vite-plus v0.2.1

Restores support for older Node.js (back to 20.19.0) and makes vp exec --fail-if-no-match fail correctly on unmatched filters.

Fixes & Enhancements

• Stop blocking older Node.js versions: v0.2.0 blocked commands when the resolved Node.js version fell outside the declared range. This reverts that enforcement and widens engines.node to ^20.19.0 || ^22.18.0 || >=24.11.0, matching Vite's own ^20.19.0 floor, so older Node that works in practice (e.g. Node 20 in rolldown CI) is no longer rejected (#1865), by @fengmk2
• vp exec --fail-if-no-match: exit non-zero when one or more --filter expressions match no workspace packages. Strict mode previously only warned and returned success, so typoed filters looked successful in CI even though no package command ran (#1859), by @jong-kyung

Bundled Versions

Tool	Version	Source
vite	8.0.16	f94df87
rolldown	1.1.1	d7f919c
tsdown	0.22.3	npm
vitest	4.1.9	npm
oxlint	1.70.0	npm
oxlint-tsgolint	0.23.0	npm
oxfmt	0.55.0	npm

Upgrade

vp upgrade

Upgrading from 0.1.x to 0.2.1 Prompt

You are upgrading a project that uses Vite+ (the `vp` CLI) from v0.1.x to v0.2.1.

v0.2.1 has one breaking change vs v0.1.x: it consumes upstream Vitest directly. The `@voidzero-dev/vite-plus-test` wrapper package is removed; `vitest` now comes in transitively through `vite-plus`.

Do not run `vp migrate` for this upgrade; it is not reliable enough yet. Make the changes yourself by editing the project's files, then verify by running the tools.

How to run vp: if a global `vp` is available, use it. Otherwise this project only ships the local CLI from the `vite-plus` package, so run vp as the project-local binary (for example via the package manager's exec: pnpm exec, npx, yarn, or bunx). After any install, re-resolve vp so you always run the version currently in the project.

Do the following:

1. Set the `vite-plus` dependency to the exact version `0.2.1` and reinstall, so the new toolchain is installed and the lockfile moves off 0.1.x. In a monorepo, do this for every workspace package that depends on `vite-plus`. Changing the spec to `0.2.1` is what moves the lockfile off the old resolution; a reinstall that leaves the spec unchanged would keep the old version.

2. Remove the `@voidzero-dev/vite-plus-test` wrapper from the project. Search everywhere it could appear: package.json, the lockfile, any workspace or catalog config (such as pnpm-workspace.yaml or .yarnrc.yml), and the source files. Then:

   - Decide whether the project itself depends on vitest. It does only if a source or test file imports directly from `vitest` or `@vitest/...`, or a `@vitest/*` package is listed in its dependencies (for example a coverage provider). Imports from `vite-plus/test` do NOT count.
   - If the project has no such vitest usage (the common case), remove the vitest configuration entirely. In package.json, delete the `vitest` entry from `dependencies` / `devDependencies` in whatever form it takes (a `@voidzero-dev/vite-plus-test` alias, a `catalog:` reference, or a plain version). Also remove the `vitest` entry from every dependency-resolution mechanism in the project: both `overrides` and `resolutions`, pnpm `overrides`/`catalog` (in package.json or pnpm-workspace.yaml), and any catalog entry. If `vitest` appears in more than one of these, remove all of them. Do not add a pinned `vitest`; it arrives transitively through `vite-plus` and the test command still works.
   - If the project does use vitest directly, pin upstream vitest to the version bundled with vite-plus (4.1.9 for v0.2.1), and upgrade every vitest ecosystem package the project depends on so the whole tree resolves to a single vitest. Set each `@vitest/*` package the project lists (for example `@vitest/coverage-v8`, `@vitest/ui`, `@vitest/browser`) to that same version (4.1.9), since those are pinned to an exact vitest version. Also update any other vitest integration package (such as `vitest-browser-*`) to a release compatible with that vitest version. Leaving an ecosystem package on an older version pulls in a second copy of vitest, which Vitest rejects at runtime.
   - Also delete any dependency-resolution config that existed only to accommodate the wrapper or the old vitest, for example pnpm `peerDependencyRules` entries (`allowedVersions` / `ignoreMissing`) referencing `vitest`, `@vitest/*`, or `@voidzero-dev/vite-plus-test`, and the equivalent peer-tweak config in other package managers (such as yarn `packageExtensions`). Leave rules that are unrelated to vitest or the wrapper untouched.

3. Keep the `vite` -> Vite+ core override (it is still required) and set it to the matching exact version: map `vite` to `npm:@voidzero-dev/vite-plus-core@0.2.1` in whatever override, resolution, or catalog form the project already uses. `@voidzero-dev/vite-plus-core` is released in lockstep with `vite-plus`.

