chore(deps): update vitest stack

[wajeht-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/coverage-v8 (source)	4.1.5 → 4.1.7
vite (source)	0.1.21 → 0.1.23
vite-plus (source)	0.1.21 → 0.1.23
vitest (source)	0.1.21 → 0.1.23

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

v4.1.6

Compare Source

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in #​10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in #​10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in #​10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in #​10276 (9f7b1)

    View changes on GitHub

voidzero-dev/vite-plus (vite)

v0.1.23: vite-plus v0.1.23

Compare Source

vite-plus v0.1.23

Enterprise-ready HTTP (proxy + custom CA), task command shorthands in vite.config.ts, a smoother vp create/vp migrate, and the oxc/vite/rolldown bundled stack moves forward.

Highlights

• Proxy and custom-CA aware HTTP: a new process-wide vite_shared::shared_http_client() honors HTTPS_PROXY / HTTP_PROXY / NO_PROXY, picks up macOS System Settings / Windows registry proxies, loads custom CAs from SSL_CERT_FILE and NODE_EXTRA_CA_CERTS, and exposes a VP_INSECURE_TLS diagnostic switch; makes vp work through Socket Firewall Free and other TLS-intercepting proxies (#​1686), by @​fengmk2
• Task command shorthands: run.tasks entries in vite.config.ts now accept a bare string ("build": "cmd") or array ("build": ["cmd1", "cmd2"]) instead of always requiring { command: ... }; arrays reuse the existing && planning path so cache, dependsOn, and task options stay consistent (vite-task#391), by @​jong-kyung
• Managed vp outdated -g: routes through Vite+'s managed global package metadata instead of delegating to the underlying npm outdated -g store, so all installed global packages are reported consistently (#​1659), by @​liangmiQwQ

Features

• vp pm approve-builds: new unified subcommand that mirrors pnpm approve-builds one-to-one, adapts to bun pm trust, and warns-and-noops on npm/yarn (#​1662), by @​fengmk2
• vp create: opt-in GitHub Copilot setup; selecting --agent copilot now generates a .github/workflows/copilot-setup-steps.yml so the Copilot Coding Agent can set up Vite+ and run vp in the new project out of the box (#​1683), by @​jong-kyung
• vp migrate: prompt to remove baseUrl from tsconfig.json before applying type-aware lint defaults (runs @andrewbranch/ts5to6 --fixBaseUrl . under the hood; auto-applied in non-interactive mode) (#​1692), by @​TheAlexLichter
• Respect packageManager in package-manager shims (npm/npx, pnpm/pnpx, yarn/yarnpkg, bun/bunx); add non-mutating packageManager resolution metadata for vp env current and vp env which (#​1654), by @​fengmk2
• vite-task: --filter no-match now exits 0 by default; add --fail-if-no-match to opt back in (vite-task#393), by @​kazupon

Fixes & Enhancements

• vp create: keep generated .vscode/settings.json trackable when the VS Code editor option is selected (avoid templates' .vscode/* .gitignore masking it) (#​1700), by @​jong-kyung
• vp create vite:monorepo: normalize sub-package vite-plus to catalog: even when only vite-plus (not vite/vitest/...) is present, and drop the vite/vitest aliases generated by the upstream library template (#​1697), by @​fengmk2
• vp add/install -g <path>: resolve the real package name from package.json instead of using the path string, so local-path installs don't create broken directories (#​1685), by @​liangmiQwQ
• vp test --coverage and other direct built-in commands now expose the workspace's package.json#packageManager to child processes so tools like Vitest coverage can spawn the configured PM (#​1696), by @​jong-kyung
• vp migrate: clean up the whole ESLint ecosystem (plugins, configs, parser/resolver, type-utils) rather than just eslint; skip the migration entirely when @nuxt/eslint is detected (#​1682), by @​fengmk2
• vp create: write fmt.configPath (not configPath) for Zed oxfmt settings to match the official Zed OXC extension layout (#​1687), by @​chungweileong94
• vp migrate: parse tsconfig.json as JSONC so files with comments don't break baseUrl detection/removal (#​1688), by @​TheAlexLichter
• vp env setup: Unix env shims now point at the active vp executable instead of always assuming VP_HOME/current/bin/vp, so Homebrew-style installs work (#​1631), by @​leohara
• vp outdated -g / vp why -g: don't require a local package.json; global commands run regardless of cwd (#​1622), by @​liangmiQwQ
• vp create: default the "Initialize a git repository?" prompt to yes (#​1650), by @​fengmk2
• vp hooks: include the managed Node bin in PATH so ./node_modules/.bin/vp can find node from a VS Code commit on macOS (#​1647), by @​TheAlexLichter
• vpx on Windows now invokes the package's .cmd shim instead of the Unix binary (#​1652), by @​tobynguyen27
• vite-task: bump cache database schema to version 13 (forces a one-time rebuild of the local task cache) (vite-task#402), by @​branchseer
• Bump vite-task to d02b257 and 5833b374; also bumps the repo's Rust nightly toolchain to nightly-2026-05-24 and ships the regenerated run config types and docs for the new task command shorthand (#​1689, #​1695), by @​branchseer

