Repository navigation
feat(deps): upgrade upstream dependencies - #3330
Merged
Merged
Conversation
Contributor
Author
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit 41cd5cd)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
Contributor
CLI artifact sizes (
|
| Artifact | Format | Base | PR | Change |
|---|---|---|---|---|
packages/cli/dist |
Directory total | 2.33 MiB | 2.33 MiB | -140 B (-0.01%) |
packages/core/dist |
Directory total | 4.07 MiB | 4.08 MiB | +9.41 KiB (+0.23%) |
| Combined package dist | Directory total | 6.40 MiB | 6.41 MiB | +9.28 KiB (+0.14%) |
vp (Linux x64) |
Binary | 8.30 MiB | 8.30 MiB | 0 B (0.00%) |
vp (Linux x64) |
gzip -9 | 3.79 MiB | 3.79 MiB | 0 B (0.00%) |
| NAPI (Linux x64) | Binary | 35.57 MiB | 36.39 MiB | +836.06 KiB (+2.30%) |
| NAPI (Linux x64) | gzip -9 | 14.17 MiB | 14.55 MiB | +389.67 KiB (+2.69%) |
vp (macOS ARM64) |
Binary | 5.42 MiB | 5.42 MiB | 0 B (0.00%) |
vp (macOS ARM64) |
gzip -9 | 3.23 MiB | 3.23 MiB | +1 B (+0.00%) |
| NAPI (macOS ARM64) | Binary | 42.33 MiB | 43.01 MiB | +694.38 KiB (+1.60%) |
| NAPI (macOS ARM64) | gzip -9 | 18.31 MiB | 18.64 MiB | +344.24 KiB (+1.84%) |
vp (Windows x64) |
Binary | 6.15 MiB | 6.15 MiB | 0 B (0.00%) |
vp (Windows x64) |
gzip -9 | 2.84 MiB | 2.84 MiB | +2 B (+0.00%) |
| NAPI (Windows x64) | Binary | 31.59 MiB | 32.32 MiB | +750.00 KiB (+2.32%) |
| NAPI (Windows x64) | gzip -9 | 12.86 MiB | 13.23 MiB | +369.06 KiB (+2.80%) |
| Trampoline (Windows x64) | Binary | 13.50 KiB | 13.50 KiB | 0 B (0.00%) |
| Trampoline (Windows x64) | gzip -9 | 7.09 KiB | 7.09 KiB | 0 B (0.00%) |
| Installer (Windows x64) | Binary | 4.66 MiB | 4.66 MiB | 0 B (0.00%) |
| Installer (Windows x64) | gzip -9 | 2.23 MiB | 2.23 MiB | +1 B (+0.00%) |
fengmk2
force-pushed
the
deps/upstream-update
branch
from
November 3, 2026 13:09
b3cf64d to
fa6d5ff
Compare
fengmk2
marked this pull request as ready for review
November 3, 2026 13:39
fengmk2
force-pushed
the
deps/upstream-update
branch
from
November 3, 2026 14:00
fa6d5ff to
41cd5cd
Compare
- rolldown: 89d821c -> v1.2.16 (de6facf) - tsdown: 0.23.3 -> 0.23.4 - @tsdown/css: 0.23.3 -> 0.23.4 - @tsdown/exe: 0.23.3 -> 0.23.4 - oxfmt: 0.75.0 -> 0.76.0 - @oxc-project/runtime: 0.156.0 -> 0.157.0 - @oxc-project/types: 0.156.0 -> 0.157.0 - oxc-parser: 0.156.0 -> 0.157.0 - Node.js: 24.22.1 -> 24.22.2 - @emnapi/core: 2.0.0-alpha.5 -> 2.0.0-beta.2 - @emnapi/runtime: 2.0.0-alpha.5 -> 2.0.0-beta.2 - emnapi: 2.0.0-alpha.5 -> 2.0.0-beta.2 - @napi-rs/wasm-runtime: ~1.2.5 -> 1.2.6 - cac: ^7.0.0 -> ^7.1.0 - remeda: ^2.50.0 -> ^2.53.0 - globstar: 0.0.4 -> 0.0.6 - jsonschema: 0.58.0 -> 0.60.0 - parking_lot: 0.12.5 -> 0.13.0 - saphyr: 0.2.1 -> 0.3.0 - simd-utf16-len: added at 0.3.0 - oxc: 0.155.0 -> 0.156.0 (including related oxc_* crates) Code changes: - Keep Vite's Rolldown runtime chunk out of declaration output and add branding regression coverage: packages/tools/src/brand-vite.ts, packages/tools/src/__tests__/brand-vite.spec.ts - Sync tsdown --env-file help and CLI snapshots: packages/cli/src/pack-bin.ts, packages/cli/src/help.ts, crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_helper/snapshots/command_helper.md, crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack/snapshots/command_pack.md, crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_tool_help/snapshots/command_tool_help.md - Regenerate Rolldown NAPI declarations: packages/cli/binding/index.d.cts - Add synced Rolldown workspace entries and the matching Renovate exclusion: Cargo.toml, .github/renovate.json Co-Authored-By: Kimi <noreply@moonshot.ai>
fengmk2
force-pushed
the
deps/upstream-update
