chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	^25.8.0 → ^25.9.1			devDependencies	minor
@types/react (source)	^19.2.14 → ^19.2.15			devDependencies	patch
area44/workflows	v4.4.0 → v4.5.0			action	minor
vite (source)	^0.1.21 → ^0.1.22			pnpm-workspace.overrides	patch
vite (source)	^0.1.21 → ^0.1.22			devDependencies	patch

---

Release Notes

area44/workflows (area44/workflows)

v4.5.0

Compare Source

What's Changed

Full Changelog: area44/workflows@v4.4.0...v4.5.0

voidzero-dev/vite-plus (vite)

v0.1.22: vite-plus v0.1.22

Compare Source

A critical Vitest browser-mode security fix, parallel vp add -g installs, a built-in oxlint rule to prefer vite-plus imports, and a new --git switch for vp create.

Highlights

• Security: bundled vitest bumped to 4.1.6 to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via the otelCarrier query parameter in Vitest browser mode (#​1633)
• Parallel global install: vp add/install/update -g now installs packages concurrently with a progress bar and a --concurrency flag (default 5) (#​1597)
• Prefer vite-plus imports: new bundled oxlint rule rewrites vite/vitest imports to vite-plus, enabled by default in generated and migrated lint configs (#​1408)
• Git init on scaffold: vp create learns --git/--no-git (interactive prompt; auto-commits "Initial commit from Vite+") (#​1484)

Features

• Spawn npm for global installation in parallel with a progress bar and a --concurrency option (#​1597), by @​liangmiQwQ
• Add bundled oxlint rule to prefer vite-plus imports over vite/vitest (#​1408), by @​Han5991
• vp create: initialize a git repository and create an initial commit on scaffold (#​1484), by @​ryohidaka
• vp create: rename underscore-prefixed files (_gitignore, _npmrc, _yarnrc.yml) to dotfiles for @org/create bundled templates (#​1574), by @​jong-kyung
• Add VP_PR_VERSION env var to install unreleased PR builds via pkg.pr.new (#​1578), by @​fengmk2

Fixes & Enhancements

• Skip merging standalone .oxfmtrc/.oxlintrc config when the fmt:/lint: key is already declared in vite.config.ts (fixes duplicate-block regression in vp create fate) (#​1601), by @​fengmk2
• Suppress the VITE+ - The Unified Toolchain for the Web banner for vp lint --lsp, vp fmt --lsp, and vp fmt --stdin-filepath so stdout stays a pure LSP / formatter stream (#​1619), by @​fengmk2
• vp create: detect output directory when running in the current directory (#​1606), by @​jong-kyung
• vp update -g: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs from npm view ... version --json (#​1596), by @​leno23
• vp create: preserve single-segment project path in updateWorkspaceConfig (#​1582), by @​jong-kyung
• vp env use: keep the change session-scoped on Windows (#​1577), by @​fengmk2
• vp rebuild: accept positional package names (#​1564), by @​fengmk2
• Adopt the new vite-task error formatter; errors now print as error: <top-level> plus * <source> chain lines, with bold-red highlight on a TTY (vite-task#390), by @​branchseer
• vite-task: forward LOCALAPPDATA so Node's compile cache stays outside the workspace on Windows (vite-task#389), by @​branchseer
• Bump vite-task to c945cc0 (#​1628), by @​branchseer

Refactor

• Revert vp pm plugin command (per discussion in #​1038) (#​1623), by @​jong-kyung

Docs

• Add vitepress-plugin-llms to the docs site so the published docs include LLM-friendly outputs (/llms.txt) (#​1625), by @​jong-kyung
• Refresh home stats for oxlint, vite, and vitest (#​1512), by @​nozomee
• Mention vp env doctor in agent instructions (#​1603), by @​leno23

Chore

• Consolidate the upstream build chain into a single pnpm build script (justfile recipe now just calls pnpm build) (#​1626), by @​fengmk2
• Fix bootstrap-cli on Windows (#​1583), by @​fengmk2
• Refresh trusted stack stats (#​1573, #​1616), by @​voidzero-guard[bot]
• Update GitHub Actions (#​1611, #​1612), by @​renovate[bot]
• Address zizmor findings in composite actions and the release workflow; drop unused actions-cool/issues-helper (#​1630), by @​Boshen
• Switch plain checkouts to taiki-e/checkout-action (#​1620), by @​Boshen
• Switch release to a version-bump PR + push trigger flow (#​1575), by @​Boshen
• Gate release publish on environment approval with a Discord notice (#​1571), by @​Boshen
• Enable cargo clippy with -D warnings (#​1579), by @​Boshen
• Drop unused setup-node from the version-check job (#​1600), by @​fengmk2
• Add Void deploy workflows for the docs site (#​1590), by @​fengmk2
• Add --help case to config snap tests for npm10/yarn1/yarn4 (#​1585), by @​jong-kyung
• Add --help case to publish snap tests for npm10/yarn1/yarn4 (#​1584), by @​jong-kyung
• Verify .gitignore and .yarnrc.yml in the new-vite-monorepo snap (#​1576), by @​jong-kyung
• vite-task: bump pnpm to 11.1.2 (vite-task#383), by @​branchseer
• vite-task: update lint-staged to v17 (vite-task#385), by @​renovate[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.11	66f3194
rolldown	1.0.0	ac5c710
tsdown	0.22.0	npm
vitest	4.1.6	npm
oxlint	1.63.0	npm
oxlint-tsgolint	0.22.1	npm
oxfmt	0.48.0	npm

New Contributors

Welcome to all new contributors! 🎉

@​nozomee, @​ryohidaka, @​leno23

Full Changelog: voidzero-dev/vite-plus@v0.1.21...v0.1.22

Published Packages

• @voidzero-dev/vite-plus-core@0.1.22
• @voidzero-dev/vite-plus-test@0.1.22
• vite-plus@0.1.22

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
area44.github.io	Ready	Preview, Comment	May 24, 2026 12:35am

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.