4. Leave imports from `vite-plus/test` (and `vite-plus/test/*`) unchanged; that is the stable public API. Only if a file imports directly from `@voidzero-dev/vite-plus-test`, repoint it to `vite-plus/test`.

5. Reinstall so the lockfile reflects your edits, then verify: confirm that no reference to `@voidzero-dev/vite-plus-test` remains anywhere outside node_modules, confirm the dependency tree resolves to a single `vitest` version (no duplicate copies), run the project's tests and confirm they pass (you will see Vitest's native banner), and run the Vite+ check workflow and confirm it passes.

Constraints:
- Do not run `vp migrate`.
- Do not bypass git hooks. If a pre-existing failure blocks you, report it rather than forcing through.
- Make the smallest set of edits that reaches the end state above; do not reformat unrelated files.
- When done, give me a short summary: old vs new `vite-plus` version, the files you changed, and the test/check results.

Full Changelog: v0.2.0...v0.2.1

Published Packages

• @voidzero-dev/vite-plus-core@0.2.1
• vite-plus@0.2.1

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

vite-plus v0.2.0

Vite+ now consumes upstream Vitest directly (no wrapper), raises the minimum supported Node.js version to 22.18.0, and ships corepack and devEngines support.

Highlights

• vp test now runs upstream Vitest directly (breaking): Vite+ used to ship @voidzero-dev/vite-plus-test, a rebundled copy of Vitest that lagged upstream releases. That package is removed; vp test now runs the real upstream vitest, which is installed automatically as a dependency of vite-plus (you no longer add vitest or @vitest/* yourself, and vite still resolves to @voidzero-dev/vite-plus-core via package-manager overrides). Your import ... from 'vite-plus/test' code keeps working unchanged and vp migrate updates existing projects (#1588), by @Brooooooklyn
• Minimum supported Node.js version raised to ^22.18.0 || >=24.11.0 (breaking): Node 20 reached end-of-life and the bundled tsdown already required ^22.18.0, so the published engines range now matches what vp pack can actually deliver; vp exec / vp run / vp dlx reject projects resolving an older Node with the existing incompatibility error (#1813), by @fengmk2
• Corepack now works under Vite+: corepack now set up by default, so corepack enable and the pnpm/yarn launchers just work, even on Node 25+ which no longer ships it. (#1808), by @fengmk2
• devEngines support for runtime and package-manager selection: Vite+ reads devEngines.runtime (ranked above engines.node) and devEngines.packageManager; auto-pin and vp migrate write devEngines.packageManager, vp env pin / unpin target devEngines.runtime, and vp env doctor reports conflicts instead of silently resolving them (#1760), by @fengmk2

Features

• vp pm approve-builds: forward to npm's new approve-scripts / deny-scripts (npm >= 11.16.0) instead of the previous no-op, matching pnpm approve-builds / bun pm trust; mixed approve+deny is rejected with actionable guidance and npm's advisory-only caveat is surfaced (#1733), by @fengmk2
• vp create: support local monorepo templates declared in create.templates in vite.config.ts; vp create vite:generator scaffolds a Bingo generator and auto-registers it in the picker, replacing the old package.json-keyword inference (#1777), by @fengmk2
• vp create: detect direct dependencies whose build scripts the package manager gated (e.g. native builds like better-sqlite3) and act on them; prompt to approve each (default off) interactively, point at vp pm approve-builds non-interactively, or build them with --approve-builds (#1828), by @fengmk2
• vp config: add --no-hooks and --no-agent opt-outs to skip git-hook installation and coding-agent instruction updates (#1842), by @leno23
• vp list -g: sort the global package list output so entries appear in a stable order (#1748), by @liangmiQwQ
• Upgrade upstream dependencies: rolldown 1.0.3 -> 1.1.1, tsdown 0.22.1 -> 0.22.3, oxlint 1.67.0 -> 1.70.0, oxfmt 0.52.0 -> 0.55.0, vitest 4.1.8 -> 4.1.9, and the oxc toolchain 0.133.0 -> 0.136.0 (#1749, #1767, #1812, #1834, #1855), by @voidzero-guard[bot]

