feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #1646 · voidzero-dev/vite-plus

voidzero-guard · 2026-05-20T14:43:07Z

Summary

Bump rolldown to v1.0.2 and vite to v8.0.13, plus vitest 4.1.7 and the oxc/oxlint/oxfmt toolchain.
Bump oxc Rust crates 0.128.0 -> 0.132.0 and pin Rust toolchain to nightly-2026-03-15.
Drop the workspace-local @rolldown/pluginutils build and consume it as a transitive dep of rolldown, repointing the licensing/build paths and updating @voidzero-dev/vite-plus-core exports.
Refresh oxlint/parser-driven snapshots and quiet a few new unicorn/consistent-function-scoping lint hits.

Dependency updates

Package	From	To
`rolldown`	`ac5c710`	`v1.0.2 (f2757ed)`
`vite`	`66f3194`	`v8.0.13 (a46f11a)`
`vitest`	`4.1.6`	`4.1.7`
`oxfmt`	`0.48.0`	`0.51.0`
`oxlint`	`1.63.0`	`1.66.0`
`oxlint-tsgolint`	`0.22.1`	`0.23.0`
`@oxc-project/runtime`	`0.129.0`	`0.132.0`
`@oxc-project/types`	`0.129.0`	`0.132.0`
`oxc-minify`	`0.129.0`	`0.132.0`
`oxc-parser`	`0.129.0`	`0.132.0`
`oxc-transform`	`0.129.0`	`0.132.0`
`@vitejs/devtools`	`0.1.21`	`0.1.24`

Unchanged dependencies

tsdown: 0.22.0
@oxc-node/cli: 0.1.0
@oxc-node/core: 0.1.0

Code changes

Cargo.toml: bump oxc workspace crates 0.128.0 -> 0.132.0; bump dashmap, jsonschema, mimalloc-safe, and pnp minor versions.
rust-toolchain.toml: bump nightly channel to nightly-2026-03-15.
.github/actions/build-upstream/action.yml, package.json: drop the standalone pnpm --filter @rolldown/pluginutils build step.
pnpm-workspace.yaml: add @rolldown/pluginutils to the catalog, remove its workspace: override, bump vitest-dev override to ^4.1.7, and sync transitive deps (remeda, rolldown-plugin-dts, rollup, semver, tsx, valibot, vitepress-plugin-graphviz, ws).
packages/core/build.ts, packages/tools/src/sync-remote-deps.ts: repoint pluginutils sources to rolldown/packages/rolldown/node_modules/@rolldown/pluginutils and its colocated LICENSE.
packages/core/package.json: collapse ./rolldown/pluginutils[/filter] exports to direct .mjs entries; bump @vitejs/devtools and bundledVersions (vite/rolldown).
packages/test/package.json: bump @vitest/* packages and vitest-dev to 4.1.7.
packages/cli/snap-tests/{bin-oxlint-wrapper,command-helper}/snap.txt: include new oxlint --debug=OPTIONS help entry.
packages/cli/snap-tests/{build-vite-env,synthetic-build-cache-disabled}/snap.txt: refresh built asset hash.
packages/cli/snap-tests-global/command-staged-broken-config/snap.txt: update parser error prefix ([PARSE_ERROR] Unexpected token).
packages/cli/src/create/__tests__/org-tarball.spec.ts, packages/prompts/src/{group-multi-select,progress-bar,select-key}.ts: add unicorn/consistent-function-scoping eslint-disable lines for intentionally inlined helpers.
packages/tools/.upstream-versions.json: pinned upstream hashes for rolldown/vite.

Build status

sync-remote-and-build: failure
build-upstream: failure

- rolldown: ac5c710 -> v1.0.2 (f2757ed) - vite: 66f3194 -> v8.0.13 (a46f11a) - vitest: 4.1.6 -> 4.1.7 - oxfmt: 0.48.0 -> 0.51.0 - oxlint: 1.63.0 -> 1.66.0 - oxlint-tsgolint: 0.22.1 -> 0.23.0 - @oxc-project/runtime: 0.129.0 -> 0.132.0 - @oxc-project/types: 0.129.0 -> 0.132.0 - oxc-minify: 0.129.0 -> 0.132.0 - oxc-parser: 0.129.0 -> 0.132.0 - oxc-transform: 0.129.0 -> 0.132.0 - @vitejs/devtools: 0.1.21 -> 0.1.24 Code changes: - Bump oxc Rust crates 0.128.0 -> 0.132.0 and minor deps (dashmap, jsonschema, mimalloc-safe, pnp) in Cargo.toml. - Bump Rust toolchain to nightly-2026-03-15 in rust-toolchain.toml. - Drop `@rolldown/pluginutils` workspace build/override; consume it as a transitive dep of rolldown (.github/actions/build-upstream/action.yml, package.json, pnpm-workspace.yaml). - Repoint pluginutils path to `rolldown/packages/rolldown/node_modules/@rolldown/pluginutils` in packages/core/build.ts and packages/tools/src/sync-remote-deps.ts. - Switch `./rolldown/pluginutils` exports to direct `.mjs` entries in packages/core/package.json; bump bundledVersions for vite/rolldown. - Sync catalog versions for transitive deps (remeda, rolldown-plugin-dts, rollup, semver, tsx, valibot, vitepress-plugin-graphviz, ws) in pnpm-workspace.yaml. - Refresh snapshots for new oxlint `--debug` flag and updated parser error format (packages/cli/snap-tests/{bin-oxlint-wrapper,command-helper,build-vite-env,synthetic-build-cache-disabled}/snap.txt, packages/cli/snap-tests-global/command-staged-broken-config/snap.txt). - Silence `unicorn/consistent-function-scoping` for inline helpers in packages/cli/src/create/__tests__/org-tarball.spec.ts and packages/prompts/src/{group-multi-select,progress-bar,select-key}.ts.

