chore(deps): bump vite-plus to PR #1633 (pkg-pr-new)#11
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates the vite, vite-plus, and vitest dependencies across the workspace to use pre-release builds from a specific pull request and adds release age configurations to .npmrc. The reviewer recommends pinning these pre-release dependencies to specific commit hashes instead of mutable PR tags to ensure build reproducibility and prevent issues if the remote PR is updated or the lockfile is regenerated.
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | ||
| "vite-plugin-static-copy": "^3.3.0", | ||
| "vite-plugin-svgr": "^4.5.0", | ||
| "vite-plugin-top-level-await": "^1.5.0", | ||
| "vite-plugin-wasm": "^3.5.0", | ||
| "vite-plus": "^0.1.20" | ||
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1633" |
There was a problem hiding this comment.
For reproducible builds, it's recommended to pin pre-release dependencies to a specific commit hash instead of a mutable tag like a PR number. The lockfile indicates that @1633 resolves to commit 428629ad4076431fdbeb332ba7c91935e32f92f6. Using the commit hash directly ensures that npm install will always use this exact version, even if the lockfile is regenerated or the remote PR is updated.
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | |
| "vite-plugin-static-copy": "^3.3.0", | |
| "vite-plugin-svgr": "^4.5.0", | |
| "vite-plugin-top-level-await": "^1.5.0", | |
| "vite-plugin-wasm": "^3.5.0", | |
| "vite-plus": "^0.1.20" | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1633" | |
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@428629ad4076431fdbeb332ba7c91935e32f92f6", | |
| "vite-plugin-static-copy": "^3.3.0", | |
| "vite-plugin-svgr": "^4.5.0", | |
| "vite-plugin-top-level-await": "^1.5.0", | |
| "vite-plugin-wasm": "^3.5.0", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@428629ad4076431fdbeb332ba7c91935e32f92f6" |
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | ||
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1633" |
There was a problem hiding this comment.
For reproducible builds, it's recommended to pin pre-release dependencies to a specific commit hash instead of a mutable tag like a PR number. The lockfile indicates that @1633 resolves to commit 428629ad4076431fdbeb332ba7c91935e32f92f6. Using the commit hash directly ensures that npm install will always use this exact version, even if the lockfile is regenerated or the remote PR is updated.
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1633" | |
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@428629ad4076431fdbeb332ba7c91935e32f92f6", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@428629ad4076431fdbeb332ba7c91935e32f92f6" |
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | ||
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1633", | ||
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1633" | ||
| }, | ||
| "overrides": { | ||
| "js-yaml": "^4.1.1", | ||
| "vite": "npm:@voidzero-dev/vite-plus-core@^0.1.20", | ||
| "vitest": "npm:@voidzero-dev/vite-plus-test@^0.1.20" | ||
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | ||
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1633" |
There was a problem hiding this comment.
To ensure reproducible builds, it's best practice to pin pre-release dependencies to a specific commit hash rather than a PR number/tag. The package-lock.json indicates that @1633 resolves to commit 428629ad4076431fdbeb332ba7c91935e32f92f6.
Using the commit hash directly in package.json for vite-plus and its related packages will guarantee that the same version is always installed, even if the lockfile is regenerated or the remote PR is updated.
Please apply this change to vite, vite-plus, and vitest in both devDependencies and overrides. This should also be applied to the other package.json files in this PR.
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1633", | |
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1633" | |
| }, | |
| "overrides": { | |
| "js-yaml": "^4.1.1", | |
| "vite": "npm:@voidzero-dev/vite-plus-core@^0.1.20", | |
| "vitest": "npm:@voidzero-dev/vite-plus-test@^0.1.20" | |
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1633", | |
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1633" | |
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@428629ad4076431fdbeb332ba7c91935e32f92f6", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@428629ad4076431fdbeb332ba7c91935e32f92f6", | |
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@428629ad4076431fdbeb332ba7c91935e32f92f6" | |
| }, | |
| "overrides": { | |
| "js-yaml": "^4.1.1", | |
| "vite": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@428629ad4076431fdbeb332ba7c91935e32f92f6", | |
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@428629ad4076431fdbeb332ba7c91935e32f92f6" |
Summary
Bump
vite-plusand related@voidzero-dev/*packages to the pkg-pr-new prerelease for vite-plus PR #1633.Updated where applicable:
vite-plus→https://pkg.pr.new/voidzero-dev/vite-plus@1633vitealias →@voidzero-dev/vite-plus-corepkg-pr-new URLvitestalias →@voidzero-dev/vite-plus-testpkg-pr-new URLoverrides/resolutions/pnpm.overrides/pnpm-workspace.yamlcatalogsAlso configured
minimum-release-agewith vite-plus /@voidzero-dev/*excluded for pnpm / bun / npm.Test plan