[dependabot]

Bumps vite-plus from 0.3.2 to 1.4.0.

Release notes

Sourced from vite-plus's releases.

vite-plus v1.4.0

Vite+ 1.4 runs TypeScript and JavaScript files with vpx, and vp migrate can move tsx scripts to it. It also adds vp check --deny-warnings and vp pm team, and installs the global CLI's dependencies from a lockfile published with each release.

Features

• vpx <file> runs a TypeScript or JavaScript file on the project's Node.js with the oxc-node loader that ships with Vite+, and vpx --watch <file> reruns it when a file it uses changes. In package.json scripts, the vpx bin of the vite-plus package runs scripts without the global CLI and runs package binaries only from node_modules/.bin, pointing to vp dlx for anything not installed (docs) (#2936, #3164), by @​Brooooooklyn and @​fengmk2.
• vp migrate offers to move tsx scripts to vpx: tsx a.ts, npx tsx a.ts, node --import tsx a.ts, and tsx watch a.ts in package.json scripts, lint-staged tasks, and #!/usr/bin/env tsx shebangs become vpx a.ts or vpx --watch a.ts. A project already on Vite+ gets the offer with vp migrate --full (docs) (#3179), by @​fengmk2.
• vp check --deny-warnings fails the check on lint warnings, so CI no longer needs a separate vp lint --deny-warnings run (docs) (#3075), by @​acalvino4.
• vp pm team creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun (#3040), by @​jong-kyung.
• Security: vp no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades (RUSTSEC-2026-0382, RUSTSEC-2026-0383), and it ships tokio 1.54.1, which fixes a race in tokio::time::Interval (RUSTSEC-2026-0384) (#3159, #3202), by @​wan9chi and @​fengmk2.
• vp pm registry commands (login, logout, whoami, owner, token, dist-tag, deprecate, search, ping, and publish) run pnpm's own commands on pnpm 11 and later (token from 12.13.0), and vp pm owner and vp pm publish run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm (#3044), by @​jong-kyung.
• The installer and vp upgrade install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to resolve them again if that installation fails (docs) (#3117), by @​fengmk2.
• Upgrade the bundled tools (#3133, #3158, #3175), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.4 to vite@8.3.5, with fixes for bundled dev mode, chunk import maps, CSS url() values containing %, and subpath imports with several # characters.
  • rolldown@1.2.14 to rolldown@1.2.15, with fixes for this.resolve recursion between plugins using skipSelf: true, strict execution order, and chunk import maps.
  • oxlint@1.88.0 to oxlint@1.89.0, with rule fixes that report cases missed before, for example in prefer-const, no-param-reassign, and sort-imports.
  • oxfmt@0.73.0 to oxfmt@0.74.0, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown.
  • The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
  • vpx scripts run on oxc-node@1.0.0.
  • @vitejs/devtools 0.8 is accepted as a peer dependency, alongside 0.7.

