feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #2104 · voidzero-dev/vite-plus

voidzero-guard · 2026-07-09T01:56:31Z

Summary

Automated daily upgrade of upstream dependencies.
Bumps rolldown to v1.1.5 and tsdown to 0.22.4, plus the oxc toolchain (oxlint 1.73.0, oxfmt 0.58.0, @oxc-project/* / oxc-* 0.139.0, and the Rust oxc* crates 0.139.0).
Keeps yuku-codegen/yuku-parser (rolldown-plugin-dts napi packages) external in the core bundle and adds them as core dependencies so their native bindings resolve at runtime.
Regenerates the NAPI binding types and applies oxfmt formatter output; build-upstream failed for this run.

Dependency updates

Package	From	To
`rolldown`	`6cbd233`	`v1.1.5 (f09947a)`
`tsdown`	`0.22.3`	`0.22.4`
`@tsdown/css`	`0.22.3`	`0.22.4`
`@tsdown/exe`	`0.22.3`	`0.22.4`
`oxfmt`	`0.57.0`	`0.58.0`
`oxlint`	`1.72.0`	`1.73.0`
`@oxc-project/runtime`	`0.138.0`	`0.139.0`
`@oxc-project/types`	`0.138.0`	`0.139.0`
`oxc-minify`	`0.138.0`	`0.139.0`
`oxc-parser`	`0.138.0`	`0.139.0`
`oxc-transform`	`0.138.0`	`0.139.0`
`oxc` (Rust crates)	`0.138.0`	`0.139.0`
`oxc_resolver`	`11.22.0`	`11.23.0`
`oxc_sourcemap`	`8.0.1`	`8.1.0`
`num-bigint`	`0.4.6`	`0.5.1`

Unchanged dependencies

vite: v8.1.3 (578ffb8)
vitest: 4.1.10
@vitest/browser: 4.1.10
@vitest/browser-playwright: 4.1.10
@vitest/browser-preview: 4.1.10
@vitest/browser-webdriverio: 4.1.10
@vitest/expect: 4.1.10
@vitest/mocker: 4.1.10
@vitest/pretty-format: 4.1.10
@vitest/runner: 4.1.10
@vitest/snapshot: 4.1.10
@vitest/spy: 4.1.10
@vitest/utils: 4.1.10
lightningcss: ^1.32.0
@oxc-node/cli: 0.1.0
@oxc-node/core: 0.1.0
oxlint-tsgolint: 0.24.0
VITEST_VERSION constant: 4.1.10
README vitest pins: 4.1.10
@vitejs/devtools: 0.3.4

Code changes

packages/core/build.ts: keep yuku-codegen/yuku-parser external (their loaders require a per-platform .node binding relative to their own __dirname, which bundling would break).
packages/core/package.json: add yuku-codegen/yuku-parser as core dependencies; bump bundledVersions (rolldown 1.1.4 -> 1.1.5, tsdown 0.22.3 -> 0.22.4).
packages/cli/binding/index.d.cts: regenerated NAPI binding types for the rolldown bump — adds sourcemapFilenames/sourcemapFileNames, preliminarySourcemapFilename, and the reserved mangle option; removes the module-preload and render-built-url binding interfaces.
pnpm-workspace.yaml: catalog version bumps plus fresh-import / void entries and valibot 1.4.1 -> 1.4.2.
docs/config/run.md, rfcs/pack-command.md, packages/tools/src/local-npm-registry.ts: oxfmt 0.58.0 reformatting of empty braces (no behavior change).

