feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #1924 · voidzero-dev/vite-plus

voidzero-guard · 2026-06-23T12:55:23Z

Summary

Automated upgrade of upstream dependencies, including the rolldown tag bump to v1.1.2 and vite to v8.1.0.
Bumps the oxc toolchain (oxfmt, oxlint, @oxc-project/*, oxc-*) from 0.136.0/0.55.0/1.70.0 to 0.137.0/0.56.0/1.71.0, plus the workspace oxc crates 0.135.0 -> 0.137.0.
Required a small source fix in vite_static_config for the oxc parser API change and regenerated NAPI bindings.
build-upstream step failed; see Build status.

Dependency updates

Package	From	To
`rolldown`	`d7f919c`	`v1.1.2 (e0d0b1b)`
`vite`	`f94df87`	`v8.1.0 (63b1489)`
`oxfmt`	`0.55.0`	`0.56.0`
`oxlint`	`1.70.0`	`1.71.0`
`@oxc-project/runtime`	`0.136.0`	`0.137.0`
`@oxc-project/types`	`0.136.0`	`0.137.0`
`oxc-minify`	`0.136.0`	`0.137.0`
`oxc-parser`	`0.136.0`	`0.137.0`
`oxc-transform`	`0.136.0`	`0.137.0`

Unchanged dependencies

vitest and @vitest/*: 4.1.9
tsdown: 0.22.3
@oxc-node/cli: 0.1.0
@oxc-node/core: 0.1.0
oxlint-tsgolint: 0.23.0
@vitejs/devtools: 0.3.3

Code changes

crates/vite_static_config/src/lib.rs: use result.diagnostics instead of result.errors for the oxc parser result (oxc 0.135 -> 0.137 API change).
Cargo.toml: bump workspace oxc crates 0.135.0 -> 0.137.0, oxc_resolver 11.21.0 -> 11.21.3, oxc_sourcemap 7 -> 8.0.1; drop unused workspace deps (commondir, num-format, ropey, urlencoding, rolldown_plugin_vite_wasm_fallback); add idna_adapter and supports-color pins.
packages/cli/binding/index.cjs, packages/cli/binding/index.d.cts: regenerated NAPI bindings (add BindingErrorStage export; remove React Compiler option types).
packages/core/package.json: bump bundledVersions (vite 8.1.0, rolldown 1.1.2) and @vitejs/devtools peer range ^0.1.18 -> ^0.3.0.
pnpm-workspace.yaml: catalog bumps (@babel/* 7.24.7 -> 7.29.7, @napi-rs/cli, acorn) and added minimumReleaseAgeExclude entries.
Cargo.lock, pnpm-lock.yaml: lockfile updates.

Build status

sync-remote-and-build: success
build-upstream: failure

- rolldown: d7f919c -> v1.1.2 (e0d0b1b) - vite: f94df87 -> v8.1.0 (63b1489) - oxfmt: 0.55.0 -> 0.56.0 - oxlint: 1.70.0 -> 1.71.0 - @oxc-project/runtime: 0.136.0 -> 0.137.0 - @oxc-project/types: 0.136.0 -> 0.137.0 - oxc-minify: 0.136.0 -> 0.137.0 - oxc-parser: 0.136.0 -> 0.137.0 - oxc-transform: 0.136.0 -> 0.137.0 Code changes: - crates/vite_static_config/src/lib.rs: use `result.diagnostics` instead of `result.errors` for the oxc parser result (oxc 0.135 -> 0.137 API change). - Cargo.toml: bump oxc crates 0.135 -> 0.137, oxc_resolver 11.21.0 -> 11.21.3, oxc_sourcemap 7 -> 8.0.1; drop unused workspace deps (commondir, num-format, ropey, urlencoding, rolldown_plugin_vite_wasm_fallback); add idna_adapter and supports-color pins. - packages/cli/binding/index.cjs, packages/cli/binding/index.d.cts: regenerated NAPI bindings (add BindingErrorStage export; drop React Compiler option types). - packages/core/package.json: bump bundledVersions (vite 8.1.0, rolldown 1.1.2) and @vitejs/devtools peer range ^0.1.18 -> ^0.3.0. - pnpm-workspace.yaml: catalog bumps (@babel/* 7.24.7 -> 7.29.7, @napi-rs/cli, acorn) and added minimumReleaseAgeExclude entries.

netlify · 2026-06-23T12:55:28Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`ffa9c90`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a3aadb48385aa00079fc3c1

socket-security · 2026-06-23T12:56:27Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/oxfmt@0.56.0
	npm/fresh-import@0.2.1
	npm/@voidzero-dev/vite-task-client@0.2.0
	npm/@babel/preset-typescript@7.29.7
	npm/typescript-eslint@8.61.1
	npm/@oxc-project/runtime@0.137.0
	npm/@vitest/utils@4.1.7 ⏵ 4.1.8
	npm/oxfmt@0.54.0
	npm/http-proxy-3@1.23.3
	npm/unrun@0.3.1
	npm/oxc-parser@0.137.0
	npm/eslint-plugin-n@18.1.0
	npm/sass@1.101.0
	cargo/oxc_allocator@0.135.0 ⏵ 0.137.0
	cargo/oxc_ast@0.135.0 ⏵ 0.137.0
	cargo/oxc_parser@0.135.0 ⏵ 0.137.0
	cargo/oxc_resolver@11.21.0 ⏵ 11.21.3
	cargo/oxc_span@0.135.0 ⏵ 0.137.0
	npm/oxc-transform@0.137.0

