feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #3236 · voidzero-dev/vite-plus

voidzero-guard · 2026-10-26T02:33:38Z

Upgrade tsdown, @tsdown/css, and @tsdown/exe to 0.23.2. Upgrade the vendored oxc-node and its npm packages to 1.0.1.
Keep declaration generation compatible with stable TypeScript and existing tsgo configurations. Scope the rolldown-plugin-dts override to tsdown@0.23.2.
Pass loader settings to the asynchronous ESM thread after the oxc-node update. Preserve configuration diagnostics and watch reports.
Require completed validation before the upgrade workflow creates a ready PR. Retry transient Windows file locks during temporary directory cleanup.

Dependency updates

Package	From	To
`oxc-node`	`4759ced`	`v1.0.1` (`6d5376d`)
`tsdown`	`0.23.1`	`0.23.2`
`@tsdown/css`	`0.23.1`	`0.23.2`
`@tsdown/exe`	`0.23.1`	`0.23.2`
`@oxc-node/cli`	`1.0.0`	`1.0.1`
`@oxc-node/core`	`1.0.0`	`1.0.1`

Unchanged dependencies

rolldown: v1.2.15 (89d821c)
vite: v8.3.5 (981f07f)
vitest: 5.0.5
@vitest/browser: 5.0.5
@vitest/browser-playwright: 5.0.5
@vitest/browser-preview: 5.0.5
@vitest/mocker: 5.0.5
@vitest/pretty-format: 5.0.5
@vitest/snapshot: 5.0.5
@vitest/spy: 5.0.5
@vitest/utils: 5.0.5
lightningcss: ^1.33.0
lint-staged: 17.6.0
oxfmt: 0.74.0
oxlint: 1.89.0
@oxlint/plugins: 1.89.0
oxlint-tsgolint: 7.0.2005
@oxc-project/runtime: 0.155.0
@oxc-project/types: 0.155.0
oxc-minify: 0.155.0
oxc-parser: 0.155.0
oxc-transform: 0.155.0
VITEST_VERSION constant: 5.0.5
yuku-parser: 0.19.0
postcss: ^8.5.30
fsevents: ~2.3.3
typescript: ~7.0.2
rolldown-plugin-dts: ^0.28.0

Code changes

pnpm-workspace.yaml: Pin tsdown@0.23.2>rolldown-plugin-dts to 0.28.8. The beta plugin requires TypeScript 7.1 for its Go API and removes support for @typescript/native-preview.
packages/tools/src/patch-oxc-node.ts: Expose freeze_tsconfig_js and initialize_loader_js without registering upstream NAPI exports.
packages/cli/binding/src/oxc_node.rs and packages/cli/src/script-*.ts: Pass frozen tsconfig settings, their diagnostic source, and dependency policy to the loader thread. Refresh generated declarations in packages/cli/binding/index.d.cts.
.github/workflows/upgrade-deps.yml: Run final validation in a separate workflow step. Failed validation produces a draft PR and a failed workflow.
packages/cli/src/create/__tests__/register-template.spec.ts: Use asynchronous cleanup with bounded retries for transient Windows file locks.
crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/: Add coverage for stable TypeScript, @typescript/native-preview, and asynchronous loader settings.

Build status

Current build and CI status: PR checks.

- oxc-node: 4759ced -> v1.0.1 (6d5376d) - tsdown: 0.23.1 -> 0.23.2 - @tsdown/css: 0.23.1 -> 0.23.2 - @tsdown/exe: 0.23.1 -> 0.23.2 - @oxc-node/cli: 1.0.0 -> 1.0.1 - @oxc-node/core: 1.0.0 -> 1.0.1 - rolldown-plugin-dts: ^0.28.0 -> ^0.29.0-beta.2 - typescript: ~7.0.2 -> 7.1.0-beta Code changes: - pin TypeScript to 7.1.0-beta when Vite's compiler range can only select 7.0.x (packages/tools/src/sync-remote-deps.ts, tests in packages/tools/src/__tests__/sync-remote-yaml.spec.ts and packages/tools/src/__tests__/sync-remote-deps.spec.ts) - switch dts generation to the Oxc generator (packages/cli/tsdown.config.ts, packages/prompts/tsdown.config.ts) - add explicit type annotations required by the Oxc dts generator (packages/prompts/src/, packages/cli/src/define-config.ts, packages/cli/src/version.ts, packages/cli/src/oxlint-plugin.ts) - remove the @typescript/native-preview peer dependency (packages/core/package.json, packages/core/build.ts) - migrate the exports-map test to the TypeScript 7.1 API (packages/cli/src/__tests__/exports-map.spec.ts) - update pack snapshot for the TypeScript Go emit messages (crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack_monorepo/snapshots/command_pack_monorepo.md) - regenerate NAPI binding declarations from the oxc-node sync (packages/cli/binding/index.d.cts)

