vite-plus

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

• Fixed in 0.1.24 · 3 advisories

  • CRITICALVitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEGHSA-g8mr-85jm-7xhm
  • HIGHvite: `server.fs.deny` bypass on Windows alternate pathsGHSA-fx2h-pf6j-xcff
  • MODERATElaunch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsGHSA-v6wh-96g9-6wx3

• Fixed in 0.1.17 · 1 advisory

  • HIGH Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOMEGHSA-33r3-4whc-44c2

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 1.3.0

   16 October 2026
   Vite+ 1.3 adds create-vite-plus for starting a project without the global vp, new vp pm pkg and vp pm licenses commands, and package-manager dist-tags in vp env.

   Vite+ 1.3 adds create-vite-plus for starting a project without the global vp, new vp pm pkg and vp pm licenses commands, and package-manager dist-tags in vp env.

   Features

   • Create a Vite+ project without installing the global vp through pnpm create vite-plus, npm create vite-plus@latest, yarn create vite-plus, or bun create vite-plus, which run vp create with the same arguments (docs) (#3028, #3048),

   • vp pm pkg get, set, delete, and fix read and update package.json through the detected package manager: npm 7.20.0 and later (fix from 9.8.0), pnpm 11.3.0 and later, and Bun 1.2.19 and later (docs) (#3020),

   • vp pm licenses list (or ls) lists dependency licenses through pnpm 7.17.0 and later, Yarn Classic, or Bun 1.4.0 and later, with --json for machine-readable output (#3037),

   • vp env accepts npm dist-tags in package-manager specs: vp env pin pnpm@latest-10 pins the exact version the tag points to, and vp env default pnpm@latest-10 follows the tag on each use (#3047),

   • Upgrade the bundled tools (#3058, #3078), by @voidzero-guard[bot] and @fengmk2:

     • rolldown@1.2.13 to rolldown@1.2.14. Rolldown adds the output.charset option and fixes several tree-shaking, code-splitting, and renaming bugs.

     • vitest@5.0.4 to vitest@5.0.5, with fixes for browser mode, hook cleanup after a failing hook, and --changed with quoted file names.

   Fixes & Enhancements

   • Import rewriting in vp migrate is up to 14 times faster on large projects, for example 78 s to 5.6 s on Dify (#2987),

   • vp dev prints Vite's ready in N ms line, so scripts that wait for it no longer time out after vp migrate. --debug, --filter, and --profile now take effect in vp dev, vp build, and vp preview, and vp preview stops when the build output is missing, as vite preview does (#3056),

   • vp staged prints one result line per task, such as ✔ vp check --fix, instead of the task list and Git progress. Warnings, errors, and rollback results stay visible, --verbose shows task output, and --debug keeps the full log (#3060),

   • After a successful upgrade, vp upgrade reminds you to run vp migrate in projects that use an older Vite+ version (#3063),

   • The coding agent picker in vp create and vp migrate lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option. --agent claude and existing CLAUDE.md files still work (#3055),

   Bundled Versions

   Tool	Version	Source	Changelog
   vite	8.3.4	b6c20f6	unchanged
   rolldown	1.2.14	c9a8cda	1.2.14
   tsdown	0.23.1	npm	unchanged
   vitest	5.0.5	npm	5.0.5
   oxlint	1.88.0	npm	unchanged
   oxlint-tsgolint	7.0.2004	npm	unchanged
   oxfmt	0.73.0	npm	unchanged

   Upgrade

   vp upgrade

   Published Packages

   • @voidzero-dev/vite-plus-core@1.3.0

   • vite-plus@1.3.0

   • create-vite-plus@1.3.0

   Installation

   macOS/Linux:

   curl -fsSL https://vite.plus | bash

   Windows:

   irm https://vite.plus/ps1 | iex

   Or download and run vp-setup.exe from the assets below.

   Docker:

2. 1.2.0

   14 October 2026
   Vite+ 1.2 supports authenticated private npm registries and shows a new vp run summary that counts cache hits among cache-enabled tasks and reports successful tasks. It also verifies installer downloads, shows download progress in vp upgrade, and fixes task cache misses in pnpm projects and PowerShell exit status.

   Vite+ 1.2 supports authenticated private npm registries and shows a new vp run summary that counts cache hits among cache-enabled tasks and reports successful tasks. It also verifies installer downloads, shows download progress in vp upgrade, and fixes task cache misses in pnpm projects and PowerShell exit status.

