Skip to content

feat(deps): upgrade upstream dependencies#2168

Merged
wan9chi merged 2 commits into
mainfrom
deps/upstream-update
Jul 14, 2026
Merged

feat(deps): upgrade upstream dependencies#2168
wan9chi merged 2 commits into
mainfrom
deps/upstream-update

Conversation

@voidzero-guard

Copy link
Copy Markdown
Contributor

Summary

  • Automated upgrade of upstream dependencies, most notably vite to v8.1.4 and tsdown (@tsdown/css, @tsdown/exe) to 0.22.7.
  • Bumps @vitejs/devtools to 0.4.0; rolldown and the vitest stack are unchanged.
  • Pins postcss-modules@9.0.0 so vite's bundled patch keeps applying after its ^9.0.0 range began resolving to 9.0.1.
  • Widens the typescript peer range to allow ^7.0.0 and adds a PTY snapshot redaction for the calendar-dependent vp env which install date.

Dependency updates

Package From To
vite 578ffb8 v8.1.4 (a477454)
tsdown 0.22.4 0.22.7
@tsdown/css 0.22.4 0.22.7
@tsdown/exe 0.22.4 0.22.7
@vitejs/devtools 0.3.4 0.4.0

Code changes

  • pnpm-workspace.yaml: bump tsdown / @tsdown/css / @tsdown/exe catalog entries to ^0.22.7, and pin postcss-modules@9.0.0 via overrides + patchedDependencies so vite's postcss-modules@9.0.0.patch stays applied.
  • packages/core/package.json: bump @vitejs/devtools to ^0.4.0, widen the typescript peer range to ^5.0.0 || ^6.0.0 || ^7.0.0, and update bundledVersions (vite 8.1.3 -> 8.1.4, tsdown 0.22.4 -> 0.22.7).
  • crates/vite_cli_snapshots/tests/cli_snapshots/redact.rs: add INSTALLED_DATE_RE to mask the wall-clock Installed: date in vp env which output.
  • PTY snapshots: command_env_which.md (install date now redacted to <date>), plus new_vite_monorepo.md and new_vite_monorepo_bun.md reflecting create-template devDependency bumps (typescript ^6 -> ^7, @types/node ^25 -> ^26, dropped @typescript/native-preview).

Build status

  • sync-remote-and-build: failure
  • build-upstream: failure

- vite: 578ffb8 -> v8.1.4 (a477454)
- tsdown: 0.22.4 -> 0.22.7
- @tsdown/css: 0.22.4 -> 0.22.7
- @tsdown/exe: 0.22.4 -> 0.22.7
- @vitejs/devtools: 0.3.4 -> 0.4.0

Code changes:
- Pin postcss-modules@9.0.0 via overrides + patchedDependencies so vite's
  postcss-modules@9.0.0.patch stays applied (pnpm-workspace.yaml).
- Widen typescript peer range to include ^7.0.0 and bump bundledVersions
  (vite 8.1.3 -> 8.1.4, tsdown 0.22.4 -> 0.22.7) (packages/core/package.json).
- Mask the calendar-dependent `Installed:` date in `vp env which` output
  (crates/vite_cli_snapshots/tests/cli_snapshots/redact.rs).
- Update PTY snapshots for the new date redaction and create-template
  devDependency bumps (command_env_which.md, new_vite_monorepo.md,
  new_vite_monorepo_bun.md).
@netlify

netlify Bot commented Jul 14, 2026

Copy link
Copy Markdown

Deploy Preview for viteplus-preview canceled.

