release: v1.4.0 by voidzero-guard[bot] · Pull Request #3201 · voidzero-dev/vite-plus

voidzero-guard · 2026-10-22T16:57:24Z

Vite+ 1.4 runs TypeScript and JavaScript files with vpx, and vp migrate can move tsx scripts to it. It also adds vp check --deny-warnings and vp pm team, and installs the global CLI's dependencies from a lockfile published with each release.

Features

vpx <file> runs a TypeScript or JavaScript file on the project's Node.js with the oxc-node loader that ships with Vite+, and vpx --watch <file> reruns it when a file it uses changes. In package.json scripts, the vpx bin of the vite-plus package runs scripts without the global CLI and runs package binaries only from node_modules/.bin, pointing to vp dlx for anything not installed (docs) (#2936, #3164), by @Brooooooklyn and @fengmk2.
vp migrate offers to move tsx scripts to vpx: tsx a.ts, npx tsx a.ts, node --import tsx a.ts, and tsx watch a.ts in package.json scripts, lint-staged tasks, and #!/usr/bin/env tsx shebangs become vpx a.ts or vpx --watch a.ts. A project already on Vite+ gets the offer with vp migrate --full (docs) (#3179), by @fengmk2.
vp check --deny-warnings fails the check on lint warnings, so CI no longer needs a separate vp lint --deny-warnings run (docs) (#3075), by @acalvino4.
vp pm team creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun (#3040), by @jong-kyung.
Security: vp no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades (RUSTSEC-2026-0382, RUSTSEC-2026-0383), and it ships tokio 1.54.1, which fixes a race in tokio::time::Interval (RUSTSEC-2026-0384) (#3159, #3202), by @wan9chi and @fengmk2.
vp pm registry commands (login, logout, whoami, owner, token, dist-tag, deprecate, search, ping, and publish) run pnpm's own commands on pnpm 11 and later (token from 12.13.0), and vp pm owner and vp pm publish run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm (#3044), by @jong-kyung.
The installer and vp upgrade install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to resolve them again if that installation fails (docs) (#3117), by @fengmk2.
Upgrade the bundled tools (#3133, #3158, #3175), by @voidzero-guard[bot] and @fengmk2:
- vite@8.3.4 to vite@8.3.5, with fixes for bundled dev mode, chunk import maps, CSS url() values containing %, and subpath imports with several # characters.
- rolldown@1.2.14 to rolldown@1.2.15, with fixes for this.resolve recursion between plugins using skipSelf: true, strict execution order, and chunk import maps.
- oxlint@1.88.0 to oxlint@1.89.0, with rule fixes that report cases missed before, for example in prefer-const, no-param-reassign, and sort-imports.
- oxfmt@0.73.0 to oxfmt@0.74.0, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown.
- The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
- vpx scripts run on oxc-node@1.0.0.
- @vitejs/devtools 0.8 is accepted as a peer dependency, alongside 0.7.