View full report

socket-security · 2026-06-23T12:56:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@typescript-eslint/eslint-plugin` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/typescript-eslint@8.61.1` → `npm/@typescript-eslint/eslint-plugin@8.61.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `oxfmt` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/oxfmt@0.56.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxfmt@0.56.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `oxfmt` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/oxfmt@0.56.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxfmt@0.56.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

The oxlint bump to 1.71.0 (published <24h before this PR's CI ran) broke two jobs. `vp migrate` runs `vp dlx @oxlint/migrate@<bundled oxlint>`, and both package managers reject the fresh version as too new: - dify e2e: pnpm ERR_PNPM_NO_MATURE_MATCHING_VERSION. dify keeps `resolutionMode: time-based`, which on its own re-activates the minimumReleaseAge policy with a 1440 (24h) default even after the patch strips `minimumReleaseAge: 0`. Strip resolutionMode too. - vp create remote-vite-react-ts (yarn): yarn quarantines it (YN0016) via npmMinimalAgeGate (default 1440). Set YARN_NPM_MINIMAL_AGE_GATE=0 for the create test job (no-op for npm/pnpm/bun). The migrate tool is version-pinned to the bundled oxlint, so a minimum release-age gate adds no safety here.

The earlier resolutionMode strip was a no-op for `vp dlx` (the bundled pnpm does not derive a minimumReleaseAge default from resolutionMode, verified locally), so dify still failed on the fresh @oxlint/migrate@1.71.0 with ERR_PNPM_NO_MATURE_MATCHING_VERSION. Set `pnpm_config_minimum_release_age=0` on the migrate step instead. The `pnpm_config_` prefix is required: `npm_config_*` does not override pnpm-workspace.yaml settings. Revert the no-op resolutionMode strip; the yarn create fix (YARN_NPM_MINIMAL_AGE_GATE=0) already passed and stays.

pkg-pr-new · 2026-06-23T15:42:28Z

Open in StackBlitz

vite-plus

npm i https://pkg.pr.new/voidzero-dev/vite-plus@1924

@voidzero-dev/vite-plus-core

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1924

@voidzero-dev/vite-plus-prompts

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-prompts@1924

@voidzero-dev/vite-plus-cli-darwin-arm64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-darwin-arm64@1924

@voidzero-dev/vite-plus-cli-darwin-x64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-darwin-x64@1924

@voidzero-dev/vite-plus-cli-linux-arm64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-arm64-gnu@1924

@voidzero-dev/vite-plus-cli-linux-arm64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-arm64-musl@1924

@voidzero-dev/vite-plus-cli-linux-x64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-x64-gnu@1924

@voidzero-dev/vite-plus-cli-linux-x64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-x64-musl@1924

@voidzero-dev/vite-plus-cli-win32-arm64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-win32-arm64-msvc@1924

@voidzero-dev/vite-plus-cli-win32-x64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-win32-x64-msvc@1924

@voidzero-dev/vite-plus-darwin-arm64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-darwin-arm64@1924

@voidzero-dev/vite-plus-darwin-x64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-darwin-x64@1924

@voidzero-dev/vite-plus-linux-arm64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-arm64-gnu@1924

@voidzero-dev/vite-plus-linux-arm64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-arm64-musl@1924

@voidzero-dev/vite-plus-linux-x64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-x64-gnu@1924

@voidzero-dev/vite-plus-linux-x64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-x64-musl@1924

@voidzero-dev/vite-plus-win32-arm64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-win32-arm64-msvc@1924

@voidzero-dev/vite-plus-win32-x64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-win32-x64-msvc@1924

commit: 529ae37

Bump dify's pin to latest main (50b3228b), which moves it from pnpm 11.5.2 to 11.8.0. That is the real fix for the migrate failure: - 11.5.2 errors (ERR_PNPM_NO_MATURE_MATCHING_VERSION) on the fresh @oxlint/migrate dlx via resolutionMode: time-based, and crashes (ERR_PNPM_RESOLUTION_POLICY_VIOLATIONS_UNHANDLED) on dify's file: overrides whenever the minimumReleaseAge policy is active. - 11.8.0 fixed the policy-violations crash and auto-excludes freshly published dlx packages instead of erroring. Verified locally: dify migrate + install succeeds end-to-end on 11.8.0, and all three e2e test files still exist at 50b3228b. Revert the pnpm_config_minimum_release_age env override (it activated the policy on 11.5.2 and triggered the crash). The yarn create fix (YARN_NPM_MINIMAL_AGE_GATE=0) stays.

fengmk2 self-assigned this Jun 23, 2026

fengmk2 approved these changes Jun 23, 2026

View reviewed changes

fengmk2 added the pkg.pr.new label Jun 23, 2026

fengmk2 merged commit b386620 into main Jun 23, 2026
92 checks passed

fengmk2 deleted the deps/upstream-update branch June 23, 2026 16:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(deps): upgrade upstream dependencies#1924

feat(deps): upgrade upstream dependencies#1924
fengmk2 merged 4 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Jun 23, 2026

Uh oh!

netlify Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jun 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

voidzero-guard Bot commented Jun 23, 2026

Summary

Dependency updates

Code changes

Build status

Uh oh!

netlify Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

socket-security Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

netlify Bot commented Jun 23, 2026 •

edited

Loading

socket-security Bot commented Jun 23, 2026 •

edited

Loading

socket-security Bot commented Jun 23, 2026 •

edited

Loading