⬆️ deps: Update Node.js dev dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@github/local-action	^7.0.0 → ^7.0.1
@types/node (source)	^24.8.1 → ^24.12.4
typescript (source)	^6.0.0 → ^6.0.3
vite-plus (source)	^0.1.16 → ^0.1.22
vitest (source)	^4.1.4 → ^4.1.7

---

Release Notes

voidzero-dev/vite-plus (vite-plus)

v0.1.22: vite-plus v0.1.22

Compare Source

A critical Vitest browser-mode security fix, parallel vp add -g installs, a built-in oxlint rule to prefer vite-plus imports, and a new --git switch for vp create.

Highlights

• Security: bundled vitest bumped to 4.1.6 to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via the otelCarrier query parameter in Vitest browser mode (#​1633)
• Parallel global install: vp add/install/update -g now installs packages concurrently with a progress bar and a --concurrency flag (default 5) (#​1597)
• Prefer vite-plus imports: new bundled oxlint rule rewrites vite/vitest imports to vite-plus, enabled by default in generated and migrated lint configs (#​1408)
• Git init on scaffold: vp create learns --git/--no-git (interactive prompt; auto-commits "Initial commit from Vite+") (#​1484)

Features

• Spawn npm for global installation in parallel with a progress bar and a --concurrency option (#​1597), by @​liangmiQwQ
• Add bundled oxlint rule to prefer vite-plus imports over vite/vitest (#​1408), by @​Han5991
• vp create: initialize a git repository and create an initial commit on scaffold (#​1484), by @​ryohidaka
• vp create: rename underscore-prefixed files (_gitignore, _npmrc, _yarnrc.yml) to dotfiles for @org/create bundled templates (#​1574), by @​jong-kyung
• Add VP_PR_VERSION env var to install unreleased PR builds via pkg.pr.new (#​1578), by @​fengmk2

Fixes & Enhancements

• Skip merging standalone .oxfmtrc/.oxlintrc config when the fmt:/lint: key is already declared in vite.config.ts (fixes duplicate-block regression in vp create fate) (#​1601), by @​fengmk2
• Suppress the VITE+ - The Unified Toolchain for the Web banner for vp lint --lsp, vp fmt --lsp, and vp fmt --stdin-filepath so stdout stays a pure LSP / formatter stream (#​1619), by @​fengmk2
• vp create: detect output directory when running in the current directory (#​1606), by @​jong-kyung
• vp update -g: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs from npm view ... version --json (#​1596), by @​leno23
• vp create: preserve single-segment project path in updateWorkspaceConfig (#​1582), by @​jong-kyung
• vp env use: keep the change session-scoped on Windows (#​1577), by @​fengmk2
• vp rebuild: accept positional package names (#​1564), by @​fengmk2
• Adopt the new vite-task error formatter; errors now print as error: <top-level> plus * <source> chain lines, with bold-red highlight on a TTY (vite-task#390), by @​branchseer
• vite-task: forward LOCALAPPDATA so Node's compile cache stays outside the workspace on Windows (vite-task#389), by @​branchseer
• Bump vite-task to c945cc0 (#​1628), by @​branchseer

Refactor

• Revert vp pm plugin command (per discussion in #​1038) (#​1623), by @​jong-kyung

Docs

• Add vitepress-plugin-llms to the docs site so the published docs include LLM-friendly outputs (/llms.txt) (#​1625), by @​jong-kyung
• Refresh home stats for oxlint, vite, and vitest (#​1512), by @​nozomee
• Mention vp env doctor in agent instructions (#​1603), by @​leno23

Chore

• Consolidate the upstream build chain into a single pnpm build script (justfile recipe now just calls pnpm build) (#​1626), by @​fengmk2
• Fix bootstrap-cli on Windows (#​1583), by @​fengmk2
• Refresh trusted stack stats (#​1573, #​1616), by @​voidzero-guard[bot]
• Update GitHub Actions (#​1611, #​1612), by @​renovate[bot]
• Address zizmor findings in composite actions and the release workflow; drop unused actions-cool/issues-helper (#​1630), by @​Boshen
• Switch plain checkouts to taiki-e/checkout-action (#​1620), by @​Boshen
• Switch release to a version-bump PR + push trigger flow (#​1575), by @​Boshen
• Gate release publish on environment approval with a Discord notice (#​1571), by @​Boshen
• Enable cargo clippy with -D warnings (#​1579), by @​Boshen
• Drop unused setup-node from the version-check job (#​1600), by @​fengmk2
• Add Void deploy workflows for the docs site (#​1590), by @​fengmk2
• Add --help case to config snap tests for npm10/yarn1/yarn4 (#​1585), by @​jong-kyung
• Add --help case to publish snap tests for npm10/yarn1/yarn4 (#​1584), by @​jong-kyung
• Verify .gitignore and .yarnrc.yml in the new-vite-monorepo snap (#​1576), by @​jong-kyung
• vite-task: bump pnpm to 11.1.2 (vite-task#383), by @​branchseer
• vite-task: update lint-staged to v17 (vite-task#385), by @​renovate[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.11	66f3194
rolldown	1.0.0	ac5c710
tsdown	0.22.0	npm
vitest	4.1.6	npm
oxlint	1.63.0	npm
oxlint-tsgolint	0.22.1	npm
oxfmt	0.48.0	npm

New Contributors

Welcome to all new contributors! 🎉

@​nozomee, @​ryohidaka, @​leno23

Full Changelog: voidzero-dev/vite-plus@v0.1.21...v0.1.22

Published Packages

• @voidzero-dev/vite-plus-core@0.1.22
• @voidzero-dev/vite-plus-test@0.1.22
• vite-plus@0.1.22

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

v0.1.21: vite-plus v0.1.21 — Create, Migrate & Local CLI Power-Up

Compare Source

vp create learns @org templates, vp migrate rewrites more of your codebase, and the local CLI gains full vp pm parity.

Highlights

• Package-manager parity — every vp pm command now works from the local CLI (#​1495)
• More Nushell support — broader shell coverage for vp env and related commands (#​1305)
• Smarter vp migrate — rewrites named catalogs (#​1493), tsdown/client imports & declare module statements (#​1541), and tsdown/client / vite/client in tsconfig compilerOptions.types (#​1542)
• vp create @org templates — scoped default templates are now supported (#​1398)

Features

• Bring all package-manager commands to the local CLI (#​1495) — @​fengmk2
• Support @org default templates in vp create (#​1398) — @​fengmk2
• Support yarn plugin commands via vp pm plugin (#​1540) — @​jong-kyung
• Forward --provenance flag when publishing a package (#​1549) — @​cpojer
• More Nushell support (#​1305) — @​XiNiHa
• vp migrate: rewrite tsdown/client imports and declare module statements (#​1541) — @​naokihaba
• vp migrate: rewrite tsdown/client and vite/client in tsconfig compilerOptions.types (#​1542) — @​naokihaba
• vite-task: add output globs for cache restoration (vite-task#375) — @​branchseer
• vite-task: store colored task logs, strip at display when needed (vite-task#378) — @​branchseer
• Upgrade upstream dependencies — rolldown v1.0.0, vite v8.0.11, tsdown 0.22.0 (with new tsx config-loader), oxc Rust crates 0.128.0, oxc npm 0.129.0, oxlint 1.63.0, oxfmt 0.48.0, @vitejs/devtools 0.1.21 (#​1521, #​1531, #​1548) — @​voidzero-guard[bot]

Fixes & Enhancements

• vp migrate: rewrite named catalogs (#​1493) — @​lyzno1
• Show create and migrate in local CLI top-level help (#​1508) — @​nurazon59
• Fish env setup using string-literal command for vp env commands (#​1518) — @​mikkurogue
• Auto-pass --ignore-scripts when pnpm >=11 in migrate/create (#​1533) — @​fengmk2
• Route Windows .cmd shims through PowerShell for pm commands (#​1498) — @​fengmk2
• Add vite-plus/pack/client export as tsdown/client equivalent (#​1501) — @​naokihaba
• Publish release as draft to support immutable releases (#​1558) — @​fengmk2
• Preserve string-literal tabs in convertTabsToSpaces (#​1559) — @​fengmk2
• Include docs/ in fmt and lint (#​1552) — @​fengmk2
• vite-task: move FORCE_COLOR fallback after pattern filtering (vite-task#379) — @​branchseer
• vite-task: preserve PATHEXT for Windows cached tasks (vite-task#366) — @​SegaraRai
• Bump vite-task to c63db22 (#​1560) — @​branchseer

Refactor

• Convert team data file to TypeScript (#​1515) — @​jong-kyung

Docs

• Add filename labels to configuration code blocks (#​1496) — @​fengmk2
• Add monorepo overrides guide (#​1535) — @​fengmk2
• Improve "before" CI usage to actual use case (#​1551) — @​Mister-Hope

Chore

• Update crate-ci/typos action to v1.46.1 (#​1509, #​1554) — @​renovate[bot]
• Rewrite upgrade-deps script in TypeScript (#​1514) — @​camc314
• Add pnpm v11 snap tests for command adaptation coverage (#​1289) — @​fengmk2
• Bump upgrade-deps max-turns from 200 to 400 (#​1520) — @​fengmk2
• Update pnpm to v10.33.2 (#​1505) — @​renovate[bot]
• Prevent false-positive <repeat> replacement on trailing plus (#​1524) — @​nurazon59
• Update lodash-es to v4.18.1 [security] (#​1522) — @​renovate[bot]
• Stabilize global snap tests against pnpm v11 (#​1528) — @​fengmk2
• Disable npm and cargo updates in Renovate (#​1536) — @​Boshen
• Publish preview packages to pkg.pr.new (#​1526) — @​Boshen
• Gate pkg.pr.new publish on label only (#​1547) — @​Boshen
• Upgrade GitHub Actions to latest versions (#​956) — @​salmanmkc
• Upgrade GitHub Actions for Node 24 compatibility (#​955) — @​salmanmkc
• Correct kazupon's X account link on the team page (#​1513) — @​jong-kyung
• Ensure no file changes after build-upstream step (#​1563) — @​fengmk2

Bundled Versions

Tool	Version	Source
vite	8.0.11	66f3194
rolldown	1.0.0	ac5c710
tsdown	0.22.0	npm
vitest	4.1.5	npm
oxlint	1.63.0	npm
oxlint-tsgolint	0.22.1	npm
oxfmt	0.48.0	npm

Published Packages

• @voidzero-dev/vite-plus-core@0.1.21
• @voidzero-dev/vite-plus-test@0.1.21
• vite-plus@0.1.21

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Upgrade:

vp upgrade

New Contributors

Welcome to all new contributors! 🎉

@​nurazon59, @​mikkurogue, @​Mister-Hope, @​salmanmkc, @​XiNiHa

Full Changelog: voidzero-dev/vite-plus@v0.1.20...v0.1.21

vitest-dev/vitest (vitest)

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

v4.1.6

Compare Source

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in #​10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in #​10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in #​10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in #​10276 (9f7b1)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.