Fixes & Enhancements

The standalone vp executable is 30%+ smaller (#3086), by @fengmk2.
VP_SETUP_NODE_VERSION selects the Node.js version the installer uses for the CLI's dependencies, so setup-vp can use the project's version and avoid downloading a second Node.js in CI (docs) (#3087), by @fengmk2.
When tasks miss the cache, vp run finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again (vite-task#871), by @magurotuna.
Cached tasks no longer miss the cache when only pnpm's node_modules/.modules.yaml differs, for example after installing with another pnpm version, with --ignore-scripts, or on glibc and musl machines (vite-task#850), by @wan9chi.
vp run in a package that sits inside a workspace folder but is not listed in its pnpm-workspace.yaml packages or package.json workspaces runs that package's own tasks with its own packageManager, instead of treating the enclosing workspace as its root (vite-task#859), by @liangmiQwQ.
A mistyped or misplaced task setting fails with an error that names it, such as unknown field outputs, instead of data did not match any variant of untagged enum UserTaskDefinition (vite-task#815), by @tlq5l.
vp run no longer panics on scripts that contain non-ASCII characters, such as echo こんにちは, and no longer cuts those commands off in its output (vite-task#861), by @magurotuna.
In cached tasks on Linux and macOS, programs that pass -1 as a directory descriptor, such as ps -p <pid> from procps-ng 4.0.6 and later, no longer abort (vite-task#862), by @magurotuna.
On Linux, cached tasks such as pnpm dlx no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup (vite-task#854), by @fengmk2.
On Windows, vp run and the global vpx wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately (#3167), by @fengmk2.
vp migrate and the prefer-vite-plus-imports lint autofix leave vite/rolldown and vite/rolldown/* imports unchanged, instead of rewriting them to vite-plus/rolldown subpaths that vite-plus does not export (#3070, #3191), by @Crimson341 and @Dunqing.
vp migrate keeps existing .nvmrc files instead of converting them to .node-version, so nvm, fnm, and other tools that read .nvmrc keep working and the selected Node.js version does not change (#3126), by @liangmiQwQ.
vp migrate converts Oxlint configs that extends shared JSON files into TypeScript modules imported through lint.extends, so the inherited rules keep applying after migration (#3097), by @fengmk2.
vp migrate skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting (#3118), by @0froq.
vp migrate keeps the workspace members declared in package.json workspaces when it selects pnpm for a project without a lockfile, so recursive commands still include them (#2863), by @SaKaNa-Y.
vp migrate no longer reports unawaited-assertion for a local assertion promise that the function later awaits or returns (#3180), by @fengmk2.
pnpm create vite-plus and yarn create vite-plus no longer fail during dependency installation when vp is not on PATH, and no longer run a different global vp version for installation, formatting, and hooks (#3181), by @fengmk2.
vp create and vp migrate resolve the npm registry and credentials as npm does: a .npmrc above the project is no longer read, userconfig and globalconfig are honored, and registry hosts in credential keys match regardless of case (#3124), by @liangmiQwQ.
vp pack and vp create find the monorepo root the same way as vp run and vp install, and vp pack at a monorepo root without a vite.config no longer picks up a config from the directory above (#3101), by @liangmiQwQ.
defineConfig keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as vike(), work under Vite+ (#3154), by @liangmiQwQ.
vp dev with experimental.bundledDev no longer fails with ERR_MODULE_NOT_FOUND when no separate rolldown package is installed, and no longer picks up the runtime of an unrelated installed rolldown (#3111), by @fengmk2.
With nodeShimMode: system_first, vp node and vp env exec run the system tool that the shell would find, instead of downloading and running the managed Node.js (#3100), by @liangmiQwQ.
VP_NODE_VERSION=22 and other partial versions resolve to an exact release in vp env install, vp env exec, and vp env clean, instead of failing with a 404 download error (#3038), by @Dev-next-gen.
vp env pin and vp env unpin show the file and field they changed. Package-manager pins from a workspace member update the workspace root package.json, and the help and guide now say so (#3103), by @SaKaNa-Y.
In PowerShell, a bare -- reaches vp again, so vp create vite -- --template react-ts forwards --template to create-vite (#3083), by @fengmk2.
Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ env.nu calls, such as update. Run vp env setup again to regenerate env.nu (#3123), by @naokihaba.
Package-manager commands reject options that the selected version would silently ignore, such as --dry-run or --provenance with an npm whose version is unknown, instead of running without them (#3122), by @jong-kyung.
Fresh Bun installs verify the integrity hash in a packageManager pin and reject a mismatched download, as pnpm 12 and later already did (#3134), by @jong-kyung.
A failed vp install -g restores the executables and npm links that existed before, instead of deleting files it never created (#3119), by @jong-kyung.
vp install -g skips package binaries with unsafe names or targets instead of linking them, as pnpm does (#3156), by @jong-kyung.
npm uninstall -g <package> --dry-run no longer removes the package's commands from Vite+ (#3112), by @jong-kyung.

Refactor

Replace glob with tinyglobby in the CLI and share .nvmrc line parsing between reading and pinning. Workspace discovery in vp create and vp migrate now honors negated patterns such as !packages/foo and follows symlinked directories in ** patterns, as pnpm does (#3099, #3125), by @liangmiQwQ.
Share clap error diagnostics, manager preference parsing, external tool lookup, and native shell parsing for migration rewrites, and remove a redundant git hooks wrapper (#3172, #3143, #3138, #3173), by @jong-kyung, @myuron, and @fengmk2.

Docs

Note that run.cache can only be set in the workspace root's vite.config.ts (#3139), by @yusuke99.

Chore

Bump vite-task to a3c087a; its user-facing changes are listed above (#3153, #3168, #3184), by @wan9chi.
Run Node.js, runtime download, and package-manager tests against local mirrors and offline fixtures, serve snapshot registry traffic from local fixtures and a shared cache, replace sleeps with deterministic waits, keep snapshot setup off the npm registry, and fix or remove tests that checked nothing (#3067, #3169, #3170, #3171, #3144, #3146, #3145, #3147, #3148, #3194, #3203), by @fengmk2 and @liangmiQwQ.
Cover package-manager detection for nested projects and owner listing with pnpm 11.28.7, and allow time for the Playwright type check on slow runners (#3051, #3174, #3082), by @liangmiQwQ, @jong-kyung, and @fengmk2.
Update the Node.js versions used for development, CI, and release publishing to the October 2026 security releases: 22.23.4, 24.22.1, and 26.12.1 (#3186), by @fengmk2.
Reduce GitHub Actions cache storage and enable the e18e lint rules for the repository (#3149, #3088), by @fengmk2.
Upgrade JavaScript dependencies and Rust crates, including @ast-grep/napi@0.51.0 and serial_test@4 (#3108, #3109), by @renovate[bot].
Refine the release-manager and vite-task bump guidance (#3084, #3160), by @fengmk2 and @wan9chi.

Bundled Versions

Tool	Version	Source	Changelog
vite	`8.3.5`	`981f07f`	8.3.5
rolldown	`1.2.15`	`89d821c`	1.2.15
oxc-node	`1.0.0`	`4759ced`	1.0.0
tsdown	`0.23.1`	npm	unchanged
vitest	`5.0.5`	npm	unchanged
oxlint	`1.89.0`	npm	1.89.0
oxlint-tsgolint	`7.0.2004`	npm	unchanged
oxfmt	`0.74.0`	npm	0.74.0

Upgrade

vp upgrade

New Contributors

@acalvino4, @Dev-next-gen, @0froq, @Crimson341, @Dunqing, @magurotuna, @tlq5l

Full Changelog: v1.3.0...v1.4.0

Merging this PR will trigger the release workflow.

NAPI bakes the package.json version into binding/index.cjs version checks. The prepare_release workflow bumps package.json but does not regenerate this file, so the CI build's regeneration step produces a diff that the post-build no-unexpected-changes guard rejects. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-22T17:01:08Z

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: 790a5b7

github-actions · 2026-10-22T17:16:42Z

CLI artifact sizes (`790a5b7`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.
The dist rows use the Linux build. The core total excludes .node files to match the release artifact.

Artifact	Format	Base	PR	Change
`packages/cli/dist`	Directory total	2.25 MiB	2.25 MiB	0 B (0.00%)
`packages/core/dist`	Directory total	4.07 MiB	4.07 MiB	0 B (0.00%)
Combined package dist	Directory total	6.33 MiB	6.33 MiB	0 B (0.00%)
`vp` (Linux x64)	Binary	8.22 MiB	8.22 MiB	0 B (0.00%)
`vp` (Linux x64)	gzip -9	3.76 MiB	3.76 MiB	-76 B (-0.00%)
NAPI (Linux x64)	Binary	35.45 MiB	35.45 MiB	0 B (0.00%)
NAPI (Linux x64)	gzip -9	14.12 MiB	14.12 MiB	+230 B (+0.00%)
`vp` (macOS ARM64)	Binary	5.38 MiB	5.38 MiB	-16 B (-0.00%)
`vp` (macOS ARM64)	gzip -9	3.20 MiB	3.20 MiB	-74 B (-0.00%)
NAPI (macOS ARM64)	Binary	42.23 MiB	42.23 MiB	0 B (0.00%)
NAPI (macOS ARM64)	gzip -9	18.25 MiB	18.25 MiB	+8 B (+0.00%)
`vp` (Windows x64)	Binary	6.08 MiB	6.08 MiB	0 B (0.00%)
`vp` (Windows x64)	gzip -9	2.81 MiB	2.81 MiB	+61 B (+0.00%)
NAPI (Windows x64)	Binary	31.50 MiB	31.50 MiB	0 B (0.00%)
NAPI (Windows x64)	gzip -9	12.83 MiB	12.83 MiB	-477 B (-0.00%)
Trampoline (Windows x64)	Binary	13.50 KiB	13.50 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	7.09 KiB	7.09 KiB	-3 B (-0.04%)
Installer (Windows x64)	Binary	4.67 MiB	4.67 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.24 MiB	2.24 MiB	-1 B (-0.00%)

