feat(deps): upgrade upstream dependencies (preserved from #1581) by fengmk2 · Pull Request #1589 · voidzero-dev/vite-plus

fengmk2 · 2026-05-15T13:09:00Z

Preserves the work from #1581 on a stable branch (deps/upstream-update-1581) so the daily upgrade-deps.yml workflow doesn't blow it away tomorrow when it recreates deps/upstream-update from a fresh upstream snapshot.

This PR is identical in tree to #1581 at its latest commit (847f7862). The bot-authored upgrade commit is preserved, and the hand-authored fixes layered on top stay attached:

#	commit	purpose
1	`feat(deps): upgrade upstream dependencies`	the original bot commit
2	`fix(clippy): satisfy new lints from nightly-2026-03-15`	unblocks `cargo clippy --all-targets --all-features -- -D warnings` against oxc 0.130
3	`fix(test/build): clean dist before bundling vitest`	clears stale hashed chunks (e.g. `cac.<old>.js`) before `brandVitest` runs, so `pnpm bootstrap-cli` is idempotent across vitest upgrades
4	`~~fix(ci): work around rolldown@1.0.1 binding tokio panic~~`	superseded — see revert below
5	`refactor(deps): simplify pluginutils handling after rolldown move`	matches #1569's lighter-weight approach: single-string `.mjs` exports, drop the dead `pnpm --filter @rolldown/pluginutils build` step from `action.yml` + `justfile`, no `.mjs` wrapping branch in `transformPluginutilsExport`
6	`refactor(build): consolidate build chain into pnpm build script`	`pnpm build` now drives the full chain (rolldown binding + node + vite types + `@voidzero-dev/` + vite-plus); `just build` just calls `pnpm build`. Fixes the earlier `vp check` failure on fresh checkouts caused by missing `vite/dist/node/.d.ts`.
7	`docs(rust-toolchain): explain why the pinned nightly date matters`	comment explaining the oxc_transformer `if_let_guard` constraint (later softened into "track vite-task")
8	`Revert "fix(ci): work around rolldown@1.0.1 binding tokio panic"`	per review feedback in #1581 — workaround was hiding the real bug, see investigation below
9	`chore(rust): sync nightly with vite-task (2026-03-05)`	review request, keeps the two repos on the same nightly
10	`docs(core): sync BUNDLING.md with relocated @rolldown/pluginutils`	docs-only sync to match the new pluginutils source path / `.mjs` outputs

⚠️ Known issue: rolldown@1.0.1 binding panics on macOS

CI snap tests on aarch64-apple-darwin still fail; full root-cause writeup posted at #1581 (comment). Short version:

Versions are consistent end-to-end (all 1.0.1, all binding sha256 e932d68a…). Not a tsdown/rolldown mismatch.
Reproducer in /tmp: only the combination "our bundled tsdown → bundled rolldown → 1.0.1 binding" SIGSEGVs with [internal exception] blocking task ran twice; unbundled tsdown with the same binding works fine.
Rebuilding the binding with mimalloc-v3 disabled fixes it.
Linux x86_64 escapes via local_dynamic_tls (-ftls-model=local-dynamic); Windows escapes because the Windows cc::Build path in libmimalloc-sys2 never selects the mimalloc3 source tree at all. Only macOS gets the full v3 hot path on the unmitigated TLS model.
No upstream fix yet (no rolldown PR or open issue tracking the SIGSEGV specifically). Recommended path: either hold this PR until rolldown 1.0.2 ships with the mimalloc-v3 issue resolved, or patch rolldown/crates/rolldown_binding/Cargo.toml in CI to drop v3 on macOS and rebuild the binding from source.

Why this branch exists

.github/workflows/upgrade-deps.yml closes whatever PR is open against deps/upstream-update and force-recreates the branch every night. Moving the work to deps/upstream-update-1581 insulates these manual fixes from that lifecycle.

Original bot-authored PR description (from #1581)

Summary

Automated daily upgrade of upstream dependencies.
Bumps rolldown to v1.0.1 and vite to v8.0.13; bumps vitest to 4.1.6 and the oxc family (oxc Rust crate, @oxc-project/*, oxc-minify/parser/transform, oxlint, oxfmt) to their latest releases.
Adjusts the rolldown pluginutils integration to follow upstream's relocation of @rolldown/pluginutils under packages/rolldown/node_modules/@rolldown/pluginutils and to its new .mjs / .d.mts exports.
Pins mimalloc-safe to =0.1.58 and bumps the nightly Rust toolchain to nightly-2026-03-15.