   Highlights

   • Support authenticated private npm registries (#2624),

   • The vp run summary now reads like 3/4 cache hit (75%), 9/10 successful, 2s saved.: the cache hit rate leaves out tasks with caching disabled, and the count of successful tasks replaces the count of failed tasks (vite-task#821),

   Features

   • The install.sh and install.ps1 installers check each downloaded platform archive against the registry's SHA-512 dist.integrity before extracting it, and stop when the digest is missing or does not match (#2949),

   • vp upgrade shows a progress bar while it downloads the new platform package, instead of looking frozen on slow connections (#2968),

   • When a task is not cached because it wrote a file it also read, the summary says it modified its inputs, and vp run --last-details shows the cache: { input, output } exclusions that let it be cached. Detailed summaries show each cause of an error on its own line, and an invalid --filter glob reports its error once (vite-task#783, vite-task#784, vite-task#761, vite-task#763),

   • The task runner can be built without file-access tracking on additional platforms. Tasks on those platforms must configure both input and output explicitly to be cached (vite-task#829),

   • Upgrade the bundled tools (#2935, #2977, #2998, #3021, #3039), by @voidzero-guard[bot] and @fengmk2:

     • vite@8.3.3 to vite@8.3.4.

     • rolldown@1.2.12 to rolldown@1.2.13.

     • tsdown@0.23.0 to tsdown@0.23.1.

     • vitest@5.0.3 to vitest@5.0.4. Vitest now turns on its on-disk caches by default, and vp test tasks run through vp run stay cacheable with them.

     • oxlint@1.87.0 to oxlint@1.88.0 and oxfmt@0.72.0 to oxfmt@0.73.0. Oxfmt now also formats TOML in Markdown code blocks and frontmatter. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check.

     • vp migrate keeps Prettier and continues the rest of the migration when the Prettier config uses a format the bundled Oxfmt cannot read, such as .prettierrc.yml.

     • oxlint-tsgolint@7.0.2003 to oxlint-tsgolint@7.0.2004. Line disable comments apply to type-aware diagnostics again (tsgolint#1271), so disable comments moved to the } as T line for v1.1.0 need to move back above the statement.

     • Projects that use @effect/tsgo should stay on v1.1.0 for now. The latest @effect/tsgo@0.52.0 supports oxlint-tsgolint@7.0.2004 but not oxlint@1.88.0, so its install-time patch step fails until @effect/tsgo adds support.

   Fixes & Enhancements

   • Reinstalling dependencies with pnpm, or installing them at another path, no longer causes task cache misses, and tasks that run pnpm run or pnpm exec no longer miss the cache after pnpm rechecks dependencies (vite-task#823, vite-task#824, vite-task#825),

   • On macOS, tasks with automatic file-access tracking can run Node.js single executable applications, such as pnpm 11's standalone binary, and deno compile outputs (vite-task#840),

   • Cached tasks can run scripts whose shebang names an interpreter path longer than 126 bytes (vite-task#788),

   • When a cache hit's outputs cannot be restored, vp run fails with an error suggesting vp cache clean instead of reporting a successful cache hit (vite-task#770),

   • vp run no longer stops every task when concurrent tasks write to a full output pipe, such as a CI log collector (vite-task#801),

   • On Linux, tasks with automatic file-access tracking start faster (vite-task#817),

   • In PowerShell, a failing vp command sets $? to False and stops && chains, as calling vp.exe directly does (#2947),

   • The Windows installer works when the PowerShell profile enables Set-StrictMode, and leaves the caller's strict mode unchanged (#3005),

   • Sourcing the Vite+ env script in POSIX shells is much faster with a long PATH, for example from 1.5 s to 6 ms in dash with 147 entries (#2905),

   • Node.js version ranges from .node-version, engines.node, and devEngines.runtime, and package-manager version ranges, follow npm's semver rules (#2835),

   • vp migrate adds the tsdown <0.23 compatibility settings (deps.resolveDepSubpath and attw.profile) only for projects on an older tsdown, so upgrades from Vite+ 1.x or tsdown@0.23.0 and later keep the modern defaults (#2910),

3. 1.1.0

   7 October 2026
   Vite+ 1.1 starts vp dev faster and makes the interactive prompts clearer, alongside fixes for vp migrate, package-manager commands, and Windows terminals.

   Vite+ 1.1 starts vp dev faster and makes the interactive prompts clearer, alongside fixes for vp migrate, package-manager commands, and Windows terminals.

