Skip to content

feat(deps): upgrade upstream dependencies#1693

Merged
fengmk2 merged 12 commits into
mainfrom
deps/upstream-update
May 27, 2026
Merged

feat(deps): upgrade upstream dependencies#1693
fengmk2 merged 12 commits into
mainfrom
deps/upstream-update

Conversation

@voidzero-guard

Copy link
Copy Markdown
Contributor

Summary

  • Automated daily upgrade of upstream dependencies.
  • Bumps the oxc toolchain group: oxlint 1.66.0 -> 1.67.0, oxfmt 0.51.0 -> 0.52.0, and @oxc-project/* / oxc-* packages 0.132.0 -> 0.133.0.
  • Refreshes CLI snapshots affected by the new oxlint --debug=files option and updated vp run cache-status messages.

Dependency updates

Package From To
oxfmt 0.51.0 0.52.0
oxlint 1.66.0 1.67.0
@oxc-project/runtime 0.132.0 0.133.0
@oxc-project/types 0.132.0 0.133.0
oxc-minify 0.132.0 0.133.0
oxc-parser 0.132.0 0.133.0
oxc-transform 0.132.0 0.133.0
Unchanged dependencies
  • rolldown: v1.0.2 (f2757ed)
  • vite: v8.0.14 (c917f1e)
  • vitest: 4.1.7
  • tsdown: 0.22.0
  • @oxc-node/cli: 0.1.0
  • @oxc-node/core: 0.1.0
  • oxlint-tsgolint: 0.23.0
  • @vitejs/devtools: 0.2.0

Code changes

  • Refresh oxlint help-output snapshots for the new --debug=files option in packages/cli/snap-tests/bin-oxlint-wrapper/snap.txt and packages/cli/snap-tests/command-helper/snap.txt.
  • Refresh vp run cache-status output snapshots in packages/cli/snap-tests/cache-clean/snap.txt, packages/cli/snap-tests/ignore_dist/snap.txt, and packages/cli/snap-tests/plain-terminal-ui-nested/snap.txt.

Build status

  • sync-remote-and-build: success
  • build-upstream: success

@netlify

netlify Bot commented May 27, 2026

Copy link
Copy Markdown

Deploy Preview for viteplus-preview canceled.

Name Link
🔨 Latest commit 0a7575e
🔍 Latest deploy log https://app.netlify.com/projects/viteplus-preview/deploys/6a16f046c3f243000893599e

@socket-security

socket-security Bot commented May 27, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​oxc-project/​runtime@​0.133.01001007596100
Addednpm/​oxfmt@​0.52.0991009296100
Addednpm/​oxc-transform@​0.133.0941009696100
Addednpm/​oxc-parser@​0.133.09910010095100

View full report

fengmk2 commented May 27, 2026

Copy link
Copy Markdown
Member

Investigation result for the packages/cli/snap-tests/oxlint-typeaware failure:

The snap itself is not failing because of the type-aware cache/input logic. It fails earlier because vp lint --type-aware ./src exits while oxlint is loading the Vite+ config.

oxlint@1.67.0 now declares an optional vite-plus peer and loads Vite+ config via import("vite-plus").resolveConfig. In CI, that path imports vite-plus -> @voidzero-dev/vite-plus-core, then reaches:

@voidzero-dev/vite-plus-core/dist/rolldown/shared/resolve-tsconfig-DCdBlPeK.mjs:103
var TsconfigCache = class extends import_binding.TsconfigCache
TypeError: Class extends value undefined is not a constructor or null

The underlying issue appears to be the published @voidzero-dev/vite-plus-core@0.1.22 Rolldown binding loader falling back to vite-plus/binding. That vite-plus/binding is the Vite+ CLI NAPI binding, not the Rolldown binding, so it does not export Rolldown symbols such as TsconfigCache; import_binding.TsconfigCache is therefore undefined.

This is why oxlint-typeaware shows the failure: the fixture runs vp lint --type-aware ./src, and oxlint 1.67.0 now tries to parse vite.config.ts through Vite+ before linting or cache behavior is exercised.