Build status

sync-remote-and-build: success
build-upstream: failure

- rolldown: 6cbd233 -> v1.1.5 (f09947a) - tsdown: 0.22.3 -> 0.22.4 - @tsdown/css: 0.22.3 -> 0.22.4 - @tsdown/exe: 0.22.3 -> 0.22.4 - oxfmt: 0.57.0 -> 0.58.0 - oxlint: 1.72.0 -> 1.73.0 - @oxc-project/runtime: 0.138.0 -> 0.139.0 - @oxc-project/types: 0.138.0 -> 0.139.0 - oxc-minify: 0.138.0 -> 0.139.0 - oxc-parser: 0.138.0 -> 0.139.0 - oxc-transform: 0.138.0 -> 0.139.0 - oxc (Rust crates): 0.138.0 -> 0.139.0 (Cargo.toml, Cargo.lock) - oxc_resolver: 11.22.0 -> 11.23.0 (Cargo.toml) - oxc_sourcemap: 8.0.1 -> 8.1.0 (Cargo.toml) - num-bigint: 0.4.6 -> 0.5.1 (Cargo.toml) Code changes: - packages/core/build.ts: keep `yuku-codegen`/`yuku-parser` (rolldown-plugin-dts napi packages) external so their per-platform binding still resolves at runtime. - packages/core/package.json: add `yuku-codegen`/`yuku-parser` as core dependencies; bump bundledVersions (rolldown 1.1.4 -> 1.1.5, tsdown 0.22.3 -> 0.22.4). - packages/cli/binding/index.d.cts: regenerated NAPI binding types for the rolldown bump (add `sourcemapFilenames`/`sourcemapFileNames`, `reserved` mangle option; drop module-preload/render-built-url binding interfaces). - docs/config/run.md, rfcs/pack-command.md, packages/tools/src/local-npm-registry.ts: oxfmt 0.58.0 reformatting of empty braces.

netlify · 2026-07-09T01:56:36Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`0e6744f`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a4f6cefba72e80008f5cee2

github-actions · 2026-07-09T01:58:03Z

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: 0e6744f

socket-security · 2026-07-09T01:58:16Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Maintenance
npm/oxc-parser@0.138.0 ⏵ 0.139.0		⁺²
cargo/oxc_allocator@0.138.0 ⏵ 0.139.0
cargo/oxc_ast@0.138.0 ⏵ 0.139.0
cargo/oxc_parser@0.138.0 ⏵ 0.139.0
cargo/oxc_resolver@11.22.0 ⏵ 11.23.0
cargo/oxc_span@0.138.0 ⏵ 0.139.0
npm/oxc-transform@0.138.0 ⏵ 0.139.0	⁺¹	⁺²

View full report

github-actions · 2026-07-09T02:04:56Z

Native binary sizes (`0e6744f`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact	Format	Base	PR	Change
`vp` (Linux x64)	Binary	10.27 MiB	10.28 MiB	+8.00 KiB (+0.08%)
`vp` (Linux x64)	gzip -9	4.41 MiB	4.41 MiB	+2.17 KiB (+0.05%)
NAPI (Linux x64)	Binary	33.42 MiB	33.41 MiB	-3.94 KiB (-0.01%)
NAPI (Linux x64)	gzip -9	12.77 MiB	12.78 MiB	+9.45 KiB (+0.07%)
`vp` (macOS ARM64)	Binary	7.61 MiB	7.61 MiB	+32 B (+0.00%)
`vp` (macOS ARM64)	gzip -9	3.82 MiB	3.83 MiB	+9.83 KiB (+0.25%)
NAPI (macOS ARM64)	Binary	40.78 MiB	40.77 MiB	-16.39 KiB (-0.04%)
NAPI (macOS ARM64)	gzip -9	17.02 MiB	17.04 MiB	+27.13 KiB (+0.16%)
`vp` (Windows x64)	Binary	8.32 MiB	8.33 MiB	+9.00 KiB (+0.11%)
`vp` (Windows x64)	gzip -9	3.63 MiB	3.63 MiB	+1,021 B (+0.03%)
NAPI (Windows x64)	Binary	27.85 MiB	27.86 MiB	+8.00 KiB (+0.03%)
NAPI (Windows x64)	gzip -9	10.76 MiB	10.78 MiB	+21.01 KiB (+0.19%)
Trampoline (Windows x64)	Binary	203.00 KiB	203.00 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	97.91 KiB	97.91 KiB	0 B (0.00%)
Installer (Windows x64)	Binary	4.45 MiB	4.46 MiB	+5.00 KiB (+0.11%)
Installer (Windows x64)	gzip -9	2.08 MiB	2.08 MiB	+1.35 KiB (+0.06%)

github-actions · 2026-07-09T03:09:29Z

Registry bridge build (`de07915`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.de07915dd0ce9170892002e8cc99ceb59f6b2beb`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.de07915dd0ce9170892002e8cc99ceb59f6b2beb`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://vite.plus | VP_PR_VERSION=2104 bash

# Windows (PowerShell)
$env:VP_PR_VERSION="2104"; irm https://vite.plus/ps1 | iex

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.de07915dd0ce9170892002e8cc99ceb59f6b2beb",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.de07915dd0ce9170892002e8cc99ceb59f6b2beb"
  }
}

github-actions · 2026-07-09T03:10:53Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-2104`	243MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-2104 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-2104

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-2104 vp --version

See docs/guide/docker.md for usage.

fengmk2 · 2026-07-09T06:33:27Z

I need to trace the snapshot test hang at linux first.

