Skip to content

⬆️ deps: Update Node.js dev dependencies - #88

Merged
renovate[bot] merged 2 commits into
mainfrom
renovate/nodejs-dev-dependencies
Jul 12, 2026
Merged

⬆️ deps: Update Node.js dev dependencies#88
renovate[bot] merged 2 commits into
mainfrom
renovate/nodejs-dev-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@types/node (source) ^24.12.4 → ^24.13.3 age confidence
vite-plus (source) ^0.1.23 → ^0.2.4 age confidence
vitest (source) ^4.1.7 → ^4.1.10 age confidence

Release Notes

voidzero-dev/vite-plus (vite-plus)

v0.2.4: vite-plus v0.2.4: Vitest security hotfix

Compare Source

This hotfix updates the bundled Vitest Browser Mode packages to 4.1.10, which includes the fix for GHSA-p63j-vcc4-9vmv. The advisory is critical and affects @vitest/browser <=4.1.9.

Highlights
  • Critical Vitest Browser Mode advisory fixed: bundled vitest and @vitest/browser* move from 4.1.9 to 4.1.10, addressing GHSA-p63j-vcc4-9vmv, where provider commands could bypass the file access permission gate (#​2089), by @​voidzero-guard[bot]
Chore
  • Add the standard release-manager skill for vite-plus release operations (#​2019), by @​fengmk2
Bundled Versions
Tool Version Source
vite 8.1.3 578ffb8
rolldown 1.1.4 6cbd233
tsdown 0.22.3 npm
vitest 4.1.10 npm
oxlint 1.72.0 npm
oxlint-tsgolint 0.24.0 npm
oxfmt 0.57.0 npm
Upgrade
vp upgrade
New Contributors

No new contributors in this release.

Full Changelog: voidzero-dev/vite-plus@v0.2.3...v0.2.4

Published Packages
  • @voidzero-dev/vite-plus-core@0.2.4
  • vite-plus@0.2.4
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.4 vp build

Run any vp command without installing it; see the Docker guide for more.

v0.2.3: vite-plus v0.2.3: config extraction, create, and vp run reliability fixes

Compare Source

A patch release that fixes static config extraction for vite.config.ts files whose defineConfig comes from a preset or custom wrapper (no longer misread as Vite+'s own), fixes vp create for org templates on registries that strip custom package fields, cleans up terminal output after Ctrl-C during vp run, and updates bundled Vite to 8.1.3.

Highlights
  • Custom VP_HOME is honored on every run: the global vp now respects a user-set VP_HOME for its home directory instead of falling back to ~/.vite-plus, and persists it in the generated env files, so a custom install location no longer produces multiple instances or unusable packages (#​2029), by @​liangmiQwQ
Features
  • Upgrade bundled Vite from 8.1.2 to 8.1.3 (inlined CSS after the shebang line, CSS preload for nested dynamic imports, SSR stacktrace column fix) (#​2042), by @​voidzero-guard[bot]
Fixes & Enhancements
  • vp run no longer misreads a vite.config.ts when its defineConfig comes from a preset or a custom wrapper instead of vite-plus or vite. Such configs are now evaluated at runtime rather than assumed to be Vite+'s own, so projects that use them no longer wrongly report Task "build" not found (#​2060, #​2075), by @​liangmiQwQ and @​fengmk2
  • Killing a vp run task with Ctrl-C no longer leaves odd OSC escape sequences in the terminal; vp defers its own Ctrl-C handling until the child process exits (#​2079), by @​forehalo
  • vp migrate: rewriting a package.json prettier script now emits a single --check, so scripts that combined --check with --list-different / -l / -c no longer produce a duplicated vp fmt --check --check (#​2044), by @​shulaoda
  • vp create @&#8203;org:name: read the org template catalog (createConfig) from the published tarball when the registry (e.g. GitHub Packages) strips custom fields from packument metadata (#​2063), by @​hiro-daikin
  • vp run: missing env vars requested through @voidzero-dev/vite-task-client now return undefined instead of null, preserving Vite production NODE_ENV semantics when builds run through vp run (vite-task#508, via #​2076), by @​wan9chi
Refactor
  • static_config: drop the unreachable vite.config.json branch (#​2045), and remove unused exported CLI helpers (#​2046), by @​shulaoda
Docs
Chore
Bundled Versions
Tool Version Source
vite 8.1.3 578ffb8
rolldown 1.1.4 6cbd233
tsdown 0.22.3 npm
vitest 4.1.9 npm
oxlint 1.72.0 npm
oxlint-tsgolint 0.24.0 npm
oxfmt 0.57.0 npm
Upgrade
vp upgrade
New Contributors