Fixes & Enhancements

• Security: resolve open Rust Dependabot advisories by bumping transitive openssl 0.10.76 -> 0.10.80 (openssl-sys 0.9.112 -> 0.9.116), fixing five high-severity rust-openssl issues (buffer overflows in key derivation, AES key wrap, and digest finalization; an unchecked PSK/cookie trampoline length leaking adjacent memory; and OCSP-responder undefined behavior: GHSA-pqf5-4pqq-29f5, GHSA-8c75-8mhr-p7r9, GHSA-ghm9-cr32-g9qj, GHSA-hppc-g8h3-xhp3, GHSA-xp3w-r5p5-63rr), and drop the unmaintained, unsound libyml (GHSA-gfxp-f68g-8x78, high) by removing dead serde_yml code (#1742), by @fengmk2
• Security (docs site): update mermaid 11.13.0 -> 11.15.0 to fix improper classDef sanitization in state diagrams that allowed HTML injection (CVE-2026-41149 / GHSA-ghcm-xqfw-q4vr, medium severity; <script> tags are stripped so it does not reach XSS) (#1745), by @renovate[bot]
• vp check --fix / vp staged: create/migrate now wrap inline Vite plugins: [...] arrays with lazyPlugins(...) so plugin factories aren't eagerly executed (and don't hang on open handles) during lint/format/check config loading (#1752), by @jong-kyung
• vp migrate: complete pending migration work for projects that already have vite-plus installed (scripts, imports, tsconfig types, ESLint/Prettier, legacy hooks, package-manager settings) instead of treating vite-plus as migration-complete; fully migrated projects stay idempotent (#1821), by @jong-kyung
• vp create / vp migrate: detect shorthand fmt, / lint, config keys so a duplicate inline block is no longer injected (#1843), by @fengmk2
• IDE oxlint/oxfmt wrappers: set VP_COMMAND so lazyPlugins() skips framework plugins during LSP config reads, preventing a stray .svelte-kit (and similar) directory at the monorepo root (#1764), by @jong-kyung
• vp lint / vp run -r lint on Windows: keep the absolute tsgolint path for workspace lint runs instead of downgrading it to a wrong cwd-relative path (#1758), by @semimikoh
• oxlint wrapper: set the tsgolint path so type-aware lint resolves it (#1811), by @jong-kyung
• vp install -g: use a unique backup directory and treat stale-backup cleanup as best-effort so a locked Windows binary no longer fails an otherwise successful reinstall (#1753), by @fengmk2
• vp install -g: remove stale managed binary shims when a reinstalled package drops a bin from its package.json#bin (#1765), by @liangmiQwQ
• vp create --git: surface git's actual stdout/stderr when the initial commit fails instead of always blaming user.name / user.email (#1819), by @fengmk2
• vp create vite:generator: reject --git / --no-git, since adding a generator to an existing monorepo does not initialize git (#1788), by @jong-kyung
• Global CLI: harden find_system_tool against a self-exec loop (skip the running executable's own bin directory) and fix two vite_global_cli tests that could hang (#1820), by @fengmk2
• CLI help: unify alias display (#1832), show supported run options (#1797), show --fail-if-no-match in exec help (#1798), add the implode documentation link (#1796), and handle nested-command typo help (#1803), by @jong-kyung

Docs

• Document vp create opt-out options (#1790), by @jong-kyung
• Document vp upgrade options (#1847), by @jong-kyung
• Align the config overview with the sidebar (#1846), by @jong-kyung
• Sync the documented command lists with the help output (#1850), by @jong-kyung
• Clarify lazy plugin side effects (#1841), by @leno23
• Add JongKyung's X profile (#1844) and update Christoph's X profile (#1845) on the team page, by @jong-kyung

Refactor

• Remove the CLI tips system; the shortcuts it printed on vp install are already covered by the help system and added unnecessary complexity (#1799), by @cpojer

Chore

• Re-enable Renovate dependency updates with a targeted ignore-list (#1744), by @fengmk2
• Keep generated NAPI bindings during upgrade-deps (#1759), by @fengmk2
• Remove the vite_glob dependency from vite-plus ([#1763](https://github.com/voidzero-dev...

vite-plus v0.1.24

A new vp pm stage publishing workflow, hardened installs and upgrades, a Node-version mismatch reinstall prompt, and the bundled vite/vitest/tsdown stack moves forward.

Features

• vp pm stage: a new vp pm subcommand exposing npm's staged-publishing workflow (upload a build to a staging area without 2FA, then approve or reject it from a trusted device); it maps to pnpm stage / npm stage / yarn npm ... --staged per package manager, with an npm fallback for yarn Classic and bun (#1715), by @fengmk2
• vp: prompt to reinstall when up-to-date global packages were built against a different Node.js than the active one (defaults to no); adds --reinstall-node-mismatch and --ignore-node-mismatch, and skips the prompt in CI (#1666), by @liangmiQwQ
• vp format: add format as a visible alias of vp fmt, so the common slip vp format resolves correctly and vp format --init / --migrate apply the same vite.config.ts wiring as vp fmt (#1727), by @semimikoh