The size gate compared the PR head against the current tip of the base branch. A branch that forked before a native-input change landed on main failed the hash comparison and got a six-platform rebuild plus a size report whose deltas came from commits already on main. #2111 hit this: an RFC-only PR received the size report for the #2104 dependency upgrade. The gate now resolves the merge base and both compares and builds against it. The build runs only when the PR itself changes a native input, and the report covers only the PR's own delta. PRs that edit this workflow file still trigger a run. The run on this PR exercised the new path end to end: base built at the merge base, head at the PR, and the size report shows 0 B raw delta on every artifact.

@liangmiQwQ

) Release vite-plus v0.2.5: Cleaner environments and more reliable workflows. This release adds cleanup and package version commands, supports TypeScript 7 declaration generation, reduces the standalone binary size, and hardens task tracking, CLI output, package-manager routing, Docker workflows, and project scaffolding. ### Highlights - Add `vp env clean` to remove unused managed Node.js runtimes and package-manager caches ([#2003](#2003)), by @liangmiQwQ - Add `vp pm version`, forwarding native version commands to npm, pnpm, Yarn, and Bun ([#2127](#2127)), by @jong-kyung - Add TypeScript 7 support to declaration generation and generated library projects with tsdown `0.22.7` ([#2104](#2104), [#2168](#2168)), by @wan9chi - Improve automatic task input tracking for Bun on macOS, Linux containers with constrained `/dev/shm`, and Windows process images, reduce Windows backing-file allocation, and clarify task wait failures ([vite-task#515](voidzero-dev/vite-task#515), [vite-task#518](voidzero-dev/vite-task#518), [vite-task#523](voidzero-dev/vite-task#523), [vite-task#524](voidzero-dev/vite-task#524), [vite-task#542](voidzero-dev/vite-task#542), [#2126](#2126), [#2167](#2167)), by @wan9chi - Prevent CLI diagnostics from truncating or panicking when inherited standard output or error is nonblocking ([#2172](#2172), [#2173](#2173)), by @wan9chi ### Fixes & Enhancements - Reduce standalone `vp` binary sizes by about 5% on Linux and macOS and 19% on Windows ([#2043](#2043)), by @fengmk2 - Keep the Docker image non-root by default while allowing passwordless `sudo` for Playwright browser dependencies and system packages ([#2088](#2088)), by @fengmk2 - Ignore `.env` and `.env.*` in generated projects while keeping `.env.example` trackable ([#2095](#2095)), by @forehalo - Create `vp-use.cmd` after the Windows environment bin directory is ready and document its Command Prompt-only usage ([#2128](#2128)), by @liangmiQwQ - Render user-facing process statuses and paths without Rust debug wrappers ([#2130](#2130)), by @liangmiQwQ - Make `vp dedupe` fall back to `yarn install` with a warning on Yarn Classic ([#2139](#2139)), by @jong-kyung - Ensure package-manager child processes, including Bun, can always find the managed Node.js runtime ([#2158](#2158)), by @BlankParticle ### Docs - Update the release-manager post-release guidance ([#2096](#2096)), by @wan9chi - Add Windows to the Namespace sponsor credit ([#2108](#2108)), by @fengmk2 - Document installer and runtime environment variables, registry settings, TLS options, and precedence rules ([#2114](#2114)), by @yukinoshi - Mark shell examples in `CONTRIBUTING.md` as Bash code blocks ([#2159](#2159)), by @BlankParticle ### Chore - Assign prepared release PRs to the workflow actor ([#2094](#2094)), by @wan9chi - Complete the PTY snapshot migration and harden the runner, fixtures, release-version redaction, registry teardown, timeouts, and Linux parallelism ([#2071](#2071), [#2080](#2080), [#2084](#2084), [#2099](#2099), [#2102](#2102), [#2103](#2103), [#2107](#2107), [#2109](#2109), [#2115](#2115), [#2117](#2117), [#2118](#2118), [#2119](#2119), [#2120](#2120), [#2121](#2121), [#2131](#2131), [#2132](#2132), [#2134](#2134), [#2137](#2137), [#2138](#2138), [#2141](#2141), [#2143](#2143), [#2145](#2145), [#2182](#2182)), by @fengmk2 and @wan9chi - Expose Vite+ managed binaries consistently inside snapshot fixtures ([#2110](#2110)), by @liangmiQwQ - Exclude PTY snapshot configuration from Vitest discovery and remove the legacy snapshot infrastructure ([#2135](#2135), [#2146](#2146)), by @jong-kyung - Modernize Windows runners, registry bridge publishing, native size reporting, merge-base comparisons, and package-manager installation CI ([#2083](#2083), [#2100](#2100), [#2105](#2105), [#2106](#2106), [#2112](#2112), [#2133](#2133)), by @fengmk2 - Verify that created monorepo libraries emit declarations in CI ([#2171](#2171)), by @wan9chi ### Bundled Versions | Tool | Version | Source | | --------------- | ------- | ----------------------------------------------------------------------- | | vite | `8.1.4` | [`a477454`](vitejs/vite@a477454) | | rolldown | `1.1.5` | [`f09947a`](rolldown/rolldown@f09947a) | | tsdown | `0.22.7` | [npm](https://npmx.dev/package/tsdown/v/0.22.7) | | vitest | `4.1.10` | [npm](https://npmx.dev/package/vitest/v/4.1.10) | | oxlint | `1.73.0` | [npm](https://npmx.dev/package/oxlint/v/1.73.0) | | oxlint-tsgolint | `0.24.0` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/0.24.0) | | oxfmt | `0.58.0` | [npm](https://npmx.dev/package/oxfmt/v/0.58.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors Welcome @yukinoshi and @BlankParticle. **Full Changelog**: v0.2.4...v0.2.5 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: wan9chi <dk4rest@gmail.com>

fengmk2 added 2 commits July 9, 2026 10:33

Merge branch 'main' into deps/upstream-update

db21395

Merge branch 'main' into deps/upstream-update

54b2b23

fengmk2 added the preview-build Publish this PR's commits to the registry bridge as preview builds label Jul 9, 2026

Merge branch 'main' into deps/upstream-update

de07915

fengmk2 marked this pull request as draft July 9, 2026 06:33

fengmk2 mentioned this pull request Jul 9, 2026

test(snapshots): migrate vp migrate snap test cases #2107

Merged

fengmk2 force-pushed the deps/upstream-update branch from 8763696 to de07915 Compare July 9, 2026 08:03

fengmk2 marked this pull request as ready for review July 9, 2026 08:10

fengmk2 assigned wan9chi Jul 9, 2026

Merge branch 'main' into deps/upstream-update

0e6744f

wan9chi approved these changes Jul 9, 2026

View reviewed changes

wan9chi merged commit dceae8c into main Jul 9, 2026
112 checks passed

wan9chi deleted the deps/upstream-update branch July 9, 2026 11:16

fengmk2 mentioned this pull request Jul 10, 2026

fix(ci): compare native binary size against PR merge base #2112

Merged

wan9chi mentioned this pull request Jul 15, 2026

release: v0.2.5: Cleaner environments and more reliable workflows #2180

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(deps): upgrade upstream dependencies#2104

feat(deps): upgrade upstream dependencies#2104
wan9chi merged 5 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Jul 9, 2026

Uh oh!

netlify Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 9, 2026

Uh oh!

fengmk2 commented Jul 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

voidzero-guard Bot commented Jul 9, 2026

Summary

Dependency updates

Code changes

Build status

Uh oh!

netlify Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Native binary sizes (0e6744f)

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Registry bridge build (de07915)

Uh oh!

github-actions Bot commented Jul 9, 2026

🐳 Docker preview image

Uh oh!

fengmk2 commented Jul 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

socket-security Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Native binary sizes (`0e6744f`)

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Registry bridge build (`de07915`)