[dependabot]

Bumps vite-plus from 0.3.3 to 1.3.0.

Release notes

Sourced from vite-plus's releases.

vite-plus v1.3.0

Vite+ 1.3 adds create-vite-plus for starting a project without the global vp, new vp pm pkg and vp pm licenses commands, and package-manager dist-tags in vp env.

Features

• Create a Vite+ project without installing the global vp through pnpm create vite-plus, npm create vite-plus@latest, yarn create vite-plus, or bun create vite-plus, which run vp create with the same arguments (docs) (#3028, #3048), by @​liangmiQwQ.
• vp pm pkg get, set, delete, and fix read and update package.json through the detected package manager: npm 7.20.0 and later (fix from 9.8.0), pnpm 11.3.0 and later, and Bun 1.2.19 and later (docs) (#3020), by @​jong-kyung.
• vp pm licenses list (or ls) lists dependency licenses through pnpm 7.17.0 and later, Yarn Classic, or Bun 1.4.0 and later, with --json for machine-readable output (#3037), by @​jong-kyung.
• vp env accepts npm dist-tags in package-manager specs: vp env pin pnpm@latest-10 pins the exact version the tag points to, and vp env default pnpm@latest-10 follows the tag on each use (#3047), by @​liangmiQwQ.
• Upgrade the bundled tools (#3058, #3078), by @​voidzero-guard[bot] and @​fengmk2:
  • rolldown@1.2.13 to rolldown@1.2.14. Rolldown adds the output.charset option and fixes several tree-shaking, code-splitting, and renaming bugs.
  • vitest@5.0.4 to vitest@5.0.5, with fixes for browser mode, hook cleanup after a failing hook, and --changed with quoted file names.

Fixes & Enhancements

• Import rewriting in vp migrate is up to 14 times faster on large projects, for example 78 s to 5.6 s on Dify (#2987), by @​fengmk2.
• vp dev prints Vite's ready in N ms line, so scripts that wait for it no longer time out after vp migrate. --debug, --filter, and --profile now take effect in vp dev, vp build, and vp preview, and vp preview stops when the build output is missing, as vite preview does (#3056), by @​fengmk2.
• vp staged prints one result line per task, such as ✔ vp check --fix, instead of the task list and Git progress. Warnings, errors, and rollback results stay visible, --verbose shows task output, and --debug keeps the full log (#3060), by @​fengmk2.
• After a successful upgrade, vp upgrade reminds you to run vp migrate in projects that use an older Vite+ version (#3063), by @​KTrain5169.
• The coding agent picker in vp create and vp migrate lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option. --agent claude and existing CLAUDE.md files still work (#3055), by @​fengmk2.

Docs

• Recommend setting runtimeOnFail: ignore and pmOnFail: ignore in the project's pnpm-workspace.yaml for pnpm 11 and later, since pnpm does not read runtimeOnFail from its global config (#3077), by @​liangmiQwQ.

Chore

• Speed up CI with ThinLTO native test builds, a pinned prepacked Windows SDK, and a precompiled std for trampoline tests, keep dependencies in Cargo caches, switch Linux runners, and update Windows build pins with Renovate (#3026, #2995, #3009, #3000, #3073, #3049), by @​fengmk2.
• Stabilize CLI snapshots during slow package-manager downloads, isolate Vitest browser and UI server ports, skip slow snapshot cases on Linux and Windows, and remove duplicate Rust unit tests (#3043, #3061, #3059, #3057), by @​fengmk2 and @​Brooooooklyn.
• Upgrade Rust crates and JavaScript dependencies, including rustls@0.23.46 and ast-grep@0.51.0, and remove unused catalog entries (#1780, #1782, #1783), by @​renovate[bot] and @​fengmk2.
• Refine the release-manager guidance (#3052), by @​fengmk2.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.4	b6c20f6	unchanged
rolldown	1.2.14	c9a8cda	1.2.14
tsdown	0.23.1	npm	unchanged
vitest	5.0.5	npm	5.0.5
oxlint	1.88.0	npm	unchanged
oxlint-tsgolint	7.0.2004	npm	unchanged
oxfmt	0.73.0	npm	unchanged

Upgrade

vp upgrade

... (truncated)

Commits

• afbe4a2 release: v1.3.0 (#3079)
• 7002261 feat(deps): upgrade upstream dependencies (#3078)
• a590ae0 feat(deps): upgrade upstream dependencies (#3058)
• ff3b83e fix(cli): start vp dev/build/preview through Vite's bin script (#3056)
• f047089 fix(cli): simplify vp staged output (#3060)
• 7b467f3 fix(create): remove CLAUDE.md from agent picker (#3055)
• cc0a45b feat: add create-vite-plus package (#3028)
• 5b01b67 perf(ci): use ThinLTO for native test builds (#3026)
• 8828720 release: v1.2.0 (#3029)
• 2e9d7cb feat(deps): upgrade upstream dependencies (#3039)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vanguard	Ready	Preview	Oct 22, 2026 7:57am UTC

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit f942cb6. Configure here.}

[cursor]

Node engine no longer matches

Medium Severity

vite-plus 1.3.0 requires Node ^22.18.0 || ^24.11.0 || >=26.0.0, but engines.node is still >=24.0.0. vp config in prepare and vp check can fail on Node 24.0–24.10 and on Node 25, which this project still claims to support.

 

^{Reviewed by Cursor Bugbot for commit f942cb6. Configure here.}

[cursor]

Vitest 4 and 5 mixed

Medium Severity

The project still pins vitest 4.1.11 while vite-plus 1.3.0 now depends on Vitest 5.0.5. The lockfile then wires @vitest/browser-preview@5.0.5 and @vitest/ui@5.0.5 (peers of exact vitest@5.0.5) onto vitest@4.1.11, which is an unsupported mixed graph.

Additional Locations (2)

• pnpm-lock.yaml#L176-L179
• pnpm-lock.yaml#L5981-L5987

 

^{Reviewed by Cursor Bugbot for commit f942cb6. Configure here.}

[sentry-junior]

Superseded by #233. It has the same vite-plus 1.3.0 package.json and lockfile as this PR, plus a narrower engines.node range for Bugbot's Node-engine finding. Closing so only one vite-plus PR stays open.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.