feat(deps): upgrade upstream dependencies by voidzero-guard[bot] · Pull Request #2202 · voidzero-dev/vite-plus

voidzero-guard · 2026-07-19T02:08:54Z

Summary

Automated daily upgrade of upstream dependencies.
Bumps rolldown to v1.2.0 and vite to v8.1.5, plus tsdown 0.22.9, the oxc/oxlint/oxfmt toolchain (oxlint 1.74.0, oxfmt 0.59.0, oxc 0.140.0), and @vitejs/devtools 0.4.1.
Requires accompanying Rust dep bumps for the new rolldown rev and regenerated NAPI bindings for the new dev-engine API.
Includes a bundling-check fix for rolldown-deduped @tsdown/css chunks and an @oxlint/migrate publish-lag fallback in the ESLint migrator.

Dependency updates

Package	From	To
`rolldown`	`f09947a`	`v1.2.0 (03e1e34)`
`vite`	`a477454`	`v8.1.5 (5e7fe12)`
`tsdown`	`0.22.7`	`0.22.9`
`@tsdown/css`	`0.22.7`	`0.22.9`
`@tsdown/exe`	`0.22.7`	`0.22.9`
`oxfmt`	`0.58.0`	`0.59.0`
`oxlint`	`1.73.0`	`1.74.0`
`oxlint-tsgolint`	`0.24.0`	`0.25.0`
`@oxc-project/runtime`	`0.139.0`	`0.140.0`
`@oxc-project/types`	`0.139.0`	`0.140.0`
`oxc-minify`	`0.139.0`	`0.140.0`
`oxc-parser`	`0.139.0`	`0.140.0`
`oxc-transform`	`0.139.0`	`0.140.0`
`@vitejs/devtools`	`0.4.0`	`0.4.1`

Unchanged dependencies

vitest: 4.1.10
@vitest/browser: 4.1.10
@vitest/browser-playwright: 4.1.10
@vitest/browser-preview: 4.1.10
@vitest/browser-webdriverio: 4.1.10
@vitest/expect: 4.1.10
@vitest/mocker: 4.1.10
@vitest/pretty-format: 4.1.10
@vitest/runner: 4.1.10
@vitest/snapshot: 4.1.10
@vitest/spy: 4.1.10
@vitest/utils: 4.1.10
lightningcss: ^1.32.0
@oxc-node/cli: 0.1.0
@oxc-node/core: 0.1.0
VITEST_VERSION constant: 4.1.10
README vitest pins: 4.1.10

Code changes

Cargo.toml (+ Cargo.lock): bump root Rust deps required by the new rolldown rev — itertools 0.14 → 0.15, phf 0.13 → 0.14 (with the macros feature), sugar_path 2 → 3, oxc_resolver/oxc_resolver_napi 11.23.0 → 11.24.2, and the oxc* crates 0.139.0 → 0.140.0.
pnpm-workspace.yaml (+ pnpm-lock.yaml): drop the postcss-modules@9.0.0 override and patch (vite no longer patches it), add a @jridgewell/trace-mapping catalog entry, and bump @napi-rs/cli 3.7.2 → 3.7.3 and rolldown-plugin-dts 0.26 → 0.27.
packages/core/build.ts: accept a rolldown-deduped @tsdown/css shared chunk (const { CssPlugin } = await import("./dist-<hash>.js")) when asserting the bundled css-plugin load is wired.
packages/cli/src/migration/migrator/eslint.ts: try candidate @oxlint/migrate specifiers in order, falling back from the exact bundled oxlint version to the latest release in the same major when the exact pin is unpublished.
packages/cli/binding/index.d.cts: regenerate NAPI bindings for the new rolldown dev-engine API (registerClient/notifyPayloadDelivered replacing invalidate/registerModules, BindingLazyChunkOutput, revised HMR envelope fields, BindingRebuildStrategy variants).

Build status

sync-remote-and-build: failure
build-upstream: failure

- rolldown: f09947a -> v1.2.0 (03e1e34) - vite: a477454 -> v8.1.5 (5e7fe12) - tsdown: 0.22.7 -> 0.22.9 - @tsdown/css: 0.22.7 -> 0.22.9 - @tsdown/exe: 0.22.7 -> 0.22.9 - oxfmt: 0.58.0 -> 0.59.0 - oxlint: 1.73.0 -> 1.74.0 - oxlint-tsgolint: 0.24.0 -> 0.25.0 - @oxc-project/runtime: 0.139.0 -> 0.140.0 - @oxc-project/types: 0.139.0 -> 0.140.0 - oxc-minify: 0.139.0 -> 0.140.0 - oxc-parser: 0.139.0 -> 0.140.0 - oxc-transform: 0.139.0 -> 0.140.0 - @vitejs/devtools: 0.4.0 -> 0.4.1 Code changes: - Cargo.toml: bump root Rust deps required by the new rolldown rev (itertools 0.14 -> 0.15, phf 0.13 -> 0.14 with `macros`, sugar_path 2 -> 3, oxc_resolver 11.23.0 -> 11.24.2, oxc crates 0.139.0 -> 0.140.0). - pnpm-workspace.yaml: drop the postcss-modules@9.0.0 override and patch (vite no longer patches it), add @jridgewell/trace-mapping catalog entry, bump @napi-rs/cli 3.7.2 -> 3.7.3 and rolldown-plugin-dts 0.26 -> 0.27. - packages/core/build.ts: accept a rolldown-deduped `@tsdown/css` shared chunk when verifying the bundled css-plugin load is wired. - packages/cli/src/migration/migrator/eslint.ts: add a major-range fallback for @oxlint/migrate when the exact bundled oxlint version is unpublished. - packages/cli/binding/index.d.cts: regenerate NAPI bindings for the new rolldown dev-engine API (registerClient/notifyPayloadDelivered, lazy chunk output, HMR envelope changes).