Dependency updates

Package	From	To
`rolldown`	`ac5c710`	`v1.0.1 (2777945)`
`vite`	`66f3194`	`v8.0.13 (a46f11a)`
`vitest`	`4.1.5`	`4.1.6`
`oxfmt`	`0.48.0`	`0.49.0`
`oxlint`	`1.63.0`	`1.64.0`
`oxc` (Rust)	`0.128.0`	`0.130.0`
`@oxc-project/runtime`	`0.129.0`	`0.130.0`
`@oxc-project/types`	`0.129.0`	`0.130.0`
`oxc-minify`	`0.129.0`	`0.130.0`
`oxc-parser`	`0.129.0`	`0.130.0`
`oxc-transform`	`0.129.0`	`0.130.0`
`@vitejs/devtools`	`0.1.21`	`0.1.23`

Unchanged dependencies

tsdown: 0.22.0
@oxc-node/cli: 0.1.0
@oxc-node/core: 0.1.0
oxlint-tsgolint: 0.22.1

Code changes

packages/core/build.ts: update the rolldown pluginutils source path to the new nested packages/rolldown/node_modules/@rolldown/pluginutils location.
packages/tools/src/sync-remote-deps.ts: handle .mjs / .d.mts exports in transformPluginutilsExport, and look up pluginutils/package.json under the new nested path.
packages/core/package.json: switch ./rolldown/pluginutils and ./rolldown/pluginutils/filter exports to .mjs / .d.mts; bump @vitejs/devtools to ^0.1.23 and bundled vite / rolldown versions.
pnpm-workspace.yaml: add @rolldown/pluginutils: ^1.0.0 to the catalog and remove the workspace override for it; bump rolldown-plugin-dts to ^0.25.0, valibot to 1.4.0, vitepress-plugin-graphviz to ^0.1.0; update the vitest-dev override to npm:vitest@^4.1.6.
Cargo.toml: bump the oxc family of crates to 0.130.0; pin mimalloc-safe = "=0.1.58".
rust-toolchain.toml: bump nightly channel to nightly-2026-03-15.
packages/cli/snap-tests-global/command-staged-broken-config/snap.txt: refresh snapshot for the new oxc parser error formatting.
packages/tools/.upstream-versions.json, Cargo.lock, pnpm-lock.yaml: regenerated to match the new versions.

Build status

sync-remote-and-build: failure
build-upstream: failure

netlify · 2026-05-15T13:09:06Z

✅ Deploy Preview for viteplus-preview ready!

Name	Link
🔨 Latest commit	`c3d7618`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a07fe703346c00008885e38
😎 Deploy Preview	https://deploy-preview-1589--viteplus-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

socket-security · 2026-05-15T13:10:12Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@oxc-project/runtime@0.130.0
	npm/@vitejs/devtools@0.1.23
	npm/@vitest/ui@4.1.5 ⏵ 4.1.6				⁺¹
	npm/@vitest/coverage-v8@4.1.5 ⏵ 4.1.6
	npm/@types/node@24.12.4
	npm/@vitest/coverage-istanbul@4.1.5 ⏵ 4.1.6				⁺¹
	npm/@vitest/browser-preview@4.1.5 ⏵ 4.1.6
	npm/@vitest/browser-webdriverio@4.1.5 ⏵ 4.1.6
	npm/oxfmt@0.49.0
	npm/unrun@0.3.0
	npm/oxlint@1.64.0
	npm/terser@5.47.1
	cargo/oxc_allocator@0.128.0 ⏵ 0.130.0
	cargo/oxc_ast@0.128.0 ⏵ 0.130.0
	cargo/oxc_parser@0.128.0 ⏵ 0.130.0
	cargo/oxc_span@0.128.0 ⏵ 0.130.0
	npm/eslint-plugin-n@18.0.1
	npm/oxc-parser@0.130.0
	npm/oxc-transform@0.130.0