voidzero-guard · 2026-10-26T02:33:39Z

✅ No upstream CLI help changes detected

Compared normalized --help output for the upstream CLIs mirrored by Vite+.

➖ Vite: no version update (8.3.5)

No version update was detected, so there is no CLI help diff.

➖ Vitest: no version update (5.0.5)

No version update was detected, so there is no CLI help diff.

➖ Oxlint: no version update (1.89.0)

No version update was detected, so there is no CLI help diff.

➖ Oxfmt: no version update (0.74.0)

No version update was detected, so there is no CLI help diff.

✅ tsdown: no CLI help changes (0.23.1 → 0.23.2)

The version was updated, but the normalized CLI help output has no differences.

socket-security · 2026-10-26T02:35:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@tsdown/exe@0.23.1 ⏵ 0.23.2	^-1		⁺¹
npm/@oxc-node/core@1.0.0 ⏵ 1.0.1	⁺¹	⁺¹	⁺²
npm/@tsdown/css@0.23.1 ⏵ 0.23.2			⁺¹
npm/@oxc-node/cli@1.0.0 ⏵ 1.0.1	⁺¹	⁺¹	⁺¹
npm/tsdown@0.23.1 ⏵ 0.23.2			⁺¹

View full report

github-actions · 2026-10-26T02:42:14Z

CLI artifact sizes (`196192f`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.
The dist rows use the Linux build. The core total excludes .node files to match the release artifact.

Artifact	Format	Base	PR	Change
`packages/cli/dist`	Directory total	2.26 MiB	2.26 MiB	+3.55 KiB (+0.15%)
`packages/core/dist`	Directory total	4.07 MiB	4.07 MiB	-965 B (-0.02%)
Combined package dist	Directory total	6.33 MiB	6.33 MiB	+2.61 KiB (+0.04%)
`vp` (Linux x64)	Binary	8.23 MiB	8.23 MiB	0 B (0.00%)
`vp` (Linux x64)	gzip -9	3.76 MiB	3.76 MiB	0 B (0.00%)
NAPI (Linux x64)	Binary	35.45 MiB	35.47 MiB	+15.31 KiB (+0.04%)
NAPI (Linux x64)	gzip -9	14.12 MiB	14.13 MiB	+8.41 KiB (+0.06%)
`vp` (macOS ARM64)	Binary	5.38 MiB	5.38 MiB	0 B (0.00%)
`vp` (macOS ARM64)	gzip -9	3.20 MiB	3.20 MiB	0 B (0.00%)
NAPI (macOS ARM64)	Binary	42.23 MiB	42.25 MiB	+16.17 KiB (+0.04%)
NAPI (macOS ARM64)	gzip -9	18.25 MiB	18.26 MiB	+4.10 KiB (+0.02%)
`vp` (Windows x64)	Binary	6.08 MiB	6.08 MiB	0 B (0.00%)
`vp` (Windows x64)	gzip -9	2.82 MiB	2.82 MiB	+1 B (+0.00%)
NAPI (Windows x64)	Binary	31.50 MiB	31.52 MiB	+17.00 KiB (+0.05%)
NAPI (Windows x64)	gzip -9	12.83 MiB	12.84 MiB	+5.19 KiB (+0.04%)
Trampoline (Windows x64)	Binary	13.50 KiB	13.50 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	7.09 KiB	7.09 KiB	+3 B (+0.04%)
Installer (Windows x64)	Binary	4.67 MiB	4.67 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.24 MiB	2.24 MiB	+2 B (+0.00%)

cloudflare-workers-and-pages · 2026-10-26T02:57:24Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `196192f`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://f9c08674-viteplus-dev.voidzero-docs.workers.dev	`196192f`	2026-10-26T02:58:00.496Z	Visit the dashboard ↗

github-actions · 2026-10-26T04:53:53Z

Preview binary sizes (`196192f`)

Compared with the latest stable release, v1.4.0. Preview build.
Each row measures one binary. Negative changes mean a smaller preview binary.

