[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	1.3.0 → 1.4.0
vite-plus (source)	1.3.0 → 1.4.0

---

Release Notes

voidzero-dev/vite-plus (vite)

v1.4.0: vite-plus v1.4.0

Compare Source

Vite+ 1.4 runs TypeScript and JavaScript files with vpx, and vp migrate can move tsx scripts to it. It also adds vp check --deny-warnings and vp pm team, and installs the global CLI's dependencies from a lockfile published with each release.

Features

• vpx <file> runs a TypeScript or JavaScript file on the project's Node.js with the oxc-node loader that ships with Vite+, and vpx --watch <file> reruns it when a file it uses changes. In package.json scripts, the vpx bin of the vite-plus package runs scripts without the global CLI and runs package binaries only from node_modules/.bin, pointing to vp dlx for anything not installed (docs) (#​2936, #​3164), by @​Brooooooklyn and @​fengmk2.
• vp migrate offers to move tsx scripts to vpx: tsx a.ts, npx tsx a.ts, node --import tsx a.ts, and tsx watch a.ts in package.json scripts, lint-staged tasks, and #!/usr/bin/env tsx shebangs become vpx a.ts or vpx --watch a.ts. A project already on Vite+ gets the offer with vp migrate --full (docs) (#​3179), by @​fengmk2.
• vp check --deny-warnings fails the check on lint warnings, so CI no longer needs a separate vp lint --deny-warnings run (docs) (#​3075), by @​acalvino4.
• vp pm team creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun (#​3040), by @​jong-kyung.
• Security: vp no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades (RUSTSEC-2026-0382, RUSTSEC-2026-0383), and it ships tokio 1.54.1, which fixes a race in tokio::time::Interval (RUSTSEC-2026-0384) (#​3159, #​3202), by @​wan9chi and @​fengmk2.
• vp pm registry commands (login, logout, whoami, owner, token, dist-tag, deprecate, search, ping, and publish) run pnpm's own commands on pnpm 11 and later (token from 12.13.0), and vp pm owner and vp pm publish run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm (#​3044), by @​jong-kyung.
• The installer and vp upgrade install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to resolve them again if that installation fails (docs) (#​3117), by @​fengmk2.
• Upgrade the bundled tools (#​3133, #​3158, #​3175), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.4 to vite@8.3.5, with fixes for bundled dev mode, chunk import maps, CSS url() values containing %, and subpath imports with several # characters.
  • rolldown@1.2.14 to rolldown@1.2.15, with fixes for this.resolve recursion between plugins using skipSelf: true, strict execution order, and chunk import maps.
  • oxlint@1.88.0 to oxlint@1.89.0, with rule fixes that report cases missed before, for example in prefer-const, no-param-reassign, and sort-imports.
  • oxfmt@0.73.0 to oxfmt@0.74.0, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown.
  • The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
  • vpx scripts run on oxc-node@1.0.0.
  • @vitejs/devtools 0.8 is accepted as a peer dependency, alongside 0.7.

Fixes & Enhancements

• The standalone vp executable binary size is ~30% smaller (#​3086), by @​fengmk2.
• VP_SETUP_NODE_VERSION selects the Node.js version the installer uses for the CLI's dependencies, so setup-vp can use the project's version and avoid downloading a second Node.js in CI (docs) (#​3087), by @​fengmk2.
• When tasks miss the cache, vp run finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again (vite-task#871), by @​magurotuna.
• Cached tasks no longer miss the cache when only pnpm's node_modules/.modules.yaml differs, for example after installing with another pnpm version, with --ignore-scripts, or on glibc and musl machines (vite-task#850), by @​wan9chi.
• vp run in a package that sits inside a workspace folder but is not listed in its pnpm-workspace.yaml packages or package.json workspaces runs that package's own tasks with its own packageManager, instead of treating the enclosing workspace as its root (vite-task#859), by @​liangmiQwQ.
• A mistyped or misplaced task setting fails with an error that names it, such as unknown field outputs, instead of data did not match any variant of untagged enum UserTaskDefinition (vite-task#815), by @​tlq5l.
• vp run no longer panics on scripts that contain non-ASCII characters, such as echo こんにちは, and no longer cuts those commands off in its output (vite-task#861), by @​magurotuna.
• In cached tasks on Linux and macOS, programs that pass -1 as a directory descriptor, such as ps -p <pid> from procps-ng 4.0.6 and later, no longer abort (vite-task#862), by @​magurotuna.
• On Linux, cached tasks such as pnpm dlx no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup (vite-task#854), by @​fengmk2.
• On Windows, vp run and the global vpx wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately (#​3167), by @​fengmk2.
• vp migrate and the prefer-vite-plus-imports lint autofix leave vite/rolldown and vite/rolldown/* imports unchanged, instead of rewriting them to vite-plus/rolldown subpaths that vite-plus does not export (#​3070, #​3191), by @​Crimson341 and @​Dunqing.
• vp migrate keeps existing .nvmrc files instead of converting them to .node-version, so nvm, fnm, and other tools that read .nvmrc keep working and the selected Node.js version does not change (#​3126), by @​liangmiQwQ.
• vp migrate converts Oxlint configs that extends shared JSON files into TypeScript modules imported through lint.extends, so the inherited rules keep applying after migration (#​3097), by @​fengmk2.
• vp migrate skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting (#​3118), by @​0froq.
• vp migrate keeps the workspace members declared in package.json workspaces when it selects pnpm for a project without a lockfile, so recursive commands still include them (#​2863), by @​SaKaNa-Y.
• vp migrate no longer reports unawaited-assertion for a local assertion promise that the function later awaits or returns (#​3180), by @​fengmk2.
• pnpm create vite-plus and yarn create vite-plus no longer fail during dependency installation when vp is not on PATH, and no longer run a different global vp version for installation, formatting, and hooks (#​3181), by @​fengmk2.
• vp create and vp migrate resolve the npm registry and credentials as npm does: a .npmrc above the project is no longer read, userconfig and globalconfig are honored, and registry hosts in credential keys match regardless of case (#​3124), by @​liangmiQwQ.
• vp pack and vp create find the monorepo root the same way as vp run and vp install, and vp pack at a monorepo root without a vite.config no longer picks up a config from the directory above (#​3101), by @​liangmiQwQ.
• defineConfig keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as vike(), work under Vite+ (#​3154), by @​liangmiQwQ.
• vp dev with experimental.bundledDev no longer fails with ERR_MODULE_NOT_FOUND when no separate rolldown package is installed, and no longer picks up the runtime of an unrelated installed rolldown (#​3111), by @​fengmk2.
• With nodeShimMode: system_first, vp node and vp env exec run the system tool that the shell would find, instead of downloading and running the managed Node.js (#​3100), by @​liangmiQwQ.
• VP_NODE_VERSION=22 and other partial versions resolve to an exact release in vp env install, vp env exec, and vp env clean, instead of failing with a 404 download error (#​3038), by @​Dev-next-gen.
• vp env pin and vp env unpin show the file and field they changed. Package-manager pins from a workspace member update the workspace root package.json, and the help and guide now say so (#​3103), by @​SaKaNa-Y.
• In PowerShell, a bare -- reaches vp again, so vp create vite -- --template react-ts forwards --template to create-vite (#​3083), by @​fengmk2.
• Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ env.nu calls, such as update. Run vp env setup again to regenerate env.nu (#​3123), by @​naokihaba.
• Package-manager commands reject options that the selected version would silently ignore, such as --dry-run or --provenance with an npm whose version is unknown, instead of running without them (#​3122), by @​jong-kyung.
• Fresh Bun installs verify the integrity hash in a packageManager pin and reject a mismatched download, as pnpm 12 and later already did (#​3134), by @​jong-kyung.
• A failed vp install -g restores the executables and npm links that existed before, instead of deleting files it never created (#​3119), by @​jong-kyung.
• vp install -g skips package binaries with unsafe names or targets instead of linking them, as pnpm does (#​3156), by @​jong-kyung.
• npm uninstall -g <package> --dry-run no longer removes the package's commands from Vite+ (#​3112), by @​jong-kyung.

Refactor

• Replace glob with tinyglobby in the CLI and share .nvmrc line parsing between reading and pinning. Workspace discovery in vp create and vp migrate now honors negated patterns such as !packages/foo and follows symlinked directories in ** patterns, as pnpm does (#​3099, #​3125), by @​liangmiQwQ.
• Share clap error diagnostics, manager preference parsing, external tool lookup, and native shell parsing for migration rewrites, and remove a redundant git hooks wrapper (#​3172, #​3143, #​3138, #​3173), by @​jong-kyung, @​myuron, and @​fengmk2.

Docs

• Note that run.cache can only be set in the workspace root's vite.config.ts (#​3139), by @​yusuke99.

Chore

• Bump vite-task to a3c087a; its user-facing changes are listed above (#​3153, #​3168, #​3184), by @​wan9chi.
• Run Node.js, runtime download, and package-manager tests against local mirrors and offline fixtures, serve snapshot registry traffic from local fixtures and a shared cache, replace sleeps with deterministic waits, keep snapshot setup off the npm registry, and fix or remove tests that checked nothing (#​3067, #​3169, #​3170, #​3171, #​3144, #​3146, #​3145, #​3147, #​3148, #​3194, #​3203), by @​fengmk2 and @​liangmiQwQ.
• Cover package-manager detection for nested projects and owner listing with pnpm 11.28.7, and allow time for the Playwright type check on slow runners (#​3051, #​3174, #​3082), by @​liangmiQwQ, @​jong-kyung, and @​fengmk2.
• Update the Node.js versions used for development, CI, and release publishing to the October 2026 security releases: 22.23.4, 24.22.1, and 26.12.1 (#​3186), by @​fengmk2.
• Reduce GitHub Actions cache storage and enable the e18e lint rules for the repository (#​3149, #​3088), by @​fengmk2.
• Upgrade JavaScript dependencies and Rust crates, including @ast-grep/napi@0.51.0 and serial_test@4 (#​3108, #​3109), by @​renovate[bot].
• Refine the release-manager and vite-task bump guidance (#​3084, #​3160), by @​fengmk2 and @​wan9chi.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.5	981f07f	8.3.5
rolldown	1.2.15	89d821c	1.2.15
oxc-node	1.0.0	4759ced	1.0.0
tsdown	0.23.1	npm	unchanged
vitest	5.0.5	npm	unchanged
oxlint	1.89.0	npm	1.89.0
oxlint-tsgolint	7.0.2004	npm	unchanged
oxfmt	0.74.0	npm	0.74.0

Upgrade

vp upgrade

New Contributors

@​acalvino4, @​Dev-next-gen, @​0froq, @​Crimson341, @​Dunqing, @​magurotuna, @​tlq5l

Full Changelog: voidzero-dev/vite-plus@v1.3.0...v1.4.0

Published Packages

• @voidzero-dev/vite-plus-core@1.4.0
• vite-plus@1.4.0
• create-vite-plus@1.4.0

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.4.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite-plus@​1.3.0 ⏵ 1.4.0				+1

View full report

[github-actions]

Remote cache staging

Commit: c1ad95910af9a203a391ae77ae06e66b50700036

The source checks did not pass. No verified Cloudflare staging deployment is ready. See the workflow run.

Manual checks and complete e2e plan.