feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #2214 · voidzero-dev/vite-plus

voidzero-guard · 2026-07-22T02:27:16Z

Summary

Automated upgrade of upstream dependencies, headlined by rolldown to v1.2.0 and vite to v8.1.5.
Bumps the bundled tsdown to 0.22.13 and the oxc toolchain (oxlint 1.75.0, oxfmt 0.60.0, oxc crates 0.141.0/0.140.0, oxc_resolver 11.24.2).
Adapts the core build to newer rolldown chunking (tsdown logger color imports, redundant @tsdown/css chunk cleanup) and regenerates the NAPI binding types for the updated dev-engine API.
Updates CLI PTY snapshots for the new clap help alias rendering.

Dependency updates

Package	From	To
`rolldown`	`f09947a`	`v1.2.0 (03e1e34)`
`vite`	`a477454`	`v8.1.5 (5e7fe12)`
`tsdown`	`0.22.7`	`0.22.13`
`@tsdown/css`	`0.22.7`	`0.22.13`
`@tsdown/exe`	`0.22.7`	`0.22.13`
`lightningcss`	`^1.32.0`	`^1.33.0`
`oxfmt`	`0.58.0`	`0.60.0`
`oxlint`	`1.73.0`	`1.75.0`
`oxlint-tsgolint`	`0.24.0`	`7.0.2001`
`@oxc-project/runtime`	`0.139.0`	`0.141.0`
`@oxc-project/types`	`0.139.0`	`0.141.0`
`oxc-minify`	`0.139.0`	`0.141.0`
`oxc-parser`	`0.139.0`	`0.141.0`
`oxc-transform`	`0.139.0`	`0.141.0`
`@vitejs/devtools`	`0.4.0`	`0.4.2`
`oxc` (Rust)	`0.139.0`	`0.140.0`
`oxc_resolver` (Rust)	`11.23.0`	`11.24.2`
`itertools` (Rust)	`0.14`	`0.15`
`phf` (Rust)	`0.13`	`0.14`
`sugar_path` (Rust)	`2`	`3`
`@napi-rs/cli`	`^3.7.2`	`^3.7.3`
`rolldown-plugin-dts`	`^0.26.0`	`^0.27.0`

Unchanged dependencies

vitest and @vitest/*: 4.1.10
@vitest/browser and browser providers: 4.1.10
@oxc-node/cli: 0.1.0
@oxc-node/core: 0.1.0
VITEST_VERSION constant: 4.1.10
README vitest pins: 4.1.10

Code changes

packages/core/build.ts: added an ensureAnsisImports helper so the branded tsdown logger chunk imports bold/red from the shared chunk after newer rolldown chunking splits them out, and drop the now-redundant @tsdown/css chunk rolldown emits as its own generated chunk.
packages/cli/binding/index.d.cts: regenerated NAPI type definitions for the updated rolldown dev-engine binding API (registerClient/notifyPayloadDelivered, BindingLazyChunkOutput, BindingHmrUpdate changedIds/seq, BindingRebuildStrategy variants).
pnpm-workspace.yaml: bumped @napi-rs/cli and rolldown-plugin-dts, added the @jridgewell/trace-mapping catalog entry, and removed the postcss-modules@9.0.0 override and patch.
Cargo.toml / Cargo.lock / pnpm-lock.yaml: version bumps and lockfile updates.
crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/**: updated PTY snapshots for the new clap help alias rendering (list [alias: ls]) and pnpm approve-builds output.