Fixes & Enhancements

• vp install / Node runtime download: HTTP retries now wrap the whole body stream, hash verification, and archive extraction (not just the request headers), so truncated or corrupt downloads of package managers and Node are re-fetched instead of failing on the first attempt (#1719), by @fengmk2
• vp upgrade --force on Windows: install into a fresh directory before repointing current, so the forced reinstall no longer fails trying to overwrite the running vp.exe (#1714), by @fengmk2
• vp install -g: install global packages directly into their final prefix instead of a temp dir that gets moved, so packages whose postinstall scripts bake in absolute or relative temp paths still resolve their bins; a failed package in a multi-package install no longer removes the shims of the ones that already succeeded (#1698), by @liangmiQwQ
• vp why: remove the -g / --global flag, which delegated to the package manager's global mode and ignored Vite+-managed global packages; vp why stays project-scoped while vp outdated -g keeps using the managed global flow (#1720), by @liangmiQwQ
• Windows installer: remove the existing current link via PowerShell (detecting junctions, symlinks, and stale directories) instead of cmd /c rmdir, which could fail with "The directory is not empty" (#1726), by @TheAlexLichter
• vp create: skip editor-config detection and package-local editor settings by default when creating a project inside an existing monorepo; --editor <name> stays an explicit opt-in and --no-editor an opt-out (#1729), by @jong-kyung
• vp create vite:monorepo (pnpm): keep the aliased vite/vitest in the website app's package.json so the workspace overrides.vite: catalog: has a direct consumer and vp why vite resolves to @voidzero-dev/vite-plus-core; npm/yarn/bun still drop the dead-weight keys (#1728), by @fengmk2
• vp pack: rewrite direct createRequire(...)("picomatch") calls in bundled tsdown output to the local bundled CJS entry, so packing no longer depends on an undeclared runtime picomatch under pnpm hoist: false (#1732), by @fengmk2
• vp migrate: resolve a catalog: husky pin from the workspace catalog (pnpm-workspace.yaml, .yarnrc.yml, or package.json catalogs) during the git-hooks preflight, so a compatible catalog-pinned husky no longer triggers a false "could not determine husky version" warning and skips hook setup (#1710), by @fengmk2

Docs

• Add a Copy Prompt button to the docs site that copies an AI-friendly getting-started prompt (intro, llms-full.txt pointer, install commands, and core vp commands) for handing straight to a coding agent (#1706), by @fengmk2
• Update troubleshooting.md: vite.config.ts related issues are resolved by updating oxlint and oxfmt (#1708), by @leaysgur
• Clarify the product and repository documentation locations and the new Run guide/config paths in AGENTS.md (#1707), by @leaysgur

Chore

• vp install: reduce retained vp versions from 5 to 3 across the installer, vp upgrade, and the shell/PowerShell bootstrap scripts (active and previous versions stay protected for rollback); document the 3-version retention and vp upgrade --rollback (#1716), by @fengmk2
• Exclude the snap-tests directory from Vitest config discovery so the VS Code Vitest extension stops generating a stray .vitest-plugin-loaded file (#1723), by @liangmiQwQ
• Refresh trusted stack stats on the docs homepage (#1734), by @voidzero-guard[bot]
• Update @wan9chi's GitHub handle (formerly branchseer) (#1705), by @wan9chi
• Update GitHub Actions (#1724, #1730), by @renovate[bot]
• Upgrade upstream dependencies: vite 8.0.14 → 8.0.16, vitest 4.1.7 → 4.1.8, tsdown 0.22.0 → 0.22.1, @vitejs/devtools 0.2.0 → 0.3.1 (#1713, #1735, #1737), by @voidzero-guard[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.16	f94df87
rolldown	1.0.3	a287faa
tsdown	0.22.1	npm
vitest	4.1.8	npm
oxlint	1.67.0	npm
oxlint-tsgolint	0.23.0	npm
oxfmt	0.52.0	npm

New Contributors

Welcome to our new contributor @semimikoh! 🎉

Full Changelog: v0.1.23...v0.1.24

Published Packages

• @voidzero-dev/vite-plus-core@0.1.24
• @voidzero-dev/vite-plus-test@0.1.24
• vite-plus@0.1.24

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Upgrade:

vp upgrade

vite-plus v0.1.23

Enterprise-ready HTTP (proxy + custom CA), task command shorthands in vite.config.ts, a smoother vp create/vp migrate, and the oxc/vite/rolldown bundled stack moves forward.

