fix(install): verify modern Yarn hashes against the CLI binary by leslieeilsel · Pull Request #2227 · voidzero-dev/vite-plus

leslieeilsel · 2026-07-23T06:12:59Z

Corepack pins Yarn 2+ from the extracted CLI (bin/yarn.js), while Vite+ hashed the npm tarball. A pin written by corepack use therefore failed vp install on a cold cache, passed on a warm one, and made every vp run re-download Yarn.

verify Yarn 2+ pins against bin/yarn.js; npm, pnpm and Yarn Classic keep the tarball hash
re-verify the cached CLI instead of trusting a warm cache
name the hashed artifact in the error, and stop vp run / vp exec from hiding an integrity failure behind "command not found"

Fixes #2209

Tests: just lint, cargo fmt --all -- --check, cargo test -p vp_error -p vp_pm_cli -p vite-plus-cli, and three PTY cases under install_yarn_corepack_hash. The #2209 pin was checked by hand with a cold, warm and tampered cache.

netlify · 2026-07-23T06:13:04Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`1143616`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a7b0c4b8ebb0c00083ac34b

chatgpt-codex-connector · 2026-08-07T09:03:34Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

leslieeilsel · 2026-08-07T09:03:35Z

Local verification results (run on macOS, `nightly-2026-08-02`)

Since the CI workflows are waiting for maintainer approval, I ran the checks locally on commit 26615d1:

✅ cargo test -p vp_pm_cli --lib — 734 passed, 0 failed (2 ignored), including package_manager::tests and request::tests
✅ cargo fmt --check — clean
✅ cargo clippy -p vp_pm_cli --lib -- -D warnings — no warnings

One note: the PR description's Test Plan references vite_install, but the changed crate is vp_pm_cli (the commands above use the actual crate name).

Could a maintainer please approve the workflow runs? Thanks! 🙏

fengmk2 · 2026-08-09T12:18:15Z

@leslieeilsel Can you convert the reproduction steps described in #2209 into a snapshot test? This would ensure that this issue continues to be validated.

leslieeilsel · 2026-08-09T14:53:16Z

Thanks for the suggestion — I’ve added CLI snapshot coverage based on #2209’s cold-cache reproduction. It uses the exact Corepack-generated Yarn 4.17.1 pin, runs vp install, and verifies that the extracted bin/yarn.js is cached.

I also added a vp run case covering both cold and warm cache behavior from the issue follow-up. Both snapshot cases pass locally in record and compare modes.

fengmk2 · 2026-08-10T16:20:02Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 35de2cb5d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

leslieeilsel · 2026-08-11T00:38:43Z

Thanks for the detailed review. I addressed all three findings in 29036b2f:

Modern Yarn npm tarballs now extract only package/bin/yarn.js; non-regular entries and unrelated archive contents are not written. A regression test covers the malicious bin/yarn symlink case.
Yarn CLI extraction and hash verification now run inside the existing download retry pipeline, with a clean target directory for every attempt. A regression test covers a corrupted first response followed by a valid response.
Hash-pinned Yarn 2+ resolutions now re-verify the cached yarn.js before global shim dispatch. Unpinned installs and other package managers retain the existing fast path. A regression test covers a corrupted warm cache.

The existing archive-hash behavior for npm, pnpm, Yarn Classic, and other package managers remains unchanged.

Local verification:

cargo fmt --all -- --check
cargo test -p vp_pm_cli --locked — 744 passed, 2 ignored
cargo test -p vp_global_cli --locked — 461 passed, 2 ignored
VP_SNAP_SKIP_FLAVORS=local cargo test -p vp_cli_snapshots --locked -- install_yarn_corepack_hash — 2 passed
cargo clippy -p vp_pm_cli -p vp_global_cli --all-features --all-targets --locked -- --deny warnings

github-actions · 2026-08-11T02:20:57Z

Registry bridge build (`29036b2`)

Warning

This build is from the fork leslieeilsel/vite-plus and has not been reviewed.
Installing it runs that code on your machine. Build log

