feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #3416 · voidzero-dev/vite-plus

voidzero-guard · 2026-11-10T09:02:54Z

Upgrade the pnpm installer pin to 10.34.9 across setup, legacy installers, lockfile generation, and pin verification.
Upgrade oxfmt to 0.78.0, Oxlint packages to 1.93.0, oxlint-tsgolint to 7.0.2006, and Oxc parser/runtime/type packages to 0.158.0; refresh pnpm-lock.yaml.
Enable phf macros, disable doctests for vp_cli_help and vp_toolchain, and remove three dependency entries from .github/renovate.json.

Dependency updates

Package	From	To
`pnpm (installer)`	`10.34.7`	`10.34.9`
`oxfmt`	`0.76.0`	`0.78.0`
`oxlint`	`1.91.0`	`1.93.0`
`@oxlint/plugins`	`1.91.0`	`1.93.0`
`oxlint-tsgolint`	`7.0.2005`	`7.0.2006`
`@oxc-project/runtime`	`0.157.0`	`0.158.0`
`@oxc-project/types`	`0.157.0`	`0.158.0`
`oxc-parser`	`0.157.0`	`0.158.0`

Unchanged dependencies

rolldown: v1.2.18 (f9a49d6)
vite: v8.3.7 (5def936)
oxc-node: 7ff14c3
vitest: 5.1.0
@vitest/browser: 5.1.0
@vitest/browser-playwright: 5.1.0
@vitest/browser-preview: 5.1.0
@vitest/mocker: 5.1.0
@vitest/pretty-format: 5.1.0
@vitest/snapshot: 5.1.0
@vitest/spy: 5.1.0
@vitest/utils: 5.1.0
tsdown: 0.23.4
@tsdown/css: 0.23.4
@tsdown/exe: 0.23.4
lightningcss: ^1.33.0
lint-staged: 17.6.0
@oxc-node/cli: 1.0.1
@oxc-node/core: 1.0.1
VITEST_VERSION constant: 5.1.0
Node.js: 24.22.2
yuku-parser: 0.19.0
postcss: ^8.5.32
fsevents: ~2.3.3

Code changes

Cargo.toml: enable the phf macros feature.
crates/vp_cli_help/Cargo.toml and crates/vp_toolchain/Cargo.toml: disable doctests.
.github/renovate.json: remove criterion2, saphyr, and testing_macros entries.

Build status

upgrade-and-sync: failure
build-upstream: failure
kimi-fixups: success

🤖 Generated with Kimi Code

- pnpm (installer): 10.34.7 -> 10.34.9 - oxfmt: 0.76.0 -> 0.78.0 - oxlint: 1.91.0 -> 1.93.0 - @oxlint/plugins: 1.91.0 -> 1.93.0 - oxlint-tsgolint: 7.0.2005 -> 7.0.2006 - @oxc-project/runtime: 0.157.0 -> 0.158.0 - @oxc-project/types: 0.157.0 -> 0.158.0 - oxc-parser: 0.157.0 -> 0.158.0 Code changes: - Enable `phf` macros in `Cargo.toml`. - Disable doctests in `crates/vp_cli_help/Cargo.toml` and `crates/vp_toolchain/Cargo.toml`. - Remove `criterion2`, `saphyr`, and `testing_macros` from `.github/renovate.json`. Co-Authored-By: Kimi Code <noreply@anthropic.com>

voidzero-guard · 2026-11-10T09:02:56Z

✅ No upstream CLI help changes detected

Compared normalized --help output for the upstream CLIs mirrored by Vite+.

➖ Vite: no version update (8.3.7)

No version update was detected, so there is no CLI help diff.

➖ Vitest: no version update (5.1.0)

No version update was detected, so there is no CLI help diff.

✅ Oxlint: no CLI help changes (1.91.0 → 1.93.0)

The version was updated, but the normalized CLI help output has no differences.

✅ Oxfmt: no CLI help changes (0.76.0 → 0.78.0)

The version was updated, but the normalized CLI help output has no differences.