I could not reproduce with the existing local install because this workspace still had oxlint@1.66.0; CI installs the PR lockfile dependency graph, where oxlint@1.67.0 takes the new Vite+ config loading path.

@pkg-pr-new

pkg-pr-new Bot commented May 27, 2026

Copy link
Copy Markdown

Open in StackBlitz

vite-plus

npm i https://pkg.pr.new/voidzero-dev/vite-plus@1693

@voidzero-dev/vite-plus-core

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1693

@voidzero-dev/vite-plus-prompts

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-prompts@1693

@voidzero-dev/vite-plus-test

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1693

@voidzero-dev/vite-plus-cli-darwin-arm64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-darwin-arm64@1693

@voidzero-dev/vite-plus-cli-darwin-x64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-darwin-x64@1693

@voidzero-dev/vite-plus-cli-linux-arm64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-arm64-gnu@1693

@voidzero-dev/vite-plus-cli-linux-arm64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-arm64-musl@1693

@voidzero-dev/vite-plus-cli-linux-x64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-x64-gnu@1693

@voidzero-dev/vite-plus-cli-linux-x64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-x64-musl@1693

@voidzero-dev/vite-plus-cli-win32-arm64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-win32-arm64-msvc@1693

@voidzero-dev/vite-plus-cli-win32-x64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-win32-x64-msvc@1693

@voidzero-dev/vite-plus-darwin-arm64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-darwin-arm64@1693

@voidzero-dev/vite-plus-darwin-x64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-darwin-x64@1693

@voidzero-dev/vite-plus-linux-arm64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-arm64-gnu@1693

@voidzero-dev/vite-plus-linux-arm64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-arm64-musl@1693

@voidzero-dev/vite-plus-linux-x64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-x64-gnu@1693

@voidzero-dev/vite-plus-linux-x64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-x64-musl@1693

@voidzero-dev/vite-plus-win32-arm64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-win32-arm64-msvc@1693

@voidzero-dev/vite-plus-win32-x64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-win32-x64-msvc@1693

commit: fba9834

Comment thread ecosystem-ci/verify-install.ts Outdated

fengmk2 commented May 27, 2026

Copy link
Copy Markdown
Member

Fixed in 76d19125 (fix(cli): build local binding with rolldown).

Root cause was that local/dev vite-plus native binding was built without the rolldown feature, so when oxlint's type-aware config loading imported local vite-plus, Rolldown's TsconfigCache / resolveTsconfig exports were missing. The PR now builds the local binding with rolldown enabled and updates the generated binding stubs. I also adjusted the oxlint-typeaware fixture so it remains lint-clean once config loading succeeds.

Local verification:

  • pnpm -F vite-plus build-native
  • pnpm -F vite-plus snap-test-local oxlint-typeaware
  • snapshot diff for packages/cli/snap-tests/oxlint-typeaware/snap.txt stayed clean

Comment thread packages/cli/build.ts Outdated
voidzero-guard Bot and others added 6 commits May 27, 2026 19:48
- oxfmt: 0.51.0 -> 0.52.0
- oxlint: 1.66.0 -> 1.67.0
- @oxc-project/runtime: 0.132.0 -> 0.133.0
- @oxc-project/types: 0.132.0 -> 0.133.0
- oxc-minify: 0.132.0 -> 0.133.0
- oxc-parser: 0.132.0 -> 0.133.0
- oxc-transform: 0.132.0 -> 0.133.0

Code changes:
- Refresh oxlint help output snapshots for new `--debug=files` option in packages/cli/snap-tests/bin-oxlint-wrapper/snap.txt and packages/cli/snap-tests/command-helper/snap.txt
- Refresh vp run cache-status output snapshots in packages/cli/snap-tests/cache-clean/snap.txt, packages/cli/snap-tests/ignore_dist/snap.txt, and packages/cli/snap-tests/plain-terminal-ui-nested/snap.txt
@fengmk2 fengmk2 requested a review from Brooooooklyn May 27, 2026 11:49
@fengmk2

This comment was marked as outdated.