Name Link
🔨 Latest commit 30b4224
🔍 Latest deploy log https://app.netlify.com/projects/viteplus-preview/deploys/6a55fac938fa6100083a5210

@socket-security

socket-security Bot commented Jul 14, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​tsdown/​exe@​0.22.7701007297100
Addednpm/​@​vitejs/​devtools@​0.4.0781007495100
Addednpm/​@​tsdown/​css@​0.22.7751008097100
Addednpm/​tsx@​4.23.11001008292100
Addednpm/​tsdown@​0.22.7981008897100
Updatednpm/​postcss-modules@​6.0.1 ⏵ 9.0.099 +1100100 +192 +12100

View full report

@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Native binary sizes (30b4224)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact Format Base PR Change
vp (Linux x64) Binary 10.32 MiB 10.32 MiB 0 B (0.00%)
vp (Linux x64) gzip -9 4.42 MiB 4.42 MiB 0 B (0.00%)
NAPI (Linux x64) Binary 33.42 MiB 33.42 MiB 0 B (0.00%)
NAPI (Linux x64) gzip -9 12.78 MiB 12.78 MiB 0 B (0.00%)
vp (macOS ARM64) Binary 7.64 MiB 7.64 MiB 0 B (0.00%)
vp (macOS ARM64) gzip -9 3.83 MiB 3.83 MiB 0 B (0.00%)
NAPI (macOS ARM64) Binary 40.78 MiB 40.78 MiB 0 B (0.00%)
NAPI (macOS ARM64) gzip -9 17.05 MiB 17.05 MiB +8 B (+0.00%)
vp (Windows x64) Binary 8.37 MiB 8.37 MiB 0 B (0.00%)
vp (Windows x64) gzip -9 3.64 MiB 3.64 MiB +2 B (+0.00%)
NAPI (Windows x64) Binary 27.88 MiB 27.88 MiB 0 B (0.00%)
NAPI (Windows x64) gzip -9 10.78 MiB 10.78 MiB +1 B (+0.00%)
Trampoline (Windows x64) Binary 203.00 KiB 203.00 KiB 0 B (0.00%)
Trampoline (Windows x64) gzip -9 97.91 KiB 97.91 KiB -2 B (-0.00%)
Installer (Windows x64) Binary 4.46 MiB 4.46 MiB 0 B (0.00%)
Installer (Windows x64) gzip -9 2.08 MiB 2.08 MiB 0 B (0.00%)

The app and library monorepo sub-templates are updated independently
upstream, and this sync moved the library template to typescript ^7.0.2
while the app template still pins ~6.0.2. Since typescript is an
optional peer of vite-plus, the mismatch makes pnpm materialize two
vite-plus/vitest peer instances in a freshly created monorepo, breaking
the single-instance invariant checked by test-vp-create (npm and yarn
hit the equivalent hoist conflict).

Align the app package and the generated workspace catalog entry to the
library's TypeScript range at create time, so future upstream bumps of
either sub-template cannot re-split the workspace. Also refresh the
stale `typescript: ^5` catalog fallback in the static template files.

Verified with a local-registry vp create + install: vite-plus, vitest,
and @voidzero-dev/vite-plus-core each resolve to a single instance with
typescript@7.0.2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@wan9chi

wan9chi commented Jul 14, 2026

Copy link
Copy Markdown
Member

Pushed 30b4224 to fix the three vp create monorepo failures.

Root cause: this sync moves the bundled library template to typescript: ^7.0.2 while the app (website) template still pins ~6.0.2. typescript is an optional peer of vite-plus, so the mismatch makes pnpm materialize two vite-plus/vitest peer instances in a freshly created monorepo, tripping the single-instance check (npm/yarn hit the equivalent hoist conflict). The generated workspace catalog also still carried a stale typescript: ^5 from the static template.

Fix: at create time, the app package and the workspace catalog entry now adopt the library template's TypeScript range (alignMonorepoTypeScriptVersion in packages/cli/src/create/templates/monorepo.ts). Deriving from the library template means future upstream bumps of either sub-template can't re-split the workspace. The static template catalogs' ^5 fallback is refreshed to ^7.0.0.