@​wan-kong and @​hiro-daikin made their first contributions.

Full Changelog: voidzero-dev/vite-plus@v0.2.2...v0.2.3

Published Packages
  • @voidzero-dev/vite-plus-core@0.2.3
  • vite-plus@0.2.3
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.3 vp build

Run any vp command without installing it; see the Docker guide for more.

v0.2.2: vite-plus v0.2.2: Vite+ Beta

Compare Source

Vite+ is now in Beta: stable and ready for production adoption, fully open source under MIT. Read the announcement to see what Vite+ is about and where it is headed: Announcing Vite+ Beta.

On top of the Beta milestone, this release brings cross-version upgrades via vp migrate, an official Docker toolchain image on GHCR, zero-config runner-aware vp build caching, and PGP-verified managed Node.js downloads.

Highlights
  • vp migrate upgrades existing Vite+ projects across versions: previous release notes told users not to run vp migrate for upgrades. It now runs from the global CLI when the local one is older, re-pins vite-plus and the vite -> @voidzero-dev/vite-plus-core alias across dependencies, overrides/resolutions, and catalogs in every workspace package, aligns vitest / @vitest/* by actual usage, and defaults to a version-only upgrade (pass --full to also run the first-time setup bucket: hooks, editor, agent files, lint migration) (#​1891), by @​fengmk2
  • Official Vite+ Docker toolchain image: ghcr.io/voidzero-dev/vite-plus bundles vp plus a native build toolchain on debian:bookworm-slim (amd64/arm64, non-root). Since vp provisions the exact Node.js from .node-version, one image builds any project, and a documented multi-stage build copies the resolved Node.js into a small vp-free runtime stage (#​1944), by @​fengmk2
  • Zero-config vp build caching via runner-aware Vite: Vite reports its inputs, outputs, and tracked env reads to the vp runner over the new @voidzero-dev/vite-task-client IPC (vite#22453), so vp build caches correctly with no hand-written cache config: outputs are tracked and restored automatically, and a changed VITE_* env var invalidates the cache and is named in the cache-miss message (#​1774), by @​wan9chi
  • PGP-verified Node.js downloads: installing a managed Node.js now verifies the release's clearsigned SHASUMS256.txt.asc against the vendored Node.js release keyring (pure Rust, no gpg required) before trusting any checksum, so a tampered archive is rejected before install; unsigned sources (musl builds, custom mirrors) fall back to checksum-only verification (#​1848), by @​fengmk2
Features
  • vp check: a check block in vite.config.ts (check.fmt / check.lint) can make plain vp check skip formatting or linting by default, mirroring --no-fmt / --no-lint; standalone vp fmt / vp lint and git hooks are unaffected, and a note: line keeps the config-based skip discoverable (#​1981), by @​fengmk2
  • vp env list-remote: highlight installed versions (color, or a * prefix when piped) and label the project-resolved current and global default versions; --json gains installed / current / default fields (#​1907), by @​semimikoh
  • vpr ships as a vite-plus package bin, so the vp run shorthand works on clean installs without global PATH shims (Vercel build image, generic CI runners) (#​1988), by @​kvnwolf
  • Vite Task: dependsOn can select tasks from dependency packages, e.g. dependsOn: [{ "task": "build", "from": "dependencies" }] (vite-task#479), by @​wan9chi
  • Vite Task: a task's env / untrackedEnv glob patterns support ! negation (e.g. ["VITE_*", "!VITE_SECRET"]) (vite-task#425), and an env-caused cache miss now names the variable inline, e.g. cache miss: env 'NODE_ENV' changed (vite-task#438), by @​wan9chi
  • Upgrade upstream dependencies: vite 8.0.16 -> 8.1.2, rolldown 1.1.1 -> 1.1.4, oxlint 1.70.0 -> 1.72.0, oxfmt 0.55.0 -> 0.57.0, oxlint-tsgolint 0.23.0 -> 0.24.0, and the oxc toolchain 0.136.0 -> 0.138.0 (#​1924, #​1989, #​2000, #​2009), by @​voidzero-guard[bot]
Fixes & Enhancements
  • Windows: vp run no longer hangs CI when a node_modules/.bin .cmd shim is routed through PowerShell; the npm/pnpm/yarn .ps1 wrappers read stdin and block forever on a non-TTY pipe, so the PowerShell rewrite is now skipped when stdin is not an interactive terminal (vite-task#491, via #​1973), by @​fengmk2
  • Vite Task: the task cache is stored in a per-schema-version directory (e.g. node_modules/.vite/task-cache/v13/), so switching between branches that pin different Vite+ versions no longer fails with Unrecognized database version (vite-task#433), by @​fengmk2
  • Vite Task: env values in cache fingerprints are stored only as SHA-256 digests and env cache-miss details report names without values (vite-task#455); prefix env assignments like PATH=... command now affect executable lookup during planning (vite-task#440); package.json / pnpm-workspace.yaml files with a UTF-8 BOM parse correctly (vite-task#424), by @​wan9chi
  • vp upgrade: run the pinned pnpm with a managed Node.js LTS directly instead of re-entering vp install, so an incompatible session/project/system runtime can no longer make pnpm skip optional native binaries and leave the upgraded CLI broken (#​1900), by @​liangmiQwQ
  • Global package installs: each install writes to an immutable packages/<name>#<uuid> prefix that is activated via metadata after npm succeeds, so an interrupted reinstall can no longer leave the active package unavailable (#​1906), and stale interrupted-install directories are swept with file-lock protection for concurrent installs (#​1945), by @​liangmiQwQ
  • lazyPlugins(): skip plugin factories only while config metadata is being resolved instead of keying off VP_COMMAND, so builds spawned under vp run / vp exec keep the user's plugins and vp format no longer loads them (#​1939), by @​fengmk2
  • vp migrate (pnpm): add a direct vite devDep aliased to the core override wherever vite-plus is depended on, so vitest's vite peer binds to @voidzero-dev/vite-plus-core instead of pulling in a second upstream vite that broke the vp test cache (#​1933), by @​fengmk2
  • vp pack: bundle @tsdown/exe and @tsdown/css into core so --exe and CSS bundling work without a resolvable top-level tsdown; the native lightningcss becomes an optional peer loaded lazily with an actionable error (#​1919), by @​fengmk2
  • vp env: invalidate stale shim resolve cache entries when the project's Node.js version source changes (#​1951), by @​jong-kyung
  • Node shim: when the project declares npm via packageManager / devEngines.packageManager, child processes spawned from node resolve the managed npm instead of the Node-bundled one (#​1938); vp env which reports bins linked by an intercepted npm install -g (e.g. tsc) instead of "not found" (#​1968); bins with uppercase names (e.g. vitePlus) dispatch correctly (#​1963), by @​liangmiQwQ
  • vp-setup: pass the configured npm registry to the inner pnpm install so setup works behind custom registries (#​1795), by @​daflyinbed
  • Native binding: declare the platform packages' true ABI floor engines.node >=20.0.0 so engine-strict package managers (pnpm) no longer skip the optional native dependency and fail with Cannot find native binding when a consumer's Node floor lands in a product-policy gap (#​1993), by @​fengmk2
  • vp create: run git init without creating an initial commit, so commitlint-configured templates no longer reject the hardcoded message and template placeholders are not baked into history (#​2008), by @​forehalo
  • vp staged --debug: inline the bundled lint-staged version so debug logging no longer crashes reading a package.json that does not exist in the bundle (#​1925), by @​rokuosan
  • Installer: retry downloads truncated mid-body in HttpClient::get_bytes (the platform-tarball path for vp upgrade and the standalone installer) (#​1940), and clean up the temp dir when a package-manager install fails instead of leaking .tmpXXXX directories (#​1949), by @​shulaoda
  • Windows/msys: normalize backslashes in the env.fish fallback path (#​1954), by @​Aalivexy
  • install.ps1: detect the missing VC++ runtime (0xC0000135) and print VC++ Redistributable guidance instead of a generic failure; interactive irm | iex installs keep the shell open (#​1962), by @​cheezone
  • vp migrate: preserve comments, key order, and trailing commas in existing .vscode / .zed JSONC configs by patching the original text instead of re-serializing it (#​1956), by @​fengmk2
  • Migration: link the git hook warning to the migration guide (#​1902), by @​naokihaba
  • vp info / vp view: use package-manager-native commands (pnpm view, bun info, yarn npm info) instead of routing every lookup through npm view (#​1895), by @​jong-kyung
  • Correct overused ErrorConfig error types across the codebase (#​1934), by @​liangmiQwQ
Refactor
Docs
  • Document Vite Task automatic tracking (fs tracking and cache-reporting tools), reusing the task cache with GitHub Actions cache, and dependsOn: [{ task, from: "dependencies" }] (#​1992), by @​wan9chi
  • Rewrite the "Upgrading Vite+" guide: preview builds install through the registry bridge as ordinary 0.0.0-commit.<sha> npm versions, and vp migrate is the recommended way to upgrade a project or move it onto a preview build (#​1965), by @​fengmk2
  • Describe how to switch back to the release version from nightly (#​1887), by @​situ2001
  • Clarify Git hook tool migration (#​1901), by @​naokihaba
  • Add a global installation explanation (#​1915), update the vp env help output (#​1969), and add liangmiQwQ as a team member (#​1911), by @​liangmiQwQ
  • Fix package manager command examples (#​1937) and the dependsOn guide link (#​1883), by @​jong-kyung
  • Remove Fathom analytics from the uninstall docs (#​1946), by @​mdong1909
  • Center the README logo and fix its size (#​1878), by @​hyf0
Chore
Bundled Versions
Tool Version Source
vite 8.1.2 ba31193
rolldown 1.1.4 6cbd233
tsdown 0.22.3 npm
vitest 4.1.9 npm
oxlint 1.72.0 npm
oxlint-tsgolint 0.24.0 npm
oxfmt 0.57.0 npm
Upgrade
vp upgrade