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.29036b2ff12ea30f80088de4a593842df2846c3b`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.29036b2ff12ea30f80088de4a593842df2846c3b`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://vite.plus | VP_PR_VERSION=2227 bash

# Windows (PowerShell)
$env:VP_PR_VERSION="2227"; irm https://vite.plus/ps1 | iex

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.29036b2ff12ea30f80088de4a593842df2846c3b",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.29036b2ff12ea30f80088de4a593842df2846c3b"
  }
}

fengmk2 · 2026-08-11T04:27:25Z

@leslieeilsel I will take over your PR to fix it, as I want to include this fix in today's new version release.

fengmk2 · 2026-08-11T05:06:38Z

@codex review

chatgpt-codex-connector · 2026-08-11T05:10:51Z

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 762ddabd82

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fengmk2 · 2026-08-11T05:40:21Z

@codex review

chatgpt-codex-connector · 2026-08-11T05:43:51Z

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 793dfa8810

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fengmk2 · 2026-08-11T11:04:52Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f23b50bb61

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fengmk2 · 2026-08-11T11:21:01Z

@codex review

chatgpt-codex-connector · 2026-08-11T11:24:06Z

Codex Review: Didn't find any major issues. 👍

Reviewed commit: e5f244cebf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fengmk2 · 2026-08-11T11:33:39Z

@codex review

chatgpt-codex-connector · 2026-08-11T11:37:02Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 4b78a9d4a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Added verification for Yarn binary hash for modern Yarn installations. Updated download logic to handle Yarn 2+ package manager correctly. Signed-off-by: Leslie Lau <1178273431@qq.com>

Signed-off-by: Leslie Lau <1178273431@qq.com>

`Hash mismatch: expected …, got …` named neither the package manager nor the file that was hashed, so voidzero-dev#2209 read as a corrupt download instead of two tools hashing different artifacts. Report both, and say which artifact the pin covers. `vp run` and `vp exec` dropped the failure into a debug log and continued without the managed package manager, so the command failed later with "yarn not found" and no hint about the pin. Stop on an integrity failure there, the way `vp install` already does.

Corepack matches its `>=2.0.0` Yarn range with `satisfiesWithPrereleases`, which drops the prerelease tag before comparing, so `yarn@4.0.0-rc.53` is a Berry pin there. Comparing full semver sent it to the Yarn Classic package, which never published that version. `corepack use yarn@4.0.0-rc.53` now installs under `vp install`, and the cached bin/yarn.js matches the hash Corepack wrote.

The shim had to restate Corepack's Yarn rule to decide whether it could take its fast path, so the same security-relevant condition lived in two crates. `ensure_package_manager_bin` owns it instead, and the shim asks for a bin path without knowing which package manager hashes what. Also from the review pass: - one `download_and_extract_tgz_with_hash` with an optional archive entry, in place of the two-variant extraction enum - `verify_cached_cli_hash` decides whether a pin covers a cached file, so neither early return repeats the test - `name_hashed_artifact` derives the artifact name; the pnpm branch maps at the pin check, so a `dist.integrity` failure keeps its own message - `Error::is_integrity_failure` replaces the predicate the binding exported to its own exec module - `is_yarn_berry` is shared with the Yarn dialect's `is_berry` - `verify_file_hash` streams in 64 KiB chunks on the blocking pool instead of slurping the artifact, which the shim path now reads on every command

The snapshot suite proved `vp install` rejects a tampered cached CLI, but not that `vp run` stops too. That path resolves the package manager through the NAPI binding, which used to log the failure at debug level and run the task without the pinned Yarn.

One idea per sentence, active voice with a named actor, and no gerund subjects, across the comments, doc comments, snapshot step comments, the guide paragraph, and the integrity error itself. The error's second line was a sentence fragment ("..., the artifact Corepack pins"), which read as an aside about the artifact rather than a statement about what vp hashed.

vp hashed the 3 MB `bin/yarn.js` on every command that resolved a hash-pinned Yarn, including every `yarn` shim invocation. It now hashes the CLI once, at install time, and writes the pin it verified next to the install. A later command compares its own pin against that record. A pin that differs from the record still hashes the cached CLI once, so a project that changes its `packageManager` hash cannot pass on a warm cache. An install made by an older vp has no record and is hashed once as well.

