Repository navigation
fix(pm): require a dist-tag version to be valid semver - #3395
Merged
Merged
Conversation
A dist-tag lookup (`latest`, `latest-N`, ...) resolves to a version string the registry returns. The installer requires that value to be strict semver, but the fresh dist-tag fetch returned it unchecked. Validate the reply in `fetch_dist_tag_version` -- the single function every dist-tag consumer passes through -- and reject anything that is not strict semver, parsing the raw value with the same `Version::parse` the installer uses so a value that is semver only after trimming is rejected and no surrounding whitespace survives. Co-Authored-By: arkmarta <arkadiuszmarta@proton.me> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://fix-dist-tag-semver-validation-viteplus-dev.voidzero-docs.workers.dev (commit 2986b38)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
Contributor
CLI artifact sizes (
|
| Artifact | Format | Base | PR | Change |
|---|---|---|---|---|
packages/cli/dist |
Directory total | 2.33 MiB | 2.33 MiB | 0 B (0.00%) |
packages/core/dist |
Directory total | 4.08 MiB | 4.08 MiB | 0 B (0.00%) |
| Combined package dist | Directory total | 6.41 MiB | 6.41 MiB | 0 B (0.00%) |
vp (Linux x64) |
Binary | 8.31 MiB | 8.31 MiB | 0 B (0.00%) |
vp (Linux x64) |
gzip -9 | 3.80 MiB | 3.80 MiB | +130 B (+0.00%) |
| NAPI (Linux x64) | Binary | 36.20 MiB | 36.20 MiB | +4.00 KiB (+0.01%) |
| NAPI (Linux x64) | gzip -9 | 14.44 MiB | 14.44 MiB | -6 B (-0.00%) |
vp (macOS ARM64) |
Binary | 5.42 MiB | 5.42 MiB | 0 B (0.00%) |
vp (macOS ARM64) |
gzip -9 | 3.23 MiB | 3.23 MiB | +467 B (+0.01%) |
| NAPI (macOS ARM64) | Binary | 43.01 MiB | 43.01 MiB | 0 B (0.00%) |
| NAPI (macOS ARM64) | gzip -9 | 18.64 MiB | 18.64 MiB | +468 B (+0.00%) |
vp (Windows x64) |
Binary | 6.16 MiB | 6.16 MiB | +512 B (+0.01%) |
vp (Windows x64) |
gzip -9 | 2.85 MiB | 2.85 MiB | +230 B (+0.01%) |
| NAPI (Windows x64) | Binary | 32.33 MiB | 32.33 MiB | 0 B (0.00%) |
| NAPI (Windows x64) | gzip -9 | 13.23 MiB | 13.23 MiB | +513 B (+0.00%) |
| Trampoline (Windows x64) | Binary | 13.50 KiB | 13.50 KiB | 0 B (0.00%) |
| Trampoline (Windows x64) | gzip -9 | 7.09 KiB | 7.09 KiB | 0 B (0.00%) |
| Installer (Windows x64) | Binary | 4.66 MiB | 4.66 MiB | 0 B (0.00%) |
| Installer (Windows x64) | gzip -9 | 2.23 MiB | 2.23 MiB | +35 B (+0.00%) |
fengmk2
added
test: e2e
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
wan9chi
approved these changes
Nov 9, 2026
Merged
fengmk2
added a commit
that referenced
this pull request
Nov 9, 2026
Vite+ 1.5.1 checks managed package-manager downloads against the integrity hash in `packageManager`, restores interactive input in `vp run` tasks, fixes `vp migrate` config merges, and adds a reference page for each package command. ### Features - Vite+ checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's `packageManager` field instead of the hash that the registry reports, and rejects a download that does not match. Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location ([#3400](#3400)), by @fengmk2 and @arkmarta. - Upgrade the bundled Vite and Rolldown ([#3390](#3390)), by @voidzero-guard[bot] and @fengmk2: - `vite@8.3.5` to `vite@8.3.7`. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore `node_modules/.modules.yaml`. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (`#`) in the dependency optimizer, SSR builds with `build.ssr: true`, and chunks shared with workers. - `rolldown@1.2.16` to `rolldown@1.2.18`, with module source maps that keep only the sources and names that they trace. - `@voidzero-dev/vite-plus-core` requires `postcss@^8.5.32`, as the bundled Vite does. ### Fixes & Enhancements - Scripts that `vp run` starts get a blocking stdin again when the `run` block of `vite.config.ts` is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as `vp update --interactive` wait for input instead of failing with `EAGAIN` ([#3361](#3361)), by @everton-dgn. - `vp migrate` changes only the `return` statements of a `defineConfig` callback, so functions inside the config, such as Rolldown `codeSplitting.groups[].name` callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, `as`, `satisfies`, `<T>`, or `!