Highlights

• Proxy and custom-CA aware HTTP: a new process-wide vite_shared::shared_http_client() honors HTTPS_PROXY / HTTP_PROXY / NO_PROXY, picks up macOS System Settings / Windows registry proxies, loads custom CAs from SSL_CERT_FILE and NODE_EXTRA_CA_CERTS, and exposes a VP_INSECURE_TLS diagnostic switch; makes vp work through Socket Firewall Free and other TLS-intercepting proxies (#1686), by @fengmk2
• Task command shorthands: run.tasks entries in vite.config.ts now accept a bare string ("build": "cmd") or array ("build": ["cmd1", "cmd2"]) instead of always requiring { command: ... }; arrays reuse the existing && planning path so cache, dependsOn, and task options stay consistent (vite-task#391), by @jong-kyung
• Managed vp outdated -g: routes through Vite+'s managed global package metadata instead of delegating to the underlying npm outdated -g store, so all installed global packages are reported consistently (#1659), by @liangmiQwQ

Features

• vp pm approve-builds: new unified subcommand that mirrors pnpm approve-builds one-to-one, adapts to bun pm trust, and warns-and-noops on npm/yarn (#1662), by @fengmk2
• vp create: opt-in GitHub Copilot setup; selecting --agent copilot now generates a .github/workflows/copilot-setup-steps.yml so the Copilot Coding Agent can set up Vite+ and run vp in the new project out of the box (#1683), by @jong-kyung
• vp migrate: prompt to remove baseUrl from tsconfig.json before applying type-aware lint defaults (runs @andrewbranch/ts5to6 --fixBaseUrl . under the hood; auto-applied in non-interactive mode) (#1692), by @TheAlexLichter
• Respect packageManager in package-manager shims (npm/npx, pnpm/pnpx, yarn/yarnpkg, bun/bunx); add non-mutating packageManager resolution metadata for vp env current and vp env which (#1654), by @fengmk2
• vite-task: --filter no-match now exits 0 by default; add --fail-if-no-match to opt back in (vite-task#393), by @kazupon

Fixes & Enhancements

• vp create: keep generated .vscode/settings.json trackable when the VS Code editor option is selected (avoid templates' .vscode/* .gitignore masking it) (#1700), by @jong-kyung
• vp create vite:monorepo: normalize sub-package vite-plus to catalog: even when only vite-plus (not vite/vitest/...) is present, and drop the vite/vitest aliases generated by the upstream library template (#1697), by @fengmk2
• vp add/install -g <path>: resolve the real package name from package.json instead of using the path string, so local-path installs don't create broken directories (#1685), by @liangmiQwQ
• vp test --coverage and other direct built-in commands now expose the workspace's package.json#packageManager to child processes so tools like Vitest coverage can spawn the configured PM (#1696), by @jong-kyung
• vp migrate: clean up the whole ESLint ecosystem (plugins, configs, parser/resolver, type-utils) rather than just eslint; skip the migration entirely when @nuxt/eslint is detected (#1682), by @fengmk2
• vp create: write fmt.configPath (not configPath) for Zed oxfmt settings to match the official Zed OXC extension layout (#1687), by @chungweileong94
• vp migrate: parse tsconfig.json as JSONC so files with comments don't break baseUrl detection/removal (#1688), by @TheAlexLichter
• vp env setup: Unix env shims now point at the active vp executable instead of always assuming VP_HOME/current/bin/vp, so Homebrew-style installs work (#1631), by @leohara
• vp outdated -g / vp why -g: don't require a local package.json; global commands run regardless of cwd (#1622), by @liangmiQwQ
• vp create: default the "Initialize a git repository?" prompt to yes (#1650), by @fengmk2
• vp hooks: include the managed Node bin in PATH so ./node_modules/.bin/vp can find node from a VS Code commit on macOS (#1647), by @TheAlexLichter
• vpx on Windows now invokes the package's .cmd shim instead of the Unix binary (#1652), by @tobynguyen27
• vite-task: bump cache database schema to version 13 (forces a one-time rebuild of the local task cache) (vite-task#402), by @branchseer
• Bump vite-task to d02b257 and 5833b374; also bumps the repo's Rust nightly toolchain to nightly-2026-05-24 and ships the regenerated run config types and docs for the new task command shorthand (#1689, #1695), by @branchseer

Refactor

• Replace VP_SHELL_NU/VP_SHELL_PWSH with a single VP_SHELL override; add explicit shell parsing for bash, zsh, fish, nu, pwsh, and cmd, and harden auto-detection against nested shells (#1658), by @nekomoyi
• vite-task: replace allocator-api2 with bumpalo collections (vite-task#400), by @branchseer
• vite-task: drop the unused and_item_index field from ExecutionItemDisplay (vite-task#394), by @branchseer