@fengmk2 fengmk2 force-pushed the deps/upstream-update branch from 9dd35dc to fba9834 Compare May 27, 2026 11:50
@fengmk2

fengmk2 commented May 27, 2026

Copy link
Copy Markdown
Member

@codex review

@fengmk2 fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests labels May 27, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fba98342a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/cli/build.ts Outdated
Comment thread pnpm-lock.yaml Outdated
Comment thread packages/cli/snap-tests/ignore_dist/snap.txt Outdated
Comment thread packages/cli/snap-tests/cache-clean/snap.txt Outdated
@fengmk2

fengmk2 commented May 27, 2026

Copy link
Copy Markdown
Member

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fengmk2 added 2 commits May 27, 2026 21:18
- Drop dead `bindingFeatures.includes('rolldown')` conditional in
  packages/cli/build.ts: the array is hardcoded to `['rolldown']`, so the
  false branch and the subsequent empty-string guard were unreachable.
- ecosystem-ci/verify-install.ts: fail loudly when vite-plus is missing the
  oxlint dependency instead of silently skipping the version check; broaden
  the semver-operator strip from `=` to `=|^|~` so future catalog format
  changes don't spuriously fail; drop the no-op `path.sep` prefix on the
  pnpm `.pnpm/vite-plus@file+` substring check.
Mirror the e2e-test.yml gate so create-e2e runs automatically on every
push to deps/upstream-update without needing the `test: create-e2e`
label. Upstream dependency upgrades can shift create/migrate behavior
even when no files under packages/cli/src/create/** change.
@fengmk2 fengmk2 merged commit f0f63e3 into main May 27, 2026
115 checks passed
@fengmk2 fengmk2 deleted the deps/upstream-update branch May 27, 2026 14:02
@fengmk2 fengmk2 mentioned this pull request May 28, 2026
fengmk2 added a commit that referenced this pull request May 29, 2026
Release vite-plus v0.1.23.

Enterprise-ready HTTP (proxy + custom CA), task command shorthands in
`vite.config.ts`, a smoother `vp create`/`vp migrate`, and the
oxc/vite/rolldown bundled stack moves forward.

### Highlights

- **Proxy and custom-CA aware HTTP**: a new process-wide
`vite_shared::shared_http_client()` honors `HTTPS_PROXY` / `HTTP_PROXY`
/ `NO_PROXY`, picks up macOS System Settings / Windows registry proxies,
loads custom CAs from `SSL_CERT_FILE` and `NODE_EXTRA_CA_CERTS`, and
exposes a `VP_INSECURE_TLS` diagnostic switch; makes `vp` work through
Socket Firewall Free and other TLS-intercepting proxies
([#1686](#1686)), by
@fengmk2
- **Task command shorthands**: `run.tasks` entries in `vite.config.ts`
now accept a bare string (`"build": "cmd"`) or array (`"build": ["cmd1",
"cmd2"]`) instead of always requiring `{ command: ... }`; arrays reuse
the existing `&&` planning path so cache, `dependsOn`, and task options
stay consistent
([vite-task#391](voidzero-dev/vite-task#391)),
by @jong-kyung
- **Managed `vp outdated -g`**: routes through Vite+'s managed global
package metadata instead of delegating to the underlying `npm outdated
-g` store, so all installed global packages are reported consistently
([#1659](#1659)), by
@liangmiQwQ

### Features

- `vp pm approve-builds`: new unified subcommand that mirrors `pnpm
approve-builds` one-to-one, adapts to `bun pm trust`, and
warns-and-noops on npm/yarn
([#1662](#1662)), by
@fengmk2
- `vp create`: opt-in GitHub Copilot setup; selecting `--agent copilot`
now generates a `.github/workflows/copilot-setup-steps.yml` so the
Copilot Coding Agent can set up Vite+ and run `vp` in the new project
out of the box
([#1683](#1683)), by
@jong-kyung
- `vp migrate`: prompt to remove `baseUrl` from `tsconfig.json` before
applying type-aware lint defaults (runs `@andrewbranch/ts5to6
--fixBaseUrl .` under the hood; auto-applied in non-interactive mode)
([#1692](#1692)), by
@TheAlexLichter
- Respect `packageManager` in package-manager shims (`npm`/`npx`,
`pnpm`/`pnpx`, `yarn`/`yarnpkg`, `bun`/`bunx`); add non-mutating
`packageManager` resolution metadata for `vp env current` and `vp env
which` ([#1654](#1654)),
by @fengmk2
- vite-task: `--filter` no-match now exits `0` by default; add
`--fail-if-no-match` to opt back in
([vite-task#393](voidzero-dev/vite-task#393)),
by @kazupon