netlify · 2026-07-19T02:08:59Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`68c475a`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a5c31b9e2678e0008381683

github-actions · 2026-07-19T02:16:36Z

Native binary sizes (`68c475a`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact	Format	Base	PR	Change
`vp` (Linux x64)	Binary	10.32 MiB	10.32 MiB	0 B (0.00%)
`vp` (Linux x64)	gzip -9	4.42 MiB	4.42 MiB	+698 B (+0.02%)
NAPI (Linux x64)	Binary	33.46 MiB	33.35 MiB	-112.19 KiB (-0.33%)
NAPI (Linux x64)	gzip -9	12.80 MiB	12.77 MiB	-23.85 KiB (-0.18%)
`vp` (macOS ARM64)	Binary	7.65 MiB	7.65 MiB	0 B (0.00%)
`vp` (macOS ARM64)	gzip -9	3.83 MiB	3.83 MiB	+1.17 KiB (+0.03%)
NAPI (macOS ARM64)	Binary	40.73 MiB	40.64 MiB	-96.91 KiB (-0.23%)
NAPI (macOS ARM64)	gzip -9	17.03 MiB	17.01 MiB	-21.15 KiB (-0.12%)
`vp` (Windows x64)	Binary	8.37 MiB	8.37 MiB	+1.50 KiB (+0.02%)
`vp` (Windows x64)	gzip -9	3.64 MiB	3.64 MiB	+353 B (+0.01%)
NAPI (Windows x64)	Binary	27.78 MiB	27.67 MiB	-110.50 KiB (-0.39%)
NAPI (Windows x64)	gzip -9	10.74 MiB	10.72 MiB	-25.32 KiB (-0.23%)
Trampoline (Windows x64)	Binary	203.00 KiB	203.00 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	97.91 KiB	97.91 KiB	-1 B (-0.00%)
Installer (Windows x64)	Binary	4.46 MiB	4.46 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.08 MiB	2.08 MiB	-2 B (-0.00%)

socket-security · 2026-07-19T02:17:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@tsdown/exe@0.22.9
	npm/@vitejs/devtools@0.4.1
	npm/@oxc-project/runtime@0.140.0
	npm/@tsdown/css@0.22.9
	npm/@vitejs/release-scripts@1.8.0
	npm/@napi-rs/cli@3.7.3
	npm/oxfmt@0.59.0
	npm/tsdown@0.22.9
	npm/oxc-parser@0.140.0
	npm/oxc-transform@0.140.0
	npm/postcss-modules@9.0.1
	npm/oxlint-tsgolint@0.25.0
	npm/eslint-plugin-n@18.2.2
	cargo/oxc_allocator@0.139.0 ⏵ 0.140.0
	cargo/oxc_ast@0.139.0 ⏵ 0.140.0
	cargo/oxc_parser@0.139.0 ⏵ 0.140.0
	cargo/oxc_resolver@11.23.0 ⏵ 11.24.2
	cargo/oxc_span@0.139.0 ⏵ 0.140.0

View full report

wan9chi · 2026-07-20T02:56:27Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68c475a599

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-20T03:00:36Z

+      if (result.exitCode === 0) {
+        return migratePackage;
      }
-      prompts.log.info(manualHint);
-      return false;
+      lastStderr = result.stderr.toString().trim();


Restrict fallback to package-resolution failures

When the exact package exists but @oxlint/migrate itself exits nonzero for a project-specific error, this loop treats that status as evidence that the version is unpublished and runs the major-range candidate again. vp dlx returns the executed package's underlying status (crates/vite_pm_cli/src/handlers.rs), so nonzero does not distinguish resolution failures from migration failures; rerunning can repeat or compound partial config edits and hides the first diagnostic. Only attempt the fallback when the failure is known to be package resolution, otherwise stop after the exact invocation.

Useful? React with 👍 / 👎.

chatgpt-codex-connector Bot reviewed Jul 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(deps): upgrade upstream dependencies#2202

feat(deps): upgrade upstream dependencies#2202
voidzero-guard[bot] wants to merge 1 commit into
mainfrom
deps/upstream-update

voidzero-guard Bot commented Jul 19, 2026

Uh oh!

netlify Bot commented Jul 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

socket-security Bot commented Jul 19, 2026

Uh oh!

wan9chi commented Jul 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

voidzero-guard Bot commented Jul 19, 2026

Summary

Dependency updates

Code changes

Build status

Uh oh!

netlify Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

github-actions Bot commented Jul 19, 2026

Native binary sizes (68c475a)

Uh oh!

socket-security Bot commented Jul 19, 2026

Uh oh!

wan9chi commented Jul 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

netlify Bot commented Jul 19, 2026 •

edited

Loading

Native binary sizes (`68c475a`)