The record held only the pin, so a replaced `bin/yarn.js` passed every later resolution and the shim executed it. The record now holds the size and the modification time of the file vp hashed, and a resolution compares them with one `stat` before it trusts the record. A file that changed sends vp back to the hash, which is the failure the two mismatch snapshot cases now cover again. A replacement that keeps the same size and modification time still passes, the same guarantee Corepack gives its own cache.

This reverts commit e5f244c. The size and modification time did not defend against a writer, because `.verified-pin` sits beside the file it describes: whoever replaces the CLI can rewrite the record in the same step. The check only caught accidental corruption, and it is not worth the description it invited. vp keeps the pin comparison, which Corepack does not do, and documents the trust boundary: write access to `$VP_HOME`.

`rfcs/package-manager-detection.md` described the `+sha512.` suffix as an optional part of the field format and said nothing about what the hash covers, which is the ambiguity behind voidzero-dev#2209. The new section names the hashed artifact per package manager, explains why Yarn 2+ is the exception, and states when Vite+ hashes, what it records, and where the trust boundary sits.

@fengmk2

Release vite-plus v0.2.9: two new commands, and `vp run` now works in AI agent sandboxes. `vp toolchain` prints the tools, versions, and bundling relationships in the active release. `vp hooks` manages the Vite+ dispatcher for Git hooks, and removes the manual setup steps. `vp run` no longer fails in the default Codex CLI and Claude Code sandboxes. Those sandboxes deny Unix sockets and shared memory, which task IPC and file-access tracking used. The rest of the release makes the install path more reliable. It fixes npm 12 blocked install scripts, Yarn 2+ integrity pins, and baseline Bun builds for older CPUs. It also fixes downloads that stopped on slow connections. ### Highlights - New `vp toolchain` command. It prints the tools, versions, and bundling relationships in the active Vite+ release as a tree. The tree shows vite-plus, core, vite, rolldown, oxc, oxc-resolver, and the compiled Vite Task with its build time and revision. Give a tool name to select part of the tree. Use `--json` for machine-readable output. Use `--global` for the global release ([#2111](#2111)), by @fengmk2 - New `vp hooks` command. It manages the Vite+ dispatcher for Git hooks. `enable` installs or refreshes the dispatcher and sets `core.hooksPath`. `disable` removes the dispatcher and keeps that preference, so `prepare` and `vp config` do not install it again. `status` shows the current state. Use `--hooks-dir` to set a custom directory. Vite+ keeps that directory for later commands. Vite+ does not change project-owned hooks, `staged` config, or `package.json` lifecycle scripts ([#2341](#2341)), by @dennybiasiolli - `vp run` now works in the default Codex CLI and Claude Code sandboxes. Before this release, a cached task failed with `Failed to set up task communication: Operation not permitted`. The task code never started. Automatic file-access tracking also failed. Task caching and input tracking now work in both default profiles. You do not need extra sandbox permissions ([vite-task#569](voidzero-dev/vite-task#569), [vite-task#576](voidzero-dev/vite-task#576)), by @wan9chi ### Features - `vp create` now shows the dependencies whose install scripts npm 12 blocked. Before this release, Vite+ left those dependencies unbuilt and gave no message. To approve them, `vp create` runs `vp pm approve-builds` and then `vp pm rebuild` ([#2336](#2336)), by @fengmk2 - Large downloads no longer stop on slow connections. Node.js tarballs and package-manager tarballs now use a 10 minute timeout. Before this release, they