Validation:

  • unit tests: 5 new cases, create suite 179/179 green; tsgo type-check and lint clean
  • PTY snapshots regenerated (new_vite_monorepo, new_vite_monorepo_bun) — website aligns to ^7.0.2, generated catalog derives ^7.0.2; create_missing_typecheck still passes
  • e2e via the local npm registry: vp create vite:monorepo + install (pnpm 11.13) → vite-plus, vitest, and @voidzero-dev/vite-plus-core each resolve to exactly one instance in node_modules/.pnpm, with a single typescript@7.0.2

With the library on TS7, vp run ready now exercises declaration generation through tsdown 0.22.7's native-compiler (tsgo) path — the same path that fixes #2160 — so the create jobs double as a TS7 dts regression gate.

@wan9chi wan9chi merged commit 19efdd0 into main Jul 14, 2026
100 checks passed
@wan9chi wan9chi deleted the deps/upstream-update branch July 14, 2026 09:17
wan9chi added a commit that referenced this pull request Jul 15, 2026
## Summary

Adds a declaration-output assertion to the `vp create monorepo` CI jobs:
after `vp run ready`, `packages/utils/dist/index.d.mts` must exist.

## Why

A green `vp run ready` only proves the build exited 0. Declaration
generation can degrade silently — generator skipped, output landing in
the wrong place — while the exit code stays clean, which would ship
type-less libraries from every freshly created monorepo without CI
noticing.

Since #2168 the monorepo template scaffolds TypeScript 7, so the utils
library's `vp pack` runs dts through tsdown's native-compiler (tsgo)
path — the machinery that broke in #2160. This assertion turns the four
create jobs into an end-to-end regression gate for that path across
pnpm/npm/yarn/bun.

## Notes

- The emitted file is `index.d.mts` (paired with the ESM `index.mjs`
bundle), not `index.d.ts` — verified against a local-registry build of
main:
  ```
  ℹ Emit types with typescript@7.0.2
  ℹ dist/index.mjs    0.10 kB
  ℹ dist/index.d.mts  0.08 kB
  ```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
wan9chi added a commit that referenced this pull request Jul 16, 2026
)

Release vite-plus v0.2.5: Cleaner environments and more reliable
workflows.

This release adds cleanup and package version commands, supports
TypeScript 7 declaration generation, reduces the standalone binary size,
and hardens task tracking, CLI output, package-manager routing, Docker
workflows, and project scaffolding.

### Highlights

- Add `vp env clean` to remove unused managed Node.js runtimes and
package-manager caches
([#2003](#2003)), by
@liangmiQwQ
- Add `vp pm version`, forwarding native version commands to npm, pnpm,
Yarn, and Bun
([#2127](#2127)), by
@jong-kyung
- Add TypeScript 7 support to declaration generation and generated
library projects with tsdown `0.22.7`
([#2104](#2104),
[#2168](#2168)), by
@wan9chi
- Improve automatic task input tracking for Bun on macOS, Linux
containers with constrained `/dev/shm`, and Windows process images,
reduce Windows backing-file allocation, and clarify task wait failures
([vite-task#515](voidzero-dev/vite-task#515),
[vite-task#518](voidzero-dev/vite-task#518),
[vite-task#523](voidzero-dev/vite-task#523),
[vite-task#524](voidzero-dev/vite-task#524),
[vite-task#542](voidzero-dev/vite-task#542),
[#2126](#2126),
[#2167](#2167)), by
@wan9chi
- Prevent CLI diagnostics from truncating or panicking when inherited
standard output or error is nonblocking
([#2172](#2172),
[#2173](#2173)), by
@wan9chi

