chore(deps): update dependency vite-plus to v0.2.8

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite-plus (source)	0.2.7 → 0.2.8

---

Release Notes

voidzero-dev/vite-plus (vite-plus)

v0.2.8: vite-plus v0.2.8: monorepo target resolution, breaking VP_* environment variable renames, and install fixes

Compare Source

Bare vp dev/build/preview/pack at a monorepo root now resolve a target package instead of silently running against the root, and three Vite+-specific environment variables move to the VP_* prefix without compatibility aliases. Two failures that broke Vite+ before it could run are also fixed: the crash on container images that ship no CA certificates, and the missing Rolldown binding under pnpm's global virtual store.

Breaking Changes

• Rename three Vite+-specific environment variables to the VP_* prefix, with no compatibility aliases, so the old names stop working (#​2312), by @​jong-kyung:

  Old	New
  VITE_LOG	VP_LOG
  VITE_GLOBAL_CLI_JS_SCRIPTS_DIR	VP_GLOBAL_CLI_JS_SCRIPTS_DIR
  VITE_UPDATE_TASK_TYPES	VP_UPDATE_TASK_TYPES

  Update any shell profile, CI job, or Dockerfile that sets the old names.

Highlights

• Resolve a target package for vp dev, build, preview, and pack at a monorepo root: interactive shells get a fuzzy package picker, non-interactive runs list the candidates and exit 1 instead of building the root, and a new global -C <dir> flag or a defaultPackage setting (a single directory, or an object mapping each of the four commands to its own directory) skips the prompt (#​2031, #​2305), by @​fengmk2
• Stop aborting with exit 134 on container images that ship no CA certificates (Debian slim, distroless): the shared HTTP client now retries once with the bundled Mozilla root list, like Node's own bundled roots, and reports a real error instead of panicking when it still cannot be built (#​2273, #​2295), by @​jbmusso and @​fengmk2
• Resolve the bundled Rolldown binding through platform packages instead of an undeclared require back into vite-plus, fixing Cannot find module 'vite-plus/binding' under pnpm enable-global-virtual-store and in standalone @voidzero-dev/vite-plus-core installs (#​2313), by @​fengmk2
• Add vp pm ci for reproducible frozen-lockfile installs, and vp pm patch / vp pm patch-commit for editing dependencies in place on pnpm, bun, and Yarn Berry (npm and Yarn Classic warn and exit successfully) (#​2082, #​2308), by @​forehalo and @​jong-kyung

Features

• Upgrade the bundled toolchain: vite 8.1.5 -> 8.2.0, rolldown 1.2.0 -> 1.2.2, oxlint 1.75.0 -> 1.76.0, oxfmt 0.60.0 -> 0.61.0, and Vite DevTools 0.4.5 -> 0.4.10 (#​2302, #​2311), by @​voidzero-guard[bot]. The new oxfmt and oxlint can flag code that passed before, so run vp fmt after upgrading if your CI runs vp check.
• Read the Node.js version from .nvmrc when no other version source is present (#​2244), by @​BlankParticle
• Support pnpm v12, which ships as a native binary: Vite+ now downloads the platform-specific @pnpm/exe.* package and generates native shims, so pnpm and pnpx work instead of failing to exec (#​2289), by @​jong-kyung
• Verify the downloaded bun platform tarball against the registry dist.integrity hash (#​2310), by @​jong-kyung

Fixes & Enhancements

• Let vp config install the Git hook dispatcher without creating or modifying project hook scripts or staged-file configuration, so a custom .vite-hooks/pre-commit survives (#​2280), by @​TheAlexLichter
• Nest immutable global package installs under packages/<package>/<uuid> instead of using # in the path, which Node treated as a URL fragment and which broke dynamic imports inside installed packages (#​2222), by @​liangmiQwQ
• Keep the recorded version spec on global installs, so vp update -g follows a dist tag or range instead of silently resolving back to latest, vp outdated -g reports Wanted versus Latest, and vp update -g --latest explicitly moves packages back to latest (#​2249), by @​TheAlexLichter
• Stop deleting a managed Node.js runtime that another process is concurrently installing (#​2248), by @​shulaoda
• Preserve the real exit code when a spawned process is terminated by a signal on Unix (#​2154), by @​liangmiQwQ
• Honor an explicit vp create --package-manager outside monorepos instead of inheriting the manager from a non-monorepo ancestor directory (#​2226), by @​jong-kyung
• Scaffold the vite:library template into a directory that contains only .git, while still refusing to overwrite existing user files (#​2287), by @​RSS1102
• Render help for delegated commands from the local CLI, so vp <command> --help matches the installed toolchain instead of drifting (#​2184), by @​liangmiQwQ
• Resolve typeAware and typeCheck options inherited through Oxlint extends, so vp check --no-lint runs and classifies type checking correctly (#​2228), by @​jong-kyung
• Report (no version) instead of unknown when globally installing a local package that has no version field (#​2232), by @​liangmiQwQ