View full report

- rolldown: ac5c710 -> v1.0.1 (2777945) - vite: 66f3194 -> v8.0.13 (a46f11a) - vitest: 4.1.5 -> 4.1.6 - oxfmt: 0.48.0 -> 0.49.0 - oxlint: 1.63.0 -> 1.64.0 - oxc (Rust): 0.128.0 -> 0.130.0 - @oxc-project/runtime: 0.129.0 -> 0.130.0 - @oxc-project/types: 0.129.0 -> 0.130.0 - oxc-minify: 0.129.0 -> 0.130.0 - oxc-parser: 0.129.0 -> 0.130.0 - oxc-transform: 0.129.0 -> 0.130.0 - @vitejs/devtools: 0.1.21 -> 0.1.23 Code changes: - packages/core/build.ts: update rolldown pluginutils source path to read from `packages/rolldown/node_modules/@rolldown/pluginutils`. - packages/tools/src/sync-remote-deps.ts: support `.mjs` / `.d.mts` exports when transforming pluginutils, and update the pluginutils package.json lookup path to match the new nested location. - packages/core/package.json: switch `./rolldown/pluginutils` and `./rolldown/pluginutils/filter` exports to `.mjs` / `.d.mts`; bump bundled `vite`/`rolldown` versions. - pnpm-workspace.yaml: add `@rolldown/pluginutils` catalog entry and drop its workspace override; bump `rolldown-plugin-dts` (^0.23 -> ^0.25), `valibot` (1.3.1 -> 1.4.0), `vitepress-plugin-graphviz` (^0.0.1 -> ^0.1.0); update `vitest-dev` override to `^4.1.6`. - Cargo.toml: pin `mimalloc-safe = "=0.1.58"`. - rust-toolchain.toml: bump nightly channel to `nightly-2026-03-15`. - packages/cli/snap-tests-global/command-staged-broken-config/snap.txt: refresh snapshot for the new oxc parser error formatting (`Error: Unexpected token` -> `Unexpected token`). - packages/tools/.upstream-versions.json, Cargo.lock, pnpm-lock.yaml: regenerated to match the new versions.

- collapsible_match: fold the bounds check into the KeyCode::Down match arm guard in vite_install package_manager - unnecessary_sort_by: switch descending sorts in vite_js_runtime and vite_setup to sort_by_key with std::cmp::Reverse - unnecessary_trailing_comma: drop trailing comma in a help.rs test assertion

bundleVitest copied vitest's distribution into packages/test/dist without cleaning the directory first. When the upstream vitest version changed, the new build emitted hashed chunks with new names (e.g. cac.<new-hash>.js) but stale chunks from the previous version lingered. The later brandVitest step iterates every cac.*.js chunk looking for cac("vitest") and threw when it hit a stale chunk whose pattern was absent or already rewritten, breaking pnpm bootstrap-cli. Clear dist/ at the start of bundleVitest so each build starts from a known-empty tree.

The npm-published rolldown@1.0.1 binding enables the mimalloc v3 feature (`crates/rolldown_binding/Cargo.toml` rolldown#9349), which panics with `[internal exception] blocking task ran twice` in tokio when tsdown drives rolldown through vp pack on darwin-arm64. The result is that vp pack exits silently after "Build start", which breaks every CLI snap test that bundles via vp pack (command-pack, command-pack-exe, command-pack-external, command-pack-monorepo, vp-cache-monorepo-missing, vp-pack-cache-disabled). Force the binding download to use rolldown@1.0.0 while keeping the 1.0.1 JS sources (and the pluginutils relocation that depends on them). The 1.0.0 binding is ABI-compatible with the surface vite-plus exercises through tsdown/rolldown. Revert once an upstream rolldown release ships without mimalloc v3 or fixes the panic. The command-staged-broken-config snap.txt also rolls back to its pre-PR form because the diagnostic prefix comes from the binding's bundled oxc — `Error: Unexpected token` (1.0.0/oxc 0.128) vs. `Unexpected token` (1.0.1/oxc 0.130).

Match the lighter-weight handling from #1569: - packages/core/package.json: collapse the two pluginutils exports back to single .mjs strings. TypeScript already resolves a sibling .d.mts for an .mjs path under moduleResolution: bundler / node16, so the explicit `types` entries were redundant. - packages/tools/src/sync-remote-deps.ts: drop the parallel .mjs branch in transformPluginutilsExport — once we stop wrapping string exports into objects, the matching `types` derivation isn't needed either. - .github/actions/build-upstream/action.yml, justfile: drop the `pnpm --filter @rolldown/pluginutils build` step. Since rolldown moved pluginutils out of its workspace into a standalone npm package (rolldown/plugins), no workspace package matches that filter — the step was a silent no-op (`No projects matched the filters`).