   Highlights

   • vp dev reaches its local URL about 24% sooner and uses about 30% less memory in the parent process, because Vite+ no longer loads Vite and Vitest there before starting the dev server (#2851),

   • Interactive prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions (#2870),

   Features

   • vp run sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn, so tools such as npm-run-all2 use the project's package manager instead of falling back to npm (#2895),

   • Upgrade vite@8.3.1 to vite@8.3.3, rolldown@1.2.11 to rolldown@1.2.12, vitest@5.0.1 to vitest@5.0.3, oxlint@1.85.0 to oxlint@1.87.0, and oxfmt@0.70.0 to oxfmt@0.72.0. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check. vp migrate now keeps the React Refresh allowCompoundComponents option because the bundled Oxlint supports it (#2871, #2896, #2904),

   Fixes & Enhancements

   • vp migrate keeps Oxlint rules written with plugin aliases (such as @typescript-eslint/*, react-hooks/*, and import-x/*) and removes rules the bundled Oxlint does not support, listing them in a warning (#2820, #2906),

   • vp migrate leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one (#2817),

   • vp migrate reports a short error for a directory without package.json instead of an ENOENT stack trace (#2821),

   • vp create in an existing pnpm workspace adds the catalog entries the new application needs, so installation no longer fails with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC (#2808),

   • On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at Terminate batch job (Y/N)? (#2890),

   • vp pack --watch on Windows rebuilds with the new options after the config file changes (#2826),

   • vp test doctor and vp test complete run the Vitest subcommands instead of being treated as test file filters (#2879),

   • With isolated dependency layouts such as pnpm's global virtual store, vp pack finds installed Vue language tools and TypeScript Go for declaration generation, and Playwright browser provider options keep their types (#2868, #2865),

   • Package-manager commands fail when the project's package manager does not support a named option, instead of silently dropping it and continuing. Bun 1.4.1+ receives --offline and --prefer-offline, and Yarn Classic accepts a single --filter for vp remove (#2775),

   • vp pm config in Bun projects falls back to npm, as its warning says (#2899),

   • vp pm approve-builds states that Yarn Berry disables third-party build scripts by default from 4.14.0, not in every version (#2902),

   • vp implode asks you to type boom instead of uninstall to confirm (#2901),

   • Global package installs and updates print a green +, and removals a red -, with bold package names in both (#2828),

   • Setup headings and command hints keep their colors when the installer captures stdout (#2829),

   Bundled Versions

   Tool	Version	Source	Changelog
   vite	8.3.3	fea5b21	8.3.2, 8.3.3
   rolldown	1.2.12	45e407b	1.2.12
   tsdown	0.23.0	npm	unchanged
   vitest	5.0.3	npm	5.0.2, 5.0.3
   oxlint	1.87.0	npm	1.86.0, 1.87.0
   oxlint-tsgolint	7.0.2003	npm	unchanged
   oxfmt	0.72.0	npm	0.71.0, 0.72.0

   Upgrade

   vp upgrade

   Published Packages

   • @voidzero-dev/vite-plus-core@1.1.0

   • vite-plus@1.1.0

   Installation

4. 1.0.0

   28 September 2026
   Vite+ 1.0 is stable (announcement). This release promotes v1.0.0-rc.1 to stable with no code changes.

   Vite+ 1.0 is stable (announcement). This release promotes v1.0.0-rc.1 to stable with no code changes.

   Notable changes since v0.3.3

   v1.0.0 includes everything from the two release candidates below. See each release's notes for the full list of changes.

   • v1.0.0-rc.0: vp test moves to vitest@5.0.1, and the CLI now requires Node.js ^22.18.0 || ^24.11.0 || >=26.0.0. vp staged has new Node.js and Git minimums. Standalone installs and vp upgrade verify release provenance.

   • v1.0.0-rc.1: task cache settings in run.tasks move under cache. vp lint and vp fmt run from a package directory now use the same config as your editor.

   Projects on v1.0.0-rc.1 need no changes. Projects on v1.0.0-rc.0 whose tasks set env, untrackedEnv, input, or output should run vp migrate to move those settings under cache. For a Vite+ 0.3 project, follow Upgrade from Vite+ 0.3 to 1.0 and run vp migrate before you update the project's dependencies.

   Bundled Versions

   Tool	Version	Source
   vite	8.3.1	39ddf7c
   rolldown	1.2.11	8df4219
   tsdown	0.23.0	npm
   vitest	5.0.1	npm
   oxlint	1.85.0	npm
   oxlint-tsgolint	7.0.2003	npm
   oxfmt	0.70.0	npm

   Upgrade

   vp upgrade

   Published Packages

   • @voidzero-dev/vite-plus-core@1.0.0

   • vite-plus@1.0.0

   Installation

   macOS/Linux:

   curl -fsSL https://vite.plus | bash

   Windows:

   irm https://vite.plus/ps1 | iex

   Or download and run vp-setup.exe from the assets below.