Refactor

• Replace VP_SHELL_NU/VP_SHELL_PWSH with a single VP_SHELL override; add explicit shell parsing for bash, zsh, fish, nu, pwsh, and cmd, and harden auto-detection against nested shells (#​1658), by @​nekomoyi
• vite-task: replace allocator-api2 with bumpalo collections (vite-task#400), by @​branchseer
• vite-task: drop the unused and_item_index field from ExecutionItemDisplay (vite-task#394), by @​branchseer

Docs

• Add the root AGENTS.md as the primary AI-agent guide for the vite-plus repository; convert CLAUDE.md into a compatibility pointer (#​1670), by @​jong-kyung
• Align the agent validation table to match AGENTS.md (#​1673), by @​jong-kyung
• Update the task output caching guide so the documented behavior matches what vite-task actually does (#​1639), by @​ericclemmons
• Correct the bundled-source location in packages/core/BUNDLING.md (#​1660), by @​shulaoda

Chore

• Clarify --help text for vp env default/pin/use/exec with Examples: blocks (#​1664), by @​Boshen
• Refresh trusted stack stats on the docs homepage (#​1680), by @​voidzero-guard[bot]
• Drop the standalone pnpm --filter @​rolldown/pluginutils build step now that @rolldown/pluginutils is published from its own package (#​1655), by @​shulaoda
• Preserve single-quote style when sync-remote rewrites pnpm-workspace.yaml (#​1672), by @​lyzno1
• Enable vite_pm_cli lib tests by removing a stale test = false flag (#​1661), by @​shulaoda
• CI: switch macOS runners back to namespace-profile-mac-default (#​1701), by @​fengmk2
• CI: fix release-day flakes in the upgrade test and snap test when the dev package.json version equals npm latest (#​1645), by @​fengmk2
• CI: replace zizmor and cargo-deny workflows with oxc-project/security-action (#​1635), by @​Boshen
• CI: warm-up monorepo cache test under npm (#​1649), by @​fengmk2
• CI: attach per-target vp binary archives (.tar.gz/.zip) to GitHub Releases alongside the existing vp-setup-*.exe installers (#​1665), by @​Boshen
• CI: declare Playwright via repo.json in ecosystem tests and bump consumers to >=1.60 to dodge the Node 24.16.0 hang (#​1668), by @​fengmk2
• Update GitHub Actions (#​1640, #​1675, #​1678, #​1679, #​1691), by @​renovate[bot]
• Upgrade upstream dependencies: vite 8.0.11 → 8.0.14, rolldown 1.0.0 → 1.0.3, vitest 4.1.6 → 4.1.7, oxlint 1.63.0 → 1.67.0, oxfmt 0.48.0 → 0.52.0, oxlint-tsgolint 0.22.1 → 0.23.0, @oxc-project/* and oxc Rust crates 0.129.0 → 0.133.0 (#​1646, #​1653, #​1693, #​1699), by @​voidzero-guard[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.14	c917f1e
rolldown	1.0.3	a287faa
tsdown	0.22.0	npm
vitest	4.1.7	npm
oxlint	1.67.0	npm
oxlint-tsgolint	0.23.0	npm
oxfmt	0.52.0	npm

New Contributors

Welcome to all new contributors! 🎉

@​ericclemmons, @​tobynguyen27, @​shulaoda, @​leohara, @​chungweileong94

Full Changelog: voidzero-dev/vite-plus@v0.1.22...v0.1.23

Published Packages

• @voidzero-dev/vite-plus-core@0.1.23
• @voidzero-dev/vite-plus-test@0.1.23
• vite-plus@0.1.23

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

v0.1.22: vite-plus v0.1.22

Compare Source

A critical Vitest browser-mode security fix, parallel vp add -g installs, a built-in oxlint rule to prefer vite-plus imports, and a new --git switch for vp create.