Refactor

• Rename the Git hooks environment variable to VP_GIT_HOOKS, keeping VITE_GIT_HOOKS working as a deprecated alias (#​2195), by @​dennybiasiolli
• Consolidate the package manager infrastructure so typed command arguments are the source of truth for per-manager compatibility (#​2140), by @​forehalo
• Generate the Zed language settings from a language list instead of 17 near-identical blocks (#​2294), by @​jong-kyung
• Share the agent-file detect and write traversal helpers so both passes apply identical rules (#​2296), by @​jong-kyung
• Drop redundant clippy allow attributes in the global CLI (#​2235), by @​shulaoda

Docs

• Avoid a duplicate vp installation step in the onboarding prompt (#​2291), by @​Arcadi4
• Recommend stacked pull requests for submitting changes (#​2281), by @​fengmk2
• Correct stale delegation comments in the global CLI (#​2236), by @​shulaoda
• Improve the release draft review guidance in the release-manager skill (#​2285), by @​wan9chi

Chore

• Stop emitting unmet peer warnings for the vite-plus peer of oxfmt and oxlint on every install (#​2321), by @​fengmk2
• Remove duplicate direct dependency declarations so each build dependency is owned by one workspace (#​2318), by @​jong-kyung
• Declare @emnapi peers where @napi-rs/cli is used (#​2319), by @​jong-kyung
• Exclude rollup-tests from the workspace and update basic-ftp (#​2322), by @​fengmk2
• Remove unused EnvConfig fields (#​2320), by @​jong-kyung
• Remove the obsolete peer dependency merger tool (#​2303), by @​jong-kyung
• Stop the staging deploy from triggering on external pull requests (#​2293), by @​BlankParticle
• Kill the real vp process, and kill it before its children, in the env_install_interrupt snapshot test (#​2299, #​2316), by @​fengmk2
• Suppress racy optimizer logs in the vitest_browser_mode snapshot test (#​2297), by @​fengmk2
• Remove the obsolete auto-install environment from the snapshot tests (#​2163), by @​liangmiQwQ

Bundled Versions

Tool	Version	Source
vite	8.2.0	fa79f9a
rolldown	1.2.2	872b98a
tsdown	0.22.14	npm
vitest	4.1.10	npm
oxlint	1.76.0	npm
oxlint-tsgolint	7.0.2001	npm
oxfmt	0.61.0	npm

Upgrade

vp upgrade

New Contributors

@​jbmusso, @​Arcadi4, @​dennybiasiolli, @​RSS1102

Full Changelog: voidzero-dev/vite-plus@v0.2.7...v0.2.8

Published Packages

• @voidzero-dev/vite-plus-core@0.2.8
• vite-plus@0.2.8

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.8 vp build

Run any vp command without installing it; see the Docker guide for more.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vite-plus@​0.2.8

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.50%  [ -2.01% ..  +3.55%]  overhead   +58.48%
dynamic/access             change  +0.24%  [ -0.65% ..  +0.81%]  overhead   +40.01%
static/launch              change  +0.45%  [ -1.84% ..  +3.24%]  overhead  +165.98%
static/access              change  +0.38%  [ -0.88% ..  +1.72%]  overhead  +745.78%

macos

dynamic/launch             change  -0.13%  [ -1.94% ..  +2.21%]  overhead  +214.67%
dynamic/access             change  +0.00%  [ -1.49% ..  +1.51%]  overhead   +22.79%

windows

dynamic/launch             change  +0.29%  [ -1.76% ..  +2.09%]  overhead   +30.96%
dynamic/access             change  +0.36%  [ -0.36% ..  +0.93%]  overhead    +8.40%