netlify · 2026-05-20T14:43:17Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`778ce0f`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a0e6ec920010d000826997f

socket-security · 2026-05-20T14:47:40Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Maintenance
npm/playwright-chromium@1.60.0
npm/@oxc-project/runtime@0.132.0
npm/@vitejs/devtools@0.1.24
npm/@vitest/ui@4.1.6 ⏵ 4.1.7		⁺¹
npm/@vitest/coverage-v8@4.1.6 ⏵ 4.1.7		⁺¹
npm/@types/node@24.12.4
npm/@vitest/coverage-istanbul@4.1.6 ⏵ 4.1.7		⁺¹
cargo/napi@3.8.3 ⏵ 3.9.0
npm/remeda@2.34.1
npm/@vitest/browser-preview@4.1.6 ⏵ 4.1.7		⁺¹
npm/@vitest/browser-webdriverio@4.1.6 ⏵ 4.1.7	⁺¹	⁺¹
npm/unrun@0.3.0
npm/oxfmt@0.51.0
npm/terser@5.47.1
cargo/napi-build@2.3.1 ⏵ 2.3.2
cargo/napi-derive@3.5.2 ⏵ 3.5.6
cargo/oxc_allocator@0.128.0 ⏵ 0.132.0
cargo/oxc_ast@0.128.0 ⏵ 0.132.0
cargo/oxc_parser@0.128.0 ⏵ 0.132.0
cargo/oxc_span@0.128.0 ⏵ 0.132.0
npm/eslint-plugin-n@18.0.1
npm/oxc-transform@0.132.0
npm/oxc-parser@0.132.0
npm/oxlint-tsgolint@0.23.0
npm/knip@6.14.1
npm/rolldown-plugin-dts@0.25.1

View full report

Fix clippy errors surfaced by the nightly-2026-03-15 toolchain upgrade: - collapsible_match in vite_install package_manager - unnecessary_sort_by in vite_js_runtime and vite_setup - unnecessary_trailing_comma in cli help test

…orkspace The bundled cargo-deny check inside oxc-project/security-action runs `cargo metadata`, which fails because the workspace Cargo.toml references `./rolldown/crates/*` paths that only exist after cloning the rolldown repo. Pre-clone via the existing `./.github/actions/clone` and clear `origin` so the action's nested taiki-e/checkout-action can re-add it without conflict.

Rolldown crates use `#![expect(clippy::print_stderr)]` at the crate root, but vite-plus's workspace sets `print_stderr = "allow"`. When rolldown crates are built as path dependencies of our workspace, our lint level wins and the expects never fire, triggering `unfulfilled_lint_expectations`. Allow the rust lint so upstream-only expects don't break our build.

fengmk2 · 2026-05-21T02:29:46Z

@codex review

chatgpt-codex-connector · 2026-05-21T02:44:13Z

Codex Review: Didn't find any major issues. What shall we delve into next?

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fengmk2 · 2026-05-21T03:22:55Z

security analysis ci follow up here #1635 (comment)

fengmk2 added 5 commits May 21, 2026 09:26

fix: address new clippy lints from nightly toolchain bump

b784c1c

Fix clippy errors surfaced by the nightly-2026-03-15 toolchain upgrade: - collapsible_match in vite_install package_manager - unnecessary_sort_by in vite_js_runtime and vite_setup - unnecessary_trailing_comma in cli help test

ci(security): scope contents read permission to security job

af55f42

chore(rust): align nightly toolchain with vite-task (2026-03-05)

f46db5f

ci(security): clone only rolldown, skip unused vite checkout

778ce0f

fengmk2 approved these changes May 21, 2026

View reviewed changes

fengmk2 merged commit bf8457b into main May 21, 2026
145 of 148 checks passed

fengmk2 deleted the deps/upstream-update branch May 21, 2026 03:23

fengmk2 mentioned this pull request May 21, 2026

feat(deps): upgrade upstream dependencies (preserved from #1581) #1589

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(deps): upgrade upstream dependencies#1646

feat(deps): upgrade upstream dependencies#1646
fengmk2 merged 7 commits into
mainfrom
deps/upstream-update

voidzero-guard Bot commented May 20, 2026

Uh oh!

netlify Bot commented May 20, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 20, 2026 •

edited

Loading

Uh oh!

fengmk2 commented May 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 21, 2026

Uh oh!

fengmk2 commented May 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

voidzero-guard Bot commented May 20, 2026

Summary

Dependency updates

Code changes

Build status

Uh oh!

netlify Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

socket-security Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fengmk2 commented May 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 21, 2026

Uh oh!

fengmk2 commented May 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

netlify Bot commented May 20, 2026 •

edited

Loading

socket-security Bot commented May 20, 2026 •

edited

Loading