cloudflare-workers-and-pages · 2026-10-22T17:18:41Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://release-v1-4-0-viteplus-dev.voidzero-docs.workers.dev (commit `790a5b7`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://21f2b3c9-viteplus-dev.voidzero-docs.workers.dev	`790a5b7`	2026-10-23T01:34:37.322Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://12c3cea9-viteplus-dev.voidzero-docs.workers.dev	`6bc2d24`	2026-10-22T17:01:40.816Z	Visit the dashboard ↗

github-actions · 2026-10-22T17:42:28Z

Preview binary sizes (`6bc2d24`)

Compared with the latest stable release, v1.3.0. Preview build.
Each row measures one binary. Negative changes mean a smaller preview binary.

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	7.62 MiB	5.38 MiB	-2.25 MiB (-29.46%)
NAPI (macOS ARM64)	41.49 MiB	42.20 MiB	+727.89 KiB (+1.71%)
`vp` (macOS x64)	9.29 MiB	6.82 MiB	-2.47 MiB (-26.61%)
NAPI (macOS x64)	46.44 MiB	47.34 MiB	+918.86 KiB (+1.93%)
`vp` (Linux ARM64 GNU)	8.48 MiB	6.81 MiB	-1.66 MiB (-19.63%)
NAPI (Linux ARM64 GNU)	30.66 MiB	31.45 MiB	+809.63 KiB (+2.58%)
`vp` (Linux ARM64 musl)	8.53 MiB	6.88 MiB	-1.65 MiB (-19.29%)
NAPI (Linux ARM64 musl)	29.89 MiB	30.67 MiB	+798.06 KiB (+2.61%)
`vp` (Linux x64 GNU)	10.21 MiB	8.23 MiB	-1.98 MiB (-19.43%)
NAPI (Linux x64 GNU)	34.53 MiB	35.45 MiB	+945.56 KiB (+2.67%)
`vp` (Linux x64 musl)	10.21 MiB	8.30 MiB	-1.92 MiB (-18.77%)
NAPI (Linux x64 musl)	33.50 MiB	34.43 MiB	+955.69 KiB (+2.79%)
`vp` (Windows x64)	8.29 MiB	6.09 MiB	-2.19 MiB (-26.47%)
NAPI (Windows x64)	30.25 MiB	31.16 MiB	+934.00 KiB (+3.02%)
Trampoline (Windows x64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows x64)	3.64 MiB	4.67 MiB	+1.04 MiB (+28.50%)
`vp` (Windows ARM64)	6.94 MiB	5.33 MiB	-1.61 MiB (-23.18%)
NAPI (Windows ARM64)	26.83 MiB	27.56 MiB	+756.50 KiB (+2.75%)
Trampoline (Windows ARM64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows ARM64)	3.01 MiB	3.85 MiB	+858.50 KiB (+27.84%)

gzip -9 sizes

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	3.94 MiB	3.20 MiB	-762.31 KiB (-18.88%)
NAPI (macOS ARM64)	17.97 MiB	18.25 MiB	+290.71 KiB (+1.58%)
`vp` (macOS x64)	4.28 MiB	3.38 MiB	-920.40 KiB (-21.01%)
NAPI (macOS x64)	19.14 MiB	19.44 MiB	+311.49 KiB (+1.59%)
`vp` (Linux ARM64 GNU)	4.26 MiB	3.69 MiB	-585.99 KiB (-13.42%)
NAPI (Linux ARM64 GNU)	13.00 MiB	13.31 MiB	+316.62 KiB (+2.38%)
`vp` (Linux ARM64 musl)	4.30 MiB	3.71 MiB	-606.28 KiB (-13.76%)
NAPI (Linux ARM64 musl)	12.71 MiB	13.01 MiB	+312.64 KiB (+2.40%)
`vp` (Linux x64 GNU)	4.50 MiB	3.76 MiB	-761.99 KiB (-16.53%)
NAPI (Linux x64 GNU)	13.81 MiB	14.12 MiB	+321.87 KiB (+2.28%)
`vp` (Linux x64 musl)	4.51 MiB	3.79 MiB	-741.84 KiB (-16.06%)
NAPI (Linux x64 musl)	13.35 MiB	13.66 MiB	+323.37 KiB (+2.37%)
`vp` (Windows x64)	3.66 MiB	2.82 MiB	-857.93 KiB (-22.90%)
NAPI (Windows x64)	12.37 MiB	12.69 MiB	+325.26 KiB (+2.57%)
Trampoline (Windows x64)	7.14 KiB	7.14 KiB	-1 B (-0.01%)
Installer (Windows x64)	1.78 MiB	2.24 MiB	+467.43 KiB (+25.62%)
`vp` (Windows ARM64)	3.46 MiB	2.69 MiB	-788.68 KiB (-22.26%)
NAPI (Windows ARM64)	11.75 MiB	12.05 MiB	+309.83 KiB (+2.58%)
Trampoline (Windows ARM64)	6.93 KiB	6.93 KiB	-1 B (-0.01%)
Installer (Windows ARM64)	1.71 MiB	2.13 MiB	+438.15 KiB (+25.07%)

Raw sizes are uncompressed file sizes. gzip sizes recompress each binary at level 9; they are not package or download archive sizes.
The baseline uses published release files, including NAPI packages from npm at the same version. Build versions and toolchains can affect the difference.

github-actions · 2026-10-22T17:44:58Z

Registry bridge build (`6bc2d24`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e`
`create-vite-plus`	`0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/voidzero-dev/vite-plus/6bc2d240a024170c08fbc831f0c201c162afd22e/packages/cli/install.sh | VP_PR_VERSION=3201 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/voidzero-dev/vite-plus/6bc2d240a024170c08fbc831f0c201c162afd22e/packages/cli/install-legacy.sh bash

# Windows (PowerShell)
$env:VP_PR_VERSION="3201"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/voidzero-dev/vite-plus/6bc2d240a024170c08fbc831f0c201c162afd22e/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/6bc2d240a024170c08fbc831f0c201c162afd22e/packages/cli/install.ps1 | iex

Or download the standalone Windows installer built from this commit:

Architecture	Installer
x64	`vp-setup-x86_64-pc-windows-msvc.exe`
Arm64	`vp-setup-aarch64-pc-windows-msvc.exe`

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or create a new project from this commit without installing the CLI:

export npm_config_registry=https://registry-bridge.viteplus.dev/ pnpm_config_registry=https://registry-bridge.viteplus.dev/
pnpm create vite-plus@0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e # or: npm create vite-plus@0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e

$env:npm_config_registry="https://registry-bridge.viteplus.dev/"; $env:pnpm_config_registry="https://registry-bridge.viteplus.dev/"
pnpm create vite-plus@0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e # or: npm create vite-plus@0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e

pnpm 11+ reads pnpm_config_registry, npm and older pnpm read npm_config_registry. The new project pins this build, so keep the registry set for later installs, or configure it as below.

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.6bc2d240a024170c08fbc831f0c201c162afd22e"
  }
}

github-actions · 2026-10-22T17:46:05Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-3201`	218MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-3201 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-3201

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-3201 vp --version

See docs/guide/docker.md for usage.

