[dependabot]

Bumps vite-plus from 1.0.0 to 1.1.0.

Release notes

Sourced from vite-plus's releases.

vite-plus v1.1.0: faster vp dev startup and clearer interactive prompts

Vite+ 1.1 starts vp dev faster and makes the interactive prompts clearer, alongside fixes for vp migrate, package-manager commands, and Windows terminals.

Highlights

• vp dev reaches its local URL about 24% sooner and uses about 30% less memory in the parent process, because Vite+ no longer loads Vite and Vitest there before starting the dev server (#2851), by @​camc314.
• Interactive prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions (#2870), by @​cpojer.

Features

• vp run sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn, so tools such as npm-run-all2 use the project's package manager instead of falling back to npm (#2895), by @​naokihaba and @​tarikermis.
• Upgrade vite@8.3.1 to vite@8.3.3, rolldown@1.2.11 to rolldown@1.2.12, vitest@5.0.1 to vitest@5.0.3, oxlint@1.85.0 to oxlint@1.87.0, and oxfmt@0.70.0 to oxfmt@0.72.0. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check. vp migrate now keeps the React Refresh allowCompoundComponents option because the bundled Oxlint supports it (#2871, #2896, #2904), by @​voidzero-guard[bot].

Fixes & Enhancements

• vp migrate keeps Oxlint rules written with plugin aliases (such as @typescript-eslint/*, react-hooks/*, and import-x/*) and removes rules the bundled Oxlint does not support, listing them in a warning (#2820, #2906), by @​TheAlexLichter and @​yusuke99.
• vp migrate leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one (#2817), by @​TheAlexLichter.
• vp migrate reports a short error for a directory without package.json instead of an ENOENT stack trace (#2821), by @​TheAlexLichter.
• vp create in an existing pnpm workspace adds the catalog entries the new application needs, so installation no longer fails with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC (#2808), by @​SaKaNa-Y.
• On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at Terminate batch job (Y/N)? (#2890), by @​fengmk2.
• vp pack --watch on Windows rebuilds with the new options after the config file changes (#2826), by @​liangmiQwQ.
• vp test doctor and vp test complete run the Vitest subcommands instead of being treated as test file filters (#2879), by @​liangmiQwQ.
• With isolated dependency layouts such as pnpm's global virtual store, vp pack finds installed Vue language tools and TypeScript Go for declaration generation, and Playwright browser provider options keep their types (#2868, #2865), by @​liangmiQwQ.
• Package-manager commands fail when the project's package manager does not support a named option, instead of silently dropping it and continuing. Bun 1.4.1+ receives --offline and --prefer-offline, and Yarn Classic accepts a single --filter for vp remove (#2775), by @​jong-kyung.
• vp pm config in Bun projects falls back to npm, as its warning says (#2899), by @​jong-kyung.
• vp pm approve-builds states that Yarn Berry disables third-party build scripts by default from 4.14.0, not in every version (#2902), by @​jong-kyung.
• vp implode asks you to type boom instead of uninstall to confirm (#2901), by @​fengmk2.
• Global package installs and updates print a green +, and removals a red -, with bold package names in both (#2828), by @​liangmiQwQ.
• Setup headings and command hints keep their colors when the installer captures stdout (#2829), by @​liangmiQwQ.

Refactor

• Replace semver with verkit in the CLI, reducing the bundled CLI JavaScript by about 26 KB (#2837), by @​liangmiQwQ.
• Share the shim filename logic between setup and vp env doctor, and remove unused config migration metadata (#2876, #2894), by @​jong-kyung.

Docs

• Announce Vite+ 1.0 on the website and update the homepage vp pack demo (#2843, #2844), by @​TheAlexLichter and @​naokihaba.
• Document vp install -g --node and explain when vp env default re-resolves versions (#2885, #2884), by @​hyunbinseo.
• Use runnable package examples in the vpx guide and vpx --help (#2864), by @​SaKaNa-Y.
• Remove the redundant vp install step from setup-vp CI examples (#2888), by @​yusuke99.
• Explain how to return from a preview build, align manual installation examples with the installed toolchain, and update the JetBrains Node.js path and vp env current --json example for the split directory layout (#2886, #2887, #2889, #2891), by @​jong-kyung.

Chore

• Update contributor setup instructions, move the logo files under docs/public, and ignore the root tmp directory (#2832, #2831, #2860), by @​liangmiQwQ.
• Stabilize Node API reporter, catalog update, Bun, Yarn, and preview snapshots (#2869, #2872, #2893), by @​liangmiQwQ and @​fengmk2.
• Build the docs with the latest Vite+ and fix flaky CI tests (#2855), by @​fengmk2.
• Remove the unused set-snapshot-version action (#2877), by @​jong-kyung.
• Refine the release-manager guidance (#2827, #2788), by @​wan9chi and @​fengmk2.

... (truncated)

Commits

• 3aa366e release: v1.1.0: faster vp dev startup and clearer interactive prompts (#2907)
• b639509 fix(shim): preserve Windows terminal after Ctrl+C (#2890)
• 390f215 perf(cli): defer Vite config resolver until needed (#2851)
• 27b4ffd fix(migrate): strip unsupported Oxlint rules with report (#2906)
• 7944376 fix(create): complete catalogs in existing pnpm workspaces (#2808)
• 6961386 fix(migrate): preserve unpinned package manager policy (#2817)
• d0490f6 fix(migrate): preserve Oxlint rule aliases (#2820)
• 1ebe40a fix(migrate): report missing package.json (#2821)
• 64cc3aa fix(cli): reload pack config on Windows in watch mode (#2826)
• c03dd22 fix(cli): set package-manager lifecycle env for vp run (#2895)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cursor]

PR Summary

Low Risk
Mostly dependency and lint-suppression churn; the CustomSnoozeDialog change is a small purity refactor with unchanged snooze date behavior.

Overview
Upgrades the workspace vite-plus / vite catalog entries to 1.1.0 and bumps @vitest/browser-playwright to 5.0.3 in apps/web, aligning the toolchain with the Vite+ 1.1 release (including newer Oxlint).

The Oxlint react/purity rule now flags several intentional new Date() uses in the web app. This PR adds targeted oxlint-disable-next-line comments where timestamps are read in event handlers, async thread actions, or deliberate per-shell/per-thread clock resyncs, and refactors CustomSnoozeDialog so the snooze calendar’s “start of today” bound comes from useState instead of an inline date in render.

Orchestration v2 docs only reformat a few TypeScript union literals onto multiple lines; no model semantics change.

^{Reviewed by Cursor Bugbot for commit 2ca84c4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	4.9 KiB	−30 B (−0.6%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−30 B (−2.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.8 KiB	−41 B (−0.2%)	29.3 KiB	✅
Codex	Live turn messages	2	1	−1 (−50.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−7 B (−0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−7 B (−0.6%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: e678c0b · PR result: 2ca84c4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a3aeca1. Configure here.}