Docs

• Add the root AGENTS.md as the primary AI-agent guide for the vite-plus repository; convert CLAUDE.md into a compatibility pointer (#1670), by @jong-kyung
• Align the agent validation table to match AGENTS.md (#1673), by @jong-kyung
• Update the task output caching guide so the documented behavior matches what vite-task actually does (#1639), by @ericclemmons
• Correct the bundled-source location in packages/core/BUNDLING.md (#1660), by @shulaoda

Chore

• Clarify --help text for vp env default/pin/use/exec with Examples: blocks (#1664), by @Boshen
• Refresh trusted stack stats on the docs homepage (#1680), by @voidzero-guard[bot]
• Drop the standalone pnpm --filter @rolldown/pluginutils build step now that @rolldown/pluginutils is published from its own package (#1655), by @shulaoda
• Preserve single-quote style when sync-remote rewrites pnpm-workspace.yaml (#1672), by @lyzno1
• Enable vite_pm_cli lib tests by removing a stale test = false flag (#1661), by @shulaoda
• CI: switch macOS runners back to namespace-profile-mac-default (#1701), by @fengmk2
• CI: fix release-day flakes in the upgrade test and snap test when the dev package.json version equals npm latest (#1645), by @fengmk2
• CI: replace zizmor and cargo-deny workflows with oxc-project/security-action (#1635), by @Boshen
• CI: warm-up monorepo cache test under npm (#1649), by @fengmk2
• CI: attach per-target vp binary archives (.tar.gz/.zip) to GitHub Releases alongside the existing vp-setup-*.exe installers (#1665), by @Boshen
• CI: declare Playwright via repo.json in ecosystem tests and bump consumers to >=1.60 to dodge the Node 24.16.0 hang (#1668), by @fengmk2
• Update GitHub Actions (#1640, #1675, #1678, #1679, #1691), by @renovate[bot]
• Upgrade upstream dependencies: vite 8.0.11 → 8.0.14, rolldown 1.0.0 → 1.0.3, vitest 4.1.6 → 4.1.7, oxlint 1.63.0 → 1.67.0, oxfmt 0.48.0 → 0.52.0, oxlint-tsgolint 0.22.1 → 0.23.0, @oxc-project/* and oxc Rust crates 0.129.0 → 0.133.0 (#1646, #1653, #1693, #1699), by @voidzero-guard[bot]

Bundled...

vite-plus v0.1.22

A critical Vitest browser-mode security fix, parallel vp add -g installs, a built-in oxlint rule to prefer vite-plus imports, and a new --git switch for vp create.

Highlights

• Security: bundled vitest bumped to 4.1.6 to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via the otelCarrier query parameter in Vitest browser mode (#1633)
• Parallel global install: vp add/install/update -g now installs packages concurrently with a progress bar and a --concurrency flag (default 5) (#1597)
• Prefer vite-plus imports: new bundled oxlint rule rewrites vite/vitest imports to vite-plus, enabled by default in generated and migrated lint configs (#1408)
• Git init on scaffold: vp create learns --git/--no-git (interactive prompt; auto-commits "Initial commit from Vite+") (#1484)

Features

• Spawn npm for global installation in parallel with a progress bar and a --concurrency option (#1597), by @liangmiQwQ
• Add bundled oxlint rule to prefer vite-plus imports over vite/vitest (#1408), by @Han5991
• vp create: initialize a git repository and create an initial commit on scaffold (#1484), by @ryohidaka
• vp create: rename underscore-prefixed files (_gitignore, _npmrc, _yarnrc.yml) to dotfiles for @org/create bundled templates (#1574), by @jong-kyung
• Add VP_PR_VERSION env var to install unreleased PR builds via pkg.pr.new (#1578), by @fengmk2

Fixes & Enhancements

• Skip merging standalone .oxfmtrc/.oxlintrc config when the fmt:/lint: key is already declared in vite.config.ts (fixes duplicate-block regression in vp create fate) (#1601), by @fengmk2
• Suppress the VITE+ - The Unified Toolchain for the Web banner for vp lint --lsp, vp fmt --lsp, and vp fmt --stdin-filepath so stdout stays a pure LSP / formatter stream (#1619), by @fengmk2
• vp create: detect output directory when running in the current directory (#1606), by @jong-kyung
• vp update -g: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs from npm view ... version --json (#1596), by @leno23
• vp create: preserve single-segment project path in updateWorkspaceConfig (#1582), by @jong-kyung
• vp env use: keep the change session-scoped on Windows (#1577), by @fengmk2
• vp rebuild: accept positional package names (#1564), by @fengmk2
• Adopt the new vite-task error formatter; errors now print as error: <top-level> plus * <source> chain lines, with bold-red highlight on a TTY (vite-task#390), by @branchseer
• vite-task: forward LOCALAPPDATA so Node's compile cache stays outside the workspace on Windows (vite-task#389), by @branchseer
• Bump vite-task to c945cc0 (#1628), by @branchseer

