Upgrade Void to 0.28.0 and retain the variables patch

README.md

@@ -294,10 +294,11 @@ Both CI and manual deployments include `config/production.env` through
 `worker.vars`. Production deployment starts only after staging passes.
 `void deploy` never uploads the local `.env`.
 
-The pinned `void@0.27.0` dependency has a patch in `patches/` because its managed
+The pinned `void@0.28.0` dependency has a patch in `patches/` because its managed
 deployment code otherwise discards `worker.vars`. The patch includes these values
-in the deployment manifest. Keep it until Void includes this fix. The deployment
-smoke check probes each configured package pattern against the running Worker.
+in the deployment manifest. Keep it until a release includes the fix in
+[Void PR #423](https://github.com/voidzero-dev/void/pull/423). The deployment smoke
+check probes each configured package pattern against the running Worker.
 
 **Migration for existing projects:** remove the public keys previously uploaded
 to remote secret storage in both production and staging. A remote secret with

patches/void@0.28.0.patch

@@ -0,0 +1,40 @@
+diff --git a/dist/deploy-B06EQq4t.mjs b/dist/deploy-B06EQq4t.mjs
+index 5dac678a9bf3ecf8d9dd54e7344a851ebc5924c7..7395f8d8d9cb101a09e9cabce47b0894cba784ca 100644
+--- a/dist/deploy-B06EQq4t.mjs
++++ b/dist/deploy-B06EQq4t.mjs
+@@ -5258,6 +5258,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
+ 		console.warn(`[void] ${fallbackWarning}`);
+ 	}
+ 	const manifest = assembleVoidManifest(pageScan, isFrameworkMode, {
++		vars: voidConfig.worker?.vars,
+ 		bindings: liveConfig ? {
+ 			...bindings,
+ 			needsLive: true
+diff --git a/dist/deploy-managed-static-CGswbcay.mjs b/dist/deploy-managed-static-CGswbcay.mjs
+index 4dfd9b0a4f17c1e9beefd60c190a8969d149ee54..bae389e086504659a27be000dc3a683752d752b3 100644
+--- a/dist/deploy-managed-static-CGswbcay.mjs
++++ b/dist/deploy-managed-static-CGswbcay.mjs
+@@ -1884,6 +1884,7 @@ function buildVoidManifest(opts) {
+ 		});
+ 	}
+ 	if (bindings.needsLive) manifest.live = toLiveManifest(options?.live);
++	if (opts.vars && Object.keys(opts.vars).length > 0) manifest.vars = opts.vars;
+ 	if (migrations && migrations.length > 0) manifest.migrations = toMigrationsManifest(migrations, resolvedDialect);
+ 	if (schedules && schedules.length > 0) manifest.schedules = schedules;
+ 	if (queues && queues.length > 0) manifest.queues = queues;
+@@ -1972,6 +1973,7 @@ function buildFrameworkManifest(opts) {
+ 		bindings: {}
+ 	};
+ 	applyResourceBindings(manifest, opts.bindings, opts.migrations?.length ?? 0, dialect, po?.bindingNames);
++	if (opts.vars && Object.keys(opts.vars).length > 0) manifest.vars = opts.vars;
+ 	if (opts.migrations && opts.migrations.length > 0) manifest.migrations = toMigrationsManifest(opts.migrations, dialect);
+ 	if (opts.schedules && opts.schedules.length > 0) manifest.schedules = opts.schedules;
+ 	if (opts.queues && opts.queues.length > 0) manifest.queues = opts.queues;
+@@ -2121,6 +2123,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
+ 		cpuMs: voidConfig.worker?.limits?.cpu_ms
+ 	};
+ 	const manifest = buildFrameworkManifest({
++		vars: voidConfig.worker?.vars,
+ 		frameworkName: detected.name,
+ 		workerMain: actualWorkerMain,
+ 		bindings,

pnpm-workspace.yaml

@@ -27,7 +27,7 @@ catalog:
   vite-plus: 1.1.0
   vitest: 5.0.3
   # Keep the managed-deploy vars patch until an upstream release includes it.
-  void: 0.27.0
+  void: 0.28.0
 overrides:
   vite@*: 'catalog:'
   vitest@*: 'catalog:'
@@ -40,4 +40,4 @@ peerDependencyRules:
     vite: '*'
     vitest: '*'
 patchedDependencies:
-  void@0.27.0: patches/void@0.27.0.patch
+  void@0.28.0: patches/void@0.28.0.patch