Highlights

• Security: bundled vitest bumped to 4.1.6 to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via the otelCarrier query parameter in Vitest browser mode (#​1633)
• Parallel global install: vp add/install/update -g now installs packages concurrently with a progress bar and a --concurrency flag (default 5) (#​1597)
• Prefer vite-plus imports: new bundled oxlint rule rewrites vite/vitest imports to vite-plus, enabled by default in generated and migrated lint configs (#​1408)
• Git init on scaffold: vp create learns --git/--no-git (interactive prompt; auto-commits "Initial commit from Vite+") (#​1484)

Features

• Spawn npm for global installation in parallel with a progress bar and a --concurrency option (#​1597), by @​liangmiQwQ
• Add bundled oxlint rule to prefer vite-plus imports over vite/vitest (#​1408), by @​Han5991
• vp create: initialize a git repository and create an initial commit on scaffold (#​1484), by @​ryohidaka
• vp create: rename underscore-prefixed files (_gitignore, _npmrc, _yarnrc.yml) to dotfiles for @org/create bundled templates (#​1574), by @​jong-kyung
• Add VP_PR_VERSION env var to install unreleased PR builds via pkg.pr.new (#​1578), by @​fengmk2

Fixes & Enhancements

• Skip merging standalone .oxfmtrc/.oxlintrc config when the fmt:/lint: key is already declared in vite.config.ts (fixes duplicate-block regression in vp create fate) (#​1601), by @​fengmk2
• Suppress the VITE+ - The Unified Toolchain for the Web banner for vp lint --lsp, vp fmt --lsp, and vp fmt --stdin-filepath so stdout stays a pure LSP / formatter stream (#​1619), by @​fengmk2
• vp create: detect output directory when running in the current directory (#​1606), by @​jong-kyung
• vp update -g: skip installs when the recorded global package version already matches the npm-resolved version, and tolerate string/array outputs from npm view ... version --json (#​1596), by @​leno23
• vp create: preserve single-segment project path in updateWorkspaceConfig (#​1582), by @​jong-kyung
• vp env use: keep the change session-scoped on Windows (#​1577), by @​fengmk2
• vp rebuild: accept positional package names (#​1564), by @​fengmk2
• Adopt the new vite-task error formatter; errors now print as error: <top-level> plus * <source> chain lines, with bold-red highlight on a TTY (vite-task#390), by @​branchseer
• vite-task: forward LOCALAPPDATA so Node's compile cache stays outside the workspace on Windows (vite-task#389), by @​branchseer
• Bump vite-task to c945cc0 (#​1628), by @​branchseer

Refactor

• Revert vp pm plugin command (per discussion in #​1038) (#​1623), by @​jong-kyung

Docs

• Add vitepress-plugin-llms to the docs site so the published docs include LLM-friendly outputs (/llms.txt) (#​1625), by @​jong-kyung
• Refresh home stats for oxlint, vite, and vitest (#​1512), by @​nozomee
• Mention vp env doctor in agent instructions (#​1603), by @​leno23

Chore

• Consolidate the upstream build chain into a single pnpm build script (justfile recipe now just calls pnpm build) (#​1626), by @​fengmk2
• Fix bootstrap-cli on Windows (#​1583), by @​fengmk2
• Refresh trusted stack stats (#​1573, #​1616), by @​voidzero-guard[bot]
• Update GitHub Actions (#​1611, #​1612), by @​renovate[bot]
• Address zizmor findings in composite actions and the release workflow; drop unused actions-cool/issues-helper (#​1630), by @​Boshen
• Switch plain checkouts to taiki-e/checkout-action (#​1620), by @​Boshen
• Switch release to a version-bump PR + push trigger flow (#​1575), by @​Boshen
• Gate release publish on environment approval with a Discord notice (#​1571), by @​Boshen
• Enable cargo clippy with -D warnings (#​1579), by @​Boshen
• Drop unused setup-node from the version-check job (#​1600), by @​fengmk2
• Add Void deploy workflows for the docs site (#​1590), by @​fengmk2
• Add --help case to config snap tests for npm10/yarn1/yarn4 (#​1585), by @​jong-kyung
• Add --help case to publish snap tests for npm10/yarn1/yarn4 (#​1584), by @​jong-kyung
• Verify .gitignore and .yarnrc.yml in the new-vite-monorepo snap (#​1576), by @​jong-kyung
• vite-task: bump pnpm to 11.1.2 (vite-task#383), by @​branchseer
• vite-task: update lint-staged to v17 (vite-task#385), by @​renovate[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.11	66f3194
rolldown	1.0.0	ac5c710
tsdown	0.22.0	npm
vitest	4.1.6	npm
oxlint	1.63.0	npm
oxlint-tsgolint	0.22.1	npm
oxfmt	0.48.0	npm

New Contributors

Welcome to all new contributors! 🎉

@​nozomee, @​ryohidaka, @​leno23

Full Changelog: voidzero-dev/vite-plus@v0.1.21...v0.1.22

Published Packages

• @voidzero-dev/vite-plus-core@0.1.22
• @voidzero-dev/vite-plus-test@0.1.22
• vite-plus@0.1.22

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • "before 9am,after 5pm"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.