[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	1.5.0 → 1.6.0
vite-plus (source)	1.5.0 → 1.6.0

---

Release Notes

voidzero-dev/vite-plus (vite)

v1.6.0: vite-plus v1.6.0

Compare Source

Vite+ 1.6.0 caches vp run tasks that rewrite files they read, previews runs with vp run --dry-run and JSON output, lets vp check --continue-on-error report every failed check, and sets VP_USER_AGENT for the tools that vp starts.

Features

• vp run caches tasks that read files they also write, such as tsdown --exports rewriting package.json or tsc --incremental reading and writing tsconfig.tsbuildinfo. The files a task writes, and folders that hold only those files, may be missing on the next run, as on a fresh clone, and a cache hit restores them with the task's outputs, including the symbolic links the task created (docs) (vite-task#913, vite-task#914, vite-task#915, vite-task#916, vite-task#917, vite-task#918), by @​wan9chi.
• vp run --dry-run shows each command that a run would start and whether it would hit the cache, without running anything or writing to the cache. vp run --json prints every package and task in the workspace, and vp run --dry-run --json prints the run plan with each step's cache status, as one JSON document for scripts, CI, and coding agents. vp run -v lists every change behind a cache miss, including each changed input file, and -vv also lists the unchanged inputs and the outputs that a hit restores (docs) (vite-task#948, vite-task#960, vite-task#961, vite-task#963, vite-task#966, vite-task#967, vite-task#968, vite-task#969), by @​wan9chi.
• vp check --continue-on-error runs the remaining enabled checks after a failure, so one run reports formatting, lint, and type errors together, and exits with the status of the first failed check. Without the flag, vp check still stops at the first failed check (#​3367), by @​chbaefront.
• vp, vpr, and vpx set VP_USER_AGENT=vp/<version> for their child processes, so tools can detect that Vite+ started them. When the global CLI delegates to a project's local CLI, the local version is reported (docs) (#​1958), by @​fengmk2.
• First part of VP_ENV_FORBIDDEN=1, for systems such as NixOS that provide Node.js and package managers themselves: with it set, Vite+ never downloads a Node.js or package-manager version, shims and vpx use only the system tools on PATH, and installers and vp upgrade use the system node and pnpm for Vite+'s own dependencies. In this release, commands that delegate to a package manager, such as vp install and vp run, fail with DisabledByEnvForbidden while it is set. A follow-up change is planned to cover them and document the variable (#​3233), by @​myuron.
• Upgrade the bundled Oxfmt and Oxlint (#​3416), by @​voidzero-guard[bot]:
  • oxfmt@0.76.0 to oxfmt@0.78.0. Oxfmt formats Vue files with its own formatter instead of Prettier, so the output for Vue templates can change. It also fixes Tailwind class sorting in several layouts, Less escapes and % selectors, and TypeScript in Astro files.
  • oxlint@1.91.0 to oxlint@1.93.0 and oxlint-tsgolint@7.0.2005 to oxlint-tsgolint@7.0.2006. no-redeclare gets an ignoreDeclarationMerge option, and promise/prefer-catch offers a suggestion.
  • Oxlint and Oxfmt resolve an unset or relative root in vite.config.ts from the directory of the config file instead of the current directory, so editor integrations in multi-root workspaces load the correct project.
  • Vite+ installs its own dependencies during setup and vp upgrade with pnpm@10.34.9 (was pnpm@10.34.7).
  • The new Oxfmt and Oxlint can flag code that passed before. If your CI runs vp check, run vp check --fix --continue-on-error after you upgrade: it formats files, applies the available lint fixes, formats again, and reports every error that remains. For example, unicorn/prefer-type-error now also reports a throw in an if branch without braces, and this command rewrites it.

Fixes & Enhancements

• While a Vite+ spinner is visible, such as Installing global packages in vp install -g, Vite+ hides the cursor and discards typed keys. Pressing Enter no longer leaves copies of the spinner row, and typed text no longer runs in the shell after the command ends. Ctrl+C during a spinner now ends the command with the usual signal status instead of exit code 0, and the global package spinners show the elapsed time (#​3373, #​3417), by @​jong-kyung and @​fengmk2.
• vp run loads a package's vite.config.* only when the run reaches one of that package's tasks. A run in one package no longer waits for the configs of other packages, a broken config in another package no longer fails it, and vp run <task> in a package that does not define the task reports Task "<task>" not found instead of another package's config error (vite-task#944, vite-task#988), by @​wan9chi.
• vp run nope#build, where no workspace package has the name nope, fails with Package 'nope' not found in the workspace and exits with code 1, instead of running nothing and exiting with code 0. A short name that matches several scoped packages fails as ambiguous (vite-task#984), by @​wan9chi.
• Folder listings no longer skip entries named dist, so a dist folder that appears or disappears in a folder a task lists makes the next run a cache miss. Exclusions in a task's input, such as "!dist/**", now also apply to the folders that the task lists. In a new monorepo from vp create, every task hits the cache from the third vp run ready, because the first build creates the dist folders (vite-task#919, vite-task#941), by @​wan9chi.
• Fewer unnecessary cache misses and cache failures in vp run: on Windows, files that a task deletes or moves are no longer among its inputs. Tasks that read node_modules/.vite/task-cache, as Parcel and Gatsby do, hit the cache. A task that writes outside the workspace through .., like cp -r dist ../site, no longer fails with Cache update failed (vite-task#937, vite-task#940, vite-task#980), by @​wan9chi.
• A cache hit restores the symbolic links that a task's output globs match as links, instead of dropping them (vite-task#885), by @​jasonkuhrt.
• When several tasks become ready at the same time, vp run checks their cache entries in parallel, so cache hits start sooner (vite-task#982), by @​wan9chi.
• On macOS, task commands that use sh or bash behave as on Linux: a while read loop with a redirect under set -e no longer exits the script, an EXIT trap sees the exit status, so a failed task is no longer reported as successful, and $BASH is set (vite-task#939), by @​lifeiscontent.
• The helper files that vp run writes to the system temp directory go in one folder that only the current user can write to, such as /tmp/vp_run-1000 on Linux. On Linux, a different Vite+ version run by another user no longer fails (vite-task#947, vite-task#974), by @​wan9chi.
• A getEnvs query from @voidzero-dev/vite-task-client that matches every name ({ prefix: '' } or *) returns nothing and no longer adds every environment variable to the cache key (vite-task#976), by @​wan9chi.
• vp migrate no longer writes package specs that the package manager cannot resolve, such as a @vitest/* catalog: reference without a catalog entry or a top-level catalog on Bun before 1.2.21. Bun projects with an empty workspaces field get catalog references, and child packages with a plain vite-plus range get the same concrete version as the root when the project cannot use catalogs (#​3397), by @​jong-kyung.
• vp create uses the package manager version that VP_PACKAGE_MANAGER selects for the generated settings, the installation, and its summary. Standalone pnpm projects get packages: ['.'] in an existing pnpm-workspace.yaml only for pnpm before 10.5.0 (#​3197), by @​evan-lc and @​fengmk2.
• vp sends a User-Agent header on all HTTP requests, so Node.js mirrors that reject requests without one, such as mirrors.aliyun.com, work (#​3425), by @​naokihaba.
• vp env pin prints Updated when it overwrites an existing .node-version or .nvmrc file and Created when it writes a new one (#​3377), by @​CheHyeonYeong.

Docs

• Describe rebuildable inputs in the Automatic Data Tracking guide, and dry runs, JSON output, and -vv in the vp run guide (#​3419, #​3421), by @​wan9chi.

Chore

• Bump vite-task to cb1ea8d, with its user-facing changes listed above, and list --dry-run, --json, and -vv in vp run --help (#​3418), by @​wan9chi.
• The daily dependency upgrade also updates the pnpm version that the installers pin, after it checks the release integrity (#​3407), by @​fengmk2.
• Warm up the monorepo cache check in the vp create CI job under pnpm and Bun (#​3423), by @​wan9chi.
• Remove an unused CI job that the required done check did not cover (#​3403), by @​jong-kyung.
• Remove an incorrect comment about export pattern order in the CLI build script (#​3405), by @​alexicum.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.7	5def936	unchanged
rolldown	1.2.18	f9a49d6	unchanged
oxc-node	1.0.1	7ff14c3	unchanged
tsdown	0.23.4	npm	unchanged
vitest	5.1.0	npm	unchanged
oxlint	1.93.0	npm	1.92.0, 1.93.0
oxlint-tsgolint	7.0.2006	npm	7.0.2006
oxfmt	0.78.0	npm	0.77.0, 0.78.0

Upgrade

vp upgrade

If vp upgrade must download Node.js and VP_NODE_DIST_MIRROR points to a mirror that rejects requests without a User-Agent header, such as mirrors.aliyun.com, unset it or point it to another mirror for this upgrade. The installed vp downloads Node.js and does not send the header yet.

New Contributors

@​alexicum, @​evan-lc, @​CheHyeonYeong

Full Changelog: voidzero-dev/vite-plus@v1.5.1...v1.6.0

Published Packages

• @voidzero-dev/vite-plus-core@1.6.0
• vite-plus@1.6.0
• create-vite-plus@1.6.0

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Homebrew (macOS/Linux):

brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp

See the Homebrew guide to switch from the script installer or the Homebrew Core vite-plus formula.

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.6.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

v1.5.1: vite-plus v1.5.1

Compare Source

Vite+ 1.5.1 fixes two high-severity security issues in package-manager downloads and vp env use, restores interactive input in vp run tasks, fixes vp migrate config merges, and adds a reference page for each package command.

Features

• Upgrade the bundled Vite and Rolldown (#​3390), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.5 to vite@8.3.7. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore node_modules/.modules.yaml. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (#) in the dependency optimizer, SSR builds with build.ssr: true, and chunks shared with workers.
  • rolldown@1.2.16 to rolldown@1.2.18, with module source maps that keep only the sources and names that they trace.
  • @voidzero-dev/vite-plus-core requires postcss@^8.5.32, as the bundled Vite does.

Fixes & Enhancements

• Security: Vite+ verifies the pnpm that it downloads for its own setup against a hash in the CLI, and checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's packageManager field instead of the hash that the registry reports. A registry set in a project's .npmrc can no longer make Vite+ run a package manager that does not match (GHSA-5qr3-w62x-jmwx, high). Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location (#​3400), by @​fengmk2 and @​arkmarta.
• Security: vp env use and other dist-tag lookups, such as pnpm@latest, accept only a valid semver version from the registry, so a registry set in a project's .npmrc can no longer put shell commands into the statements that the vp env use shell wrapper runs (GHSA-p79r-mf8q-r78h, high) (#​3395), by @​fengmk2 and @​arkmarta.
• Scripts that vp run starts get a blocking stdin again when the run block of vite.config.ts is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as vp update --interactive wait for input instead of failing with EAGAIN (#​3361), by @​everton-dgn.
• vp migrate changes only the return statements of a defineConfig callback, so functions inside the config, such as Rolldown codeSplitting.groups[].name callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, as, satisfies, <T>, or ! (#​3325, #​3372), by @​jong-kyung.
• vp create react-router passes --no-git-init to create-react-router, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured (#​3363), by @​chbaefront.
• env.fish calls fish built-ins through builtin, so vp env use changes the Node.js version even when a user function has the name of a built-in such as count (#​3353), by @​naokihaba.
• Shell completion suggests full command names before aliases, so vp i<Tab> offers install and vp up<Tab> offers update. An alias stays available when no full name matches (#​3337), by @​nekomoyi.
• Completion for vp run and vpr skips comment keys such as "# docs #" in package.json scripts, matches task names that contain :, and shows each task's command as its description in Zsh and Fish (#​3354), by @​nekomoyi.
• vp pm dist-tag rm works with Yarn Berry, because Vite+ passes remove to yarn npm tag (#​3358), by @​jong-kyung.

Docs

• Add a Package Management section to the guide, with a reference page for each of the 38 package commands that lists its options, package-manager support, version requirements, and npm fallbacks. Help output for package commands and the old package management and install URLs point to the new pages (docs) (#​3105), by @​jong-kyung.
• Show the README logo that matches the GitHub theme, so the logo stays visible after a theme change (#​3350), by @​fengmk2.

Chore

• Build Linux native bindings against the napi-cross glibc 2.17 sysroot with @napi-rs/cli@3.10.12, let the linker reject unresolved symbols, and run Linux CI on ubuntu-latest again. Let the dependency upgrade workflow change workflow files (#​3349, #​3384), by @​fengmk2.
• Refine contributor guidance: AGENTS.md separates the vite-plus package from the global vp CLI and replaces CLAUDE.md, and the Node.js version RFCs describe .nvmrc support (#​3388, #​3383), by @​liangmiQwQ and @​hyunbinseo.
• Resolve the docs theme aliases from import.meta.dirname, so the docs dev server no longer warns about __dirname (#​3379), by @​liangmiQwQ.
• Fold the .node-version parse tests into one table (#​3355), by @​Brooooooklyn.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.7	5def936	8.3.6, 8.3.7
rolldown	1.2.18	f9a49d6	1.2.18
oxc-node	1.0.1	7ff14c3	unchanged
tsdown	0.23.4	npm	unchanged
vitest	5.1.0	npm	unchanged
oxlint	1.91.0	npm	unchanged
oxlint-tsgolint	7.0.2005	npm	unchanged
oxfmt	0.76.0	npm	unchanged

Upgrade

vp upgrade

New Contributors

@​chbaefront, @​everton-dgn

Full Changelog: voidzero-dev/vite-plus@v1.5.0...v1.5.1

Published Packages

• @voidzero-dev/vite-plus-core@1.5.1
• vite-plus@1.5.1
• create-vite-plus@1.5.1

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Homebrew (macOS/Linux):

brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp

See the Homebrew guide to switch from the script installer or the Homebrew Core vite-plus formula.

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.5.1 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite-plus@​1.5.0 ⏵ 1.6.0	+1			+2

View full report

[github-actions]

Remote cache staging

Commit: 1b1dad2e8474e7457d0c4d6fea68a2f3f2a6433d

The source checks did not pass. No verified Cloudflare staging deployment is ready. See the workflow run.

Manual checks and complete e2e plan.