Repository navigation
chore(deps): upgrade active dependencies and remove unused catalog entries - #1782
Merged
Merged
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
2 times, most recently
from
June 14, 2026 17:38
e72e6b4 to
6f274d0
Compare
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
3 times, most recently
from
June 28, 2026 16:46
ba10bd3 to
9187b13
Compare
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
2 times, most recently
from
July 5, 2026 16:19
9da68e2 to
b538d6a
Compare
fengmk2
added a commit
that referenced
this pull request
Aug 16, 2026
Renovate aborts the whole repository scan with `ERR_PNPM_INVALID_SELECTOR` when it parses the multi-level pnpm override selector (`vite-plugin-svgr>foo>vite`) in the `migration_monorepo_pnpm_overrides_dependency_selector` snapshot fixture ([error log](https://developer.mend.io/github/voidzero-dev/vite-plus/-/job/5694ac3b-1f35-49c0-b558-51d59fe4842b)). The selector is intentional `vp migrate` test data, but `@pnpm/parse-overrides` cannot parse two `>` levels. Every run since mid-June failed, so the update PRs #1780, #1782, and #1831 went stale. Fix: add the snapshot and unit-test fixture trees to `ignorePaths`. Renovate applies `ignorePaths` before extraction, so fixture files never reach the parser on any Renovate version. Fixture dependencies also stop receiving bump PRs, which would break recorded snapshots. Verified with `renovate-config-validator` and a local dry run (`npx renovate --platform=local --dry-run=extract`): the npm manager drops from 726 files to 11 real package files, no fixture file is extracted, and the cargo and github-actions managers are unchanged (`crates/vp_cli_snapshots/Cargo.toml` stays managed). Closes #2451
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
from
August 16, 2026 17:29
d36b486 to
4b93a95
Compare
Contributor
|
✅ Staging deployment successful! Preview: https://viteplus-staging.void.app/ |
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
2 times, most recently
from
August 23, 2026 18:47
0951b0b to
c293acb
Compare
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
2 times, most recently
from
September 6, 2026 16:06
2f2b7e2 to
1a15fea
Compare
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
4 times, most recently
from
September 13, 2026 17:21
349af6b to
88f428f
Compare
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
3 times, most recently
from
September 20, 2026 16:33
c9e6323 to
2a611e3
Compare
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
2 times, most recently
from
September 27, 2026 18:58
2248d41 to
918e11b
Compare
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
from
October 4, 2026 21:02
7fb1a0c to
1be2694
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6a7512e2a4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
fengmk2
pushed a commit
that referenced
this pull request
Oct 15, 2026
<!-- claude-projects-attribution: {"github_login":"Brooooooklyn"} -->
_Requested by **Brooklyn** · [project
thread](https://claude.ai/code/project/chan_018s9RxRdtH424j2EhXdzV3N?thread=cmsg_018s9RxRdtH424j2EhXdzV3NQxbeR8Pt7qaqSQwoq9rEFo)_
<!-- routine:prune-tests:duplicate-shell-and-helper-tests -->
Before: `vp_global_cli` and `vp_pm_cli` carried Rust unit tests that
could not fail when the product broke: an `assert!(true)` in
`create.rs`, four `env use` shell-detection tests that repeat
`commands::shell` tests for code `env use` only imports, and three tests
of test-only helpers. `upgrade_check.rs` had 20 hand-unrolled lookup
tests.
After: those 8 tests are gone and the 20 lookup tests are 2 table-driven
tests that keep every row and comment, with the failing row named in the
assertion message. Only test code changes: every hunk is inside a
`#[cfg(test)]` module or the `#[cfg(test)]`-only
`resolution::test_utils` module.
How: each candidate was defended by mutating product code with the most
realistic regression only it would catch, running the crate's tests, and
reverting. No deleted test failed alone on any mutation.
### Totals
| | Before (origin/main c04bcf6) | After |
|---|---|---|
| Files touched | – | 5 |
| `vp_global_cli` cases collected (Linux) | 502 (+2 ignored) | 479 (+2
ignored) |
| `vp_pm_cli` cases collected | 923 (+2 ignored) | 920 (+2 ignored) |
- Cases deleted: **8** of 1,425 collected in the two touched crates.
