release: v0.1.22: Security Patch, Parallel Global Install & Scaffold Polish#1637
Merged
Conversation
✅ Deploy Preview for viteplus-preview canceled.
|
Boshen
approved these changes
May 19, 2026
fengmk2
changed the title
fengmk2
changed the title
NAPI bakes the package.json version into binding/index.cjs version checks. The prepare_release workflow bumps package.json but does not regenerate this file, so the CI build's regeneration step produces a diff that the post-build no-unexpected-changes guard rejects.
vite-plus
@voidzero-dev/vite-plus-core
@voidzero-dev/vite-plus-prompts
@voidzero-dev/vite-plus-test
@voidzero-dev/vite-plus-cli-darwin-arm64
@voidzero-dev/vite-plus-cli-darwin-x64
@voidzero-dev/vite-plus-cli-linux-arm64-gnu
@voidzero-dev/vite-plus-cli-linux-arm64-musl
@voidzero-dev/vite-plus-cli-linux-x64-gnu
@voidzero-dev/vite-plus-cli-linux-x64-musl
@voidzero-dev/vite-plus-cli-win32-arm64-msvc
@voidzero-dev/vite-plus-cli-win32-x64-msvc
@voidzero-dev/vite-plus-darwin-arm64
@voidzero-dev/vite-plus-darwin-x64
@voidzero-dev/vite-plus-linux-arm64-gnu
@voidzero-dev/vite-plus-linux-arm64-musl
@voidzero-dev/vite-plus-linux-x64-gnu
@voidzero-dev/vite-plus-linux-x64-musl
@voidzero-dev/vite-plus-win32-arm64-msvc
@voidzero-dev/vite-plus-win32-x64-msvc
commit: |
fengmk2
added
test: e2e
The e2e-test and test-vp-create workflows referenced
tmp/tgz/vite-plus-0.0.0.tgz (and the voidzero-dev-vite-plus-{core,test}
variants) by literal name. On main this works because package.json has
version 0.0.0, but on release branches (e.g. release/v0.1.22) the
prepare_release workflow bumps the version, so pnpm pack emits
vite-plus-0.1.22.tgz and the install step fails with
"tgz file not found".
Resolve each tgz via shell glob and lift VP_VERSION / VP_OVERRIDE_PACKAGES
into a step that writes the file: URLs to GITHUB_ENV. Also read the
expected installed version from packages/cli/package.json so the
"Verify local tgz packages installed" check stays in sync.
- Drop the shell-var → env-var → process.env round-trip in the "Verify local tgz packages installed" step; the node script can require() the cli package.json directly. - Anchor tgz globs to -[0-9]*.tgz so the vite-plus-*.tgz pattern cannot accidentally match a future sibling package without a version suffix. - Quote $GITHUB_WORKSPACE expansions.
…rdcoding 0.0.0 Both ecosystem-ci helpers hardcoded 0.0.0 in the tgz paths and the expected installed version. On a release branch (e.g. release/v0.1.22) those paths and that version mismatch the freshly packed artifacts, so the second `vp install` in the ecosystem job fails with ENOENT on vite-plus-0.0.0.tgz. Resolve the version once from packages/cli/package.json in each script.
Replaces the readFile + JSON.parse + fileURLToPath path-resolution
dance with `import cliPkg from '../packages/cli/package.json' with
{ type: 'json' }`, matching the existing `repo.json` import pattern
in the same file. Drops three unused imports across both files and
removes the top-level await in patch-project.ts.
Member
|
ci fails follow here #1638 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release vite-plus v0.1.22.
A critical Vitest browser-mode security fix, parallel
vp add -ginstalls, a built-in oxlint rule to prefervite-plusimports, and a new--gitswitch forvp create.Highlights
vitestbumped to4.1.6to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via theotelCarrierquery parameter in Vitest browser mode (#1633)vp add/install/update -gnow installs packages concurrently with a progress bar and a--concurrencyflag (default 5) (#1597)vite/vitestimports tovite-plus, enabled by default in generated and migratedlintconfigs (#1408)vp createlearns--git/--no-git(interactive prompt; auto-commits "Initial commit from Vite+") (#1484)Features
--concurrencyoption (#1597), by @liangmiQwQvite-plusimports overvite/vitest(#1408), by @Han5991vp create: initialize a git repository and create an initial commit on scaffold (#1484), by @ryohidakavp create: rename underscore-prefixed files (_gitignore,_npmrc,_yarnrc.yml) to dotfiles for@org/createbundled templates (#1574), by @jong-kyungVP_PR_VERSIONenv var to install unreleased PR builds via pkg.pr.new (#1578), by @fengmk2Fixes & Enhancements
.oxfmtrc/.oxlintrcconfig when thefmt:/lint:key is already declared invite.config.ts(fixes duplicate-block regression invp create fate) (#1601), by @fengmk2VITE+ - The Unified Toolchain for the Webbanner forvp lint --lsp,vp fmt --lsp, andvp fmt --stdin-filepathso stdout stays a pure LSP / formatter stream (#1619), by @fengmk2vp create: detect output directory when running in the current directory (#1606), by @jong-kyungvp update -g: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs fromnpm view ... version --json(#1596), by @leno23vp create: preserve single-segment project path inupdateWorkspaceConfig(#1582), by @jong-kyungvp env use: keep the change session-scoped on Windows (#1577), by @fengmk2vp rebuild: accept positional package names (#1564), by @fengmk2error: <top-level>plus* <source>chain lines, with bold-red highlight on a TTY (vite-task#390), by @branchseerLOCALAPPDATAso Node's compile cache stays outside the workspace on Windows (vite-task#389), by @branchseerc945cc0(#1628), by @branchseerRefactor
vp pm plugincommand (per discussion in Forward various commands usingvp pm#1038) (#1623), by @jong-kyungDocs
vitepress-plugin-llmsto the docs site so the published docs include LLM-friendly outputs (/llms.txt) (#1625), by @jong-kyungvp env doctorin agent instructions (#1603), by @leno23Chore
pnpm buildscript (justfile recipe now just callspnpm build) (#1626), by @fengmk2actions-cool/issues-helper(#1630), by @Boshentaiki-e/checkout-action(#1620), by @Boshencargo clippywith-D warnings(#1579), by @Boshensetup-nodefrom the version-check job (#1600), by @fengmk2--helpcase to config snap tests for npm10/yarn1/yarn4 (#1585), by @jong-kyung--helpcase to publish snap tests for npm10/yarn1/yarn4 (#1584), by @jong-kyung.gitignoreand.yarnrc.ymlin the new-vite-monorepo snap (#1576), by @jong-kyung11.1.2(vite-task#383), by @branchseerBundled Versions
8.0.1166f31941.0.0ac5c7100.22.04.1.61.63.00.22.10.48.0New Contributors
Welcome to all new contributors! 🎉
@nozomee, @ryohidaka, @leno23
Full Changelog: v0.1.21...v0.1.22
Merging this PR will trigger the release workflow.