Fixes & Enhancements

• The standalone vp executable binary size is ~30% smaller (#3086), by @​fengmk2.
• VP_SETUP_NODE_VERSION selects the Node.js version the installer uses for the CLI's dependencies, so setup-vp can use the project's version and avoid downloading a second Node.js in CI (docs) (#3087), by @​fengmk2.
• When tasks miss the cache, vp run finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again (vite-task#871), by @​magurotuna.
• Cached tasks no longer miss the cache when only pnpm's node_modules/.modules.yaml differs, for example after installing with another pnpm version, with --ignore-scripts, or on glibc and musl machines (vite-task#850), by @​wan9chi.
• vp run in a package that sits inside a workspace folder but is not listed in its pnpm-workspace.yaml packages or package.json workspaces runs that package's own tasks with its own packageManager, instead of treating the enclosing workspace as its root (vite-task#859), by @​liangmiQwQ.
• A mistyped or misplaced task setting fails with an error that names it, such as unknown field outputs, instead of data did not match any variant of untagged enum UserTaskDefinition (vite-task#815), by @​tlq5l.
• vp run no longer panics on scripts that contain non-ASCII characters, such as echo こんにちは, and no longer cuts those commands off in its output (vite-task#861), by @​magurotuna.
• In cached tasks on Linux and macOS, programs that pass -1 as a directory descriptor, such as ps -p <pid> from procps-ng 4.0.6 and later, no longer abort (vite-task#862), by @​magurotuna.
• On Linux, cached tasks such as pnpm dlx no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup (vite-task#854), by @​fengmk2.
• On Windows, vp run and the global vpx wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately (#3167), by @​fengmk2.
• vp migrate and the prefer-vite-plus-imports lint autofix leave vite/rolldown and vite/rolldown/* imports unchanged, instead of rewriting them to vite-plus/rolldown subpaths that vite-plus does not export (#3070, #3191), by @​Crimson341 and @​Dunqing.
• vp migrate keeps existing .nvmrc files instead of converting them to .node-version, so nvm, fnm, and other tools that read .nvmrc keep working and the selected Node.js version does not change (#3126), by @​liangmiQwQ.
• vp migrate converts Oxlint configs that extends shared JSON files into TypeScript modules imported through lint.extends, so the inherited rules keep applying after migration (#3097), by @​fengmk2.
• vp migrate skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting (#3118), by @​0froq.
• vp migrate keeps the workspace members declared in package.json workspaces when it selects pnpm for a project without a lockfile, so recursive commands still include them (#2863), by @​SaKaNa-Y.
• vp migrate no longer reports unawaited-assertion for a local assertion promise that the function later awaits or returns (#3180), by @​fengmk2.
• pnpm create vite-plus and yarn create vite-plus no longer fail during dependency installation when vp is not on PATH, and no longer run a different global vp version for installation, formatting, and hooks (#3181), by @​fengmk2.
• vp create and vp migrate resolve the npm registry and credentials as npm does: a .npmrc above the project is no longer read, userconfig and globalconfig are honored, and registry hosts in credential keys match regardless of case (#3124), by @​liangmiQwQ.
• vp pack and vp create find the monorepo root the same way as vp run and vp install, and vp pack at a monorepo root without a vite.config no longer picks up a config from the directory above (#3101), by @​liangmiQwQ.
• defineConfig keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as vike(), work under Vite+ (#3154), by @​liangmiQwQ.
• vp dev with experimental.bundledDev no longer fails with ERR_MODULE_NOT_FOUND when no separate rolldown package is installed, and no longer picks up the runtime of an unrelated installed rolldown (#3111), by @​fengmk2.
• With nodeShimMode: system_first, vp node and vp env exec run the system tool that the shell would find, instead of downloading and running the managed Node.js (#3100), by @​liangmiQwQ.
• VP_NODE_VERSION=22 and other partial versions resolve to an exact release in vp env install, vp env exec, and vp env clean, instead of failing with a 404 download error (#3038), by @​Dev-next-gen.
• vp env pin and vp env unpin show the file and field they changed. Package-manager pins from a workspace member update the workspace root package.json, and the help and guide now say so (#3103), by @​SaKaNa-Y.
• In PowerShell, a bare -- reaches vp again, so vp create vite -- --template react-ts forwards --template to create-vite (#3083), by @​fengmk2.
• Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ env.nu calls, such as update. Run vp env setup again to regenerate env.nu (#3123), by @​naokihaba.
• Package-manager commands reject options that the selected version would silently ignore, such as --dry-run or --provenance with an npm whose version is unknown, instead of running without them (#3122), by @​jong-kyung.

... (truncated)

Commits

• 102fe8e release: v1.4.0 (#3201)
• b2abe27 fix(create): run child commands without a global vp (#3181)
• c891e5d feat(migrate): migrate tsx scripts to vpx (#3179)
• 0a96bd9 fix(lint): keep vite/rolldown imports in prefer-vite-plus-imports (#3191)
• cbb9fee fix(migrate): recognize awaited local assertion promises (#3180)
• 74c8d18 refactor(cli): share clap error diagnostics (#3172)
• 2162b28 feat(deps): upgrade upstream dependencies (#3175)
• f8d9da8 fix(cli): keep own properties of promise plugins in defineConfig (#3154)
• 0445f73 refactor(migrate): remove redundant git hooks wrapper (#3173)
• 13ac064 fix(vpx): handle --experimental-config-file and Windows Ctrl+C (#3167)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d2963e9a-2185-4a6e-b622-fe84959f728a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}