✅ tsdown: no CLI help changes (0.23.4 → 0.23.7)

The version was updated, but the normalized CLI help output has no differences.

socket-security · 2026-11-10T09:03:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@oxc-project/types@0.150.0 ⏵ 0.158.0
npm/@oxc-project/runtime@0.158.0
npm/oxfmt@0.78.0
npm/oxc-parser@0.157.0 ⏵ 0.158.0			⁺¹
npm/oxlint-tsgolint@7.0.2006
npm/knip@6.39.0 ⏵ 6.44.2			⁺²
npm/minimatch@11.0.4 ⏵ 11.0.5	⁺¹	⁺¹

View full report

cloudflare-workers-and-pages · 2026-11-10T09:04:15Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `57191d2`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://5b3439b1-viteplus-dev.voidzero-docs.workers.dev	`57191d2`	2026-11-10T12:42:25.846Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://53439f8e-viteplus-dev.voidzero-docs.workers.dev	`ca2e5a7`	2026-11-10T11:54:39.245Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://04749194-viteplus-dev.voidzero-docs.workers.dev	`b10d307`	2026-11-10T11:40:23.214Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://ecb562a5-viteplus-dev.voidzero-docs.workers.dev	`c25cd53`	2026-11-10T09:04:33.690Z	Visit the dashboard ↗

github-actions · 2026-11-10T09:04:48Z

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: d4fa2e4

github-actions · 2026-11-10T09:13:45Z

CLI artifact sizes (`57191d2`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.
The dist rows use the Linux build. The core total excludes .node files to match the release artifact.

Artifact	Format	Base	PR	Change
`packages/cli/dist`	Directory total	2.33 MiB	2.33 MiB	+3.71 KiB (+0.16%)
`packages/core/dist`	Directory total	4.09 MiB	4.09 MiB	0 B (0.00%)
Combined package dist	Directory total	6.42 MiB	6.42 MiB	+3.71 KiB (+0.06%)
`vp` (Linux x64)	Binary	8.34 MiB	8.34 MiB	0 B (0.00%)
`vp` (Linux x64)	gzip -9	3.81 MiB	3.81 MiB	-1 B (-0.00%)
NAPI (Linux x64)	Binary	36.77 MiB	36.77 MiB	0 B (0.00%)
NAPI (Linux x64)	gzip -9	14.69 MiB	14.69 MiB	0 B (0.00%)
`vp` (macOS ARM64)	Binary	5.46 MiB	5.46 MiB	0 B (0.00%)
`vp` (macOS ARM64)	gzip -9	3.25 MiB	3.25 MiB	+7 B (+0.00%)
NAPI (macOS ARM64)	Binary	43.42 MiB	43.42 MiB	0 B (0.00%)
NAPI (macOS ARM64)	gzip -9	18.86 MiB	18.86 MiB	0 B (0.00%)
`vp` (Windows x64)	Binary	6.18 MiB	6.18 MiB	0 B (0.00%)
`vp` (Windows x64)	gzip -9	2.86 MiB	2.86 MiB	-1 B (-0.00%)
NAPI (Windows x64)	Binary	32.80 MiB	32.80 MiB	0 B (0.00%)
NAPI (Windows x64)	gzip -9	13.45 MiB	13.45 MiB	-9 B (-0.00%)
Trampoline (Windows x64)	Binary	13.50 KiB	13.50 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	7.09 KiB	7.09 KiB	+1 B (+0.01%)
Installer (Windows x64)	Binary	4.68 MiB	4.68 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.24 MiB	2.24 MiB	-4 B (-0.00%)

github-actions · 2026-11-10T12:16:23Z

Preview binary sizes (`ca2e5a7`)

Compared with the latest stable release, v1.5.1. Preview build.
Each row measures one binary. Negative changes mean a smaller preview binary.

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	5.42 MiB	5.44 MiB	+16.33 KiB (+0.29%)
NAPI (macOS ARM64)	43.01 MiB	43.39 MiB	+388.30 KiB (+0.88%)
`vp` (macOS x64)	6.90 MiB	6.90 MiB	+8.23 KiB (+0.12%)
NAPI (macOS x64)	48.29 MiB	48.75 MiB	+477.55 KiB (+0.97%)
`vp` (Linux ARM64 GNU)	6.88 MiB	6.88 MiB	+4.01 KiB (+0.06%)
NAPI (Linux ARM64 GNU)	32.26 MiB	32.68 MiB	+428.67 KiB (+1.30%)
`vp` (Linux ARM64 musl)	6.95 MiB	6.96 MiB	+3.98 KiB (+0.06%)
NAPI (Linux ARM64 musl)	31.48 MiB	31.89 MiB	+416.48 KiB (+1.29%)
`vp` (Linux x64 GNU)	8.31 MiB	8.31 MiB	0 B (0.00%)
NAPI (Linux x64 GNU)	36.19 MiB	36.69 MiB	+512.67 KiB (+1.38%)
`vp` (Linux x64 musl)	8.38 MiB	8.38 MiB	+4.80 KiB (+0.06%)
NAPI (Linux x64 musl)	35.39 MiB	35.89 MiB	+506.39 KiB (+1.40%)
`vp` (Windows x64)	6.16 MiB	6.17 MiB	+10.50 KiB (+0.17%)
NAPI (Windows x64)	32.02 MiB	32.44 MiB	+436.50 KiB (+1.33%)
Trampoline (Windows x64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows x64)	4.67 MiB	4.67 MiB	+4.00 KiB (+0.08%)
`vp` (Windows ARM64)	5.40 MiB	5.40 MiB	+4.00 KiB (+0.07%)
NAPI (Windows ARM64)	28.31 MiB	28.65 MiB	+348.00 KiB (+1.20%)
Trampoline (Windows ARM64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows ARM64)	3.84 MiB	3.85 MiB	+3.00 KiB (+0.08%)

gzip -9 sizes

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	3.24 MiB	3.24 MiB	+2.79 KiB (+0.08%)
NAPI (macOS ARM64)	18.68 MiB	18.85 MiB	+173.32 KiB (+0.91%)
`vp` (macOS x64)	3.42 MiB	3.42 MiB	-649 B (-0.02%)
NAPI (macOS x64)	19.91 MiB	20.11 MiB	+206.57 KiB (+1.01%)
`vp` (Linux ARM64 GNU)	3.73 MiB	3.73 MiB	+2.94 KiB (+0.08%)
NAPI (Linux ARM64 GNU)	13.74 MiB	13.93 MiB	+195.81 KiB (+1.39%)
`vp` (Linux ARM64 musl)	3.75 MiB	3.76 MiB	+3.72 KiB (+0.10%)
NAPI (Linux ARM64 musl)	13.44 MiB	13.63 MiB	+192.13 KiB (+1.40%)
`vp` (Linux x64 GNU)	3.80 MiB	3.80 MiB	+1.81 KiB (+0.05%)
NAPI (Linux x64 GNU)	14.44 MiB	14.65 MiB	+218.42 KiB (+1.48%)
`vp` (Linux x64 musl)	3.82 MiB	3.83 MiB	+3.25 KiB (+0.08%)
NAPI (Linux x64 musl)	14.11 MiB	14.33 MiB	+218.72 KiB (+1.51%)
`vp` (Windows x64)	2.85 MiB	2.85 MiB	+2.89 KiB (+0.10%)
NAPI (Windows x64)	13.11 MiB	13.30 MiB	+196.40 KiB (+1.46%)
Trampoline (Windows x64)	7.14 KiB	7.14 KiB	+1 B (+0.01%)
Installer (Windows x64)	2.24 MiB	2.24 MiB	+1.06 KiB (+0.05%)
`vp` (Windows ARM64)	2.72 MiB	2.72 MiB	+1.88 KiB (+0.07%)
NAPI (Windows ARM64)	12.45 MiB	12.62 MiB	+178.28 KiB (+1.40%)
Trampoline (Windows ARM64)	6.92 KiB	6.93 KiB	+3 B (+0.04%)
Installer (Windows ARM64)	2.13 MiB	2.13 MiB	+1.69 KiB (+0.08%)

Raw sizes are uncompressed file sizes. gzip sizes recompress each binary at level 9; they are not package or download archive sizes.
The baseline uses published release files, including NAPI packages from npm at the same version. Build versions and toolchains can affect the difference.

github-actions · 2026-11-10T12:18:54Z

Registry bridge build (`ca2e5a7`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f`
`create-vite-plus`	`0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install.sh | VP_PR_VERSION=3416 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install-legacy.sh bash

# Windows (PowerShell)
$env:VP_PR_VERSION="3416"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/ca2e5a7bac9b1250f003607e30d8af65bffd377f/packages/cli/install.ps1 | iex

Or install with Homebrew (macOS / glibc Linux):

These commands use the formula and binary from this published commit. Replace brew install with brew reinstall if the tap package is already installed.
If Homebrew Core’s vite-plus is installed, run brew uninstall vite-plus first. This keeps your user data; do not run vp implode to switch installations.

(
  set -eu
  export HOMEBREW_NO_AUTO_UPDATE=1
  export HOMEBREW_VP_PR_VERSION=ca2e5a7bac9b1250f003607e30d8af65bffd377f
  brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
  preview_tap="$(brew --repository voidzero-dev/vite-plus)"
  git -C "$preview_tap" fetch --depth=1 https://github.com/voidzero-dev/vite-plus.git "$HOMEBREW_VP_PR_VERSION"
  git -C "$preview_tap" switch --detach "$HOMEBREW_VP_PR_VERSION"
  brew install voidzero-dev/vite-plus/vp
  brew test voidzero-dev/vite-plus/vp
  "$(brew --prefix)/bin/vp"
)

The tap stays at the tested commit. Return it to main after testing:

git -C "$(brew --repository voidzero-dev/vite-plus)" switch main

Or download the standalone Windows installer built from this commit:

Architecture	Installer
x64	`vp-setup-x86_64-pc-windows-msvc.exe`
Arm64	`vp-setup-aarch64-pc-windows-msvc.exe`

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or create a new project from this commit without installing the CLI:

export npm_config_registry=https://registry-bridge.viteplus.dev/ pnpm_config_registry=https://registry-bridge.viteplus.dev/
pnpm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f # or: npm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f

$env:npm_config_registry="https://registry-bridge.viteplus.dev/"; $env:pnpm_config_registry="https://registry-bridge.viteplus.dev/"
pnpm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f # or: npm create vite-plus@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f

pnpm 11+ reads pnpm_config_registry, npm and older pnpm read npm_config_registry. The new project pins this build, so keep the registry set for later installs, or configure it as below.

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.ca2e5a7bac9b1250f003607e30d8af65bffd377f"
  }
}

github-actions · 2026-11-10T12:19:53Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-3416`	219MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-3416 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-3416

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-3416 vp --version

See docs/guide/docker.md for usage.

Merge branch 'main' into deps/upstream-update

b10d307

fengmk2 self-assigned this Nov 10, 2026

fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests test: sfw preview-build Publish this PR's commits to the registry bridge as preview builds labels Nov 10, 2026

Merge branch 'main' into deps/upstream-update

ca2e5a7

fengmk2 added preview-build Publish this PR's commits to the registry bridge as preview builds and removed preview-build Publish this PR's commits to the registry bridge as preview builds labels Nov 10, 2026

Merge branch 'main' into deps/upstream-update

57191d2

fengmk2 mentioned this pull request Nov 10, 2026

chore(deps): automate pnpm installer pins and fix validation #3407

Merged

Merge main into deps/upstream-update

d4fa2e4

Navigation Menu

Repository navigation

feat(deps): upgrade upstream dependencies - #3416

feat(deps): upgrade upstream dependencies#3416
voidzero-guard[bot] wants to merge 5 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Nov 10, 2026

Uh oh!

voidzero-guard Bot commented Nov 10, 2026

Uh oh!

socket-security Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

voidzero-guard Bot commented Nov 10, 2026

Dependency updates

Code changes

Build status

Uh oh!

voidzero-guard Bot commented Nov 10, 2026

✅ No upstream CLI help changes detected

Uh oh!

socket-security Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit 57191d2)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Uh oh!

github-actions Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI artifact sizes (57191d2)

Uh oh!

github-actions Bot commented Nov 10, 2026

Preview binary sizes (ca2e5a7)

Uh oh!

github-actions Bot commented Nov 10, 2026

Registry bridge build (ca2e5a7)

Uh oh!

github-actions Bot commented Nov 10, 2026

🐳 Docker preview image

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security Bot commented Nov 10, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Nov 10, 2026 •

edited

Loading

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `57191d2`)

github-actions Bot commented Nov 10, 2026 •

edited

Loading

github-actions Bot commented Nov 10, 2026 •

edited

Loading

CLI artifact sizes (`57191d2`)

Preview binary sizes (`ca2e5a7`)

Registry bridge build (`ca2e5a7`)