   Docker:

   docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.0.0 vp build

   Run any vp command without installing it; see the Docker guide for more.

5. 0.3.3

   18 September 2026
   This release fixes Homebrew setup, Windows installation, and workspace dependency commands. It also updates Rolldown, Oxlint, and Oxfmt.

   This release fixes Homebrew setup, Windows installation, and workspace dependency commands. It also updates Rolldown, Oxlint, and Oxfmt.

   Fixes & Enhancements

   • Homebrew installations complete setup once, retain their bundled CLI, and direct upgrades to brew upgrade vite-plus (#2729),

   • Windows installations decode remote legacy PowerShell scripts correctly (#2701),

   • vp migrate removes the unsupported React Refresh allowCompoundComponents option and warns about possible lint errors (#2702),

   • New monorepo packages use the root lint configuration without a conflicting nested configuration (#2667),

   • Yarn Classic rejects filtered additions and removals instead of changing unintended dependencies (#2705),

   • Yarn Berry rejects unsupported filtered updates and respects filters during recursive removal (#2709, #2712),

   • Yarn and Bun warn when a command does not support --workspace-root. Yarn Classic accepts root additions through vp add and vp install <packages> (#2713),

   • vp dedupe warns about unsupported check options (#2717),

   • Rust command output respects NO_COLOR (#2716),

   • Windows commands find lowercase shims in directories with case-sensitive file names (#2727),

   Bundled Versions

   Tool	Version	Source
   vite	8.3.0	434e8e9
   rolldown	1.2.9	5b4746e
   tsdown	0.23.0	npm
   vitest	4.1.11	npm
   oxlint	1.83.0	npm
   oxlint-tsgolint	7.0.2001	npm
   oxfmt	0.68.0	npm

   Upgrade

   vp upgrade

   Published Packages

   • @voidzero-dev/vite-plus-core@0.3.3

   • vite-plus@0.3.3

   Installation

   macOS/Linux:

   curl -fsSL https://vite.plus | bash

   Windows:

   irm https://vite.plus/ps1 | iex

   Or download and run vp-setup.exe from the assets below.

   Docker:

   docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.3.3 vp build

   Run any vp command without installing it; see the Docker guide for more.

6. 0.3.2

   14 September 2026
   Vp env use now sets each package manager's version independently. This release also adds Oxlint plugin APIs and fixes migration, installation, and template extraction.

   vp env use now sets each package manager's version independently. This release also adds Oxlint plugin APIs and fixes migration, installation, and template extraction.

   Breaking Changes

   Package-manager overrides

   Direct package-manager commands no longer use VP_PACKAGE_MANAGER. Use the matching version variable in shell profiles, CI jobs, and Dockerfiles:

   Previous override for a direct command	New override
   VP_PACKAGE_MANAGER=npm@<version>	VP_NPM_VERSION=<version>
   VP_PACKAGE_MANAGER=pnpm@<version>	VP_PNPM_VERSION=<version>
   VP_PACKAGE_MANAGER=yarn@<version>	VP_YARN_VERSION=<version>
   VP_PACKAGE_MANAGER=bun@<version>	VP_BUN_VERSION=<version>

   VP_PACKAGE_MANAGER still selects the manager and version for vp install and related commands. vp env use pnpm@10 now changes only the direct pnpm commands. To override vp install, set VP_PACKAGE_MANAGER explicitly.

   The old .session-package-manager file is no longer read or migrated. Run vp env use again to create the new session files. Projects that use only project pins or global defaults need no changes. See the environment guide (#2658, #2659),

   Installer preferences

   VP_NODE_MANAGER now controls only Node.js. Existing installations retain saved preferences during upgrades, so vp upgrade needs no configuration changes. For scripted installations, set VP_PM_MANAGER to apply the same choice to package managers:

   Previous combined setting	New combined setting
   VP_NODE_MANAGER=no	VP_NODE_MANAGER=no VP_PM_MANAGER=no
   VP_NODE_MANAGER=yes	VP_NODE_MANAGER=yes VP_PM_MANAGER=yes

   Update installer commands in CI jobs and Dockerfiles. Use VP_NPM_MANAGER, VP_PNPM_MANAGER, VP_YARN_MANAGER, or VP_BUN_MANAGER for individual preferences. The interactive prompt retains its combined choice. See the installer variables guide (#2681),

   Vite DevTools

   Projects that install @vitejs/devtools must update its dependency range from ^0.4.0 || ^0.5.0 to ^0.7.1. Projects without this optional dependency need no changes. This requirement comes with the Vite upgrade listed below.