` ([#3325](#3325), [#3372](#3372)), by @jong-kyung. - `vp create react-router` passes `--no-git-init` to `create-react-router`, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured ([#3363](#3363)), by @chbaefront. - `env.fish` calls fish built-ins through `builtin`, so `vp env use` changes the Node.js version even when a user function has the name of a built-in such as `count` ([#3353](#3353)), by @naokihaba. - Shell completion suggests full command names before aliases, so `vp i<Tab>` offers `install` and `vp up<Tab>` offers `update`. An alias stays available when no full name matches ([#3337](#3337)), by @nekomoyi. - Completion for `vp run` and `vpr` skips comment keys such as `"# docs #"` in `package.json` scripts, matches task names that contain `:`, and shows each task's command as its description in Zsh and Fish ([#3354](#3354)), by @nekomoyi. - `vp pm dist-tag rm` works with Yarn Berry, because Vite+ passes `remove` to `yarn npm tag` ([#3358](#3358)), by @jong-kyung. - A package-manager version that resolves through a dist-tag, such as `pnpm@latest` in `vp env use`, must be a valid semver version. Vite+ rejects any other registry reply with an error, including a version with surrounding whitespace ([#3395](#3395)), by @fengmk2 and @arkmarta. ### Docs - Add a Package Management section to the guide, with a reference page for each of the 38 package commands that lists its options, package-manager support, version requirements, and npm fallbacks. Help output for package commands and the old package management and install URLs point to the new pages ([docs](https://viteplus.dev/guide/package-management/)) ([#3105](#3105)), by @jong-kyung. - Show the README logo that matches the GitHub theme, so the logo stays visible after a theme change ([#3350](#3350)), by @fengmk2. ### Chore - Build Linux native bindings against the napi-cross glibc 2.17 sysroot with `@napi-rs/cli@3.10.12`, let the linker reject unresolved symbols, and run Linux CI on `ubuntu-latest` again. Let the dependency upgrade workflow change workflow files ([#3349](#3349), [#3384](#3384)), by @fengmk2. - Refine contributor guidance: `AGENTS.md` separates the `vite-plus` package from the global `vp` CLI and replaces `CLAUDE.md`, and the Node.js version RFCs describe `.nvmrc` support ([#3388](#3388), [#3383](#3383)), by @liangmiQwQ and @hyunbinseo. - Resolve the docs theme aliases from `import.meta.dirname`, so the docs dev server no longer warns about `__dirname` ([#3379](#3379)), by @liangmiQwQ. - Fold the `.node-version` parse tests into one table ([#3355](#3355)), by @Brooooooklyn. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | vite | `8.3.7` | [`5def936`](vitejs/vite@5def936) | [8.3.6](https://github.com/vitejs/vite/releases/tag/v8.3.6), [8.3.7](https://github.com/vitejs/vite/releases/tag/v8.3.7) | | rolldown | `1.2.18` | [`f9a49d6`](rolldown/rolldown@f9a49d6) | [1.2.18](https://github.com/rolldown/rolldown/releases/tag/v1.2.18) | | oxc-node | `1.0.1` | [`7ff14c3`](oxc-project/oxc-node@7ff14c3) | unchanged | | tsdown | `0.23.4` | [npm](https://npmx.dev/package/tsdown/v/0.23.4) | unchanged | | vitest | `5.1.0` | [npm](https://npmx.dev/package/vitest/v/5.1.0) | unchanged | | oxlint | `1.91.0` | [npm](https://npmx.dev/package/oxlint/v/1.91.0) | unchanged | | oxlint-tsgolint | `7.0.2005` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2005) | unchanged | | oxfmt | `0.76.0` | [npm](https://npmx.dev/package/oxfmt/v/0.76.0) | unchanged | ### Upgrade ```bash vp upgrade ``` ### New Contributors @chbaefront, @everton-dgn **Full Changelog**: v1.5.0...v1.5.1 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A dist-tag lookup (
latest,latest-N, …) resolves to a version string theregistry returns. The installer requires that value to be strict semver, but the
fresh dist-tag fetch returned it unchecked, so consumers of the resolved value
received it before any validation. Validate it once, at the fetch, so every
consumer gets a strict-semver version.
Change
Validate the reply in
fetch_dist_tag_version— the single function everydist-tag consumer passes through — and reject anything that is not strict semver.
The check parses the raw value with the same
Version::parsethe installer uses,so a value that is semver only after trimming (for example
"\n1.0.0") isrejected and no surrounding whitespace survives. This covers
vp env use pnpm@latest, the--no-installpath, the equivalent paths for yarn/bun/npm, andthe session-file and diagnostic sinks.
Behavior
trailing whitespace) is rejected with a clear error.
🤖 Generated with Claude Code