Update tokio from 1.54.0 to 1.54.1 to fix [RUSTSEC-2026-0384](https://rustsec.org/advisories/RUSTSEC-2026-0384). In 1.54.0, `tokio::time::Interval` on the multi-threaded runtime can race with the time driver and cause a use-after-free. tokio yanked 1.54.0. Only the tokio entry in `Cargo.lock` changes. This clears the Security Analysis failure on the v1.4.0 release PR (#3201). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Problem On the v1.4.0 release PR (#3201), every CLI snapshot shard fails on every OS. Every case dies while the runner prepares its home: ``` first-start setup failed with status exit status: 1 error: Setup error: Failed to fetch CLI package metadata from https://registry.npmjs.org/@voidzero-dev/vite-plus-cli-linux-x64-gnu/1.4.0: HTTP status client error (404 Not Found) ``` Since #3117, first-start setup calls `vp_setup::lockfile::prepare` unless `VP_SKIP_DEPS_INSTALL` is set. The dev-built case binary has no `vp-install-lock.yaml` beside it, so `prepare` looks up the platform package for the binary's own version on registry.npmjs.org. A release branch has not published that version yet, so the lookup returns 404 and every case fails before its first step. Every future release branch would fail the same way. `main` only passes because the previous version (1.3.0) is published and advertises no lockfile, so `prepare` returns without installing anything. As a side effect, each case makes a hidden request to npm. The `snapshot_setup` fixture's reference home has the same problem. It mirrors the runner's preparation by running the unmarked binary in a second home, so it would still fail on a release branch after the runner is fixed. ## Change - The runner's first-start command now sets `VP_SKIP_DEPS_INSTALL=1`, next to the existing `VP_SELF_SETUP_NO_MODIFY_PATH=1`. First-start runs in place, and the checkout package is already installed in the case home, so setup has nothing to install and resolves no Node runtime on this path. The only effect is that the registry lookup no longer happens. - `snapshot_setup/verify.mjs` sets the same override for its reference setup. It also asserts that case commands do not inherit the override, as it already does for `VP_SELF_SETUP_NO_MODIFY_PATH`. Fixtures that test self-setup, such as `download_progress` and `command_self_setup`, keep their own `VP_SKIP_DEPS_INSTALL` values. - The snapshot runner README documents the override. Product code (`vp_setup`, `self_setup`) is unchanged, and no recorded snapshots change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

release: v1.4.0

17596c4

voidzero-guard Bot assigned fengmk2 Oct 22, 2026

fengmk2 and others added 2 commits October 23, 2026 01:59

chore(release): sync docs and prompts version to 1.4.0

6bc2d24

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fengmk2 added the preview-build Publish this PR's commits to the registry bridge as preview builds label Oct 22, 2026

fengmk2 mentioned this pull request Oct 22, 2026

fix(deps): update tokio to 1.54.1 for RUSTSEC-2026-0384 #3202

Merged

fengmk2 mentioned this pull request Oct 22, 2026

test(snapshots): keep first-start setup off the npm registry #3203

Merged

Merge remote-tracking branch 'origin/main' into release/v1.4.0

790a5b7

fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests test: sfw labels Oct 23, 2026

fengmk2 approved these changes Oct 23, 2026

View reviewed changes

fengmk2 merged commit 102fe8e into main Oct 23, 2026
225 of 237 checks passed

fengmk2 deleted the release/v1.4.0 branch October 23, 2026 02:21

Navigation Menu

Repository navigation

release: v1.4.0 - #3201

release: v1.4.0#3201
fengmk2 merged 4 commits into
mainfrom
release/v1.4.0

voidzero-guard Bot commented Oct 22, 2026 •

edited by fengmk2

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

voidzero-guard Bot commented Oct 22, 2026 • edited by fengmk2 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Features

Fixes & Enhancements

Refactor

Docs

Chore

Bundled Versions

Upgrade

New Contributors

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI artifact sizes (790a5b7)

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://release-v1-4-0-viteplus-dev.voidzero-docs.workers.dev (commit 790a5b7)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Uh oh!

github-actions Bot commented Oct 22, 2026

Preview binary sizes (6bc2d24)

Uh oh!

github-actions Bot commented Oct 22, 2026

Registry bridge build (6bc2d24)

Uh oh!

github-actions Bot commented Oct 22, 2026

🐳 Docker preview image

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

voidzero-guard Bot commented Oct 22, 2026 •

edited by fengmk2

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading

CLI artifact sizes (`790a5b7`)

cloudflare-workers-and-pages Bot commented Oct 22, 2026 •

edited

Loading

Preview URL: https://release-v1-4-0-viteplus-dev.voidzero-docs.workers.dev (commit `790a5b7`)

Preview binary sizes (`6bc2d24`)

Registry bridge build (`6bc2d24`)