### Fixes & Enhancements

- `vp create`: keep generated `.vscode/settings.json` trackable when the
VS Code editor option is selected (avoid templates' `.vscode/*`
`.gitignore` masking it)
([#1700](#1700)), by
@jong-kyung
- `vp create vite:monorepo`: normalize sub-package `vite-plus` to
`catalog:` even when only `vite-plus` (not `vite`/`vitest`/...) is
present, and drop the `vite`/`vitest` aliases generated by the upstream
library template
([#1697](#1697)), by
@fengmk2
- `vp add/install -g <path>`: resolve the real package name from
`package.json` instead of using the path string, so local-path installs
don't create broken directories
([#1685](#1685)), by
@liangmiQwQ
- `vp test --coverage` and other direct built-in commands now expose the
workspace's `package.json#packageManager` to child processes so tools
like Vitest coverage can spawn the configured PM
([#1696](#1696)), by
@jong-kyung
- `vp migrate`: clean up the whole ESLint ecosystem (plugins, configs,
parser/resolver, type-utils) rather than just `eslint`; skip the
migration entirely when `@nuxt/eslint` is detected
([#1682](#1682)), by
@fengmk2
- `vp create`: write `fmt.configPath` (not `configPath`) for Zed oxfmt
settings to match the official Zed OXC extension layout
([#1687](#1687)), by
@chungweileong94
- `vp migrate`: parse `tsconfig.json` as JSONC so files with comments
don't break `baseUrl` detection/removal
([#1688](#1688)), by
@TheAlexLichter
- `vp env setup`: Unix env shims now point at the active `vp` executable
instead of always assuming `VP_HOME/current/bin/vp`, so Homebrew-style
installs work
([#1631](#1631)), by
@leohara
- `vp outdated -g` / `vp why -g`: don't require a local `package.json`;
global commands run regardless of cwd
([#1622](#1622)), by
@liangmiQwQ
- `vp create`: default the "Initialize a git repository?" prompt to yes
([#1650](#1650)), by
@fengmk2
- `vp` hooks: include the managed Node bin in `PATH` so
`./node_modules/.bin/vp` can find `node` from a VS Code commit on macOS
([#1647](#1647)), by
@TheAlexLichter
- `vpx` on Windows now invokes the package's `.cmd` shim instead of the
Unix binary
([#1652](#1652)), by
@tobynguyen27
- vite-task: bump cache database schema to version 13 (forces a one-time
rebuild of the local task cache)
([vite-task#402](voidzero-dev/vite-task#402)),
by @branchseer
- Bump vite-task to `d02b257` and `5833b374`; also bumps the repo's Rust
nightly toolchain to `nightly-2026-05-24` and ships the regenerated
`run` config types and docs for the new task command shorthand
([#1689](#1689),
[#1695](#1695)), by
@branchseer

### Refactor

- Replace `VP_SHELL_NU`/`VP_SHELL_PWSH` with a single `VP_SHELL`
override; add explicit shell parsing for `bash`, `zsh`, `fish`, `nu`,
`pwsh`, and `cmd`, and harden auto-detection against nested shells
([#1658](#1658)), by
@nekomoyi
- vite-task: replace `allocator-api2` with `bumpalo` collections
([vite-task#400](voidzero-dev/vite-task#400)),
by @branchseer
- vite-task: drop the unused `and_item_index` field from
`ExecutionItemDisplay`
([vite-task#394](voidzero-dev/vite-task#394)),
by @branchseer

