Skip to content

chore(deps): update vite+ - #3419

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/vite+
Open

chore(deps): update vite+#3419
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/vite+

Conversation

@renovate

@renovate renovate Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@vitest/browser-playwright (source) 5.0.5 → 5.1.0 age confidence
@vitest/coverage-v8 (source) 5.0.5 → 5.1.0 age confidence
vite (source) 1.4.0 → 1.6.0 age confidence
vite-plus (source) 1.4.0 → 1.6.0 age confidence
vitest (source) 5.0.5 → 5.1.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

vitest-dev/vitest (@​vitest/browser-playwright)

v5.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
voidzero-dev/vite-plus (vite)

v1.6.0: vite-plus v1.6.0

Compare Source

Vite+ 1.6.0 caches vp run tasks that rewrite files they read, previews runs with vp run --dry-run and JSON output, lets vp check --continue-on-error report every failed check, and sets VP_USER_AGENT for the tools that vp starts.

Features
  • vp run caches tasks that read files they also write, such as tsdown --exports rewriting package.json or tsc --incremental reading and writing tsconfig.tsbuildinfo. The files a task writes, and folders that hold only those files, may be missing on the next run, as on a fresh clone, and a cache hit restores them with the task's outputs, including the symbolic links the task created (docs) (vite-task#913, vite-task#914, vite-task#915, vite-task#916, vite-task#917, vite-task#918), by @​wan9chi.
  • vp run --dry-run shows each command that a run would start and whether it would hit the cache, without running anything or writing to the cache. vp run --json prints every package and task in the workspace, and vp run --dry-run --json prints the run plan with each step's cache status, as one JSON document for scripts, CI, and coding agents. vp run -v lists every change behind a cache miss, including each changed input file, and -vv also lists the unchanged inputs and the outputs that a hit restores (docs) (vite-task#948, vite-task#960, vite-task#961, vite-task#963, vite-task#966, vite-task#967, vite-task#968, vite-task#969), by @​wan9chi.
  • vp check --continue-on-error runs the remaining enabled checks after a failure, so one run reports formatting, lint, and type errors together, and exits with the status of the first failed check. Without the flag, vp check still stops at the first failed check (#​3367), by @​chbaefront.
  • vp, vpr, and vpx set VP_USER_AGENT=vp/<version> for their child processes, so tools can detect that Vite+ started them. When the global CLI delegates to a project's local CLI, the local version is reported (docs) (#​1958), by @​fengmk2.
  • First part of VP_ENV_FORBIDDEN=1, for systems such as NixOS that provide Node.js and package managers themselves: with it set, Vite+ never downloads a Node.js or package-manager version, shims and vpx use only the system tools on PATH, and installers and vp upgrade use the system node and pnpm for Vite+'s own dependencies. In this release, commands that delegate to a package manager, such as vp install and vp run, fail with DisabledByEnvForbidden while it is set. A follow-up change is planned to cover them and document the variable (#​3233), by @​myuron.
  • Upgrade the bundled Oxfmt and Oxlint (#​3416), by @​voidzero-guard[bot]:
    • [email protected] to [email protected]. Oxfmt formats Vue files with its own formatter instead of Prettier, so the output for Vue templates can change. It also fixes Tailwind class sorting in several layouts, Less escapes and % selectors, and TypeScript in Astro files.
    • [email protected] to [email protected] and [email protected] to [email protected]. no-redeclare gets an ignoreDeclarationMerge option, and promise/prefer-catch offers a suggestion.
    • Oxlint and Oxfmt resolve an unset or relative root in vite.config.ts from the directory of the config file instead of the current directory, so editor integrations in multi-root workspaces load the correct project.
    • Vite+ installs its own dependencies during setup and vp upgrade with [email protected] (was [email protected]).
    • The new Oxfmt and Oxlint can flag code that passed before. If your CI runs vp check, run vp check --fix --continue-on-error after you upgrade: it formats files, applies the available lint fixes, formats again, and reports every error that remains. For example, unicorn/prefer-type-error now also reports a throw in an if branch without braces, and this command rewrites it.
Fixes & Enhancements
  • While a Vite+ spinner is visible, such as Installing global packages in vp install -g, Vite+ hides the cursor and discards typed keys. Pressing Enter no longer leaves copies of the spinner row, and typed text no longer runs in the shell after the command ends. Ctrl+C during a spinner now ends the command with the usual signal status instead of exit code 0, and the global package spinners show the elapsed time (#​3373, #​3417), by @​jong-kyung and @​fengmk2.