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	5.38 MiB	5.38 MiB	+96 B (+0.00%)
NAPI (macOS ARM64)	42.20 MiB	42.22 MiB	+16.16 KiB (+0.04%)
`vp` (macOS x64)	6.82 MiB	6.82 MiB	+4.06 KiB (+0.06%)
NAPI (macOS x64)	47.34 MiB	47.35 MiB	+12.05 KiB (+0.02%)
`vp` (Linux ARM64 GNU)	6.81 MiB	6.82 MiB	+4.00 KiB (+0.06%)
NAPI (Linux ARM64 GNU)	31.44 MiB	31.46 MiB	+19.25 KiB (+0.06%)
`vp` (Linux ARM64 musl)	6.88 MiB	6.89 MiB	+7.15 KiB (+0.10%)
NAPI (Linux ARM64 musl)	30.67 MiB	30.68 MiB	+12.06 KiB (+0.04%)
`vp` (Linux x64 GNU)	8.22 MiB	8.23 MiB	+4.00 KiB (+0.05%)
NAPI (Linux x64 GNU)	35.45 MiB	35.47 MiB	+15.31 KiB (+0.04%)
`vp` (Linux x64 musl)	8.29 MiB	8.30 MiB	+3.09 KiB (+0.04%)
NAPI (Linux x64 musl)	34.43 MiB	34.45 MiB	+12.13 KiB (+0.03%)
`vp` (Windows x64)	6.09 MiB	6.10 MiB	+3.50 KiB (+0.06%)
NAPI (Windows x64)	31.16 MiB	31.17 MiB	+14.50 KiB (+0.05%)
Trampoline (Windows x64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows x64)	4.67 MiB	4.67 MiB	0 B (0.00%)
`vp` (Windows ARM64)	5.33 MiB	5.33 MiB	+4.50 KiB (+0.08%)
NAPI (Windows ARM64)	27.57 MiB	27.58 MiB	+15.00 KiB (+0.05%)
Trampoline (Windows ARM64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows ARM64)	3.85 MiB	3.85 MiB	0 B (0.00%)

gzip -9 sizes

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	3.20 MiB	3.20 MiB	+1.13 KiB (+0.03%)
NAPI (macOS ARM64)	18.25 MiB	18.26 MiB	+3.92 KiB (+0.02%)
`vp` (macOS x64)	3.38 MiB	3.38 MiB	+1.71 KiB (+0.05%)
NAPI (macOS x64)	19.44 MiB	19.44 MiB	+1.69 KiB (+0.01%)
`vp` (Linux ARM64 GNU)	3.69 MiB	3.69 MiB	+1.88 KiB (+0.05%)
NAPI (Linux ARM64 GNU)	13.31 MiB	13.32 MiB	+4.04 KiB (+0.03%)
`vp` (Linux ARM64 musl)	3.71 MiB	3.71 MiB	+2.49 KiB (+0.07%)
NAPI (Linux ARM64 musl)	13.01 MiB	13.02 MiB	+5.78 KiB (+0.04%)
`vp` (Linux x64 GNU)	3.76 MiB	3.76 MiB	+1.17 KiB (+0.03%)
NAPI (Linux x64 GNU)	14.12 MiB	14.13 MiB	+9.16 KiB (+0.06%)
`vp` (Linux x64 musl)	3.78 MiB	3.79 MiB	+2.33 KiB (+0.06%)
NAPI (Linux x64 musl)	13.66 MiB	13.67 MiB	+6.40 KiB (+0.05%)
`vp` (Windows x64)	2.82 MiB	2.82 MiB	+2.02 KiB (+0.07%)
NAPI (Windows x64)	12.69 MiB	12.70 MiB	+10.39 KiB (+0.08%)
Trampoline (Windows x64)	7.14 KiB	7.14 KiB	-1 B (-0.01%)
Installer (Windows x64)	2.24 MiB	2.24 MiB	+26 B (+0.00%)
`vp` (Windows ARM64)	2.69 MiB	2.69 MiB	+2.38 KiB (+0.09%)
NAPI (Windows ARM64)	12.05 MiB	12.06 MiB	+11.09 KiB (+0.09%)
Trampoline (Windows ARM64)	6.93 KiB	6.93 KiB	+1 B (+0.01%)
Installer (Windows ARM64)	2.14 MiB	2.14 MiB	+50 B (+0.00%)

Raw sizes are uncompressed file sizes. gzip sizes recompress each binary at level 9; they are not package or download archive sizes.
The baseline uses published release files, including NAPI packages from npm at the same version. Build versions and toolchains can affect the difference.

github-actions · 2026-10-26T04:56:20Z

Registry bridge build (`196192f`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396`
`create-vite-plus`	`0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install.sh | VP_PR_VERSION=3236 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install-legacy.sh bash

# Windows (PowerShell)
$env:VP_PR_VERSION="3236"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/196192f062b2ac4759090c50e3433a72c2995396/packages/cli/install.ps1 | iex

Or download the standalone Windows installer built from this commit:

Architecture	Installer
x64	`vp-setup-x86_64-pc-windows-msvc.exe`
Arm64	`vp-setup-aarch64-pc-windows-msvc.exe`

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or create a new project from this commit without installing the CLI:

export npm_config_registry=https://registry-bridge.viteplus.dev/ pnpm_config_registry=https://registry-bridge.viteplus.dev/
pnpm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396 # or: npm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396

$env:npm_config_registry="https://registry-bridge.viteplus.dev/"; $env:pnpm_config_registry="https://registry-bridge.viteplus.dev/"
pnpm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396 # or: npm create vite-plus@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396

pnpm 11+ reads pnpm_config_registry, npm and older pnpm read npm_config_registry. The new project pins this build, so keep the registry set for later installs, or configure it as below.

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.196192f062b2ac4759090c50e3433a72c2995396"
  }
}

github-actions · 2026-10-26T04:57:18Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-3236`	218MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-3236 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-3236

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-3236 vp --version

See docs/guide/docker.md for usage.

fix: preserve compatibility in upstream dependency updates

196192f

fengmk2 mentioned this pull request Oct 26, 2026

Remove the temporary rolldown-plugin-dts override #3237

Open

4 tasks

fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests test: sfw preview-build Publish this PR's commits to the registry bridge as preview builds labels Oct 26, 2026

fengmk2 approved these changes Oct 26, 2026

View reviewed changes

fengmk2 merged commit 16e8767 into main Oct 26, 2026
245 of 279 checks passed

fengmk2 deleted the deps/upstream-update branch October 26, 2026 05:41

Navigation Menu

Repository navigation

feat(deps): upgrade upstream dependencies - #3236

feat(deps): upgrade upstream dependencies#3236
fengmk2 merged 2 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Oct 26, 2026 •

edited by fengmk2

Loading

Uh oh!

voidzero-guard Bot commented Oct 26, 2026

Uh oh!

socket-security Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

voidzero-guard Bot commented Oct 26, 2026 • edited by fengmk2 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency updates

Code changes

Build status

Uh oh!

voidzero-guard Bot commented Oct 26, 2026

✅ No upstream CLI help changes detected

Uh oh!

socket-security Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI artifact sizes (196192f)

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit 196192f)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Uh oh!

github-actions Bot commented Oct 26, 2026

Preview binary sizes (196192f)

Uh oh!

github-actions Bot commented Oct 26, 2026

Registry bridge build (196192f)

Uh oh!

github-actions Bot commented Oct 26, 2026

🐳 Docker preview image

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

voidzero-guard Bot commented Oct 26, 2026 •

edited by fengmk2

Loading

socket-security Bot commented Oct 26, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading

CLI artifact sizes (`196192f`)

cloudflare-workers-and-pages Bot commented Oct 26, 2026 •

edited

Loading

Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit `196192f`)

Preview binary sizes (`196192f`)

Registry bridge build (`196192f`)