.13 KiB (+0.03%)
NAPI (macOS ARM64)	18.25 MiB	18.26 MiB	+3.92 KiB (+0.02%)
`vp` (macOS x64)	3.38 MiB	3.38 MiB	+1.71 KiB (+0.05%)
NAPI (macOS x64)	19.44 MiB	19.44 MiB	+1.69 KiB (+0.01%)
`vp` (Linux ARM64 GNU)	3.69 MiB	3.69 MiB	+1.88 KiB (+0.05%)
NAPI (Linux ARM64 GNU)	13.31 MiB	13.32 MiB	+4.04 KiB (+0.03%)
`vp` (Linux ARM64 musl)	3.71 MiB	3.71 MiB	+2.49 KiB (+0.07%)
NAPI (Linux ARM64 musl)	13.01 MiB	13.02 MiB	+5.78 KiB (+0.04%)
`vp` (Linux x64 GNU)	3.76 MiB	3.76 MiB	+1.17 KiB (+0.03%)
NAPI (Linux x64 GNU)	14.12 MiB	14.13 MiB	+9.16 KiB (+0.06%)
`vp` (Linux x64 musl)	3.78 MiB	3.79 MiB	+2.33 KiB (+0.06%)
NAPI (Linux x64 musl)	13.66 MiB	13.67 MiB	+6.40 KiB (+0.05%)
`vp` (Windows x64)	2.82 MiB	2.82 MiB	+2.02 KiB (+0.07%)
NAPI (Windows x64)	12.69 MiB	12.70 MiB	+10.39 KiB (+0.08%)
Trampoline (Windows x64)	7.14 KiB	7.14 KiB	-1 B (-0.01%)
Installer (Windows x64)	2.24 MiB	2.24 MiB	+26 B (+0.00%)
`vp` (Windows ARM64)	2.69 MiB	2.69 MiB	+2.38 KiB (+0.09%)
NAPI (Windows ARM64)	12.05 MiB	12.06 MiB	+11.09 KiB (+0.09%)
Trampoline (Windows ARM64)	6.93 KiB	6.93 KiB	+1 B (+0.01%)
Installer (Windows ARM64)	2.14 MiB	2.14 MiB	+50 B (+0.00%)

Raw sizes are uncompressed file sizes. gzip sizes recompress each binary at level 9; they are not package or download archive sizes.
The baseline uses published release files, including NAPI packages from npm at the same version. Build versions and toolchains can affect the difference.

github-actions · 2026-10-26T04:56:20Z

Registry bridge build (`196192f`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396`
`create-vite-plus`	`0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://github.com/raw/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install.sh | VP_PR_VERSION=3236 VP_LEGACY_INSTALLER_URL=https://github.com/raw/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install-legacy.sh bash

# Windows (PowerShell)
$env:VP_PR_VERSION="3236"; $env:VP_LEGACY_INSTALLER_URL="https://github.com/raw/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install.ps1 | iex

Or download the standalone Windows installer built from this commit:

Architecture	Installer
x64	`vp-setup-x86_64-pc-windows-msvc.exe`
Arm64	`vp-setup-aarch64-pc-windows-msvc.exe`

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or create a new project from this commit without installing the CLI:

export npm_config_registry=https://registry-bridge.viteplus.dev/ pnpm_config_registry=https://registry-bridge.viteplus.dev/
pnpm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396 # or: npm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396

$env:npm_config_registry="https://registry-bridge.viteplus.dev/"; $env:pnpm_config_registry="https://registry-bridge.viteplus.dev/"
pnpm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396 # or: npm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396

pnpm 11+ reads pnpm_config_registry, npm and older pnpm read npm_config_registry. The new project pins this build, so keep the registry set for later installs, or configure it as below.

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396"
  }
}

github-actions · 2026-10-26T04:57:18Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-3236`	218MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-3236 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-3236

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-3236 vp --version

See docs/guide/docker.md for usage.

@fengmk2

Vite+ 1.5 adds an official Homebrew tap, runs TypeScript through Node.js with `node --import vite-plus/register`, and lets `vp migrate` move `oxnode` and transpile-only `ts-node` scripts to `vpx`. ### Features - Install `vp` from the official Homebrew tap on macOS and glibc Linux ([docs](https://viteplus.dev/guide/homebrew)) ([#2740](#2740)), by @fengmk2: ```bash brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus brew install voidzero-dev/vite-plus/vp ``` - `node --import vite-plus/register` runs TypeScript with the same loader as `vpx`, so tools that start Node.js themselves, such as the Node.js test runner, AVA, or a `NODE_OPTIONS` setting, can run TypeScript files ([docs](https://viteplus.dev/guide/vpx#using-node-js-directly)) ([#3208](#3208)), by @fengmk2. - `vp migrate` moves `oxnode` commands and transpile-only `ts-node` commands to `vpx`, and moves their Node.js preloads and literal `NODE_OPTIONS` values to `vite-plus/register`. `ts-node` commands that type-check stay unchanged with a warning, and the `ts-node` dependency is removed only when nothing still uses it. A project already on Vite+ gets this migration with `vp migrate --full` ([docs](https://viteplus.dev/guide/migrate-rules#oxnode-to-vpx)) ([#3209](#3209), [#3210](#3210)), by @fengmk2. - `vp migrate` warns when it finds Rollup, Rolldown, or Jest dependencies with matching configuration, and explains how to move them to Vite, tsdown, or Vitest. The warnings show during the first migration, or with `vp migrate --full` in a project already on Vite+ ([#3275](#3275)), by @KTrain5169 and @fengmk2. - `vite-plus` exports `resolveConfigFromFile(configFile, options?)`, which resolves a config relative to the config file's directory instead of `process.cwd()`, so editor plugins with several workspace folders load the files of the right project ([#3249](#3249)), by @leaysgur and @fengmk2. - Security: the CLI ships `minimatch@11.0.4`, which fixes a denial of service through glob pattern amplification ([GHSA-g3hv-75wg-m249](GHSA-g3hv-75wg-m249), medium), and `zstd@0.13.4`, which fixes [RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391), [RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398), and [RUSTSEC-2026-0403](https://rustsec.org/advisories/RUSTSEC-2026-0403) ([#3328](#3328), [#3331](#3331)), by @renovate[bot] and @wan9chi. - Upgrade the bundled tools ([#3205](#3205), [#3236](#3236), [#3261](#3261), [#3206](#3206), [#3330](#3330), [#3338](#3338)), by @voidzero-guard[bot] and @fengmk2: - `rolldown@1.2.15` to `rolldown@1.2.16`, with `experimentalInlineCommonChunks` in dev mode and no crash when the working directory was deleted. - `tsdown@0.23.1` to `tsdown@0.23.4`: `vp pack --env-file` can be repeated to load several env files, the config has a JSON schema, and `?inline` CSS imported from dependencies is inlined. - `vitest@5.0.5` to `vitest@5.1.0`, with `--last-failed` and `--since-last-run`, fake timers for `node:timers`, and interactive review of failed snapshots. Browser mode now uses port 23315 by default. - `oxlint@1.89.0` to `oxlint@1.91.0` and `oxlint-tsgolint@7.0.2004` to `oxlint-tsgolint@7.0.2005`, with the new type-aware rule `typescript/no-unsafe-enum-assignment`, wider checks in rules such as `array-callback-return`, `no-useless-concat`, and `no-control-regex`, and two rules moved into the `suspicious` category. - `oxfmt@0.74.0` to `oxfmt@0.76.0`, with a new HTML formatter and JavaScript and TypeScript fixes for parentheses, array layout, and line width with wide characters. - The new oxlint and oxfmt versions can flag code that passed before. If your CI runs `vp check`, run `vp fmt` after upgrading. - `vpx` and `vite-plus/register` run on `oxc-node@1.0.1`, which resolves a `.jsx` specifier to its `.tsx` or `.ts` source. ### Fixes & Enhancements - `vp create` into a target path that is a symbolic link removes only the link after confirmation, instead of deleting the contents of the linked directory, and the overwrite prompt names symbolic links and files ([#2418](#2418)), by @leslieeilsel and @fengmk2. - `vp implode` removes only directories and shims that it can verify as Vite+ installations, and refuses the home directory, its parents, and filesystem roots even