branch
from
November 3, 2026 15:23
41cd5cd to
58d24c1
Compare
fengmk2
approved these changes
Nov 3, 2026
Merged
fengmk2
added a commit
that referenced
this pull request
Nov 4, 2026
Vite+ 1.5 adds an official Homebrew tap, runs TypeScript through Node.js with `node --import vite-plus/register`, and lets `vp migrate` move `oxnode` and transpile-only `ts-node` scripts to `vpx`. ### Features - Install `vp` from the official Homebrew tap on macOS and glibc Linux ([docs](https://viteplus.dev/guide/homebrew)) ([#2740](#2740)), by @fengmk2: ```bash brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus brew install voidzero-dev/vite-plus/vp ``` - `node --import vite-plus/register` runs TypeScript with the same loader as `vpx`, so tools that start Node.js themselves, such as the Node.js test runner, AVA, or a `NODE_OPTIONS` setting, can run TypeScript files ([docs](https://viteplus.dev/guide/vpx#using-node-js-directly)) ([#3208](#3208)), by @fengmk2. - `vp migrate` moves `oxnode` commands and transpile-only `ts-node` commands to `vpx`, and moves their Node.js preloads and literal `NODE_OPTIONS` values to `vite-plus/register`. `ts-node` commands that type-check stay unchanged with a warning, and the `ts-node` dependency is removed only when nothing still uses it. A project already on Vite+ gets this migration with `vp migrate --full` ([docs](https://viteplus.dev/guide/migrate-rules#oxnode-to-vpx)) ([#3209](#3209), [#3210](#3210)), by @fengmk2. - `vp migrate` warns when it finds Rollup, Rolldown, or Jest dependencies with matching configuration, and explains how to move them to Vite, tsdown, or Vitest. The warnings show during the first migration, or with `vp migrate --full` in a project already on Vite+ ([#3275](#3275)), by @KTrain5169 and @fengmk2. - `vite-plus` exports `resolveConfigFromFile(configFile, options?)`, which resolves a config relative to the config file's directory instead of `process.cwd()`, so editor plugins with several workspace folders load the files of the right project ([#3249](#3249)), by @leaysgur and @fengmk2. - Security: the CLI ships `minimatch@11.0.4`, which fixes a denial of service through glob pattern amplification ([GHSA-g3hv-75wg-m249](GHSA-g3hv-75wg-m249), medium), and `zstd@0.13.4`, which fixes [RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391), [RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398), and [RUSTSEC-2026-0403](https://rustsec.org/advisories/RUSTSEC-2026-0403) ([#3328](#3328), [#3331](#3331)), by @renovate[bot] and @wan9chi. - Upgrade the bundled tools ([#3205](#3205), [#3236](#3236), [#3261](#3261), [#3206](#3206), [#3330](#3330), [#3338](#3338)), by @voidzero-guard[bot] and @fengmk2: - `rolldown@1.2.15` to `rolldown@1.2.16`, with `experimentalInlineCommonChunks` in dev mode and no crash when the working directory was deleted. - `tsdown@0.23.1` to `tsdown@0.23.4`: `vp pack --env-file` can be repeated to load several env files, the config has a JSON schema, and `?inline` CSS imported from dependencies is inlined. - `vitest@5.0.5` to `vitest@5.1.0`, with `--last-failed` and `--since-last-run`, fake timers for `node:timers`, and interactive review of failed snapshots. Browser mode now uses port 23315 by default. - `oxlint@1.89.0` to `oxlint@1.91.0` and `oxlint-tsgolint@7.0.2004` to `oxlint-tsgolint@7.0.2005`, with the new type-aware rule `typescript/no-unsafe-enum-assignment`, wider checks in rules such as `array-callback-return`, `no-useless-concat`, and `no-control-regex`, and two rules moved into the `suspicious` category. - `oxfmt@0.74.0` to `oxfmt@0.76.0`, with a new HTML formatter and JavaScript and TypeScript fixes for parentheses, array layout, and line width with wide characters. - The new oxlint and oxfmt versions can flag code that passed before. If your CI runs `vp check`, run `vp fmt` after upgrading. - `vpx` and `vite-plus/register` run on `oxc-node@1.0.1`, which resolves a `.jsx` specifier to its `.tsx` or `.ts` source. ### Fixes & Enhancements - `vp create` into a target path that is a symbolic link removes only the link after confirmation, instead of deleting the contents of the linked directory, and the overwrite prompt names symbolic links and files ([#2418](#2418)), by @leslieeilsel and @fengmk2. - `vp implode` removes only directories and shims that it can verify as Vite+ installations, and refuses the home directory, its parents, and filesystem roots even with `--yes`, so a `VP_HOME` that points at another directory cannot delete unrelated files ([#3228](#3228)), by @jong-kyung. - `vp run` starts faster in workspaces whose tasks share cache `input` and `output` patterns, because each pattern is parsed once. In a 138-package workspace this saves about 2 seconds of CPU on every run ([vite-task#887](voidzero-dev/vite-task#887), [vite-task#890](voidzero-dev/vite-task#890)), by @jasonkuhrt and @wan9chi. - `vp run` and package-manager commands in npm projects start about 110 ms sooner, because `vp` reads the npm version from npm's `package.json` instead of running `npm --version` ([#3259](#3259)), by @magurotuna. - `vp migrate` checks Vitest prerequisites faster in workspaces, because it parses each lockfile once ([#3212](#3212)), by @jong-kyung. - The installer and `vp upgrade` install the global CLI's dependencies with the Node.js version that the release pins (24.22.2 for this release), instead of the latest LTS ([docs](https://viteplus.dev/guide/ci#node-js-during-installation)) ([#3269](#3269)), by @fengmk2. - The Node.js `latest` alias in `vp env use`, `vp env default`, `vp env pin`, `vp env install`, and `.nvmrc` resolves to the newest stable release instead of a `27.0.0-alpha` build, and `vp env list-remote` marks that stable release as latest ([#3335](#3335)), by @voidzero-bot[bot] and @fengmk2. - `VP_NODE_VERSION=22` and other partial versions work for project commands such as `vp build`, `vp run`, and `vp list`, instead of failing with a 404 download error ([#3341](#3341)), by @jong-kyung. - Two `vp install -g` commands that run at the same time no longer delete each other's active package, and a command that starts while a package manager is being installed no longer runs its shim before the shim is executable ([#3185](#3185), [#3248](#3248)), by @jong-kyung. - `vp config` waits and retries when another linked git worktree holds the shared git config lock, so a `prepare` script no longer fails when two worktrees install at the same time ([#3199](#3199)), by @naokihaba. - `vp env doctor` reports Node.js resolution failures, unreadable config, a failing system `node`, and missing shims as errors and exits with code 1. When it finds only warnings, the summary says `Some warnings found` instead of `All checks passed` ([#3215](#3215), [#3222](#3222)), by @liangmiQwQ. - Nushell completions for `vp` and `vpr` use the named completer input, so Nushell 0.116 shows no deprecation warning, and they fall back to file completion when fish is not installed. Run `vp env setup --refresh` to regenerate `env.nu` ([#3267](#3267), [#3276](#3276)), by @naokihaba. - `vp migrate` removes the `tsx` dependency even when a comment still contains a `tsx` command or code fence, and keeps it for JSDoc type imports that need it ([#3299](#3299)), by @voidzero-bot[bot] and @fengmk2. - The `prefer-vite-plus-imports` lint rule and its autofix leave the `vite` and `vitest` imports that `vp migrate` keeps, such as `vitest` imports in a package that lists `vitest` in `peerDependencies`, so `vp lint --fix` no longer breaks the package for its plain Vitest users ([#3192](#3192)), by @Dunqing. - Generated Zed settings no longer force `typeAware` and `unusedDisableDirectives`, so editor diagnostics follow the `lint.options` in `vite.config.ts`. Existing editor settings stay unchanged ([#2357](#2357)), by @pweyck. - `vp dlx` with npm runs the right executable for scoped packages such as `@angular/cli` ([#3229](#3229)), by @jong-kyung. - `vp outdated -r` in npm projects checks the workspaces instead of transitive dependencies, and requires npm 7.14.0 or later ([#3240](#3240)), by @jong-kyung. - Dependency filters such as `--prod` and `--dev` work with npm 6, and filters that npm 6 cannot apply are rejected instead of passed through ([#3251](#3251)), by @jong-kyung. - Package-manager commands that the selected version does not have, such as `vp pm stage` before npm 11.15.0, are skipped with a warning. Unsupported `pnpm dlx` and `pnpm pack` options, and project-only flags on managed global commands such as `vp install -g`, are rejected instead of silently ignored ([#3286](#3286), [#3285](#3285)), by @jong-kyung. - `vp toolchain -g` is short for `vp toolchain --global` ([#3189](#3189)), by @jong-kyung. - On Linux and macOS, programs in tasks with automatic file-access tracking no longer abort when they call `exec` with an empty path or `execl` with 32 or more arguments ([vite-task#896](voidzero-dev/vite-task#896), [vite-task#865](voidzero-dev/vite-task#865)), by @wan9chi and @tlq5l. ### Refactor - Remove the test-only package download wrapper ([#3224](#3224)), by @jong-kyung. ### Docs - Explain that `vp check` stops at formatting failures, and that `vp check` flags go before file paths ([#3262](#3262)), by @SaKaNa-Y. - Show how to align an existing `vite` dependency with its override during a manual npm installation, to avoid `EOVERRIDE` ([#3157](#3157)), by @SaKaNa-Y. - Explain how environment variable prefixes such as `FOO=bar command` work in task commands on every platform ([#3161](#3161)), by @tartelettie. - Restore the `/vp-setup` redirect and the redirects for moved guide pages ([#3271](#3271)), by @fengmk2. - Align the labels of "See [...]" section links with their target titles ([#3231](#3231)), by @yamaurakazuto. ### Chore - Bump vite-task to `40cb9ca`; its user-facing changes are listed above ([#3246](#3246), [#3280](#3280)), by @wan9chi. - Keep CI working on the Node.js 26 LTS and Ubuntu 24.04, cap job runtimes, reduce Node.js downloads, avoid upgrade build and snapshot download timeouts, pin Nushell, and restore Namespace Linux runners ([#3198](#3198), [#3258](#3258), [#3266](#3266), [#3268](#3268), [#3303](#3303), [#3309](#3309), [#3320](#3320), [#3332](#3332)), by @fengmk2 and @wan9chi. - Add automated issue triage ([#3253](#3253), [#3260](#3260)), by @Boshen and @fengmk2. - Run the upstream dependency upgrade with Kimi K3.1 Pro and report its timeouts ([#3314](#3314), [#3304](#3304)), by @Brooooooklyn and @wan9chi. - Stabilize and trim tests: rerun ESLint and Prettier migration fixtures with `--full`, stabilize pnpm setup and Bun snapshots, update the tiptap ecosystem pin, use a recorded package in the install shortcut case, and remove duplicate `devEngines` parse tests ([#3193](#3193), [#3196](#3196), [#3242](#3242), [#3305](#3305), [#3301](#3301)), by @liangmiQwQ, @fengmk2, @wan9chi, and @Brooooooklyn. - Update Rust crates, synchronize workspace dependency requirements, and stop installing `dprint` and `taplo` in `just init` ([#3234](#3234), [#3310](#3310), [#3250](#3250)), by @renovate[bot], @leaysgur, and @fengmk2. - Refine contributor guidance: the release-manager skill, isolated CLI bootstrap checks in `AGENTS.md`, and the Rolldown exports in the CLI bundling notes ([#3207](#3207), [#3238](#3238), [#3316](#3316)), by @fengmk2 and @liangmiQwQ. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | vite | `8.3.5` | [`981f07f`](vitejs/vite@981f07f) | unchanged | | rolldown | `1.2.16` | [`de6facf`](rolldown/rolldown@de6facf) | [1.2.16](https://github.com/rolldown/rolldown/releases/tag/v1.2.16) | | oxc-node | `1.0.1` | [`7ff14c3`](oxc-project/oxc-node@7ff14c3) | [1.0.1](https://github.com/oxc-project/oxc-node/releases/tag/v1.0.1) | | tsdown | `0.23.4` | [npm](https://npmx.dev/package/tsdown/v/0.23.4) | [0.23.2](https://github.com/rolldown/tsdown/releases/tag/v0.23.2), [0.23.3](https://github.com/rolldown/tsdown/releases/tag/v0.23.3), [0.23.4](https://github.com/rolldown/tsdown/releases/tag/v0.23.4) | | vitest | `5.1.0` | [npm](https://npmx.dev/package/vitest/v/5.1.0) | [5.1.0](https://github.com/vitest-dev/vitest/releases/tag/v5.1.0) | | oxlint | `1.91.0` | [npm](https://npmx.dev/package/oxlint/v/1.91.0) | [1.90.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.90.0), [1.91.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.91.0) | | oxlint-tsgolint | `7.0.2005` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2005) | [7.0.2005](https://github.com/oxc-project/tsgolint/releases/tag/v7.0.2005) | | oxfmt | `0.76.0` | [npm](https://npmx.dev/package/oxfmt/v/0.76.0) | [0.75.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.75.0), [0.76.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.76.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @yamaurakazuto, @tartelettie, @pweyck, @jasonkuhrt **Full Changelog**: v1.4.0...v1.5.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update Rolldown to
1.2.16, tsdown to0.23.4, and Oxfmt to0.76.0. Align Oxc packages, Node.js, and workspace dependencies with upstream requirements.Rolldown now emits a separate JavaScript runtime chunk. The Vite declaration build gives this chunk a
.jsfilename so the declaration plugin can remove it. The WebContainer fixture loads shared chunks in its isolated VM and keeps the existing WASM download and cache assertions.Update NAPI declarations for code identity, rendered lengths, and devtools modes. Update
vp pack --helpfor the repeatable--env-fileoption.Dependency updates
rolldownv1.2.15(89d821c)v1.2.16(de6facf)tsdown0.23.30.23.4@tsdown/css0.23.30.23.4@tsdown/exe0.23.30.23.4oxfmt0.75.00.76.0@oxc-project/runtime0.156.00.157.0@oxc-project/types0.156.00.157.0oxc-parser0.156.00.157.0Node.js24.22.124.22.2@emnapi/core2.0.0-alpha.52.0.0-beta.2@emnapi/runtime2.0.0-alpha.52.0.0-beta.2emnapi2.0.0-alpha.52.0.0-beta.2@napi-rs/wasm-runtime~1.2.51.2.6cac^7.0.0^7.1.0remeda^2.50.0^2.53.0globstar0.0.40.0.6jsonschema0.58.00.60.0parking_lot0.12.50.13.0saphyr0.2.10.3.0simd-utf16-len0.3.0oxc/oxc_*Rust crates0.155.00.156.0Unchanged dependencies
vite:v8.3.5 (981f07f)oxc-node:7ff14c3vitest:5.1.0@vitest/browser:5.1.0@vitest/browser-playwright:5.1.0@vitest/browser-preview:5.1.0@vitest/mocker:5.1.0@vitest/pretty-format:5.1.0@vitest/snapshot:5.1.0@vitest/spy:5.1.0@vitest/utils:5.1.0lightningcss:^1.33.0lint-staged:17.6.0@oxc-node/cli:1.0.1@oxc-node/core:1.0.1oxlint:1.90.0@oxlint/plugins:1.90.0oxlint-tsgolint:7.0.2005VITEST_VERSION constant:5.1.0yuku-parser:0.19.0postcss:^8.5.30fsevents:~2.3.3