  • vp run loads a package's vite.config.* only when the run reaches one of that package's tasks. A run in one package no longer waits for the configs of other packages, a broken config in another package no longer fails it, and vp run <task> in a package that does not define the task reports Task "<task>" not found instead of another package's config error (vite-task#944, vite-task#988), by @​wan9chi.
  • vp run nope#build, where no workspace package has the name nope, fails with Package 'nope' not found in the workspace and exits with code 1, instead of running nothing and exiting with code 0. A short name that matches several scoped packages fails as ambiguous (vite-task#984), by @​wan9chi.
  • Folder listings no longer skip entries named dist, so a dist folder that appears or disappears in a folder a task lists makes the next run a cache miss. Exclusions in a task's input, such as "!dist/**", now also apply to the folders that the task lists. In a new monorepo from vp create, every task hits the cache from the third vp run ready, because the first build creates the dist folders (vite-task#919, vite-task#941), by @​wan9chi.
  • Fewer unnecessary cache misses and cache failures in vp run: on Windows, files that a task deletes or moves are no longer among its inputs. Tasks that read node_modules/.vite/task-cache, as Parcel and Gatsby do, hit the cache. A task that writes outside the workspace through .., like cp -r dist ../site, no longer fails with Cache update failed (vite-task#937, vite-task#940, vite-task#980), by @​wan9chi.
  • A cache hit restores the symbolic links that a task's output globs match as links, instead of dropping them (vite-task#885), by @​jasonkuhrt.
  • When several tasks become ready at the same time, vp run checks their cache entries in parallel, so cache hits start sooner (vite-task#982), by @​wan9chi.
  • On macOS, task commands that use sh or bash behave as on Linux: a while read loop with a redirect under set -e no longer exits the script, an EXIT trap sees the exit status, so a failed task is no longer reported as successful, and $BASH is set (vite-task#939), by @​lifeiscontent.
  • The helper files that vp run writes to the system temp directory go in one folder that only the current user can write to, such as /tmp/vp_run-1000 on Linux. On Linux, a different Vite+ version run by another user no longer fails (vite-task#947, vite-task#974), by @​wan9chi.
  • A getEnvs query from @voidzero-dev/vite-task-client that matches every name ({ prefix: '' } or *) returns nothing and no longer adds every environment variable to the cache key (vite-task#976), by @​wan9chi.
  • vp migrate no longer writes package specs that the package manager cannot resolve, such as a @vitest/* catalog: reference without a catalog entry or a top-level catalog on Bun before 1.2.21. Bun projects with an empty workspaces field get catalog references, and child packages with a plain vite-plus range get the same concrete version as the root when the project cannot use catalogs (#​3397), by @​jong-kyung.
  • vp create uses the package manager version that VP_PACKAGE_MANAGER selects for the generated settings, the installation, and its summary. Standalone pnpm projects get packages: ['.'] in an existing pnpm-workspace.yaml only for pnpm before 10.5.0 (#​3197), by @​evan-lc and @​fengmk2.
  • vp sends a User-Agent header on all HTTP requests, so Node.js mirrors that reject requests without one, such as mirrors.aliyun.com, work (#​3425), by @​naokihaba.
  • vp env pin prints Updated when it overwrites an existing .node-version or .nvmrc file and Created when it writes a new one (#​3377), by @​CheHyeonYeong.
Docs
  • Describe rebuildable inputs in the Automatic Data Tracking guide, and dry runs, JSON output, and -vv in the vp run guide (#​3419, #​3421), by @​wan9chi.
Chore
  • Bump vite-task to cb1ea8d, with its user-facing changes listed above, and list --dry-run, --json, and -vv in vp run --help (#​3418), by @​wan9chi.
  • The daily dependency upgrade also updates the pnpm version that the installers pin, after it checks the release integrity (#​3407), by @​fengmk2.
  • Warm up the monorepo cache check in the vp create CI job under pnpm and Bun (#​3423), by @​wan9chi.
  • Remove an unused CI job that the required done check did not cover (#​3403), by @​jong-kyung.
  • Remove an incorrect comment about export pattern order in the CLI build script (#​3405), by @​alexicum.
Bundled Versions
Tool Version Source Changelog
vite 8.3.7 5def936 unchanged
rolldown 1.2.18 f9a49d6 unchanged
oxc-node 1.0.1 7ff14c3 unchanged
tsdown 0.23.4 npm unchanged
vitest 5.1.0 npm unchanged
oxlint 1.93.0 npm 1.92.0, 1.93.0
oxlint-tsgolint 7.0.2006 npm 7.0.2006
oxfmt 0.78.0 npm 0.77.0, 0.78.0
Upgrade
vp upgrade

If vp upgrade must download Node.js and VP_NODE_DIST_MIRROR points to a mirror that rejects requests without a User-Agent header, such as mirrors.aliyun.com, unset it or point it to another mirror for this upgrade. The installed vp downloads Node.js and does not send the header yet.

New Contributors

@​alexicum, @​evan-lc, @​CheHyeonYeong

Full Changelog: voidzero-dev/vite-plus@v1.5.1...v1.6.0

Published Packages
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Homebrew (macOS/Linux):

brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp

See the Homebrew guide to switch from the script installer or the Homebrew Core vite-plus formula.

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.6.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

v1.5.1: vite-plus v1.5.1

Compare Source

Vite+ 1.5.1 fixes two high-severity security issues in package-manager downloads and vp env use, restores interactive input in vp run tasks, fixes vp migrate config merges, and adds a reference page for each package command.

Features
  • Upgrade the bundled Vite and Rolldown (#​3390), by @​voidzero-guard[bot] and @​fengmk2:
    • [email protected] to [email protected]. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore node_modules/.modules.yaml. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (#) in the dependency optimizer, SSR builds with build.ssr: true, and chunks shared with workers.
    • [email protected] to [email protected], with module source maps that keep only the sources and names that they trace.
    • @voidzero-dev/vite-plus-core requires postcss@^8.5.32, as the bundled Vite does.
Fixes & Enhancements
  • Security: Vite+ verifies the pnpm that it downloads for its own setup against a hash in the CLI, and checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's packageManager field instead of the hash that the registry reports. A registry set in a project's .npmrc can no longer make Vite+ run a package manager that does not match (GHSA-5qr3-w62x-jmwx, high). Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location (#​3400), by @​fengmk2 and @​arkmarta.
  • Security: vp env use and other dist-tag lookups, such as pnpm@latest, accept only a valid semver version from the registry, so a registry set in a project's .npmrc can no longer put shell commands into the statements that the vp env use shell wrapper runs (GHSA-p79r-mf8q-r78h, high) (#​3395), by @​fengmk2 and @​arkmarta.
  • Scripts that vp run starts get a blocking stdin again when the run block of vite.config.ts is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as vp update --interactive wait for input instead of failing with EAGAIN (#​3361), by @​everton-dgn.
  • vp migrate changes only the return statements of a defineConfig callback, so functions inside the config, such as Rolldown codeSplitting.groups[].name callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, as, satisfies, <T>, or ! (#​3325, #​3372), by @​jong-kyung.
  • vp create react-router passes --no-git-init to create-react-router, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured (#​3363), by @​chbaefront.
  • env.fish calls fish built-ins through builtin, so vp env use changes the Node.js version even when a user function has the name of a built-in such as count (#​3353), by @​naokihaba.
  • Shell completion suggests full command names before aliases, so vp i<Tab> offers install and vp up<Tab> offers update. An alias stays available when no full name matches (#​3337), by @​nekomoyi.
  • Completion for vp run and vpr skips comme

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs.npmx.dev Error Error Nov 12, 2026 7:54am UTC
npmx.dev Error Error Nov 12, 2026 7:54am UTC
1 Skipped Deployment
Project Deployment Actions Updated
npmx-lunaria Ignored Ignored Nov 12, 2026 7:54am UTC

