[dependabot]

Bumps vite-plus from 1.5.0 to 1.5.1.

Release notes

Sourced from vite-plus's releases.

vite-plus v1.5.1

Vite+ 1.5.1 fixes two high-severity security issues in package-manager downloads and vp env use, restores interactive input in vp run tasks, fixes vp migrate config merges, and adds a reference page for each package command.

Features

• Upgrade the bundled Vite and Rolldown (#3390), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.5 to vite@8.3.7. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore node_modules/.modules.yaml. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (#) in the dependency optimizer, SSR builds with build.ssr: true, and chunks shared with workers.
  • rolldown@1.2.16 to rolldown@1.2.18, with module source maps that keep only the sources and names that they trace.
  • @voidzero-dev/vite-plus-core requires postcss@^8.5.32, as the bundled Vite does.

Fixes & Enhancements

• Security: Vite+ verifies the pnpm that it downloads for its own setup against a hash in the CLI, and checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's packageManager field instead of the hash that the registry reports. A registry set in a project's .npmrc can no longer make Vite+ run a package manager that does not match (GHSA-5qr3-w62x-jmwx, high). Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location (#3400), by @​fengmk2 and @​arkmarta.
• Security: vp env use and other dist-tag lookups, such as pnpm@latest, accept only a valid semver version from the registry, so a registry set in a project's .npmrc can no longer put shell commands into the statements that the vp env use shell wrapper runs (GHSA-p79r-mf8q-r78h, high) (#3395), by @​fengmk2 and @​arkmarta.
• Scripts that vp run starts get a blocking stdin again when the run block of vite.config.ts is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as vp update --interactive wait for input instead of failing with EAGAIN (#3361), by @​everton-dgn.
• vp migrate changes only the return statements of a defineConfig callback, so functions inside the config, such as Rolldown codeSplitting.groups[].name callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, as, satisfies, <T>, or ! (#3325, #3372), by @​jong-kyung.
• vp create react-router passes --no-git-init to create-react-router, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured (#3363), by @​chbaefront.
• env.fish calls fish built-ins through builtin, so vp env use changes the Node.js version even when a user function has the name of a built-in such as count (#3353), by @​naokihaba.
• Shell completion suggests full command names before aliases, so vp i<Tab> offers install and vp up<Tab> offers update. An alias stays available when no full name matches (#3337), by @​nekomoyi.
• Completion for vp run and vpr skips comment keys such as "# docs #" in package.json scripts, matches task names that contain :, and shows each task's command as its description in Zsh and Fish (#3354), by @​nekomoyi.
• vp pm dist-tag rm works with Yarn Berry, because Vite+ passes remove to yarn npm tag (#3358), by @​jong-kyung.

Docs

• Add a Package Management section to the guide, with a reference page for each of the 38 package commands that lists its options, package-manager support, version requirements, and npm fallbacks. Help output for package commands and the old package management and install URLs point to the new pages (docs) (#3105), by @​jong-kyung.
• Show the README logo that matches the GitHub theme, so the logo stays visible after a theme change (#3350), by @​fengmk2.

Chore

• Build Linux native bindings against the napi-cross glibc 2.17 sysroot with @napi-rs/cli@3.10.12, let the linker reject unresolved symbols, and run Linux CI on ubuntu-latest again. Let the dependency upgrade workflow change workflow files (#3349, #3384), by @​fengmk2.
• Refine contributor guidance: AGENTS.md separates the vite-plus package from the global vp CLI and replaces CLAUDE.md, and the Node.js version RFCs describe .nvmrc support (#3388, #3383), by @​liangmiQwQ and @​hyunbinseo.
• Resolve the docs theme aliases from import.meta.dirname, so the docs dev server no longer warns about __dirname (#3379), by @​liangmiQwQ.
• Fold the .node-version parse tests into one table (#3355), by @​Brooooooklyn.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.7	5def936	8.3.6, 8.3.7
rolldown	1.2.18	f9a49d6	1.2.18
oxc-node	1.0.1	7ff14c3	unchanged
tsdown	0.23.4	npm	unchanged
vitest	5.1.0	npm	unchanged
oxlint	1.91.0	npm	unchanged
oxlint-tsgolint	7.0.2005	npm	unchanged
oxfmt	0.76.0	npm	unchanged

Upgrade

vp upgrade
</tr></table> 

... (truncated)

Commits

• e5defe1 release: v1.5.1 (#3401)
• a110977 fix(pm): verify and content-key managed package-manager installs (#3400)
• 37cb983 fix(cli): restore blocking stdin after loading a dynamic config (#3361)
• bb2d43e fix(create): skip React Router Git initialization (#3363)
• a32a8ce fix(build): use the napi-cross sysroot for native Linux builds (#3349)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite-plus@​1.5.0 ⏵ 1.5.1	+1			+2

View full report