with `--yes`, so a `VP_HOME` that points at another directory cannot delete unrelated files ([#3228](#3228)), by @jong-kyung. - `vp run` starts faster in workspaces whose tasks share cache `input` and `output` patterns, because each pattern is parsed once. In a 138-package workspace this saves about 2 seconds of CPU on every run ([vite-task#887](voidzero-dev/vite-task#887), [vite-task#890](voidzero-dev/vite-task#890)), by @jasonkuhrt and @wan9chi. - `vp run` and package-manager commands in npm projects start about 110 ms sooner, because `vp` reads the npm version from npm's `package.json` instead of running `npm --version` ([#3259](#3259)), by @magurotuna. - `vp migrate` checks Vitest prerequisites faster in workspaces, because it parses each lockfile once ([#3212](#3212)), by @jong-kyung. - The installer and `vp upgrade` install the global CLI's dependencies with the Node.js version that the release pins (24.22.2 for this release), instead of the latest LTS ([docs](https://viteplus.dev/guide/ci#node-js-during-installation)) ([#3269](#3269)), by @fengmk2. - The Node.js `latest` alias in `vp env use`, `vp env default`, `vp env pin`, `vp env install`, and `.nvmrc` resolves to the newest stable release instead of a `27.0.0-alpha` build, and `vp env list-remote` marks that stable release as latest ([#3335](#3335)), by @voidzero-bot[bot] and @fengmk2. - `VP_NODE_VERSION=22` and other partial versions work for project commands such as `vp build`, `vp run`, and `vp list`, instead of failing with a 404 download error ([#3341](#3341)), by @jong-kyung. - Two `vp install -g` commands that run at the same time no longer delete each other's active package, and a command that starts while a package manager is being installed no longer runs its shim before the shim is executable ([#3185](#3185), [#3248](#3248)), by @jong-kyung. - `vp config` waits and retries when another linked git worktree holds the shared git config lock, so a `prepare` script no longer fails when two worktrees install at the same time ([#3199](#3199)), by @naokihaba. - `vp env doctor` reports Node.js resolution failures, unreadable config, a failing system `node`, and missing shims as errors and exits with code 1. When it finds only warnings, the summary says `Some warnings found` instead of `All checks passed` ([#3215](#3215), [#3222](#3222)), by @liangmiQwQ. - Nushell completions for `vp` and `vpr` use the named completer input, so Nushell 0.116 shows no deprecation warning, and they fall back to file completion when fish is not installed. Run `vp env setup --refresh` to regenerate `env.nu` ([#3267](#3267), [#3276](#3276)), by @naokihaba. - `vp migrate` removes the `tsx` dependency even when a comment still contains a `tsx` command or code fence, and keeps it for JSDoc type imports that need it ([#3299](#3299)), by @voidzero-bot[bot] and @fengmk2. - The `prefer-vite-plus-imports` lint rule and its autofix leave the `vite` and `vitest` imports that `vp migrate` keeps, such as `vitest` imports in a package that lists `vitest` in `peerDependencies`, so `vp lint --fix` no longer breaks the package for its plain Vitest users ([#3192](#3192)), by @Dunqing. - Generated Zed settings no longer force `typeAware` and `unusedDisableDirectives`, so editor diagnostics follow the `lint.options` in `vite.config.ts`. Existing editor settings stay unchanged ([#2357](#2357)), by @pweyck. - `vp dlx` with npm runs the right executable for scoped packages such as `@angular/cli` ([#3229](#3229)), by @jong-kyung. - `vp outdated -r` in npm projects checks the workspaces instead of transitive dependencies, and requires npm 7.14.0 or later ([#3240](#3240)), by @jong-kyung. - Dependency filters such as `--prod` and `--dev` work with npm 6, and filters that npm 6 cannot apply are rejected instead of passed through ([#3251](#3251)), by @jong-kyung. - Package-manager commands that the selected version does not have, such as `vp pm stage` before npm 11.15.0, are skipped with a warning. Unsupported `pnpm dlx` and `pnpm pack` options, and project-only flags on managed global commands such as `vp install -g`, are rejected instead of silently ignored ([#3286](#3286), [#3285](#3285)), by @jong-kyung. - `vp toolchain -g` is short for `vp toolchain --global` ([#3189](#3189)), by @jong-kyung. - On Linux and macOS, programs in tasks with automatic file-access tracking no longer abort when they call `exec` with an empty path or `execl` with 32 or more arguments ([vite-task#896](voidzero-dev/vite-task#896), [vite-task#865](voidzero-dev/vite-task#865)), by @wan9chi and @tlq5l. ### Refactor - Remove the test-only package download wrapper ([#3224](#3224)), by @jong-kyung. ### Docs - Explain that `vp check` stops at formatting failures, and that `vp check` flags go before file paths ([#3262](#3262)), by @SaKaNa-Y. - Show how to align an existing `vite` dependency with its override during a manual npm installation, to avoid `EOVERRIDE` ([#3157](#3157)), by @SaKaNa-Y. - Explain how environment variable prefixes such as `FOO=bar command` work in task commands on every platform ([#3161](#3161)), by @tartelettie. - Restore the `/vp-setup` redirect and the redirects for moved guide pages ([#3271](#3271)), by @fengmk2. - Align the labels of "See [...]" section links with their target titles ([#3231](#3231)), by @yamaurakazuto. ### Chore - Bump vite-task to `40cb9ca`; its user-facing changes are listed above ([#3246](#3246), [#3280](#3280)), by @wan9chi. - Keep CI working on the Node.js 26 LTS and Ubuntu 24.04, cap job runtimes, reduce Node.js downloads, avoid upgrade build and snapshot download timeouts, pin Nushell, and restore Namespace Linux runners ([#3198](#3198), [#3258](#3258), [#3266](#3266), [#3268](#3268), [#3303](#3303), [#3309](#3309), [#3320](#3320), [#3332](#3332)), by @fengmk2 and @wan9chi. - Add automated issue triage ([#3253](#3253), [#3260](#3260)), by @Boshen and @fengmk2. - Run the upstream dependency upgrade with Kimi K3.1 Pro and report its timeouts ([#3314](#3314), [#3304](#3304)), by @Brooooooklyn and @wan9chi. - Stabilize and trim tests: rerun ESLint and Prettier migration fixtures with `--full`, stabilize pnpm setup and Bun snapshots, update the tiptap ecosystem pin, use a recorded package in the install shortcut case, and remove duplicate `devEngines` parse tests ([#3193](#3193), [#3196](#3196), [#3242](#3242), [#3305](#3305), [#3301](#3301)), by @liangmiQwQ, @fengmk2, @wan9chi, and @Brooooooklyn. - Update Rust crates, synchronize workspace dependency requirements, and stop installing `dprint` and `taplo` in `just init` ([#3234](#3234), [#3310](#3310), [#3250](#3250)), by @renovate[bot], @leaysgur, and @fengmk2. - Refine contributor guidance: the release-manager skill, isolated CLI bootstrap checks in `AGENTS.md`, and the Rolldown exports in the CLI bundling notes ([#3207](#3207), [#3238](#3238), [#3316](#3316)), by @fengmk2 and @liangmiQwQ. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | vite | `8.3.5` | [`981f07f`](vitejs/vite@981f07f) | unchanged | | rolldown | `1.2.16` | [`de6facf`](rolldown/rolldown@de6facf) | [1.2.16](https://github.com/rolldown/rolldown/releases/tag/v1.2.16) | | oxc-node | `1.0.1` | [`7ff14c3`](oxc-project/oxc-node@7ff14c3) | [1.0.1](https://github.com/oxc-project/oxc-node/releases/tag/v1.0.1) | | tsdown | `0.23.4` | [npm](https://npmx.dev/package/tsdown/v/0.23.4) | [0.23.2](https://github.com/rolldown/tsdown/releases/tag/v0.23.2), [0.23.3](https://github.com/rolldown/tsdown/releases/tag/v0.23.3), [0.23.4](https://github.com/rolldown/tsdown/releases/tag/v0.23.4) | | vitest | `5.1.0` | [npm](https://npmx.dev/package/vitest/v/5.1.0) | [5.1.0](https://github.com/vitest-dev/vitest/releases/tag/v5.1.0) | | oxlint | `1.91.0` | [npm](https://npmx.dev/package/oxlint/v/1.91.0) | [1.90.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.90.0), [1.91.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.91.0) | | oxlint-tsgolint | `7.0.2005` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2005) | [7.0.2005](https://github.com/oxc-project/tsgolint/releases/tag/v7.0.2005) | | oxfmt | `0.76.0` | [npm](https://npmx.dev/package/oxfmt/v/0.76.0) | [0.75.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.75.0), [0.76.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.76.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @yamaurakazuto, @tartelettie, @pweyck, @jasonkuhrt **Full Changelog**: v1.4.0...v1.5.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

