vite-plus 0.1.22

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

A critical Vitest browser-mode security fix, parallel `vp add -g` installs, a built-in oxlint rule to prefer `vite-plus` imports, and a new `--git` switch for `vp create`.
Highlights

Security: bundled vitest bumped to 4.1.6 to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via the otelCarrier query parameter in Vitest browser mode (#1633)
Parallel global install: vp add/install/update -g now installs packages concurrently with a progress bar and a --concurrency flag (default 5) (#1597)
Prefer vite-plus imports: new bundled oxlint rule rewrites vite/vitest imports to vite-plus, enabled by default in generated and migrated lint configs (#1408)
Git init on scaffold: vp create learns --git/--no-git (interactive prompt; auto-commits "Initial commit from Vite+") (#1484)

Features

Spawn npm for global installation in parallel with a progress bar and a --concurrency option (#1597), by @liangmiQwQ
Add bundled oxlint rule to prefer vite-plus imports over vite/vitest (#1408), by @Han5991
vp create: initialize a git repository and create an initial commit on scaffold (#1484), by @ryohidaka
vp create: rename underscore-prefixed files (_gitignore, _npmrc, _yarnrc.yml) to dotfiles for @org/create bundled templates (#1574), by @jong-kyung
Add VP_PR_VERSION env var to install unreleased PR builds via pkg.pr.new (#1578), by @fengmk2

Fixes & Enhancements

Skip merging standalone .oxfmtrc/.oxlintrc config when the fmt:/lint: key is already declared in vite.config.ts (fixes duplicate-block regression in vp create fate) (#1601), by @fengmk2
Suppress the VITE+ - The Unified Toolchain for the Web banner for vp lint --lsp, vp fmt --lsp, and vp fmt --stdin-filepath so stdout stays a pure LSP / formatter stream (#1619), by @fengmk2
vp create: detect output directory when running in the current directory (#1606), by @jong-kyung
vp update -g: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs from npm view ... version --json (#1596), by @leno23
vp create: preserve single-segment project path in updateWorkspaceConfig (#1582), by @jong-kyung
vp env use: keep the change session-scoped on Windows (#1577), by @fengmk2
vp rebuild: accept positional package names (#1564), by @fengmk2
Adopt the new vite-task error formatter; errors now print as error: <top-level> plus * <source> chain lines, with bold-red highlight on a TTY (vite-task#390), by @branchseer
vite-task: forward LOCALAPPDATA so Node's compile cache stays outside the workspace on Windows (vite-task#389), by @branchseer
Bump vite-task to c945cc0 (#1628), by @branchseer

Refactor

Revert vp pm plugin command (per discussion in #1038) (#1623), by @jong-kyung

Docs

Add vitepress-plugin-llms to the docs site so the published docs include LLM-friendly outputs (/llms.txt) (#1625), by @jong-kyung
Refresh home stats for oxlint, vite, and vitest (#1512), by @nozomee
Mention vp env doctor in agent instructions (#1603), by @leno23

Chore

Consolidate the upstream build chain into a single pnpm build script (justfile recipe now just calls pnpm build) (#1626), by @fengmk2
Fix bootstrap-cli on Windows (#1583), by @fengmk2
Refresh trusted stack stats (#1573, #1616), by @voidzero-guard[bot]
Update GitHub Actions (#1611, #1612), by @renovate[bot]
Address zizmor findings in composite actions and the release workflow; drop unused actions-cool/issues-helper (#1630), by @Boshen
Switch plain checkouts to taiki-e/checkout-action (#1620), by @Boshen
Switch release to a version-bump PR + push trigger flow (#1575), by @Boshen
Gate release publish on environment approval with a Discord notice (#1571), by @Boshen
Enable cargo clippy with -D warnings (#1579), by @Boshen
Drop unused setup-node from the version-check job (#1600), by @fengmk2
Add Void deploy workflows for the docs site (#1590), by @fengmk2
Add --help case to config snap tests for npm10/yarn1/yarn4 (#1585), by @jong-kyung
Add --help case to publish snap tests for npm10/yarn1/yarn4 (#1584), by @jong-kyung
Verify .gitignore and .yarnrc.yml in the new-vite-monorepo snap (#1576), by @jong-kyung
vite-task: bump pnpm to 11.1.2 (vite-task#383), by @branchseer
vite-task: update lint-staged to v17 (vite-task#385), by @renovate[bot]

Bundled Versions



Tool
Version
Source




vite
8.0.11
66f3194


rolldown
1.0.0
ac5c710


tsdown
0.22.0
npm


vitest
4.1.6
npm


oxlint
1.63.0
npm


oxlint-tsgolint
0.22.1
npm


oxfmt
0.48.0
npm



New Contributors
Welcome to all new contributors! :tada:
@nozomee, @ryohidaka, @leno23
Full Changelog: voidzero-dev/vite-plus@v0.1.21...v0.1.22
Published Packages

@voidzero-dev/vite-plus-core@0.1.22
@voidzero-dev/vite-plus-test@0.1.22
vite-plus@0.1.22

Installation
macOS/Linux:
curl -fsSL https://vite.plus | bash
Windows:
irm https://vite.plus/ps1 | iex
Or download and run vp-setup.exe from the assets below.

View the full release notes at https://github.com/voidzero-dev/vite-plus/releases/tag/v0.1.22.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.