[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	1.2.0 → 1.3.0
vite-plus (source)	1.2.0 → 1.3.0
vitest (source)	5.0.4 → 5.0.5

ℹ️ This dependency is compiled into the committed publish-action bundle. The needs-bundle-rebuild label triggers a workflow that re-runs vp run build:action and pushes the refreshed .github/actions/publish-preview/dist to this branch automatically, so the "Verify action bundle" check passes without a manual rebuild. If that push doesn't run (e.g. a fork PR the bot can't push to), rebuild and commit the dist yourself.

---

Release Notes

voidzero-dev/vite-plus (vite)

v1.3.0: vite-plus v1.3.0

Compare Source

Vite+ 1.3 adds create-vite-plus for starting a project without the global vp, new vp pm pkg and vp pm licenses commands, and package-manager dist-tags in vp env.

Features

• Create a Vite+ project without installing the global vp through pnpm create vite-plus, npm create vite-plus@latest, yarn create vite-plus, or bun create vite-plus, which run vp create with the same arguments (docs) (#​3028, #​3048), by @​liangmiQwQ.
• vp pm pkg get, set, delete, and fix read and update package.json through the detected package manager: npm 7.20.0 and later (fix from 9.8.0), pnpm 11.3.0 and later, and Bun 1.2.19 and later (docs) (#​3020), by @​jong-kyung.
• vp pm licenses list (or ls) lists dependency licenses through pnpm 7.17.0 and later, Yarn Classic, or Bun 1.4.0 and later, with --json for machine-readable output (#​3037), by @​jong-kyung.
• vp env accepts npm dist-tags in package-manager specs: vp env pin pnpm@latest-10 pins the exact version the tag points to, and vp env default pnpm@latest-10 follows the tag on each use (#​3047), by @​liangmiQwQ.
• Upgrade the bundled tools (#​3058, #​3078), by @​voidzero-guard[bot] and @​fengmk2:
  • rolldown@1.2.13 to rolldown@1.2.14. Rolldown adds the output.charset option and fixes several tree-shaking, code-splitting, and renaming bugs.
  • vitest@5.0.4 to vitest@5.0.5, with fixes for browser mode, hook cleanup after a failing hook, and --changed with quoted file names.

Fixes & Enhancements

• Import rewriting in vp migrate is up to 14 times faster on large projects, for example 78 s to 5.6 s on Dify (#​2987), by @​fengmk2.
• vp dev prints Vite's ready in N ms line, so scripts that wait for it no longer time out after vp migrate. --debug, --filter, and --profile now take effect in vp dev, vp build, and vp preview, and vp preview stops when the build output is missing, as vite preview does (#​3056), by @​fengmk2.
• vp staged prints one result line per task, such as ✔ vp check --fix, instead of the task list and Git progress. Warnings, errors, and rollback results stay visible, --verbose shows task output, and --debug keeps the full log (#​3060), by @​fengmk2.
• After a successful upgrade, vp upgrade reminds you to run vp migrate in projects that use an older Vite+ version (#​3063), by @​KTrain5169.
• The coding agent picker in vp create and vp migrate lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option. --agent claude and existing CLAUDE.md files still work (#​3055), by @​fengmk2.

Docs

• Recommend setting runtimeOnFail: ignore and pmOnFail: ignore in the project's pnpm-workspace.yaml for pnpm 11 and later, since pnpm does not read runtimeOnFail from its global config (#​3077), by @​liangmiQwQ.

Chore

• Speed up CI with ThinLTO native test builds, a pinned prepacked Windows SDK, and a precompiled std for trampoline tests, keep dependencies in Cargo caches, switch Linux runners, and update Windows build pins with Renovate (#​3026, #​2995, #​3009, #​3000, #​3073, #​3049), by @​fengmk2.
• Stabilize CLI snapshots during slow package-manager downloads, isolate Vitest browser and UI server ports, skip slow snapshot cases on Linux and Windows, and remove duplicate Rust unit tests (#​3043, #​3061, #​3059, #​3057), by @​fengmk2 and @​Brooooooklyn.
• Upgrade Rust crates and JavaScript dependencies, including rustls@0.23.46 and ast-grep@0.51.0, and remove unused catalog entries (#​1780, #​1782, #​1783), by @​renovate[bot] and @​fengmk2.
• Refine the release-manager guidance (#​3052), by @​fengmk2.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.4	b6c20f6	unchanged
rolldown	1.2.14	c9a8cda	1.2.14
tsdown	0.23.1	npm	unchanged
vitest	5.0.5	npm	5.0.5
oxlint	1.88.0	npm	unchanged
oxlint-tsgolint	7.0.2004	npm	unchanged
oxfmt	0.73.0	npm	unchanged

Upgrade

vp upgrade

Full Changelog: voidzero-dev/vite-plus@v1.2.0...v1.3.0

Published Packages

• @voidzero-dev/vite-plus-core@1.3.0
• vite-plus@1.3.0
• create-vite-plus@1.3.0

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.3.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

vitest-dev/vitest (vitest)

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​voidzero-dev/​vite-plus-core@​1.2.0 ⏵ 1.3.0	+1		+1	+2
	vitest@​5.0.4 ⏵ 5.0.5	+1		+1	+2
	vite-plus@​1.2.0 ⏵ 1.3.0				+2

View full report

[fengmk2]

@copilot fix ci fail

[Copilot]

@copilot fix ci fail

CI failed at vp install. @vitest/utils@5.0.5 and the other @vitest/* packages that come with vitest 5.0.5 were published inside the minimumReleaseAge window, and only vitest itself was excluded. I added @vitest/* to minimumReleaseAgeExclude in pnpm-workspace.yaml. I couldn't run vp install here (vp isn't installed), so the fix is unverified until CI runs. The log I read was cut off after @vitest/utils, so it may not list every rejected package.