### Fixes & Enhancements

- Reduce standalone `vp` binary sizes by about 5% on Linux and macOS and
19% on Windows
([#2043](#2043)), by
@fengmk2
- Keep the Docker image non-root by default while allowing passwordless
`sudo` for Playwright browser dependencies and system packages
([#2088](#2088)), by
@fengmk2
- Ignore `.env` and `.env.*` in generated projects while keeping
`.env.example` trackable
([#2095](#2095)), by
@forehalo
- Create `vp-use.cmd` after the Windows environment bin directory is
ready and document its Command Prompt-only usage
([#2128](#2128)), by
@liangmiQwQ
- Render user-facing process statuses and paths without Rust debug
wrappers ([#2130](#2130)),
by @liangmiQwQ
- Make `vp dedupe` fall back to `yarn install` with a warning on Yarn
Classic ([#2139](#2139)),
by @jong-kyung
- Ensure package-manager child processes, including Bun, can always find
the managed Node.js runtime
([#2158](#2158)), by
@BlankParticle

### Docs

- Update the release-manager post-release guidance
([#2096](#2096)), by
@wan9chi
- Add Windows to the Namespace sponsor credit
([#2108](#2108)), by
@fengmk2
- Document installer and runtime environment variables, registry
settings, TLS options, and precedence rules
([#2114](#2114)), by
@yukinoshi
- Mark shell examples in `CONTRIBUTING.md` as Bash code blocks
([#2159](#2159)), by
@BlankParticle

### Chore

- Assign prepared release PRs to the workflow actor
([#2094](#2094)), by
@wan9chi
- Complete the PTY snapshot migration and harden the runner, fixtures,
release-version redaction, registry teardown, timeouts, and Linux
parallelism
([#2071](#2071),
[#2080](#2080),
[#2084](#2084),
[#2099](#2099),
[#2102](#2102),
[#2103](#2103),
[#2107](#2107),
[#2109](#2109),
[#2115](#2115),
[#2117](#2117),
[#2118](#2118),
[#2119](#2119),
[#2120](#2120),
[#2121](#2121),
[#2131](#2131),
[#2132](#2132),
[#2134](#2134),
[#2137](#2137),
[#2138](#2138),
[#2141](#2141),
[#2143](#2143),
[#2145](#2145),
[#2182](#2182)), by
@fengmk2 and @wan9chi
- Expose Vite+ managed binaries consistently inside snapshot fixtures
([#2110](#2110)), by
@liangmiQwQ
- Exclude PTY snapshot configuration from Vitest discovery and remove
the legacy snapshot infrastructure
([#2135](#2135),
[#2146](#2146)), by
@jong-kyung
- Modernize Windows runners, registry bridge publishing, native size
reporting, merge-base comparisons, and package-manager installation CI
([#2083](#2083),
[#2100](#2100),
[#2105](#2105),
[#2106](#2106),
[#2112](#2112),
[#2133](#2133)), by
@fengmk2
- Verify that created monorepo libraries emit declarations in CI
([#2171](#2171)), by
@wan9chi

### Bundled Versions

| Tool | Version | Source |
| --------------- | ------- |
-----------------------------------------------------------------------
|
| vite | `8.1.4` |
[`a477454`](vitejs/vite@a477454)
|
| rolldown | `1.1.5` |
[`f09947a`](rolldown/rolldown@f09947a)
|
| tsdown | `0.22.7` | [npm](https://npmx.dev/package/tsdown/v/0.22.7) |
| vitest | `4.1.10` | [npm](https://npmx.dev/package/vitest/v/4.1.10) |
| oxlint | `1.73.0` | [npm](https://npmx.dev/package/oxlint/v/1.73.0) |
| oxlint-tsgolint | `0.24.0` |
[npm](https://npmx.dev/package/oxlint-tsgolint/v/0.24.0) |
| oxfmt | `0.58.0` | [npm](https://npmx.dev/package/oxfmt/v/0.58.0) |

### Upgrade

```bash
vp upgrade
```

### New Contributors

Welcome @yukinoshi and @BlankParticle.

**Full Changelog**:
v0.2.4...v0.2.5

---

Merging this PR will trigger the release workflow.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: wan9chi <dk4rest@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant