[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	1.5.0 → 1.5.1
vite-plus (source)	1.5.0 → 1.5.1

---

Release Notes

voidzero-dev/vite-plus (vite)

v1.5.1: vite-plus v1.5.1

Compare Source

Vite+ 1.5.1 fixes two high-severity security issues in package-manager downloads and vp env use, restores interactive input in vp run tasks, fixes vp migrate config merges, and adds a reference page for each package command.

Features

• Upgrade the bundled Vite and Rolldown (#​3390), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.5 to vite@8.3.7. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore node_modules/.modules.yaml. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (#) in the dependency optimizer, SSR builds with build.ssr: true, and chunks shared with workers.
  • rolldown@1.2.16 to rolldown@1.2.18, with module source maps that keep only the sources and names that they trace.
  • @voidzero-dev/vite-plus-core requires postcss@^8.5.32, as the bundled Vite does.

Fixes & Enhancements

• Security: Vite+ verifies the pnpm that it downloads for its own setup against a hash in the CLI, and checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's packageManager field instead of the hash that the registry reports. A registry set in a project's .npmrc can no longer make Vite+ run a package manager that does not match (GHSA-5qr3-w62x-jmwx, high). Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location (#​3400), by @​fengmk2 and @​arkmarta.
• Security: vp env use and other dist-tag lookups, such as pnpm@latest, accept only a valid semver version from the registry, so a registry set in a project's .npmrc can no longer put shell commands into the statements that the vp env use shell wrapper runs (GHSA-p79r-mf8q-r78h, high) (#​3395), by @​fengmk2 and @​arkmarta.
• Scripts that vp run starts get a blocking stdin again when the run block of vite.config.ts is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as vp update --interactive wait for input instead of failing with EAGAIN (#​3361), by @​everton-dgn.
• vp migrate changes only the return statements of a defineConfig callback, so functions inside the config, such as Rolldown codeSplitting.groups[].name callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, as, satisfies, <T>, or ! (#​3325, #​3372), by @​jong-kyung.
• vp create react-router passes --no-git-init to create-react-router, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured (#​3363), by @​chbaefront.
• env.fish calls fish built-ins through builtin, so vp env use changes the Node.js version even when a user function has the name of a built-in such as count (#​3353), by @​naokihaba.
• Shell completion suggests full command names before aliases, so vp i<Tab> offers install and vp up<Tab> offers update. An alias stays available when no full name matches (#​3337), by @​nekomoyi.
• Completion for vp run and vpr skips comment keys such as "# docs #" in package.json scripts, matches task names that contain :, and shows each task's command as its description in Zsh and Fish (#​3354), by @​nekomoyi.
• vp pm dist-tag rm works with Yarn Berry, because Vite+ passes remove to yarn npm tag (#​3358), by @​jong-kyung.

Docs

• Add a Package Management section to the guide, with a reference page for each of the 38 package commands that lists its options, package-manager support, version requirements, and npm fallbacks. Help output for package commands and the old package management and install URLs point to the new pages (docs) (#​3105), by @​jong-kyung.
• Show the README logo that matches the GitHub theme, so the logo stays visible after a theme change (#​3350), by @​fengmk2.

Chore

• Build Linux native bindings against the napi-cross glibc 2.17 sysroot with @napi-rs/cli@3.10.12, let the linker reject unresolved symbols, and run Linux CI on ubuntu-latest again. Let the dependency upgrade workflow change workflow files (#​3349, #​3384), by @​fengmk2.
• Refine contributor guidance: AGENTS.md separates the vite-plus package from the global vp CLI and replaces CLAUDE.md, and the Node.js version RFCs describe .nvmrc support (#​3388, #​3383), by @​liangmiQwQ and @​hyunbinseo.
• Resolve the docs theme aliases from import.meta.dirname, so the docs dev server no longer warns about __dirname (#​3379), by @​liangmiQwQ.
• Fold the .node-version parse tests into one table (#​3355), by @​Brooooooklyn.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.7	5def936	8.3.6, 8.3.7
rolldown	1.2.18	f9a49d6	1.2.18
oxc-node	1.0.1	7ff14c3	unchanged
tsdown	0.23.4	npm	unchanged
vitest	5.1.0	npm	unchanged
oxlint	1.91.0	npm	unchanged
oxlint-tsgolint	7.0.2005	npm	unchanged
oxfmt	0.76.0	npm	unchanged

Upgrade

vp upgrade

New Contributors

@​chbaefront, @​everton-dgn

Full Changelog: voidzero-dev/vite-plus@v1.5.0...v1.5.1

Published Packages

• @voidzero-dev/vite-plus-core@1.5.1
• vite-plus@1.5.1
• create-vite-plus@1.5.1

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Homebrew (macOS/Linux):

brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp

See the Homebrew guide to switch from the script installer or the Homebrew Core vite-plus formula.

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.5.1 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite-plus@​1.5.0 ⏵ 1.5.1	+1			+2

View full report

[github-actions]

Remote cache staging

Commit: fb7e32bdac5c0052d563c03ca4183730258868db

The source checks did not pass. No verified Cloudflare staging deployment is ready. See the workflow run.

Manual checks and complete e2e plan.