The justfile's build recipe and the root package.json's build script had drifted: the justfile knew it needed to build rolldown's native binding, rolldown's JS, and vite's types before the @voidzero-dev/* chain, while package.json's build only ran the @voidzero-dev/* + vite-plus step. That meant pnpm bootstrap-cli (which calls pnpm build) silently produced an incomplete tree on fresh checkouts — packages/ core/dist/vite/node/index.d.ts wouldn't exist, and vp check then failed with TS7016 on every @voidzero-dev/vite-plus-core import. Move the upstream prerequisites into the pnpm build script and have the justfile recipe just call pnpm build, so the build sequence has a single source of truth. CI is unaffected: bootstrap-cli:ci runs only pnpm install-global-cli, and the per-target build-upstream action keeps its own chain (it skips build-binding:release because the binding is pulled from npm, and runs build-ts instead of build because NAPI bindings are built and cached as a separate step).

The existing comment justifies using nightly at all (Z-bindeps and windows_process_extensions_main_thread_handle), but a future `feat(deps): upgrade upstream dependencies` PR bumps the date and nobody remembers why. Add a note that the date itself is gated by oxc_transformer >=0.130 using `if let` guards, which only stabilized in rustc 1.94 (2026-01-29) — earlier nightlies fail with E0658.

This reverts commit 60ae3de.

The reviewer asked us to share a single nightly with voidzero-dev/ vite-task, whose rust-toolchain.toml is currently pinned to nightly-2026-03-05. Match that and replace the date-rationale comment with a directive that future bumps track the vite-task pin. The earlier rationale (oxc_transformer >=0.130 needs `if_let_guard`, stabilized in rustc 1.94 / 2026-01-29) is still satisfied — any nightly past late January 2026 works.

Rolldown 1.0.1 moved @rolldown/pluginutils out of its monorepo into a standalone npm package (rolldown/plugins). In our checkout it shows up hoisted under `rolldown/packages/rolldown/node_modules/@rolldown/ pluginutils`, with `.mjs` / `.d.mts` outputs. Update BUNDLING.md to match what the build actually does now: - source location (top-of-doc table + "Source Directories" table + rolldownPluginUtilsDir code constant) - bundleRolldownPluginutils input path - emitted output structure (.js/.d.ts -> .mjs/.d.mts) - exports table extensions No code change — same content as packages/core/build.ts and packages/core/package.json already reference.

fengmk2 mentioned this pull request May 15, 2026

feat(deps): upgrade upstream dependencies #1581

Closed

fengmk2 marked this pull request as draft May 15, 2026 13:09

shulaoda force-pushed the deps/upstream-update-1581 branch from da20b9a to 283d412 Compare May 15, 2026 16:26

voidzero-guard Bot and others added 10 commits May 16, 2026 00:36

Revert "fix(ci): work around rolldown@1.0.1 binding tokio panic"

da45685

This reverts commit 60ae3de.

shulaoda force-pushed the deps/upstream-update-1581 branch 7 times, most recently from 3adf29f to 34ef519 Compare May 15, 2026 22:23

u

63e00a5

shulaoda force-pushed the deps/upstream-update-1581 branch from 34ef519 to 63e00a5 Compare May 15, 2026 22:59

u

faab99f

shulaoda force-pushed the deps/upstream-update-1581 branch 2 times, most recently from 986cc92 to a26da8f Compare May 16, 2026 00:47

u

03a4c1b

shulaoda force-pushed the deps/upstream-update-1581 branch from a26da8f to 03a4c1b Compare May 16, 2026 01:06

u

c3d7618

shulaoda force-pushed the deps/upstream-update-1581 branch from 22329de to c3d7618 Compare May 16, 2026 05:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(deps): upgrade upstream dependencies (preserved from #1581)#1589

feat(deps): upgrade upstream dependencies (preserved from #1581)#1589
fengmk2 wants to merge 14 commits into
mainfrom
deps/upstream-update-1581

fengmk2 commented May 15, 2026

Uh oh!

netlify Bot commented May 15, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

fengmk2 commented May 15, 2026

⚠️ Known issue: rolldown@1.0.1 binding panics on macOS

Why this branch exists

Summary

Dependency updates

Code changes

Build status

Uh oh!

netlify Bot commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview ready!

Uh oh!

socket-security Bot commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify Bot commented May 15, 2026 •

edited

Loading

socket-security Bot commented May 15, 2026 •

edited

Loading