used the shared 2 minute per-request limit. That limit stopped healthy downloads below approximately 250 KB/s. It also made `vp env install` and `vp migrate` impossible to complete. Set `VP_DOWNLOAD_TIMEOUT` to a different number of seconds ([#2386](#2386)), by @tarikermis - Package-manager downloads now show a byte progress bar. The managed Node.js runtime already showed one. A slow download no longer looks stopped ([#2369](#2369)), by @semimikoh - You can now select JetBrains editors (IntelliJ, WebStorm, and similar) in the editor setup question. Vite+ writes the Oxc plugin ID to `.idea/externalDependencies.xml`. The docs now describe the gitignore strategy for `.idea` ([#2204](#2204), [#2378](#2378)), by @KTrain5169 - `vp` now shows a warning when it falls back to the global CLI in a project that has no project-local `vite-plus`. If the project declares the dependency, `vp` tells you to run `vp install`. If the project does not declare it, `vp` points to the migration guide. `vp migrate` and commands outside a project stay silent ([#2362](#2362)), by @liangmiQwQ - Generated editor settings now disable nested Oxlint config resolution. The Vite+ config stays authoritative ([#2331](#2331)), by @liangmiQwQ > [!NOTE] > Upstream toolchain upgrade: vite `8.2.0` -> `8.2.1`, rolldown `1.2.2` -> `1.2.3`, oxlint `1.76.0` -> `1.77.0`, oxfmt `0.61.0` -> `0.62.0`, and the oxc npm packages and Rust crates `0.142.0` -> `0.143.0`. oxfmt and oxlint both changed. The new versions can report problems in code that passed before. If your CI runs `vp check`, run `vp fmt` after you upgrade ([#2373](#2373)), by @voidzero-guard[bot] ### Fixes & Enhancements - Yarn 2+ pins from `corepack use` now verify against the extracted CLI (`bin/yarn.js`), not the npm tarball. `vp install` no longer fails on a cold cache. `vp run` no longer downloads Yarn again on every run ([#2227](#2227)), by @leslieeilsel - `vp dev` no longer crashes at startup with `ENOENT` when `experimental.bundledDev` is enabled. The bundled dev client path now points to the packaged layout ([#2384](#2384)), by @lofcz - `vp migrate` now rejects a workspace member as its target. Before this release, it migrated the enclosing workspace instead. It now tells you to run the command from the workspace root ([#2229](#2229)), by @leslieeilsel - `VP_NODE_VERSION=22` and other partial versions now resolve to an exact Node.js release. This applies to shim-dispatched commands such as `vp env exec node -v` ([#2411](#2411)), by @jong-kyung - Managed `bunx` shims now dispatch through `bun x`. `bunx <package>` no longer starts a matching package script recursively. This applies to new Bun installations ([#2151](#2151)), by @liangmiQwQ - Managed Bun now selects the baseline build on x64 CPUs that do not have AVX2. Bun's standard builds require AVX2. Cached installations keep their current files ([#2179](#2179)), by @liangmiQwQ - Generated Nushell env files now escape and normalize paths correctly. A `VP_HOME` path that contains spaces or quotes now loads without an error ([#2191](#2191)), by @naokihaba - `vite-plus/test/browser-*` type exports now add `.js` extensions to relative shim specifiers. Those specifiers now resolve with `NodeNext` module resolution ([#2360](#2360)), by @eai04191 - Tool-backed help is now consistent with upstream. An exact `vp <command> --help` shows the local themed help. A command with more arguments (`vp test --help --coverage`, `vp test list --help`) goes to the bundled tool. Deep help and subcommand help stay complete ([#2345](#2345)), by @liangmiQwQ - Vite Task diagnostics now print paths and working directories without Rust debug formatting. Vite+ no longer prints quoted paths or escaped Windows backslashes ([vite-task#534](voidzero-dev/vite-task#534)), by @liangmiQwQ - Broad workspace globs no longer find and run package scripts inside `node_modules` ([vite-task#539](voidzero-dev/vite-task#539)), by @jong-kyung ### Refactor - Rename the internal Rust crates from `vite_*` to `vp_*` ([#2335](#2335)), by @fengmk2 - Move the shared CLI helpers into `utils` ([#2347](#2347)), by @jong-kyung - Remove a redundant Vite reporter patch from core ([#2355](#2355)), by @jong-kyung - Remove the duplicate export transformers in tools ([#2358](#2358)), by @jong-kyung - Move the accent helpers into `crate::help` ([#2363](#2363)), by @jong-kyung - Sort installed Node.js versions with node-semver ([#2366](#2366)), by @jong-kyung - Remove the duplicate package-manager command resolution tests ([#2393](#2393)), by @jong-kyung - Share the Vite config file order between the CLI code paths ([#2409](#2409)), by @jong-kyung - Use the silent spinner again in the migrators ([#2408](#2408)), by @jong-kyung ### Docs - Document how to write custom Oxlint plugins in the lint guide ([#2381](#2381)), by @connorshea - Document manual installation in the migrate guide ([#2365](#2365)), by @liangmiQwQ - Add a View Prompt dialog for the setup prompt ([#2400](#2400)), by @dennybiasiolli - Correct the documented `overrides` behavior to match Vite+ ([#1942](#1942)), by @liangmiQwQ - Explain `setup-vite-plus-action` version pinning in the CI guide ([#2359](#2359)), by @fengmk2 - Correct the config and staged paths in the CLI `BUNDLING.md` ([#2334](#2334)), by @dennybiasiolli - Remove unused performance data from the docs ([#2392](#2392)), by @jong-kyung - Add the v0.2.8 release learnings to the release-manager skill ([#2333](#2333)), by @fengmk2 ### Chore - Update the compiled Vite Task to `d05b1dc` ([#2339](#2339), [#2403](#2403)), by @wan9chi - Update the Rust nightly toolchain to `2026-08-02` ([#2342](#2342)), by @wan9chi - Update the repository pnpm to v11 ([#1997](#1997)), by @renovate[bot] - Remove the unused VitePress bundling from core ([#2332](#2332)), by @jong-kyung - Remove the unused tool subcommands ([#2324](#2324)), by @jong-kyung - Remove the unused `build:src` task ([#2396](#2396)), by @jong-kyung - Handle upstream help differences in the dependency upgrade workflow ([#2330](#2330)), by @liangmiQwQ - Publish preview builds from fork PRs with GitHub OIDC ([#2387](#2387)), by @fengmk2 - Require the preview publish approval only for fork PRs ([#2404](#2404)), by @fengmk2 - Correct the publishing workflow after its first real runs ([#2397](#2397)), by @fengmk2 - Deploy the production docs on release, and deploy a main preview on push ([#2389](#2389)), by @fengmk2 - Check the format of docs PRs with the `vp` built from the checkout ([#2388](#2388)), by @fengmk2 - Run the e2e migrate test at the clone root ([#2410](#2410)), by @fengmk2 - Pin the `dev_engines_runtime_pnpm11` snapshot to the seeded default Node version ([#2390](#2390)), by @fengmk2 - Use `pnpm test` again as the full gate ([#2376](#2376)), by @jong-kyung - Remove the global compile checks that did nothing ([#2394](#2394)), by @jong-kyung ### Bundled Versions | Tool | Version | Source | | --------------- | ---------- | ---------------------------------------------------------------------------- | | vite | `8.2.1` | [`4216158`](vitejs/vite@4216158) | | rolldown | `1.2.3` | [`52dbd19`](rolldown/rolldown@52dbd19) | | tsdown | `0.22.14` | [npm](https://npmx.dev/package/tsdown/v/0.22.14) | | vitest | `4.1.10` | [npm](https://npmx.dev/package/vitest/v/4.1.10) | | oxlint | `1.77.0` | [npm](https://npmx.dev/package/oxlint/v/1.77.0) | | oxlint-tsgolint | `7.0.2001` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2001) | | oxfmt | `0.62.0` | [npm](https://npmx.dev/package/oxfmt/v/0.62.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @eai04191, @KTrain5169, @lofcz, @tarikermis, @leslieeilsel **Full Changelog**: v0.2.8...v0.2.9 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK <fengmk2@gmail.com>

leslieeilsel force-pushed the agent/yarn-corepack-hash branch 2 times, most recently from f7cdc8f to 26615d1 Compare August 5, 2026 13:19

leslieeilsel marked this pull request as ready for review August 7, 2026 09:03

leslieeilsel force-pushed the agent/yarn-corepack-hash branch from 07ce1cf to c3609f2 Compare August 7, 2026 09:18

fengmk2 self-assigned this Aug 9, 2026

leslieeilsel force-pushed the agent/yarn-corepack-hash branch from c3609f2 to 35de2cb Compare August 9, 2026 14:52

chatgpt-codex-connector Bot reviewed Aug 10, 2026

View reviewed changes

Comment thread crates/vp_pm_cli/src/package_manager.rs Outdated

Comment thread crates/vp_pm_cli/src/package_manager.rs Outdated

Comment thread crates/vp_pm_cli/src/package_manager.rs Outdated

leslieeilsel force-pushed the agent/yarn-corepack-hash branch from 35de2cb to 29036b2 Compare August 11, 2026 00:38

fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests test: sfw preview-build Publish this PR's commits to the registry bridge as preview builds labels Aug 11, 2026

fengmk2 reviewed Aug 11, 2026

View reviewed changes

Comment thread crates/vp_pm_cli/src/package_manager.rs Outdated

fengmk2 force-pushed the agent/yarn-corepack-hash branch from 662b443 to 762ddab Compare August 11, 2026 05:05

fengmk2 force-pushed the agent/yarn-corepack-hash branch from 762ddab to 5c9a78a Compare August 11, 2026 05:16

fengmk2 reviewed Aug 11, 2026

View reviewed changes

Comment thread docs/guide/install.md Outdated

fengmk2 force-pushed the agent/yarn-corepack-hash branch from d67918e to ff390f8 Compare August 11, 2026 09:28

fengmk2 force-pushed the agent/yarn-corepack-hash branch from f23b50b to dc6325e Compare August 11, 2026 11:07

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread crates/vp_pm_cli/src/package_manager.rs

leslieeilsel and others added 12 commits August 11, 2026 19:47

fix(install): verify modern Yarn hashes against the CLI binary

f736472

Added verification for Yarn binary hash for modern Yarn installations. Updated download logic to handle Yarn 2+ package manager correctly. Signed-off-by: Leslie Lau <1178273431@qq.com>

test(install): cover Corepack Yarn hash snapshots

30dec74

fix(install): harden Corepack Yarn verification

474af7f

Signed-off-by: Leslie Lau <1178273431@qq.com>

fengmk2 force-pushed the agent/yarn-corepack-hash branch from ea92499 to 1143616 Compare August 11, 2026 11:49

fengmk2 approved these changes Aug 11, 2026

View reviewed changes

fengmk2 merged commit 295c8d6 into voidzero-dev:main Aug 11, 2026
179 of 182 checks passed

fengmk2 mentioned this pull request Aug 11, 2026

release: v0.2.9 #2415

Merged

BrewTestBot mentioned this pull request Aug 12, 2026

vite-plus 0.2.9 Homebrew/homebrew-core#298372

Open

2 tasks

Uh oh!

Conversation

leslieeilsel commented Jul 23, 2026 • edited by fengmk2 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

chatgpt-codex-connector Bot commented Aug 7, 2026

Uh oh!

leslieeilsel commented Aug 7, 2026

Local verification results (run on macOS, nightly-2026-08-02)

Uh oh!

fengmk2 commented Aug 9, 2026

Uh oh!

leslieeilsel commented Aug 9, 2026

Uh oh!

fengmk2 commented Aug 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

leslieeilsel commented Aug 11, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026

Registry bridge build (29036b2)

Uh oh!

Uh oh!

fengmk2 commented Aug 11, 2026

Uh oh!

fengmk2 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

fengmk2 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

Uh oh!

fengmk2 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

fengmk2 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

fengmk2 commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

leslieeilsel commented Jul 23, 2026 •

edited by fengmk2

Loading

netlify Bot commented Jul 23, 2026 •

edited

Loading

Local verification results (run on macOS, `nightly-2026-08-02`)

Registry bridge build (`29036b2`)