Build status

sync-remote-and-build: failure
build-upstream: failure

- rolldown: f09947a -> v1.2.0 (03e1e34) - vite: a477454 -> v8.1.5 (5e7fe12) - tsdown: 0.22.7 -> 0.22.13 - @tsdown/css: 0.22.7 -> 0.22.13 - @tsdown/exe: 0.22.7 -> 0.22.13 - lightningcss: ^1.32.0 -> ^1.33.0 - oxfmt: 0.58.0 -> 0.60.0 - oxlint: 1.73.0 -> 1.75.0 - oxlint-tsgolint: 0.24.0 -> 7.0.2001 - @oxc-project/runtime: 0.139.0 -> 0.141.0 - @oxc-project/types: 0.139.0 -> 0.141.0 - oxc-minify: 0.139.0 -> 0.141.0 - oxc-parser: 0.139.0 -> 0.141.0 - oxc-transform: 0.139.0 -> 0.141.0 - @vitejs/devtools: 0.4.0 -> 0.4.2 Code changes: - Cargo.toml: bump oxc crates 0.139.0 -> 0.140.0, oxc_resolver 11.23.0 -> 11.24.2, itertools 0.14 -> 0.15, phf 0.13 -> 0.14, sugar_path 2 -> 3. - pnpm-workspace.yaml: bump @napi-rs/cli -> ^3.7.3 and rolldown-plugin-dts -> ^0.27.0, add @jridgewell/trace-mapping catalog entry, drop the postcss-modules@9.0.0 override and patch. - packages/core/build.ts: add ensureAnsisImports helper so the branded tsdown logger imports bold/red after newer rolldown chunking splits them out, and drop redundant @tsdown/css chunks now emitted as their own generated chunk. - packages/cli/binding/index.d.cts: regenerate NAPI type definitions for the updated rolldown dev-engine binding API (registerClient/notifyPayloadDelivered, BindingLazyChunkOutput, BindingHmrUpdate changes). - crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/**: update PTY snapshots for the new clap help alias rendering ("list [alias: ls]") and pnpm approve-builds output.

netlify · 2026-07-22T02:27:22Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`aae02a0`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a607acf09adf800086aafaf

socket-security · 2026-07-22T02:29:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security
	cargo/tokio@1.50.0 ⏵ 1.53.1	^-1
	cargo/nix@0.31.2 ⏵ 0.31.3
	npm/@oxc-project/types@0.141.0
	npm/@tsdown/exe@0.22.13
	npm/@vitejs/devtools@0.4.2
	npm/@oxc-project/runtime@0.141.0
	npm/@tsdown/css@0.22.13
	cargo/thiserror@2.0.18 ⏵ 2.0.19
	cargo/reqwest@0.13.2 ⏵ 0.13.4	⁺²
	cargo/anyhow@1.0.103 ⏵ 1.0.104
	npm/@vitejs/release-scripts@1.8.0
	npm/postcss@8.5.20
	cargo/serde@1.0.228 ⏵ 1.0.229
	cargo/rustls@0.23.37 ⏵ 0.23.42
	cargo/napi@3.9.0 ⏵ 3.11.0
	cargo/serde_json@1.0.149 ⏵ 1.0.151
	npm/@napi-rs/cli@3.7.4
	npm/oxfmt@0.60.0
	npm/tsdown@0.22.13
	npm/browserslist@4.28.6
	npm/oxc-parser@0.141.0
	npm/postcss-modules@9.0.1
	npm/eslint-plugin-n@18.2.2
	cargo/async-trait@0.1.89 ⏵ 0.1.91
	cargo/bstr@1.12.1 ⏵ 1.13.0
	cargo/chrono@0.4.44 ⏵ 0.4.45
	cargo/clap@4.6.0 ⏵ 4.6.4
	cargo/clap_complete@4.6.0 ⏵ 4.6.7	⁺¹
	cargo/futures@0.3.32 ⏵ 0.3.33
	cargo/futures-util@0.3.32 ⏵ 0.3.33
	cargo/ignore@0.4.25 ⏵ 0.4.31	^-1
	cargo/indexmap@2.13.0 ⏵ 2.14.0
See 22 more rows in the dashboard

View full report

socket-security · 2026-07-22T02:29:35Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo `openssl` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `cargo/reqwest@0.13.4` → `cargo/openssl@0.10.81` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/openssl@0.10.81`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo `tokio` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: bench/Cargo.toml → `cargo/tokio@1.53.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/tokio@1.53.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo `zerocopy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `cargo/pgp@0.19.0` → `cargo/brush-parser@0.4.0` → `cargo/criterion@0.7.0` → `cargo/brush-parser@0.3.0` → `cargo/zerocopy@0.8.55` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/zerocopy@0.8.55`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-07-22T02:35:38Z