### Docs

- Add the root `AGENTS.md` as the primary AI-agent guide for the
vite-plus repository; convert `CLAUDE.md` into a compatibility pointer
([#1670](#1670)), by
@jong-kyung
- Align the agent validation table to match `AGENTS.md`
([#1673](#1673)), by
@jong-kyung
- Update the task output caching guide so the documented behavior
matches what vite-task actually does
([#1639](#1639)), by
@ericclemmons
- Correct the bundled-source location in `packages/core/BUNDLING.md`
([#1660](#1660)), by
@shulaoda

### Chore

- Clarify `--help` text for `vp env default`/`pin`/`use`/`exec` with
`Examples:` blocks
([#1664](#1664)), by
@Boshen
- Refresh trusted stack stats on the docs homepage
([#1680](#1680)), by
@voidzero-guard[bot]
- Drop the standalone `pnpm --filter @rolldown/pluginutils build` step
now that `@rolldown/pluginutils` is published from its own package
([#1655](#1655)), by
@shulaoda
- Preserve single-quote style when `sync-remote` rewrites
`pnpm-workspace.yaml`
([#1672](#1672)), by
@lyzno1
- Enable `vite_pm_cli` lib tests by removing a stale `test = false` flag
([#1661](#1661)), by
@shulaoda
- CI: switch macOS runners back to `namespace-profile-mac-default`
([#1701](#1701)), by
@fengmk2
- CI: fix release-day flakes in the upgrade test and snap test when the
dev `package.json` version equals npm latest
([#1645](#1645)), by
@fengmk2
- CI: replace `zizmor` and `cargo-deny` workflows with
`oxc-project/security-action`
([#1635](#1635)), by
@Boshen
- CI: warm-up monorepo cache test under npm
([#1649](#1649)), by
@fengmk2
- CI: attach per-target `vp` binary archives (`.tar.gz`/`.zip`) to
GitHub Releases alongside the existing `vp-setup-*.exe` installers
([#1665](#1665)), by
@Boshen
- CI: declare Playwright via `repo.json` in ecosystem tests and bump
consumers to `>=1.60` to dodge the Node 24.16.0 hang
([#1668](#1668)), by
@fengmk2
- Update GitHub Actions
([#1640](#1640),
[#1675](#1675),
[#1678](#1678),
[#1679](#1679),
[#1691](#1691)), by
@renovate[bot]
- Upgrade upstream dependencies: vite `8.0.11 → 8.0.14`, rolldown `1.0.0
→ 1.0.3`, vitest `4.1.6 → 4.1.7`, oxlint `1.63.0 → 1.67.0`, oxfmt
`0.48.0 → 0.52.0`, oxlint-tsgolint `0.22.1 → 0.23.0`, `@oxc-project/*`
and oxc Rust crates `0.129.0 → 0.133.0`
([#1646](#1646),
[#1653](#1653),
[#1693](#1693),
[#1699](#1699)), by
@voidzero-guard[bot]

### Bundled Versions

| Tool | Version | Source |
| --- | --- | --- |
| vite | `8.0.14` |
[`c917f1e`](vitejs/vite@c917f1e)
|
| rolldown | `1.0.3` |
[`a287faa`](rolldown/rolldown@a287faa)
|
| tsdown | `0.22.0` | [npm](https://npmx.dev/package/tsdown/v/0.22.0) |
| vitest | `4.1.7` | [npm](https://npmx.dev/package/vitest/v/4.1.7) |
| oxlint | `1.67.0` | [npm](https://npmx.dev/package/oxlint/v/1.67.0) |
| oxlint-tsgolint | `0.23.0` |
[npm](https://npmx.dev/package/oxlint-tsgolint/v/0.23.0) |
| oxfmt | `0.52.0` | [npm](https://npmx.dev/package/oxfmt/v/0.52.0) |

### New Contributors

Welcome to all new contributors! 🎉

@ericclemmons, @tobynguyen27, @shulaoda, @leohara, @chungweileong94

**Full Changelog**:
v0.1.22...v0.1.23

Merging this PR will trigger the release workflow.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: MK <fengmk2@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg.pr.new test: create-e2e Run `vp create` e2e tests test: e2e Auto run e2e tests test: install-e2e run vite install e2e test

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant