feat(deps): upgrade upstream dependencies#1569
Closed
voidzero-guard[bot] wants to merge 3 commits into
Closed
Conversation
- rolldown: ac5c710 -> v1.0.1 (2777945) - vite: 66f3194 -> v8.0.12 (4dce8b4) - vitest: 4.1.5 -> 4.1.6 - oxfmt: 0.48.0 -> 0.49.0 - oxlint: 1.63.0 -> 1.64.0 - @oxc-project/runtime: 0.129.0 -> 0.130.0 - @oxc-project/types: 0.129.0 -> 0.130.0 - oxc-minify: 0.129.0 -> 0.130.0 - oxc-parser: 0.129.0 -> 0.130.0 - oxc-transform: 0.129.0 -> 0.130.0 - @vitejs/devtools: 0.1.21 -> 0.1.22 - rolldown-plugin-dts: 0.23.0 -> 0.25.0 - valibot: 1.3.1 -> 1.4.0 - vitepress-plugin-graphviz: 0.0.1 -> 0.1.0 Code changes: - Drop `pnpm --filter @rolldown/pluginutils build` step now that `@rolldown/pluginutils` is published standalone (.github/actions/build-upstream/action.yml, justfile). - Add `@rolldown/pluginutils: ^1.0.0` to the workspace catalog and remove the workspace override (pnpm-workspace.yaml). - Resolve `@rolldown/pluginutils` from the hoisted `rolldown/packages/rolldown/node_modules/@rolldown/pluginutils` path (packages/core/build.ts, packages/tools/src/sync-remote-deps.ts). - Simplify `./rolldown/pluginutils` exports to point at `.mjs` files in packages/core/package.json and bump bundledVersions. - Update parse-error snapshot to drop the `Error:` prefix (packages/cli/snap-tests-global/command-staged-broken-config/snap.txt). - Add `rolldown_ecmascript` to a rolldown crate's dependencies (Cargo.lock).
✅ Deploy Preview for viteplus-preview canceled.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
vite-plus
@voidzero-dev/vite-plus-core
@voidzero-dev/vite-plus-prompts
@voidzero-dev/vite-plus-test
@voidzero-dev/vite-plus-cli-darwin-arm64
@voidzero-dev/vite-plus-cli-darwin-x64
@voidzero-dev/vite-plus-cli-linux-arm64-gnu
@voidzero-dev/vite-plus-cli-linux-arm64-musl
@voidzero-dev/vite-plus-cli-linux-x64-gnu
@voidzero-dev/vite-plus-cli-linux-x64-musl
@voidzero-dev/vite-plus-cli-win32-arm64-msvc
@voidzero-dev/vite-plus-cli-win32-x64-msvc
@voidzero-dev/vite-plus-darwin-arm64
@voidzero-dev/vite-plus-darwin-x64
@voidzero-dev/vite-plus-linux-arm64-gnu
@voidzero-dev/vite-plus-linux-arm64-musl
@voidzero-dev/vite-plus-linux-x64-gnu
@voidzero-dev/vite-plus-linux-x64-musl
@voidzero-dev/vite-plus-win32-arm64-msvc
@voidzero-dev/vite-plus-win32-x64-msvc
commit: |
7 tasks
fengmk2
added a commit
that referenced
this pull request
May 15, 2026
## Summary Add `VP_PR_VERSION` env var to both `install.sh` and `install.ps1` so users can install an unreleased PR build (or any commit) via pkg.pr.new for temporary testing. Since npm releases only ship from `main`, pkg.pr.new is the only available testing channel for in-flight changes. When `VP_PR_VERSION` is set, the installer: - Bypasses the npm registry (no metadata fetch) - Downloads the CLI platform tarball from `https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-{platform}@{PR_or_SHA}` - Writes `vite-plus` in the wrapper `package.json` as `https://pkg.pr.new/voidzero-dev/vite-plus@{PR_or_SHA}` — the published pkg.pr.new tarball already rewrites scoped workspace deps to matching pkg.pr.new URLs by commit SHA, so pnpm pulls in a coherent PR build. - Installs into `~/.vite-plus/pkg-pr-new-{PR_or_SHA}/` — a non-semver dir name so `cleanup_old_versions` won't auto-delete it. - Errors early if combined with `VP_LOCAL_TGZ`. ## Usage ```bash # bash / macOS / Linux curl -fsSL https://vite.plus | VP_PR_VERSION=1569 bash ``` ```powershell # Windows $env:VP_PR_VERSION = "1569"; irm https://vite.plus/ps1 | iex ``` `VP_PR_VERSION` accepts either a PR number (e.g. `1569`) or a commit SHA. ## Test plan End-to-end verified against #1569 in a sandboxed `HOME`: - [x] `vp --version` reports `v0.0.0-pkg-pr-new.c178e90` (matches PR #1569 commit) - [x] `node_modules/vite-plus/package.json` version matches the PR build - [x] Transitive `@voidzero-dev/vite-plus-core` resolves via pkg.pr.new URL with the same commit SHA - [x] `pnpm-lock.yaml` records `vite-plus.specifier: https://pkg.pr.new/voidzero-dev/vite-plus@1569` - [x] Normal (no `VP_PR_VERSION`) flow unchanged — still hits npm registry - [x] `VP_PR_VERSION` + `VP_LOCAL_TGZ` errors early as expected - [x] `bash -n` passes on `install.sh` <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes the installation path and download sources in the cross-platform installers, which could break installs or pull unintended artifacts if the new URL construction/branching logic is wrong. Scope is limited to `install.sh`/`install.ps1` and guarded by an opt-in env var. > > **Overview** > Adds `VP_PR_VERSION` to `install.sh` and `install.ps1` to install unreleased PR/commit builds via `pkg.pr.new`, bypassing npm metadata/version resolution. > > When set, the installers (1) refuse to run alongside `VP_LOCAL_TGZ`, (2) download the platform CLI tarball from `pkg.pr.new`, (3) install into a synthetic non-semver version directory (`pkg-pr-new-...`) to avoid old-version cleanup, and (4) write the wrapper `package.json` dependency as a `pkg.pr.new` URL so `pnpm` pulls a coherent PR build of `vite-plus` and its workspace deps. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 247c17e. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
fengmk2
added a commit
that referenced
this pull request
May 15, 2026
Match the lighter-weight handling from #1569: - packages/core/package.json: collapse the two pluginutils exports back to single .mjs strings. TypeScript already resolves a sibling .d.mts for an .mjs path under moduleResolution: bundler / node16, so the explicit `types` entries were redundant. - packages/tools/src/sync-remote-deps.ts: drop the parallel .mjs branch in transformPluginutilsExport — once we stop wrapping string exports into objects, the matching `types` derivation isn't needed either. - .github/actions/build-upstream/action.yml, justfile: drop the `pnpm --filter @rolldown/pluginutils build` step. Since rolldown moved pluginutils out of its workspace into a standalone npm package (rolldown/plugins), no workspace package matches that filter — the step was a silent no-op (`No projects matched the filters`).
fengmk2
added a commit
that referenced
this pull request
May 15, 2026
Match the lighter-weight handling from #1569: - packages/core/package.json: collapse the two pluginutils exports back to single .mjs strings. TypeScript already resolves a sibling .d.mts for an .mjs path under moduleResolution: bundler / node16, so the explicit `types` entries were redundant. - packages/tools/src/sync-remote-deps.ts: drop the parallel .mjs branch in transformPluginutilsExport — once we stop wrapping string exports into objects, the matching `types` derivation isn't needed either. - .github/actions/build-upstream/action.yml, justfile: drop the `pnpm --filter @rolldown/pluginutils build` step. Since rolldown moved pluginutils out of its workspace into a standalone npm package (rolldown/plugins), no workspace package matches that filter — the step was a silent no-op (`No projects matched the filters`).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v1.0.1(2777945) and vitev8.0.12(4dce8b4); bump vitest to4.1.6and the@oxc-project/*/oxc-*family to0.130.0.@rolldown/pluginutilspackage (now published outside the rolldown monorepo): add it to the workspace catalog, drop its dedicated build step, and resolve it from the hoistednode_modulespath.rolldown_ecmascriptto a rolldown crate's lockfile entry.Dependency updates
rolldownac5c710v1.0.1 (2777945)vite66f3194v8.0.12 (4dce8b4)vitest4.1.54.1.6oxfmt0.48.00.49.0oxlint1.63.01.64.0@oxc-project/runtime0.129.00.130.0@oxc-project/types0.129.00.130.0oxc-minify0.129.00.130.0oxc-parser0.129.00.130.0oxc-transform0.129.00.130.0@vitejs/devtools0.1.210.1.22rolldown-plugin-dts0.23.00.25.0valibot1.3.11.4.0vitepress-plugin-graphviz0.0.10.1.0Unchanged dependencies
tsdown:0.22.0@oxc-node/cli:0.1.0@oxc-node/core:0.1.0oxlint-tsgolint:0.22.1Code changes
.github/actions/build-upstream/action.yml,justfile: remove thepnpm --filter @rolldown/pluginutils buildstep; the package is now consumed from npm rather than built from the rolldown workspace.pnpm-workspace.yaml: add@rolldown/pluginutils: ^1.0.0to the catalog, drop the matchingworkspace:@rolldown/pluginutils@*override, and bump thevitest-devoverride to^4.1.6.packages/core/build.ts,packages/tools/src/sync-remote-deps.ts: resolve@rolldown/pluginutilsfromrolldown/packages/rolldown/node_modules/@rolldown/pluginutilsinstead ofrolldown/packages/pluginutils.packages/core/package.json: collapse./rolldown/pluginutilsand./rolldown/pluginutils/filterexports to single.mjsentries and updatebundledVersions(vite8.0.12,rolldown1.0.1).packages/test/package.json: bump all@vitest/*deps andvitest-devto4.1.6; bumpbundledVersions.vitest.packages/cli/snap-tests-global/command-staged-broken-config/snap.txt: update expected output to drop theError:prefix from the rolldown parse-error message.Cargo.lock: addrolldown_ecmascriptto a rolldown crate's dependencies (regenerated from upstream).Build status
sync-remote-and-build: failurebuild-upstream: failure