Refactor

• Revert vp pm plugin command (per discussion in #1038) (#1623), by @jong-kyung

Docs

• Add vitepress-plugin-llms to the docs site so the published docs include LLM-friendly outputs (/llms.txt) (#1625), by @jong-kyung
• Refresh home stats for oxlint, vite, and vitest (#1512), by @nozomee
• Mention vp env doctor in agent instructions (#1603), by @leno23

Chore

• Consolidate the upstream build chain into a single pnpm build script (justfile recipe now just calls pnpm build) (#1626), by @fengmk2
• Fix bootstrap-cli on Windows (#1583), by @fengmk2
• Refresh trusted stack stats (#1573, #1616), by @voidzero-guard[bot]
• Update GitHub Actions (#1611, #1612), by @renovate[bot]
• Address zizmor findings in composite actions and the release workflow; drop unused actions-cool/issues-helper (#1630), by @Boshen
• Switch plain checkouts to taiki-e/checkout-action (#1620), by @Boshen
• Switch release to a version-bump PR + push trigger flow (#1575), by @Boshen
• Gate release publish on environment approval with a Discord notice (#1571), by @Boshen
• Enable cargo clippy with -D warnings (#1579), by @Boshen
• Drop unused setup-node from the version-check job (#1600), by @fengmk2
• Add Void deploy workflows for the docs site (#1590), by @fengmk2
• Add --help case to config snap tests for npm10/yarn1/yarn4 (#1585), by @jong-kyung
• Add --help case to publish snap tests for npm10/yarn1/yarn4 (#1584), by @jong-kyung
• Verify .gitignore and .yarnrc.yml in the new-vite-monorepo snap (#1576), by @jong-kyung
• vite-task: bump pnpm to 11.1.2 (vite-task#383), by @branchseer
• vite-task: update lint-staged to v17 (vite-task#385), by @renovate[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.11	66f3194
rolldown	1.0.0	ac5c710
tsdown	0.22.0	npm
vitest	4.1.6	npm
oxlint	1.63.0	npm
oxlint-tsgolint	0.22.1	npm
oxfmt	0.48.0	npm

New Contributors

Welcome to all new contributors! 🎉

@nozomee, @ryohidaka, @leno23

Full Changelog: v0.1.21...v0.1.22

Published Packages

• @voidzero-dev/vite-plus-core@0.1.22
• @voidzero-dev/vite-plus-test@0.1.22
• vite-plus@0.1.22

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Upgrade:

vp upgrade

vite-plus v0.1.21 — Create, Migrate & Local CLI Power-Up

vp create learns @org templates, vp migrate rewrites more of your codebase, and the local CLI gains full vp pm parity.

Highlights

• Package-manager parity — every vp pm command now works from the local CLI (#1495)
• More Nushell support — broader shell coverage for vp env and related commands (#1305)
• Smarter vp migrate — rewrites named catalogs (#1493), tsdown/client imports & declare module statements (#1541), and tsdown/client / vite/client in tsconfig compilerOptions.types (#1542)
• vp create @org templates — scoped default templates are now supported (#1398)

Features

• Bring all package-manager commands to the local CLI (#1495) — @fengmk2
• Support @org default templates in vp create (#1398) — @fengmk2
• Support yarn plugin commands via vp pm plugin (#1540) — @jong-kyung
• Forward --provenance flag when publishing a package (#1549) — @cpojer
• More Nushell support (#1305) — @XiNiHa
• vp migrate: rewrite tsdown/client imports and declare module statements (#1541) — @naokihaba
• vp migrate: rewrite tsdown/client and vite/client in tsconfig compilerOptions.types (#1542) — @naokihaba
• vite-task: add output globs for cache restoration (vite-task#375) — @branchseer
• vite-task: store colored task logs, strip at display when needed (vite-task#378) — @branchseer
• Upgrade upstream dependencies — rolldown v1.0.0, vite v8.0.11, tsdown 0.22.0 (with new tsx config-loader), oxc Rust crates 0.128.0, oxc npm 0.129.0, oxlint 1.63.0, oxfmt 0.48.0, @vitejs/devtools 0.1.21 (#1521, #1531, #1548) — @voidzero-guard[bot]

Fixes & Enhancements

• vp migrate: rewrite named catalogs (#1493) — @lyzno1
• Show create and migrate in local CLI top-level help (#1508) — @nurazon59
• Fish env setup using string-literal command for vp env commands (#1518) — @mikkurogue
• Auto-pass --ignore-scripts when pnpm >=11 in migrate/create (#1533) — @fengmk2
• Route Windows .cmd shims through PowerShell for pm commands (#1498) — @fengmk2
• Add vite-plus/pack/client export as tsdown/client equivalent (#1501) — @naokihaba
• Publish release as draft to support immutable releases (#1558) — @fengmk2
• Preserve string-literal tabs in convertTabsToSpaces (#1559) — @fengmk2
• Include docs/ in fmt and lint (#1552) — @fengmk2
• vite-task: move FORCE_COLOR fallback after pattern filtering (vite-task#379) — @branchseer
• vite-task: preserve PATHEXT for Windows cached tasks (vite-task#366) — @SegaraRai
• Bump vite-task to c63db22 (#1560) — @branchseer

Refactor

• Convert team data file to TypeScript (#1515) — @jong-kyung

Docs

• Add filename labels to configuration code blocks (#1496) — @fengmk2
• Add monorepo overrides guide (#1535) — @fengmk2
• Improve "before" CI usage to actual use case (#1551) — @Mister-Hope

Chore

• Update crate-ci/typos action to v1.46.1 (#1509, #1554) — @renovate[bot]
• Rewrite upgrade-deps script in TypeScript (#1514) — @camc314
• Add pnpm v11 snap tests for command adaptation coverage (#1289) — @fengmk2
• Bump upgrade-deps max-turns from 200 to 400 (#1520) — @fengmk2
• Update pnpm to v10.33.2 (#1505) — @renovate[bot]
• Prevent false-positive <repeat> replacement on trailing plus (#1524) — @nurazon59
• Update lodash-es to v4.18.1 [security] (#1522) — @renovate[bot]
• Stabilize global snap tests against pnpm v11 (#1528) — @fengmk2
• Disable npm and cargo updates in Renovate (#1536) — @Boshen
• Publish preview packages to pkg.pr.new (#1526) — @Boshen
• Gate pkg.pr.new publish on label only (#1547) — @Boshen
• Upgrade GitHub Actions to latest versions (#956) — @salmanmkc
• Upgrade GitHub Actions for Node 24 compatibility (#955) — @salmanmkc
• Correct kazupon's X account link on the team page (#1513) — @jong-kyung
• Ensure no file changes after build-upstream step (#1563) — @fengmk2

Bundled Versions

Tool	Version	Source
vite	8.0.11	66f3194
rolldown	1.0.0	ac5c710
tsdown	0.22.0	npm
vitest	4.1.5	npm
oxlint	1.63.0	npm
oxlint-tsgolint	0.22.1	npm
oxfmt	0.48.0	npm

Published Packages

• @voidzero-dev/vite-plus-core@0.1.21
• @voidzero-dev/vite-plus-test@0.1.21
• vite-plus@0.1.21

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Upgrade:

vp upgrade

New Contributors

Welcome to all new contributors! 🎉

@nurazon59, @mikkurogue, @Mister-Hope, @salmanmkc, @XiNiHa

Full Changelog: v0.1.20...v0.1.21

vite-plus v0.1.21-alpha.7

vite-plus v0.1.21-alpha.7

Published Packages

• @voidzero-dev/vite-plus-core@0.1.21-alpha.7
• @voidzero-dev/vite-plus-test@0.1.21-alpha.7
• vite-plus@0.1.21-alpha.7

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.21-alpha.7 bash

Windows:

\$env:VP_VERSION=\"0.1.21-alpha.7\"; irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: c61621a

vite-plus v0.1.21-alpha.6

vite-plus v0.1.21-alpha.6

Published Packages

• @voidzero-dev/vite-plus-core@0.1.21-alpha.6
• @voidzero-dev/vite-plus-test@0.1.21-alpha.6
• vite-plus@0.1.21-alpha.6

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.21-alpha.6 bash

Windows:

\$env:VP_VERSION=\"0.1.21-alpha.6\"; irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: e134e4f

vite-plus v0.1.21-alpha.5

vite-plus v0.1.21-alpha.5

Published Packages

• @voidzero-dev/vite-plus-core@0.1.21-alpha.5
• @voidzero-dev/vite-plus-test@0.1.21-alpha.5
• vite-plus@0.1.21-alpha.5

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.21-alpha.5 bash

Windows:

\$env:VP_VERSION=\"0.1.21-alpha.5\"; irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: 6347597

vite-plus v0.1.21-alpha.4

vite-plus v0.1.21-alpha.4

Published Packages

• @voidzero-dev/vite-plus-core@0.1.21-alpha.4
• @voidzero-dev/vite-plus-test@0.1.21-alpha.4
• vite-plus@0.1.21-alpha.4

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.21-alpha.4 bash

Windows:

\$env:VP_VERSION=\"0.1.21-alpha.4\"; irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: dc41b71