voidzero-dev/vite-plus v0.1.22

vite-plus v0.1.22

on GitHub

A critical Vitest browser-mode security fix, parallel vp add -g installs, a built-in oxlint rule to prefer vite-plus imports, and a new --git switch for vp create.

Highlights

• Security: bundled vitest bumped to 4.1.6 to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via the otelCarrier query parameter in Vitest browser mode (#1633)
• Parallel global install: vp add/install/update -g now installs packages concurrently with a progress bar and a --concurrency flag (default 5) (#1597)
• Prefer vite-plus imports: new bundled oxlint rule rewrites vite/vitest imports to vite-plus, enabled by default in generated and migrated lint configs (#1408)
• Git init on scaffold: vp create learns --git/--no-git (interactive prompt; auto-commits "Initial commit from Vite+") (#1484)

Features

• Spawn npm for global installation in parallel with a progress bar and a --concurrency option (#1597), by @liangmiQwQ
• Add bundled oxlint rule to prefer vite-plus imports over vite/vitest (#1408), by @Han5991
• vp create: initialize a git repository and create an initial commit on scaffold (#1484), by @ryohidaka
• vp create: rename underscore-prefixed files (_gitignore, _npmrc, _yarnrc.yml) to dotfiles for @org/create bundled templates (#1574), by @jong-kyung
• Add VP_PR_VERSION env var to install unreleased PR builds via pkg.pr.new (#1578), by @fengmk2

Fixes & Enhancements

• Skip merging standalone .oxfmtrc/.oxlintrc config when the fmt:/lint: key is already declared in vite.config.ts (fixes duplicate-block regression in vp create fate) (#1601), by @fengmk2
• Suppress the VITE+ - The Unified Toolchain for the Web banner for vp lint --lsp, vp fmt --lsp, and vp fmt --stdin-filepath so stdout stays a pure LSP / formatter stream (#1619), by @fengmk2
• vp create: detect output directory when running in the current directory (#1606), by @jong-kyung
• vp update -g: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs from npm view ... version --json (#1596), by @leno23
• vp create: preserve single-segment project path in updateWorkspaceConfig (#1582), by @jong-kyung
• vp env use: keep the change session-scoped on Windows (#1577), by @fengmk2
• vp rebuild: accept positional package names (#1564), by @fengmk2
• Adopt the new vite-task error formatter; errors now print as error: <top-level> plus * <source> chain lines, with bold-red highlight on a TTY (vite-task#390), by @branchseer
• vite-task: forward LOCALAPPDATA so Node's compile cache stays outside the workspace on Windows (vite-task#389), by @branchseer
• Bump vite-task to c945cc0 (#1628), by @branchseer

Refactor

• Revert vp pm plugin command (per discussion in #1038) (#1623), by @jong-kyung

Docs

• Add vitepress-plugin-llms to the docs site so the published docs include LLM-friendly outputs (/llms.txt) (#1625), by @jong-kyung
• Refresh home stats for oxlint, vite, and vitest (#1512), by @nozomee
• Mention vp env doctor in agent instructions (#1603), by @leno23

Chore

• Consolidate the upstream build chain into a single pnpm build script (justfile recipe now just calls pnpm build) (#1626), by @fengmk2
• Fix bootstrap-cli on Windows (#1583), by @fengmk2
• Refresh trusted stack stats (#1573, #1616), by @voidzero-guard[bot]
• Update GitHub Actions (#1611, #1612), by @renovate[bot]
• Address zizmor findings in composite actions and the release workflow; drop unused actions-cool/issues-helper (#1630), by @Boshen
• Switch plain checkouts to taiki-e/checkout-action (#1620), by @Boshen
• Switch release to a version-bump PR + push trigger flow (#1575), by @Boshen
• Gate release publish on environment approval with a Discord notice (#1571), by @Boshen
• Enable cargo clippy with -D warnings (#1579), by @Boshen
• Drop unused setup-node from the version-check job (#1600), by @fengmk2
• Add Void deploy workflows for the docs site (#1590), by @fengmk2
• Add --help case to config snap tests for npm10/yarn1/yarn4 (#1585), by @jong-kyung
• Add --help case to publish snap tests for npm10/yarn1/yarn4 (#1584), by @jong-kyung
• Verify .gitignore and .yarnrc.yml in the new-vite-monorepo snap (#1576), by @jong-kyung
• vite-task: bump pnpm to 11.1.2 (vite-task#383), by @branchseer
• vite-task: update lint-staged to v17 (vite-task#385), by @renovate[bot]

Bundled Versions

New Contributors

Welcome to all new contributors! 🎉

@nozomee, @ryohidaka, @leno23

Full Changelog: v0.1.21...v0.1.22

Published Packages

• @voidzero-dev/vite-plus-core@0.1.22
• @voidzero-dev/vite-plus-test@0.1.22
• vite-plus@0.1.22

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.