Request Review

@renovate

renovate Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 3 workspace projects
✓ Lockfile passes supply-chain policies (verified 1m ago)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 48, reused 0, downloaded 0, added 0
Progress: resolved 95, reused 0, downloaded 0, added 0
Progress: resolved 105, reused 0, downloaded 0, added 0
Progress: resolved 109, reused 0, downloaded 0, added 0
Progress: resolved 113, reused 0, downloaded 0, added 0
Progress: resolved 115, reused 0, downloaded 0, added 0
Progress: resolved 118, reused 0, downloaded 0, added 0
Progress: resolved 216, reused 0, downloaded 0, added 0
Progress: resolved 300, reused 0, downloaded 0, added 0
Progress: resolved 349, reused 0, downloaded 0, added 0
Progress: resolved 407, reused 0, downloaded 0, added 0
Progress: resolved 493, reused 0, downloaded 0, added 0
Progress: resolved 537, reused 0, downloaded 0, added 0
Progress: resolved 557, reused 0, downloaded 0, added 0
Progress: resolved 559, reused 0, downloaded 0, added 0
Progress: resolved 562, reused 0, downloaded 0, added 0
Progress: resolved 564, reused 0, downloaded 0, added 0
Progress: resolved 565, reused 0, downloaded 0, added 0
Progress: resolved 579, reused 0, downloaded 0, added 0
Progress: resolved 694, reused 0, downloaded 0, added 0
Progress: resolved 820, reused 0, downloaded 0, added 0
Progress: resolved 879, reused 0, downloaded 0, added 0
Progress: resolved 1011, reused 0, downloaded 0, added 0
Progress: resolved 1095, reused 0, downloaded 0, added 0
Progress: resolved 1099, reused 0, downloaded 0, added 0
Progress: resolved 1101, reused 0, downloaded 0, added 0
Progress: resolved 1102, reused 0, downloaded 0, added 0
Progress: resolved 1103, reused 0, downloaded 0, added 0
Progress: resolved 1104, reused 0, downloaded 0, added 0
Progress: resolved 1112, reused 0, downloaded 0, added 0
Progress: resolved 1141, reused 0, downloaded 0, added 0
Progress: resolved 1316, reused 0, downloaded 0, added 0
Progress: resolved 1383, reused 0, downloaded 0, added 0
Progress: resolved 1388, reused 0, downloaded 0, added 0
Progress: resolved 1394, reused 0, downloaded 0, added 0
Progress: resolved 1399, reused 0, downloaded 0, added 0
Progress: resolved 1402, reused 0, downloaded 0, added 0
Progress: resolved 1403, reused 0, downloaded 0, added 0
Progress: resolved 1404, reused 0, downloaded 0, added 0
Progress: resolved 1409, reused 0, downloaded 0, added 0
Progress: resolved 1579, reused 0, downloaded 0, added 0
Progress: resolved 1725, reused 0, downloaded 0, added 0
Progress: resolved 1894, reused 0, downloaded 0, added 0
Progress: resolved 1983, reused 0, downloaded 0, added 0
Progress: resolved 2117, reused 0, downloaded 0, added 0
Progress: resolved 2193, reused 0, downloaded 0, added 0
Progress: resolved 2195, reused 0, downloaded 0, added 0
Progress: resolved 2196, reused 0, downloaded 0, added 0
Progress: resolved 2197, reused 0, downloaded 0, added 0
[WARN] 7 deprecated subdependencies found: @types/[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Progress: resolved 2201, reused 0, downloaded 0, added 0
Progress: resolved 2201, reused 0, downloaded 0, added 0, done
[ERR_PNPM_PEER_DEP_ISSUES] Unmet peer dependencies

✕ unmet peer vite-plus
  Installed: 1.6.0
  Wanted:
    "^0.1.15 || ^0.2.0":
      [email protected]
hint: To disable failing on peer dependency issues, add the following to pnpm-workspace.yaml in your project root:

  strictPeerDependencies: false

@codecov

codecov Bot commented Nov 9, 2026

Copy link
Copy Markdown

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown

e18e dependency analysis

No dependency warnings found.

This branch had an error being deployed

2 failed deployments
Preview – docs.npmx.dev — 55b0006c Deployed Nov 12, 2026 by vercel[bot]
View deployment
Preview – npmx.dev — 55b0006c Deployed Nov 12, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants