Skip to content

Commit 12368da

Browse files
release: v0.1.22 (#1637)
Release vite-plus v0.1.22: Security Patch, Parallel Global Install & Scaffold Polish A critical Vitest browser-mode security fix, parallel `vp add -g` installs, a built-in oxlint rule to prefer `vite-plus` imports, and a new `--git` switch for `vp create`. ### Highlights - **Security**: bundled `vitest` bumped to `4.1.6` to address [GHSA-2h32-95rg-cppp](GHSA-2h32-95rg-cppp) (Critical, CVSS 9.6), an XSS to RCE chain via the `otelCarrier` query parameter in Vitest browser mode ([#1633](#1633)) - **Parallel global install**: `vp add/install/update -g` now installs packages concurrently with a progress bar and a `--concurrency` flag (default 5) ([#1597](#1597)) - **Prefer vite-plus imports**: new bundled oxlint rule rewrites `vite`/`vitest` imports to `vite-plus`, enabled by default in generated and migrated `lint` configs ([#1408](#1408)) - **Git init on scaffold**: `vp create` learns `--git`/`--no-git` (interactive prompt; auto-commits "Initial commit from Vite+") ([#1484](#1484)) ### Features - Spawn npm for global installation in parallel with a progress bar and a `--concurrency` option ([#1597](#1597)), by @liangmiQwQ - Add bundled oxlint rule to prefer `vite-plus` imports over `vite`/`vitest` ([#1408](#1408)), by @Han5991 - `vp create`: initialize a git repository and create an initial commit on scaffold ([#1484](#1484)), by @ryohidaka - `vp create`: rename underscore-prefixed files (`_gitignore`, `_npmrc`, `_yarnrc.yml`) to dotfiles for `@org/create` bundled templates ([#1574](#1574)), by @jong-kyung - Add `VP_PR_VERSION` env var to install unreleased PR builds via pkg.pr.new ([#1578](#1578)), by @fengmk2 ### Fixes & Enhancements - Skip merging standalone `.oxfmtrc`/`.oxlintrc` config when the `fmt:`/`lint:` key is already declared in `vite.config.ts` (fixes duplicate-block regression in `vp create fate`) ([#1601](#1601)), by @fengmk2 - Suppress the `VITE+ - The Unified Toolchain for the Web` banner for `vp lint --lsp`, `vp fmt --lsp`, and `vp fmt --stdin-filepath` so stdout stays a pure LSP / formatter stream ([#1619](#1619)), by @fengmk2 - `vp create`: detect output directory when running in the current directory ([#1606](#1606)), by @jong-kyung - `vp update -g`: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs from `npm view ... version --json` ([#1596](#1596)), by @leno23 - `vp create`: preserve single-segment project path in `updateWorkspaceConfig` ([#1582](#1582)), by @jong-kyung - `vp env use`: keep the change session-scoped on Windows ([#1577](#1577)), by @fengmk2 - `vp rebuild`: accept positional package names ([#1564](#1564)), by @fengmk2 - Adopt the new vite-task error formatter; errors now print as `error: <top-level>` plus `* <source>` chain lines, with bold-red highlight on a TTY ([vite-task#390](voidzero-dev/vite-task#390)), by @branchseer - vite-task: forward `LOCALAPPDATA` so Node's compile cache stays outside the workspace on Windows ([vite-task#389](voidzero-dev/vite-task#389)), by @branchseer - Bump vite-task to `c945cc0` ([#1628](#1628)), by @branchseer ### Refactor - Revert `vp pm plugin` command (per discussion in #1038) ([#1623](#1623)), by @jong-kyung ### Docs - Add `vitepress-plugin-llms` to the docs site so the published docs include LLM-friendly outputs (`/llms.txt`) ([#1625](#1625)), by @jong-kyung - Refresh home stats for oxlint, vite, and vitest ([#1512](#1512)), by @nozomee - Mention `vp env doctor` in agent instructions ([#1603](#1603)), by @leno23 ### Chore - Consolidate the upstream build chain into a single `pnpm build` script (justfile recipe now just calls `pnpm build`) ([#1626](#1626)), by @fengmk2 - Fix bootstrap-cli on Windows ([#1583](#1583)), by @fengmk2 - Refresh trusted stack stats ([#1573](#1573), [#1616](#1616)), by @voidzero-guard[bot] - Update GitHub Actions ([#1611](#1611), [#1612](#1612)), by @renovate[bot] - Address zizmor findings in composite actions and the release workflow; drop unused `actions-cool/issues-helper` ([#1630](#1630)), by @Boshen - Switch plain checkouts to `taiki-e/checkout-action` ([#1620](#1620)), by @Boshen - Switch release to a version-bump PR + push trigger flow ([#1575](#1575)), by @Boshen - Gate release publish on environment approval with a Discord notice ([#1571](#1571)), by @Boshen - Enable `cargo clippy` with `-D warnings` ([#1579](#1579)), by @Boshen - Drop unused `setup-node` from the version-check job ([#1600](#1600)), by @fengmk2 - Add Void deploy workflows for the docs site ([#1590](#1590)), by @fengmk2 - Add `--help` case to config snap tests for npm10/yarn1/yarn4 ([#1585](#1585)), by @jong-kyung - Add `--help` case to publish snap tests for npm10/yarn1/yarn4 ([#1584](#1584)), by @jong-kyung - Verify `.gitignore` and `.yarnrc.yml` in the new-vite-monorepo snap ([#1576](#1576)), by @jong-kyung - vite-task: bump pnpm to `11.1.2` ([vite-task#383](voidzero-dev/vite-task#383)), by @branchseer - vite-task: update lint-staged to v17 ([vite-task#385](voidzero-dev/vite-task#385)), by @renovate[bot] ### Bundled Versions | Tool | Version | Source | | --- | --- | --- | | vite | `8.0.11` | [`66f3194`](vitejs/vite@66f3194) | | rolldown | `1.0.0` | [`ac5c710`](rolldown/rolldown@ac5c710) | | tsdown | `0.22.0` | [npm](https://npmx.dev/package/tsdown/v/0.22.0) | | vitest | `4.1.6` | [npm](https://npmx.dev/package/vitest/v/4.1.6) | | oxlint | `1.63.0` | [npm](https://npmx.dev/package/oxlint/v/1.63.0) | | oxlint-tsgolint | `0.22.1` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/0.22.1) | | oxfmt | `0.48.0` | [npm](https://npmx.dev/package/oxfmt/v/0.48.0) | ### New Contributors Welcome to all new contributors! 🎉 @nozomee, @ryohidaka, @leno23 **Full Changelog**: v0.1.21...v0.1.22 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK <fengmk2@gmail.com>
1 parent 11975a3 commit 12368da

11 files changed

Lines changed: 86 additions & 71 deletions

File tree

.github/workflows/e2e-test.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -392,7 +392,8 @@ jobs:
392392
cp tmp/tgz/vp target/release/vp 2>/dev/null || cp tmp/tgz/vp.exe target/release/vp.exe 2>/dev/null || true
393393
cp tmp/tgz/vp-shim.exe target/release/vp-shim.exe 2>/dev/null || true
394394
chmod +x target/release/vp 2>/dev/null || true
395-
node $GITHUB_WORKSPACE/packages/tools/src/install-global-cli.ts --tgz $GITHUB_WORKSPACE/tmp/tgz/vite-plus-0.0.0.tgz
395+
VP_TGZ=$(ls "$GITHUB_WORKSPACE"/tmp/tgz/vite-plus-[0-9]*.tgz | head -n1)
396+
node "$GITHUB_WORKSPACE"/packages/tools/src/install-global-cli.ts --tgz "$VP_TGZ"
396397
# Use USERPROFILE (native Windows path) instead of HOME (Git Bash path /c/Users/...)
397398
# so cmd.exe and Node.js execSync can resolve binaries in PATH
398399
echo "${USERPROFILE:-$HOME}/.vite-plus/bin" >> $GITHUB_PATH

.github/workflows/test-vp-create.yml

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,6 @@ jobs:
152152
- yarn
153153
- bun
154154
env:
155-
VP_OVERRIDE_PACKAGES: '{"vite":"file:${{ github.workspace }}/tmp/tgz/voidzero-dev-vite-plus-core-0.0.0.tgz","vitest":"file:${{ github.workspace }}/tmp/tgz/voidzero-dev-vite-plus-test-0.0.0.tgz","@voidzero-dev/vite-plus-core":"file:${{ github.workspace }}/tmp/tgz/voidzero-dev-vite-plus-core-0.0.0.tgz","@voidzero-dev/vite-plus-test":"file:${{ github.workspace }}/tmp/tgz/voidzero-dev-vite-plus-test-0.0.0.tgz"}'
156-
VP_VERSION: 'file:${{ github.workspace }}/tmp/tgz/vite-plus-0.0.0.tgz'
157155
# Force full dependency rewriting so the library template's existing
158156
# vite-plus dep gets overridden with the local tgz
159157
VP_FORCE_MIGRATE: '1'
@@ -170,12 +168,22 @@ jobs:
170168
name: vite-plus-packages
171169
path: tmp/tgz
172170