fix: preserve compatibility in upstream dependency updates

196192f

fengmk2 mentioned this pull request Oct 26, 2026

Remove the temporary rolldown-plugin-dts override #3237

Closed

4 tasks

fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests test: sfw preview-build Publish this PR's commits to the registry bridge as preview builds labels Oct 26, 2026

fengmk2 approved these changes Oct 26, 2026

View reviewed changes

fengmk2 merged commit 16e8767 into main Oct 26, 2026
245 of 279 checks passed

fengmk2 deleted the deps/upstream-update branch October 26, 2026 05:41

fengmk2 mentioned this pull request Nov 3, 2026

release: v1.5.0 #3336

Merged

BrewTestBot mentioned this pull request Nov 4, 2026

vite-plus 1.5.0 Homebrew/homebrew-core#323336

Merged

Navigation Menu

Repository navigation

feat(deps): upgrade upstream dependencies - #3236

feat(deps): upgrade upstream dependencies#3236
fengmk2 merged 2 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Oct 26, 2026 •

edited by fengmk2

Loading

Uh oh!

voidzero-guard Bot commented Oct 26, 2026

Uh oh!

socket-security Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

voidzero-guard Bot commented Oct 26, 2026 • edited by fengmk2 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency updates

Code changes

Build status

Uh oh!

voidzero-guard Bot commented Oct 26, 2026

✅ No upstream CLI help changes detected

Uh oh!

socket-security Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI artifact sizes (196192f)

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit 196192f)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Uh oh!

github-actions Bot commented Oct 26, 2026

Preview binary sizes (196192f)

Uh oh!

github-actions Bot commented Oct 26, 2026

Registry bridge build (196192f)

Uh oh!

github-actions Bot commented Oct 26, 2026

🐳 Docker preview image

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

voidzero-guard Bot commented Oct 26, 2026 •

edited by fengmk2

Loading

socket-security Bot commented Oct 26, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading

CLI artifact sizes (`196192f`)

cloudflare-workers-and-pages Bot commented Oct 26, 2026 •

edited

Loading

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `196192f`)

Preview binary sizes (`196192f`)

Registry bridge build (`196192f`)