Repo-wide: about 2,432 `#[test]`/`#[tokio::test]` attributes in tracked
Rust (static count) and 1,492 static `it`/`test` calls in 101 JS spec
files (not collected; Vitest needs a full `packages/core` build).
- Cases folded: **20 into 2**, every row and comment kept.
Runner-collected total: −26.
- Net lines: **−159** (+42 / −201).
- Runtime saved: about 0.03 s (the 8 deleted cases each report 0.000 s;
the 20 folded cases summed 0.028 s against 0.011 s for the 2
replacements).
- Test-binary time on this shared machine: `vp_global_cli` 3.13 s → 3.32
s, `vp_pm_cli` 27.81 s → 29.06 s (noise).
### Per file
1. **`crates/vp_global_cli/src/commands/create.rs` ›
`test_create_command_module_exists`**
- Class: tautology (`assert!(true)`).
- Best defense: M1 (delegate `"new"` instead of `"create"`) passes all
502 tests, so this test cannot fail. The whole `mod tests` goes.
- Coverage gap (pre-existing, unchanged by this PR): no unit test covers
`vp create` delegation. It may be covered by the PTY snapshot suite,
which was not run.
2. **`crates/vp_global_cli/src/commands/env/use.rs` ›
`test_detect_shell_vp_shell_{powershell,fish,nu}`,
`test_detect_shell_posix_default`**
- Class: duplicates of stronger tests. `detect_shell` /
`Shell::from_str` live in `commands/shell.rs`; `env use` only imports
them.
- Still covered: `fish` is byte-identical to
`commands::shell::tests::test_detect_shell_vp_shell_fish`; `nu` to
`test_detect_shell_vp_shell_explicit`; lowercase `powershell` by
`test_shell_from_str` and `test_detect_shell_vp_shell_case_insensitive`;
`posix_default` by `test_detect_shell_defaults_without_vp_shell`.
- Best defenses M2–M5: each failed the nominee together with at least
one `commands::shell` test.
- The `use vp_shared::env_vars;` import is now `#[cfg(windows)]`, since
only the three Windows-only tests in the module still use it.
3. **`crates/vp_pm_cli/src/resolution/test_utils.rs` ›
`parses_args_without_a_program_name`,
`parses_subcommands_without_a_program_name`**
- Class: test tooling testing test tooling.
- Best defense: M7 fails 122 tests and M8 fails 17; every resolution
parser test exercises these helpers.
4. **`crates/vp_pm_cli/src/resolution/commands/list.rs` ›
`list_args_helper_keeps_pattern`** (and its test-only `list_args`
helper, which had no other caller)
- Class: test tooling testing test tooling; it only checked struct
construction.
- Best defenses: M9 fails only
`test_list_with_pattern_and_pass_through_args`; M10 fails
`test_parser_accepts_short_dev_and_global_flags` and
`cli::tests::projects_managed_global_commands`. The nominee passes both.
### Folds (`crates/vp_global_cli/src/upgrade_check.rs`)
- The 9 `is_newer_version_*` tests → `is_newer_version_compares_semver`
(12 rows, original comments kept, one comment added for the `0.0.0`
dev-build row).
- The 11 `should_run_for_*` / `should_not_run_for_*` tests →
`should_run_for_command_skips_excluded_and_machine_readable_commands`
(11 rows).
- M11, M12 and M13 still fail the folded tables.
### Kept after defense — do not re-nominate
None: no nominee survived its defense.
### Case counts
| file | before | after | delta | expected delta |
|---|---|---|---|---|
| vp_global_cli `commands/create.rs` | 1 | 0 | −1 | −1 |
| vp_global_cli `commands/env/use.rs` (Linux) | 16 | 12 | −4 | −4 |
| vp_global_cli `upgrade_check.rs` | 36 | 18 | −18 | −18 (20 folded into
2) |
| vp_pm_cli `resolution/commands/list.rs` | 45 | 44 | −1 | −1 |
| vp_pm_cli `resolution/test_utils.rs` | 2 | 0 | −2 | −2 |
| **Crates total** | 1,425 | 1,399 | −26 | −26 |
**0 new failures** (0 failed and 4 ignored, before and after).
### Mutations
Each was temporary and reverted (`git status` clean afterwards).