171+
- name: Resolve tgz paths
172+
run: |
173+
CLI_TGZ=$(ls "$GITHUB_WORKSPACE"/tmp/tgz/vite-plus-[0-9]*.tgz | head -n1)
174+
CORE_TGZ=$(ls "$GITHUB_WORKSPACE"/tmp/tgz/voidzero-dev-vite-plus-core-[0-9]*.tgz | head -n1)
175+
TEST_TGZ=$(ls "$GITHUB_WORKSPACE"/tmp/tgz/voidzero-dev-vite-plus-test-[0-9]*.tgz | head -n1)
176+
echo "CLI_TGZ=$CLI_TGZ" >> $GITHUB_ENV
177+
echo "VP_VERSION=file:$CLI_TGZ" >> $GITHUB_ENV
178+
printf 'VP_OVERRIDE_PACKAGES={"vite":"file:%s","vitest":"file:%s","@voidzero-dev/vite-plus-core":"file:%s","@voidzero-dev/vite-plus-test":"file:%s"}\n' \
179+
"$CORE_TGZ" "$TEST_TGZ" "$CORE_TGZ" "$TEST_TGZ" >> $GITHUB_ENV
180+
173181
- name: Install vp CLI
174182
run: |
175183
mkdir -p target/release
176184
cp tmp/tgz/vp target/release/vp
177185
chmod +x target/release/vp
178-
node $GITHUB_WORKSPACE/packages/tools/src/install-global-cli.ts --tgz $GITHUB_WORKSPACE/tmp/tgz/vite-plus-0.0.0.tgz
186+
node $GITHUB_WORKSPACE/packages/tools/src/install-global-cli.ts --tgz "$CLI_TGZ"
179187
echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
180188
181189
- name: Verify vp installation
@@ -258,9 +266,10 @@ jobs:
258266
run: |
259267
node -e "
260268
const path = require('path');
269+
const expected = require('$GITHUB_WORKSPACE/packages/cli/package.json').version;
261270
const pkg = require(path.resolve('node_modules/vite-plus/package.json'));
262-
if (pkg.version !== '0.0.0') {
263-
console.error('Expected vite-plus@0.0.0, got ' + pkg.version);
271+
if (pkg.version !== expected) {
272+
console.error('Expected vite-plus@' + expected + ', got ' + pkg.version);
264273
process.exit(1);
265274
}
266275
console.log('✓ vite-plus@' + pkg.version + ' installed correctly');

Cargo.lock

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

crates/vite_global_cli/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "vite_global_cli"
3-
version = "0.0.0"
3+
version = "0.1.22"
44
authors.workspace = true
55
edition.workspace = true
66
license.workspace = true

ecosystem-ci/patch-project.ts

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,12 @@ import { execSync } from 'node:child_process';
22
import { readFile, writeFile } from 'node:fs/promises';
33
import { join } from 'node:path';
44

5+
import cliPkg from '../packages/cli/package.json' with { type: 'json' };
56
import { ecosystemCiDir, tgzDir } from './paths.ts';
67
import repos from './repo.json' with { type: 'json' };
78

9+
const vpVersion = cliPkg.version;
10+
811
const projects = Object.keys(repos);
912

1013
const project = process.argv[2];
@@ -54,11 +57,11 @@ execSync(`${cli} migrate --no-agent --no-interactive`, {
5457
...process.env,
5558
...(forceFreshMigration ? { VP_FORCE_MIGRATE: '1' } : {}),
5659
VP_OVERRIDE_PACKAGES: JSON.stringify({
57-
vite: `file:${tgzDir}/voidzero-dev-vite-plus-core-0.0.0.tgz`,
58-
vitest: `file:${tgzDir}/voidzero-dev-vite-plus-test-0.0.0.tgz`,
59-
'@voidzero-dev/vite-plus-core': `file:${tgzDir}/voidzero-dev-vite-plus-core-0.0.0.tgz`,
60-
'@voidzero-dev/vite-plus-test': `file:${tgzDir}/voidzero-dev-vite-plus-test-0.0.0.tgz`,
60+
vite: `file:${tgzDir}/voidzero-dev-vite-plus-core-${vpVersion}.tgz`,
61+
vitest: `file:${tgzDir}/voidzero-dev-vite-plus-test-${vpVersion}.tgz`,
62+
'@voidzero-dev/vite-plus-core': `file:${tgzDir}/voidzero-dev-vite-plus-core-${vpVersion}.tgz`,
63+
'@voidzero-dev/vite-plus-test': `file:${tgzDir}/voidzero-dev-vite-plus-test-${vpVersion}.tgz`,
6164
}),
62-
VP_VERSION: `file:${tgzDir}/vite-plus-0.0.0.tgz`,
65+
VP_VERSION: `file:${tgzDir}/vite-plus-${vpVersion}.tgz`,
6366
},
6467
});

ecosystem-ci/verify-install.ts

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
import { createRequire } from 'node:module';
22

3+
import cliPkg from '../packages/cli/package.json' with { type: 'json' };
4+
35
const require = createRequire(`${process.cwd()}/`);
46

5-
const expectedVersion = '0.0.0';
7+
const expectedVersion = cliPkg.version;
68

79
try {
810
const pkg = require('vite-plus/package.json') as { version: string; name: string };

packages/cli/binding/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "vite-plus-cli"
3-
version = "0.0.0"
3+
version = "0.1.22"
44
authors.workspace = true
55
edition.workspace = true
66
license.workspace = true

0 commit comments

Comments
 (0)