New to Vite+? Start with the Beta announcement, then create a project with vp create or bring an existing one over with vp migrate.

New Contributors

Welcome to our new contributors @​rokuosan, @​Aalivexy, @​cheezone, @​daflyinbed, @​forehalo, @​kvnwolf! 🎉

Full Changelog: voidzero-dev/vite-plus@v0.2.1...v0.2.2

Published Packages
  • @voidzero-dev/vite-plus-core@0.2.2
  • vite-plus@0.2.2
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.2 vp build

Run any vp command without installing it; see the Docker guide for more.

v0.2.1: vite-plus v0.2.1

Compare Source

Restores support for older Node.js (back to 20.19.0) and makes vp exec --fail-if-no-match fail correctly on unmatched filters.

Fixes & Enhancements
  • Stop blocking older Node.js versions: v0.2.0 blocked commands when the resolved Node.js version fell outside the declared range. This reverts that enforcement and widens engines.node to ^20.19.0 || ^22.18.0 || >=24.11.0, matching Vite's own ^20.19.0 floor, so older Node that works in practice (e.g. Node 20 in rolldown CI) is no longer rejected (#​1865), by @​fengmk2
  • vp exec --fail-if-no-match: exit non-zero when one or more --filter expressions match no workspace packages. Strict mode previously only warned and returned success, so typoed filters looked successful in CI even though no package command ran (#​1859), by @​jong-kyung
Bundled Versions
Tool Version Source
vite 8.0.16 f94df87
rolldown 1.1.1 d7f919c
tsdown 0.22.3 npm
vitest 4.1.9 npm
oxlint 1.70.0 npm
oxlint-tsgolint 0.23.0 npm
oxfmt 0.55.0 npm
Upgrade
vp upgrade
Upgrading from 0.1.x to 0.2.1 Prompt
You are upgrading a project that uses Vite+ (the `vp` CLI) from v0.1.x to v0.2.1.

v0.2.1 has one breaking change vs v0.1.x: it consumes upstream Vitest directly. The `@voidzero-dev/vite-plus-test` wrapper package is removed. `vitest` and the base browser runtime (`@vitest/browser`, `@vitest/browser-preview`) now come in transitively through `vite-plus`. The opt-in browser providers (`@vitest/browser-playwright`, `@vitest/browser-webdriverio`) are NOT shipped by `vite-plus`: any project that runs browser-mode tests must install the provider it uses itself.

Do not run `vp migrate` for this upgrade; it is not reliable enough yet. Make the changes yourself by editing the project's files, then verify by running the tools.

How to run vp: if a global `vp` is available, use it. Otherwise this project only ships the local CLI from the `vite-plus` package, so run vp as the project-local binary (for example via the package manager's exec: pnpm exec, npx, yarn, or bunx). After any install, re-resolve vp so you always run the version currently in the project.

Do the following:

1. Set the `vite-plus` dependency to the exact version `0.2.1` and reinstall, so the new toolchain is installed and the lockfile moves off 0.1.x. In a monorepo, do this for every workspace package that depends on `vite-plus` (a shared `catalog:` entry covers them all at once). Changing the spec to `0.2.1` is what moves the lockfile off the old resolution; a reinstall that leaves the spec unchanged would keep the old version.

2. Remove the `@voidzero-dev/vite-plus-test` wrapper from the project. Search everywhere it could appear: package.json, the lockfile, any workspace or catalog config (such as pnpm-workspace.yaml or .yarnrc.yml), and the source files. Then classify the project and apply the matching case. Note these are not exclusive: a browser-mode project is also handled by case C in addition to removing the wrapper config.

   First, determine the project's Vitest usage:
   - BROWSER MODE: the project runs Vitest in the browser. It does if a config or test file imports a real browser provider (`vite-plus/test/browser-playwright` or `vite-plus/test/browser-webdriverio`, or the pre-upgrade raw forms `@vitest/browser-playwright` / `@vitest/browser-webdriverio`), or sets `test.browser.enabled`. This needs extra deps regardless of anything below; see case C.
   - DIRECT vitest usage: a source or test file imports directly from `vitest` or `@vitest/...`, or a `@vitest/*` package is listed in its dependencies (for example a coverage provider). Plain imports from `vite-plus/test` and `vite-plus/test/*` do NOT count as direct usage; a `vite-plus/test/browser-*` provider import is a browser-mode signal (case C), not direct usage.

   Case A - node-mode only (no direct vitest usage, no browser mode; the common case): remove the vitest configuration entirely. In package.json, delete the `vitest` entry from `dependencies` / `devDependencies` in whatever form it takes (a `@voidzero-dev/vite-plus-test` alias, a `catalog:` reference, or a plain version). Also remove the `vitest` entry from every dependency-resolution mechanism in the project: both `overrides` and `resolutions`, pnpm `overrides`/`catalog` (in package.json or pnpm-workspace.yaml), and any catalog entry. If `vitest` appears in more than one of these, remove all of them. Do not add a pinned `vitest`; it arrives transitively through `vite-plus` and the node-mode test command works without it.

