[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

Vite+ 1.5.1 fixes two high-severity security issues in package-manager downloads and `vp env use`, restores interactive input in `vp run` tasks, fixes `vp migrate` config merges, and adds a reference page for each package command.
Features

Upgrade the bundled Vite and Rolldown (#3390), by @voidzero-guard[bot] and @fengmk2:

vite@8.3.5 to vite@8.3.7. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore node_modules/.modules.yaml. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (#) in the dependency optimizer, SSR builds with build.ssr: true, and chunks shared with workers.
rolldown@1.2.16 to rolldown@1.2.18, with module source maps that keep only the sources and names that they trace.
@voidzero-dev/vite-plus-core requires postcss@^8.5.32, as the bundled Vite does.



Fixes & Enhancements

Security: Vite+ verifies the pnpm that it downloads for its own setup against a hash in the CLI, and checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's packageManager field instead of the hash that the registry reports. A registry set in a project's .npmrc can no longer make Vite+ run a package manager that does not match (GHSA-5qr3-w62x-jmwx, high). Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location (#3400), by @fengmk2 and @arkmarta.
Security: vp env use and other dist-tag lookups, such as pnpm@latest, accept only a valid semver version from the registry, so a registry set in a project's .npmrc can no longer put shell commands into the statements that the vp env use shell wrapper runs (GHSA-p79r-mf8q-r78h, high) (#3395), by @fengmk2 and @arkmarta.
Scripts that vp run starts get a blocking stdin again when the run block of vite.config.ts is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as vp update --interactive wait for input instead of failing with EAGAIN (#3361), by @everton-dgn.
vp migrate changes only the return statements of a defineConfig callback, so functions inside the config, such as Rolldown codeSplitting.groups[].name callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, as, satisfies, <T>, or ! (#3325, #3372), by @jong-kyung.
vp create react-router passes --no-git-init to create-react-router, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured (#3363), by @chbaefront.
env.fish calls fish built-ins through builtin, so vp env use changes the Node.js version even when a user function has the name of a built-in such as count (#3353), by @naokihaba.
Shell completion suggests full command names before aliases, so vp i<Tab> offers install and vp up<Tab> offers update. An alias stays available when no full name matches (#3337), by @nekomoyi.
Completion for vp run and vpr skips comment keys such as "# docs #" in package.json scripts, matches task names that contain :, and shows each task's command as its description in Zsh and Fish (#3354), by @nekomoyi.
vp pm dist-tag rm works with Yarn Berry, because Vite+ passes remove to yarn npm tag (#3358), by @jong-kyung.

Docs

Add a Package Management section to the guide, with a reference page for each of the 38 package commands that lists its options, package-manager support, version requirements, and npm fallbacks. Help output for package commands and the old package management and install URLs point to the new pages (docs) (#3105), by @jong-kyung.
Show the README logo that matches the GitHub theme, so the logo stays visible after a theme change (#3350), by @fengmk2.

Chore

Build Linux native bindings against the napi-cross glibc 2.17 sysroot with @napi-rs/cli@3.10.12, let the linker reject unresolved symbols, and run Linux CI on ubuntu-latest again. Let the dependency upgrade workflow change workflow files (#3349, #3384), by @fengmk2.
Refine contributor guidance: AGENTS.md separates the vite-plus package from the global vp CLI and replaces CLAUDE.md, and the Node.js version RFCs describe .nvmrc support (#3388, #3383), by @liangmiQwQ and @hyunbinseo.
Resolve the docs theme aliases from import.meta.dirname, so the docs dev server no longer warns about __dirname (#3379), by @liangmiQwQ.
Fold the .node-version parse tests into one table (#3355), by @Brooooooklyn.

Bundled Versions



Tool
Version
Source
Changelog




vite
8.3.7
5def936
8.3.6, 8.3.7


rolldown
1.2.18
f9a49d6
1.2.18


oxc-node
1.0.1
7ff14c3
unchanged


tsdown
0.23.4
npm
unchanged


vitest
5.1.0
npm
unchanged


oxlint
1.91.0
npm
unchanged


oxlint-tsgolint
7.0.2005
npm
unchanged


oxfmt
0.76.0
npm
unchanged



Upgrade
vp upgrade
New Contributors
@chbaefront, @everton-dgn
Full Changelog: voidzero-dev/vite-plus@v1.5.0...v1.5.1
Published Packages

@voidzero-dev/vite-plus-core@1.5.1
vite-plus@1.5.1
create-vite-plus@1.5.1

Installation
macOS/Linux:
curl -fsSL https://vite.plus | bash
Homebrew (macOS/Linux):
brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp
See the Homebrew guide to switch from the script installer or the Homebrew Core vite-plus formula.
Windows:
irm https://vite.plus/ps1 | iex
Or download and run vp-setup.exe from the assets below.
Docker:
docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.5.1 vp build
Run any vp command without installing it; see the Docker guide for more.
Create a New App
Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.
pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev
Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

View the full release notes at https://github.com/voidzero-dev/vite-plus/releases/tag/v1.5.1.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.