Native binary sizes (`aae02a0`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact	Format	Base	PR	Change
`vp` (Linux x64)	Binary	10.32 MiB	10.31 MiB	-12.01 KiB (-0.11%)
`vp` (Linux x64)	gzip -9	4.42 MiB	4.43 MiB	+7.38 KiB (+0.16%)
NAPI (Linux x64)	Binary	33.46 MiB	33.06 MiB	-410.44 KiB (-1.20%)
NAPI (Linux x64)	gzip -9	12.80 MiB	12.72 MiB	-80.54 KiB (-0.61%)
`vp` (macOS ARM64)	Binary	7.65 MiB	7.64 MiB	-16.08 KiB (-0.21%)
`vp` (macOS ARM64)	gzip -9	3.83 MiB	3.84 MiB	+4.22 KiB (+0.11%)
NAPI (macOS ARM64)	Binary	40.73 MiB	40.50 MiB	-244.05 KiB (-0.59%)
NAPI (macOS ARM64)	gzip -9	17.03 MiB	16.97 MiB	-59.57 KiB (-0.34%)
`vp` (Windows x64)	Binary	8.37 MiB	8.35 MiB	-14.50 KiB (-0.17%)
`vp` (Windows x64)	gzip -9	3.64 MiB	3.64 MiB	-165 B (-0.00%)
NAPI (Windows x64)	Binary	27.78 MiB	27.50 MiB	-281.00 KiB (-0.99%)
NAPI (Windows x64)	gzip -9	10.74 MiB	10.69 MiB	-49.86 KiB (-0.45%)
Trampoline (Windows x64)	Binary	203.00 KiB	203.00 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	97.91 KiB	97.91 KiB	0 B (0.00%)
Installer (Windows x64)	Binary	4.46 MiB	4.44 MiB	-15.00 KiB (-0.33%)
Installer (Windows x64)	gzip -9	2.08 MiB	2.08 MiB	-1.02 KiB (-0.05%)

## Summary - disable pnpm and Yarn package-age gates in the create approval-flow fixtures - regenerate snapshots around stable build-script approval behavior - avoid wall-clock failures when pinned upstream dependencies mature Fixes the cross-platform snapshot failures blocking #2217. ## Motivation While preparing v0.2.6 in #2217, the three `create_approve_builds` snapshots failed on Linux, macOS, and Windows. The release branch inherited the dependency upgrade from #2214, including OXC 0.141.0. When #2214 recorded these snapshots, the OXC packages were still inside the package-manager age window. The pnpm snapshots therefore included temporary `minimumReleaseAgeExclude` entries. The Yarn fixture stopped at an OXC quarantine error before it reached the `core-js` build-approval behavior that the fixture was meant to test. By the time release CI ran, the same OXC packages were old enough to install normally. No Vite+ behavior had changed, but pnpm no longer generated the temporary exclusions and Yarn completed installation. The resulting output was correct, but it no longer matched snapshots captured under the earlier registry state. Simply accepting the new snapshots would leave the fixtures dependent on package publication time. A future dependency upgrade could make them fail again while the new package is inside the age window. These fixtures should only test whether `vp create` detects, reports, and approves blocked build scripts. Disabling age gates in the three fixture environments makes that behavior deterministic without changing Vite+ or package-manager defaults for users. The regenerated snapshots now cover pnpm `allowBuilds`, Yarn `dependenciesMeta.built`, and the guidance shown when a build remains unapproved. ## Validation - `pnpm build` - `UPDATE_SNAPSHOTS=1 just snapshot-test create_approve_builds` - `just snapshot-test create_approve_builds`