   Case B - direct vitest usage: pin upstream vitest to the version bundled with vite-plus (4.1.9 for v0.2.1), and upgrade every vitest ecosystem package the project depends on so the whole tree resolves to a single vitest. Set each `@vitest/*` package the project lists (for example `@vitest/coverage-v8`, `@vitest/ui`, `@vitest/browser`) to that same version (4.1.9), since those are pinned to an exact vitest version. Also update any other vitest integration package (such as `vitest-browser-*`) to a release compatible with that vitest version. Leaving an ecosystem package on an older version pulls in a second copy of vitest, which Vitest rejects at runtime.

   Case C - browser mode (in addition to removing the wrapper config): you MUST add two deps to the workspace package that runs the browser tests (not the repo root, unless that is where the tests live), both pinned to the bundled vitest version so the tree still resolves to a single vitest:
     - The browser provider the project actually uses: `@vitest/browser-playwright@4.1.9` and/or `@vitest/browser-webdriverio@4.1.9`. Without it, config load fails with `Cannot find package '@&#8203;vitest/browser-playwright'` from `vite-plus/test/browser-playwright`. Make sure its framework peer is present too (`playwright` for Playwright, `webdriverio` for WebdriverIO); the project usually already has it.
     - A direct `vitest@4.1.9`. This is the one case where you DO add a pinned vitest, and it contradicts the "never add vitest" rule that holds for node mode. Reason: under pnpm's isolated node_modules, `vitest` is only a transitive dep of `vite-plus`, so the browser-tester Vite server (rooted at the consumer project) cannot resolve `vitest/internal/browser` or the `vitest > ...` optimizeDeps entries. The symptom is `Failed to resolve import "vitest/internal/browser"` followed by `Failed to connect to the browser session ... within the timeout` and a `no tests` run. vite-plus 0.2.1 ships a `vite-plus:vitest-resolver` plugin meant to rescue this, but it does not reach the separate `@vitest/browser` orchestrator server, so a direct `vitest@4.1.9` (matching the bundled version, single copy preserved) is required. (If a future vite-plus fixes the resolver to cover the browser-tester server, this direct `vitest` may become unnecessary; re-check.)

   In all cases, also delete any dependency-resolution config that existed only to accommodate the wrapper or the old vitest, for example pnpm `peerDependencyRules` entries (`allowedVersions` / `ignoreMissing`) referencing `vitest`, `@vitest/*`, or `@voidzero-dev/vite-plus-test`, and the equivalent peer-tweak config in other package managers (such as yarn `packageExtensions`). Leave rules that are unrelated to vitest or the wrapper untouched.

3. Keep the `vite` -> Vite+ core override (it is still required) and set it to the matching exact version: map `vite` to `npm:@&#8203;voidzero-dev/vite-plus-core@0.2.1` in whatever override, resolution, or catalog form the project already uses. `@voidzero-dev/vite-plus-core` is released in lockstep with `vite-plus`.

4. Leave imports from `vite-plus/test` (and `vite-plus/test/*`, including `vite-plus/test/browser-playwright`) unchanged; that is the stable public API. Only if a file imports directly from `@voidzero-dev/vite-plus-test`, repoint it to `vite-plus/test`. Leave `declare module 'vitest'` / `declare module '@&#8203;vitest/browser*'` type augmentations pointing at the upstream module (they must target the upstream identity to merge).

5. Reinstall so the lockfile reflects your edits, then verify:
   - No reference to `@voidzero-dev/vite-plus-test` remains anywhere outside node_modules (source, configs, lockfile).
   - The dependency tree resolves to a single `vitest` version (4.1.9) with no duplicate copies. Note that one `vitest@4.1.9:` entry in the lockfile `packages:` section plus one `vitest@4.1.9(...)` key in `snapshots:` is still a single version, not a duplicate.
   - The project's tests pass with Vitest's native banner; for browser mode, confirm the suite actually runs in the browser (you get passing test files, not `no tests` or a session timeout). Browser tests also need the browser binary installed (e.g. `npx playwright install chromium`).
   - The Vite+ check workflow passes (exit 0). A pre-existing lint/format warning in a file you did not touch is not a failure; report it but do not fix it.

   Troubleshooting: if you hit `vitest/internal/browser` resolution errors, or see duplicate `@vitest/browser` / `vite-plus` peer-variant directories under `node_modules/.pnpm` after several sequential installs across this dependency-graph change, do a clean reinstall (remove `node_modules` in the root and all workspaces, remove the Vite optimize caches `node_modules/.vite`, then reinstall) to collapse the stale variants before concluding it is a code problem.

Constraints:
- Do not run `vp migrate`.
- Do not bypass git hooks. If a pre-existing failure blocks you, report it rather than forcing through.
- Make the smallest set of edits that reaches the end state above; do not reformat unrelated files. (For browser mode, the added `vitest` + provider pins ARE part of that minimal end state.)
- When done, give me a short summary: old vs new `vite-plus` version, the files you changed, the test/check results, and call out explicitly any dependency you added beyond the wrapper removal (especially a direct `vitest`) with the reason.

Full Changelog: voidzero-dev/vite-plus@v0.2.0...v0.2.1

Published Packages
  • @voidzero-dev/vite-plus-core@0.2.1
  • vite-plus@0.2.1
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

v0.2.0: vite-plus v0.2.0

Compare Source

Vite+ now consumes upstream Vitest directly (no wrapper), raises the minimum supported Node.js version to 22.18.0, and ships corepack and devEngines support.

Highlights
  • vp test now runs upstream Vitest directly (breaking): Vite+ used to ship @voidzero-dev/vite-plus-test, a rebundled copy of Vitest that lagged upstream releases. That package is removed; vp test now runs the real upstream vitest, which is installed automatically as a dependency of vite-plus (you no longer add vitest or @vitest/* yourself, and vite still resolves to @voidzero-dev/vite-plus-core via package-manager overrides). Your import ... from 'vite-plus/test' code keeps working unchanged and vp migrate updates existing projects (#​1588), by @​Brooooooklyn
  • Minimum supported Node.js version raised to ^22.18.0 || >=24.11.0 (breaking): Node 20 reached end-of-life and the bundled tsdown already required ^22.18.0, so the published engines range now matches what vp pack can actually deliver; vp exec / vp run / vp dlx reject projects resolving an older Node with the existing incompatibility error (#​1813), by @​fengmk2
  • Corepack now works under Vite+: corepack now set up by default, so corepack enable and the pnpm/yarn launchers just work, even on Node 25+ which no longer ships it. (#​1808), by @​fengmk2
  • devEngines support for runtime and package-manager selection: Vite+ reads devEngines.runtime (ranked above engines.node) and devEngines.packageManager; auto-pin and vp migrate write devEngines.packageManager, vp env pin / unpin target devEngines.runtime, and vp env doctor reports conflicts instead of silently resolving them (#​1760), by @​fengmk2
Features
  • vp pm approve-builds: forward to npm's new approve-scripts / deny-scripts (npm >= 11.16.0) instead of the previous no-op, matching pnpm approve-builds / bun pm trust; mixed approve+deny is rejected with actionable guidance and npm's advisory-only caveat is surfaced (#​1733), by @​fengmk2
  • vp create: support local monorepo templates declared in create.templates in vite.config.ts; vp create vite:generator scaffolds a Bingo generator and auto-registers it in the picker, replacing the old package.json-keyword inference (#​1777), by @​fengmk2
  • vp create: detect direct dependencies whose build scripts the package manager gated (e.g. native builds like better-sqlite3) and act on them; prompt to approve each (default off) interactively, point at vp pm approve-builds non-interactively, or build them with --approve-builds (#​1828), by @​fengmk2
  • vp config: add --no-hooks and --no-agent opt-outs to skip git-hook installation and coding-agent instruction updates (#​1842), by @​leno23
  • vp list -g: sort the global package list output so entries appear in a stable order (#​1748), by @​liangmiQwQ
  • Upgrade upstream dependencies: rolldown 1.0.3 -> 1.1.1, tsdown 0.22.1 -> 0.22.3, oxlint 1.67.0 -> 1.70.0, oxfmt 0.52.0 -> 0.55.0, vitest 4.1.8 -> 4.1.9, and the oxc toolchain 0.133.0 -> 0.136.0 (#​1749, #​1767, #​1812, #​1834, #​1855), by @​voidzero-guard[bot]
Fixes & Enhancements
  • Security: resolve open Rust Dependabot advisories by bumping transitive openssl 0.10.76 -> 0.10.80 (openssl-sys 0.9.112 -> 0.9.116), fixing five high-severity rust-openssl issues (buffer overflows in key derivation, AES key wrap, and digest finalization; an unchecked PSK/cookie trampoline length leaking adjacent memory; and OCSP-responder undefined behavior: GHSA-pqf5-4pqq-29f5, GHSA-8c75-8mhr-p7r9, GHSA-ghm9-cr32-g9qj, GHSA-hppc-g8h3-xhp3, GHSA-xp3w-r5p5-63rr), and drop the unmaintained, unsound libyml (GHSA-gfxp-f68g-8x78, high) by removing dead serde_yml code (#​1742), by @​fengmk2
  • Security (docs site): update mermaid 11.13.0 -> 11.15.0 to fix improper classDef sanitization in state diagrams that allowed HTML injection (CVE-2026-41149 / GHSA-ghcm-xqfw-q4vr, medium severity; <script> tags are stripped so it does not reach XSS) (#​1745), by @​renovate[bot]
  • vp check --fix / vp staged: create/migrate now wrap inline Vite plugins: [...] arrays with lazyPlugins(...) so plugin factories aren't eagerly executed (and don't hang on open handles) during lint/format/check config loading (#​1752), by @​jong-kyung
  • vp migrate: complete pending migration work for projects that already have vite-plus installed (scripts, imports, tsconfig types, ESLint/Prettier, legacy hooks, package-manager settings) instead of treating vite-plus as migration-complete; fully migrated projects stay idempotent (#​1821), by @​jong-kyung
  • vp create / vp migrate: detect shorthand fmt, / lint, config keys so a duplicate inline block is no longer injected (#​1843), by @​fengmk2
  • IDE oxlint/oxfmt wrappers: set VP_COMMAND so lazyPlugins() skips framework plugins during LSP config reads, preventing a stray .svelte-kit (and similar) directory at the monorepo root (#​1764), by @​jong-kyung
  • vp lint / vp run -r lint on Windows: keep the absolute tsgolint path for workspace lint runs instead of downgrading it to a wrong cwd-relative path (#​1758), by @​semimikoh
  • oxlint wrapper: set the tsgolint path so type-aware lint resolves it (#​1811), by @​jong-kyung
  • vp install -g: use a unique backup directory and treat stale-backup cleanup as best-effort so a locked Windows binary no longer fails an otherwise successful reinstall (#​1753), by @​fengmk2
  • vp install -g: remove stale managed binary shims when a reinstalled package drops a bin from its package.json#bin (#​1765), by @​liangmiQwQ
  • vp create --git: surface git's actual stdout/stderr when the initial commit fails instead of always blaming user.name / user.email (#​1819), by @​fengmk2
  • vp create vite:generator: reject --git / --no-git, since adding a generator to an existing monorepo does not initialize git (#​1788), by @​jong-kyung
  • Global CLI: harden find_system_tool against a self-exec loop (skip the running executable's own bin directory) and fix two vite_global_cli tests that could hang (#​1820), by @​fengmk2
  • CLI help: unify alias display (#​1832), show supported run options (#​1797), show --fail-if-no-match in exec help (#​1798), add the implode documentation link (#​1796), and handle nested-command typo help (#​1803), by @​jong-kyung
Docs

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Jul 12, 2026
@renovate
renovate Bot enabled auto-merge July 12, 2026 17:50
@renovate
renovate Bot added this pull request to the merge queue Jul 12, 2026
@renovate

renovate Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Merged via the queue into main with commit 3cac46c Jul 12, 2026
8 checks passed
@renovate
renovate Bot deleted the renovate/nodejs-dev-dependencies branch July 12, 2026 17:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ShigureNyako