1. M1 `create.rs:15`: delegate `"new"` instead of `"create"`. Failed:
none.
2. M2 `shell.rs:30`: `"fish"` → `"fishshell"`. Failed: `use::…_fish`,
`shell::test_shell_from_str`, `shell::…_fish`.
3. M3 `shell.rs:31`: `"nu" | "nushell"` → `"nushell"`. Failed:
`use::…_nu`, `shell::…_explicit`, `shell::test_shell_from_str`.
4. M4 `shell.rs:32`: drop `"powershell"`. Failed: `use::…_powershell`,
`shell::…_case_insensitive`, `shell::test_shell_from_str`.
5. M5 `shell.rs:54`: default always `Cmd`. Failed:
`use::…_posix_default`, `shell::…_defaults_without_vp_shell`,
`shell::…_invalid_vp_shell_falls_back_to_default`.
6. M6 `shell.rs:49`: upper-case the value. Failed: none (equivalent
mutation; `from_str` lowercases).
7. M7 `test_utils.rs:70`: `test_argv` no longer prepends a program name.
Failed: 122 tests, including both nominees.
8. M8 `test_utils.rs:57`: `parse_subcommand` gets raw args. Failed: 17
tests (`config`, `dist_tag`, `owner`, `stage`, `token`, plus the
nominee).
9. M9 `list.rs:78-80`: pnpm drops the pattern. Failed:
`test_list_with_pattern_and_pass_through_args` only.
10. M10 `list.rs:11`: `pattern` becomes `#[arg(long)]`. Failed:
`test_parser_accepts_short_dev_and_global_flags`,
`cli::tests::projects_managed_global_commands`.
11. M11 `upgrade_check.rs:170` (after the fold): `>` → `>=`. Failed:
`is_newer_version_compares_semver`.
12. M12 `upgrade_check.rs:338` (after the fold): `Upgrade` removed from
the excluded commands. Failed:
`should_run_for_command_skips_excluded_and_machine_readable_commands`.
13. M13 `upgrade_check.rs:165` (after the fold): the `0.0.0` early
return removed. Failed: `is_newer_version_compares_semver`.
### What ran and what did not
- Ran, at origin/main and on this branch: `cargo test -p vp_global_cli`
and `cargo test -p vp_pm_cli` with `--report-time`; `cargo clippy -p
vp_global_cli -p vp_pm_cli --all-targets --all-features -- --deny
warnings` with the `just lint` allow-list; `cargo fmt --all -- --check`;
`git diff --check`. All pass.
- Not run: the full workspace `just test` / `just lint` / `just check`;
Windows targets (none installed here, so the `#[cfg(windows)]` import
gate was reviewed but not compiled; Windows CI will compile it); the
JS/Vitest suite; the PTY snapshot suite.
### Excluded pull requests
55 open PRs touch 737 files between them; none of the 5 files here is
among them. #3055 #3052 #3051 #3049 #3047 #3046 #3044 #3040 #3038 #3037
#3020 #3018 #3014 #3012 #3009 #3008 #3000 #2986 #2981 #2966 #2936 #2922
#2900 #2863 #2862 #2810 #2792 #2740 #2721 #2699 #2695 #2574 #2557 #2552
#2549 #2543 #2542 #2541 #2483 #2475 #2463 #2462 #2461 #2456 #2428 #2418
#2357 #2267 #2125 #1958 #1783 #1782 #1614 #1517 #1180.
### Age check (cutoff: 30 days, 2026-09-14)
First-added dates from `git log -S`, followed across the `vite_*` →
`vp_*` crate rename.
| Test | First added |
|---|---|
| `test_create_command_module_exists` | 2026-02-10 (a29ac83, #570) |
| `test_detect_shell_posix_default` | 2026-02-07 (194c0dc, #524) |
| `test_detect_shell_vp_shell_{powershell,fish,nu}` | 2026-05-24
(53ae721, #1658) |
| `test_utils` tests and `list_args_helper_keeps_pattern` | 2026-08-03
(c1574dd, #2140) |
| The 20 folded `upgrade_check` tests | 2026-03-30 (db75675) |
None was added for a bug or incident, and none is in a permission,
security or entitlement suite.
### Checks
| Check | Before | After |
|---|---|---|
| Tests `vp_global_cli` | 502 pass | 479 pass |
| Tests `vp_pm_cli` | 923 pass | 920 pass |
| Clippy (deny warnings) | pass | pass |
| rustfmt | – | pass |
| `git diff --check` | – | clean |
To revert: `git revert 687935d`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01PxVsmvB9xfZKfVnUonY8kf
---
_Generated by [Claude
Code](https://claude.ai/code/session_01PxVsmvB9xfZKfVnUonY8kf)_
Co-authored-by: Claude <noreply@anthropic.com>
renovate
Bot
force-pushed
the
renovate/major-npm-packages
branch
from
October 15, 2026 04:53
6a7512e to
50c8368
Compare
fengmk2
changed the title
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
fengmk2
added
test: e2e
fengmk2
force-pushed
the
renovate/major-npm-packages
branch
from
October 15, 2026 07:43
4293d38 to
a41ecab
Compare
fengmk2
changed the title
fengmk2
force-pushed
the
renovate/major-npm-packages
branch
from
October 15, 2026 09:13
2bc3fe2 to
0c9b2d0
Compare
fengmk2
approved these changes
Oct 15, 2026
Merged
fengmk2
added a commit
that referenced
this pull request
Oct 16, 2026
Vite+ 1.3 adds `create-vite-plus`, so `npm create vite-plus@latest` starts a project without the global `vp`. It adds `vp pm pkg` for editing `package.json` and `vp pm licenses list` for dependency licenses, and lets `vp env` take package-manager dist-tags such as `pnpm@latest-10`. It also makes `vp migrate` import rewriting much faster on large projects and makes `vp dev` print Vite's `ready in` line and honor `--debug`, `--filter`, and `--profile`. ### Features - Create a Vite+ project without installing the global `vp` through `pnpm create vite-plus`, `npm create vite-plus@latest`, `yarn create vite-plus`, or `bun create vite-plus`, which run `vp create` with the same arguments ([docs](https://viteplus.dev/guide/create#without-the-global-cli)) ([#3028](#3028), [#3048](#3048)), by @liangmiQwQ. - `vp pm pkg get`, `set`, `delete`, and `fix` read and update `package.json` through the detected package manager: npm 7.20.0 and later (`fix` from 9.8.0), pnpm 11.3.0 and later, and Bun 1.2.19 and later ([docs](https://viteplus.dev/guide/package-management#package-manifest)) ([#3020](#3020)), by @jong-kyung. - `vp pm licenses list` (or `ls`) lists dependency licenses through pnpm 7.17.0 and later, Yarn Classic, or Bun 1.4.0 and later, with `--json` for machine-readable output ([#3037](#3037)), by @jong-kyung. - `vp env` accepts npm dist-tags in package-manager specs: `vp env pin pnpm@latest-10` pins the exact version the tag points to, and `vp env default pnpm@latest-10` follows the tag on each use ([#3047](#3047)), by @liangmiQwQ. - Upgrade the bundled tools ([#3058](#3058), [#3078](#3078)), by @voidzero-guard[bot] and @fengmk2: - `rolldown@1.2.13` to `rolldown@1.2.14`. Rolldown adds the `output.charset` option and fixes several tree-shaking, code-splitting, and renaming bugs. - `vitest@5.0.4` to `vitest@5.0.5`, with fixes for browser mode, hook cleanup after a failing hook, and `--changed` with quoted file names. ### Fixes & Enhancements - Import rewriting in `vp migrate` is up to 14 times faster on large projects, for example 78 s to 5.6 s on Dify ([#2987](#2987)), by @fengmk2. - `vp dev` prints Vite's `ready in N ms` line, so scripts that wait for it no longer time out after `vp migrate`. `--debug`, `--filter`, and `--profile` now take effect in `vp dev`, `vp build`, and `vp preview`, and `vp preview` stops when the build output is missing, as `vite preview` does ([#3056](#3056)), by @fengmk2. - `vp staged` prints one result line per task, such as `✔ vp check --fix`, instead of the task list and Git progress. Warnings, errors, and rollback results stay visible, `--verbose` shows task output, and `--debug` keeps the full log ([#3060](#3060)), by @fengmk2. - After a successful upgrade, `vp upgrade` reminds you to run `vp migrate` in projects that use an older Vite+ version ([#3063](#3063)), by @KTrain5169. - The coding agent picker in `vp create` and `vp migrate` lists Claude Code under `AGENTS.md` and no longer offers a separate `CLAUDE.md` option. `--agent claude` and existing `CLAUDE.md` files still work ([#3055](#3055)), by @fengmk2. ### Docs - Recommend setting `runtimeOnFail: ignore` and `pmOnFail: ignore` in the project's `pnpm-workspace.yaml` for pnpm 11 and later, since pnpm does not read `runtimeOnFail` from its global config ([#3077](#3077)), by @liangmiQwQ. ### Chore - Speed up CI with ThinLTO native test builds, a pinned prepacked Windows SDK, and a precompiled std for trampoline tests, keep dependencies in Cargo caches, switch Linux runners, and update Windows build pins with Renovate ([#3026](#3026), [#2995](#2995), [#3009](#3009), [#3000](#3000), [#3073](#3073), [#3049](#3049)), by @fengmk2. - Stabilize CLI snapshots during slow package-manager downloads, isolate Vitest browser and UI server ports, skip slow snapshot cases on Linux and Windows, and remove duplicate Rust unit tests ([#3043](#3043), [#3061](#3061), [#3059](#3059), [#3057](#3057)), by @fengmk2 and @Brooooooklyn. - Upgrade Rust crates and JavaScript dependencies, including `rustls@0.23.46` and `ast-grep@0.51.0`, and remove unused catalog entries ([#1780](#1780), [#1782](#1782), [#1783](#1783)), by @renovate[bot] and @fengmk2. - Refine the release-manager guidance ([#3052](#3052)), by @fengmk2. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | vite | `8.3.4` | [`b6c20f6`](vitejs/vite@b6c20f6) | unchanged | | rolldown | `1.2.14` | [`c9a8cda`](rolldown/rolldown@c9a8cda) | [1.2.14](https://github.com/rolldown/rolldown/releases/tag/v1.2.14) | | tsdown | `0.23.1` | [npm](https://npmx.dev/package/tsdown/v/0.23.1) | unchanged | | vitest | `5.0.5` | [npm](https://npmx.dev/package/vitest/v/5.0.5) | [5.0.5](https://github.com/vitest-dev/vitest/releases/tag/v5.0.5) | | oxlint | `1.88.0` | [npm](https://npmx.dev/package/oxlint/v/1.88.0) | unchanged | | oxlint-tsgolint | `7.0.2004` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2004) | unchanged | | oxfmt | `0.73.0` | [npm](https://npmx.dev/package/oxfmt/v/0.73.0) | unchanged | ### Upgrade ```bash vp upgrade ``` **Full Changelog**: v1.2.0...v1.3.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrade six active dependencies. Remove nine unused catalog entries and the unused
magic-stringdeclaration frompackages/core/package.json. Keep the CLI Node.js range at^22.18.0 || ^24.11.0 || >=26.0.0.Update
es-module-lexer,fast-string-width,is-unicode-supported,sisteransi,validate-npm-package-name, andmermaid.Set Unicode support explicitly in prompt output tests and cover fallback symbols. This keeps output assertions independent of the terminal environment.
The SQLocal ecosystem tests wait for peer clients to reconnect after database deletion and overwrite. Allow
5000ms for the OPFS case that exports two databases and performs three overwrites. These fixes are also in DallasHoff/sqlocal#112.validate-npm-package-name@8.0.0declares higher Node.js minimums, but its runtime files match7.0.2. The CLI bundles this code, so users do not install the validator package separately.vitepress-plugin-mermaidstill declares themermaidpeer range10 || 11, so the documentation install reports a peer warning.