@wan9chi

…2217) Release vite-plus v0.2.6: Stable type-aware linting and a refreshed toolchain. This release moves Vite+'s type-aware linting to the [stable tsgolint 7 engine](https://oxc.rs/blog/2026-07-22-type-aware-linting-stable), refreshes the bundled build and formatting tools, strengthens `vp run` caching and workspace discovery, and removes the redundant `vp build` startup banner. ### Highlights - Move bundled type-aware linting to stable tsgolint 7 with 59 of 61 typescript-eslint type-aware rules, and update Vite `8.1.4` -> `8.1.5`, Rolldown `1.1.5` -> `1.2.0`, tsdown `0.22.7` -> `0.22.13`, Oxlint `1.73.0` -> `1.75.0`, oxlint-tsgolint `0.24.0` -> `7.0.2001`, and Oxfmt `0.58.0` -> `0.60.0` ([#2214](#2214)), by @voidzero-guard[bot] - Improve `vp run` reliability by caching much larger automatically tracked input sets, discovering npm workspaces whose patterns start with `./`, and reporting output-forwarding failures accurately ([vite-task#554](voidzero-dev/vite-task#554), [vite-task#547](voidzero-dev/vite-task#547), [vite-task#552](voidzero-dev/vite-task#552), [#2215](#2215)), by @wan9chi and @liangmiQwQ - Remove the redundant Vite startup banner from `vp build` output and fail fast when upstream Vite changes invalidate Vite+ branding patches ([#2200](#2200), [#2205](#2205)), by @liangmiQwQ ### Refactor - Deduplicate package-manager version gates in migration catalog handling ([#2216](#2216)), by @jong-kyung - Unify static and generated CLI help under one document model and renderer ([#2211](#2211)), by @jong-kyung - Reuse shared subprocess exit-status handling across global CLI command paths ([#2196](#2196)), by @jong-kyung ### Docs - Fix broken documentation anchors and add Migration Rules to the Migrate sidebar ([#2203](#2203)), by @charpeni ### Chore - Stabilize `vp create` build-approval snapshots by removing package-age timing from those fixtures ([#2224](#2224)), by @wan9chi - Remove the temporary release workflow dispatch used for the previous release ([#2193](#2193)), by @wan9chi - Share package-manager fixtures across CLI tests ([#2197](#2197)), by @jong-kyung - Remove stale raw Oxlint and Oxfmt development dependencies that bypassed repository editor configuration ([#2187](#2187)), by @liangmiQwQ ### Bundled Versions | Tool | Version | Source | | --------------- | ------- | ----------------------------------------------------------------------- | | vite | `8.1.5` | [`5e7fe12`](vitejs/vite@5e7fe12) | | rolldown | `1.2.0` | [`03e1e34`](rolldown/rolldown@03e1e34) | | tsdown | `0.22.13` | [npm](https://npmx.dev/package/tsdown/v/0.22.13) | | vitest | `4.1.10` | [npm](https://npmx.dev/package/vitest/v/4.1.10) | | oxlint | `1.75.0` | [npm](https://npmx.dev/package/oxlint/v/1.75.0) | | oxlint-tsgolint | `7.0.2001` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2001) | | oxfmt | `0.60.0` | [npm](https://npmx.dev/package/oxfmt/v/0.60.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors Welcome @charpeni. **Full Changelog**: v0.2.5...v0.2.6 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: wan9chi <dk4rest@gmail.com>

fix(ci): disable pnpm age gate for dify e2e

aae02a0

wan9chi approved these changes Jul 22, 2026

View reviewed changes

wan9chi merged commit bb540c3 into main Jul 22, 2026
143 of 144 checks passed

wan9chi deleted the deps/upstream-update branch July 22, 2026 08:45

This was referenced Jul 22, 2026

release: v0.2.6: Stable type-aware linting and more reliable task caching #2217

Merged

test(create): disable age gates in approve-build fixtures #2224

Merged

BrewTestBot mentioned this pull request Jul 23, 2026

vite-plus 0.2.6 Homebrew/homebrew-core#294771

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(deps): upgrade upstream dependencies#2214

feat(deps): upgrade upstream dependencies#2214
wan9chi merged 2 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Jul 22, 2026

Uh oh!

netlify Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

voidzero-guard Bot commented Jul 22, 2026

Summary

Dependency updates

Code changes

Build status

Uh oh!

netlify Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

socket-security Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Native binary sizes (aae02a0)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

netlify Bot commented Jul 22, 2026 •

edited

Loading

socket-security Bot commented Jul 22, 2026 •

edited

Loading

socket-security Bot commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading

Native binary sizes (`aae02a0`)