   Highlights

   • Installers and vp upgrade share setup behavior across platforms, which simplifies maintenance. The installers retain support for older releases (#2611),

   • Custom Oxlint rules can import their APIs from vite-plus/lint/plugins and vite-plus/lint/plugins-dev. vp migrate updates supported existing imports (#2328),

   • vp install and vp add now honor --ignore-scripts for named packages and managed global installations (#2682),

   Features

   • The bundled tools update from vite@8.2.2 to vite@8.3.0 and from rolldown@1.2.7 to rolldown@1.2.8. They also update from oxlint@1.81.0 to oxlint@1.82.0 and from oxfmt@0.66.0 to oxfmt@0.67.0. The new linter and formatter can flag code that passed before. Run vp fmt after the upgrade if CI runs vp check (#2670),

   Fixes & Enhancements

   • vp create rejects malformed registry versions that could place organization template files outside the cache directory (#2665),

   • vp env pin updates an active local .nvmrc and preserves its comments. Use --target nvmrc to select this file explicitly (#2676),

   • vp migrate reports unsupported ESLint rules that it skips, so users can review the missing checks (#2689),

   • vp migrate imports leftover tsdown configuration when a project already uses Vite+ (#2646),

   • vp migrate accepts single-line JSON formatter configuration with a final newline (#2643),

   • vp migrate avoids a redundant playwright dependency when the project already declares @playwright/test (#2637),

   • Newly scaffolded local generators honor --no-interactive and report missing arguments without prompts. Existing generators need the updated entrypoint (#2677),

   • vp upgrade installs its dependencies correctly when the installation directory is inside a pnpm workspace (#2644),

   • Nested package-manager commands retain the selected Node runtime and package-manager versions (#2631),

   • Built-in tools reuse the Node executable that starts the CLI. Editor lint and format servers work when node is absent from PATH (#2673),

7. 0.3.1

   8 September 2026
   Vp env now manages Node.js and package-manager versions together. This release also fixes TanStack Start routing and stale Vitest aliases.

   vp env now manages Node.js and package-manager versions together. This release also fixes TanStack Start routing and stale Vitest aliases.

   Breaking Changes

   Package-manager setup

   Vite+ replaces Corepack with managed npm, pnpm, yarn, and bun commands. It removes the corepack shim and legacy global package-manager installations (#2391),

   Replace Corepack setup commands in shell profiles, CI jobs, and Dockerfiles:

   Previous setup	Replacement
   corepack enable	vp env setup
   vp install -g pnpm@<version>	vp env default pnpm@<version>
   vp install -g yarn@<version>	vp env default yarn@<version>
   vp install -g bun@<version>	vp env default bun@<version>
   vp install -g corepack	Use the managed package-manager commands directly

   Use vp env pin <manager>@<version> to set a project version.

   vp env command scope and JSON output

   Unscoped vp env commands now operate on Node.js and package managers. Package managers support independent defaults, project pins, session overrides, and installation commands (#2398),

   Add node to limit an operation to Node.js, for example, vp env off node or vp env unpin node. Bare versions, such as vp env default 22.19.0, still select Node.js.

   Update scripts that read JSON output:

   Command	New output structure
   vp env current --json	node and package_manager objects
   vp env list --json, vp env list-remote --json	node and package_managers groups

   See the environment guide.

   vp pack migration to tsdown@0.23

   vp pack now uses tsdown@0.23, which removes deprecated options and changes defaults (#2614),

   1. breaking

      Run vp migrate to update supported static configurations and package scripts, including projects that already use Vite+.

   2. breaking

      Check migration warnings in vite.config.*, tsdown.config.*, and package.json.

   3. breaking

      Update dynamic configurations manually. Arrays built with .map() require manual changes, even when migration reports no warning.

   4. breaking

      Run vp pack to check the result.

   Previous option	Replacement
   bundle: false	unbundle: true
   outExtension	outExtensions
   publicDir / --public-dir	copy / --copy
   removeNodeProtocol: true	nodeProtocol: 'strip'
   injectStyle	css.inject
   inlineOnly / deps.onlyAllowBundle	deps.onlyBundle
   noExternal	deps.alwaysBundle
   skipNodeModulesBundle: true / deps.skipNodeModulesBundle: true	deps.neverBundle: true
   dts.tsgo: true / dts.oxc: true	dts.generator: 'tsgo' / dts.generator: 'oxc'

   Migration preserves the previous defaults for dependency resolution and ATTW.

   tsdown no longer supports Node.js 25. Use Node.js ^22.18.0, ^24.11.0, or >=26.0.0. The programmatic build() API now returns { bundles, watch }.

   See the complete migration guide for declaration and TypeScript module-resolution changes.

   CLI argument validation

   vp staged, vp config, vp hooks, vp migrate, and vp create now reject unsupported options and extra positional arguments (#2523),

   Remove unsupported arguments from scripts. For example, replace vp config --hooks-only with vp config --no-agent.

   Highlights

   • Fix TanStack Start HTTP 404 responses caused by separate Vite runtime copies (#2617),

   • Reduce the Windows vp-shim.exe size from 214 KiB to 14 KiB (#2466),

   • Add vp check --quiet to hide lint warning diagnostics while retaining errors and summary counts (#2593),

8. 0.3.0

   24 August 2026
   Fresh installs now use a split directory layout instead of a single ~/.vite-plus root. Unix follows the XDG base directory specification, and Windows uses the standard %LOCALAPPDATA% and %APPDATA% folders. Existing ~/.vite-plus installs keep their current directory layout. vp migrate also converts tsup projects, and vp now sends Bun 1.4 package-manager commands to bun directly. The published npm package shrank by about half, and the upgrade check no longer delays each command.

   Fresh installs now use a split directory layout instead of a single ~/.vite-plus root. Unix follows the XDG base directory specification, and Windows uses the standard %LOCALAPPDATA% and %APPDATA% folders. Existing ~/.vite-plus installs keep their current directory layout. vp migrate also converts tsup projects, and vp now sends Bun 1.4 package-manager commands to bun directly. The published npm package shrank by about half, and the upgrade check no longer delays each command.

   Breaking Changes

   • breaking

     Fresh installs now use a split directory layout instead of a single root: XDG base directories on Unix, and the standard known folders on Windows. Existing ~/.vite-plus installs keep their current layout, and the installer does not move their files. VP_HOME still selects the single-root layout (#2346),

     Category	Unix default	Windows default	Single-root (VP_HOME)
     bin	~/.local/share/vite-plus/bin	%LOCALAPPDATA%\vite-plus\bin	<root>/bin
     data	~/.local/share/vite-plus	%LOCALAPPDATA%\vite-plus\data	<root>
     cache	~/.cache/vite-plus	%LOCALAPPDATA%\vite-plus\cache	<root>/cache
     config	~/.config/vite-plus	%APPDATA%\vite-plus	<root>
     state	~/.local/state/vite-plus	%LOCALAPPDATA%\vite-plus\state	<root>

     The installer configures your shell for the new location, and CI that installs through setup-vp keeps the single-root layout automatically. Update each hard-coded ~/.vite-plus/bin path, such as a path in a Dockerfile.

     vp upgrade leaves an existing install where it is. To move one to the split layout, remove it and install again:

     vp implode
     unset VP_HOME VP_DATA_DIR VP_BIN_DIR VP_CACHE_DIR
     curl -fsSL https://vite.plus | bash

     On Windows, run vp implode, then Remove-Item Env:\VP_HOME, Env:\VP_DATA_DIR, Env:\VP_BIN_DIR, Env:\VP_CACHE_DIR -ErrorAction SilentlyContinue, then irm https://vite.plus/ps1 | iex. Also delete any persistent VP_HOME or VP_*_DIR definition from your shell profile or system environment, because a fresh install still honors them and VP_HOME selects the single-root layout.

     vp implode removes every Vite+ managed Node.js runtime, global package, configuration file, and cache. Stay on your current layout if you would rather not rebuild that state. See Move an existing install to the split directory layout.

   Highlights

   • vp migrate now converts tsup projects. It replaces the tsup dependency and script with vp pack. It also changes tsup.config.ts to a tsdown.config.ts that imports from vite-plus/pack (#2434),

   • Shell integrations now accept the global -C flag. vp -C <dir> env use changes the environment of your current shell. The -C<dir> and -C=<dir> forms also work. In zsh, Fish, Nushell, and PowerShell, vpr completion keeps the working directory when it changes the command to vp run (#2508),

   • The published vite-plus npm package shrank from 1.05 MB to 516 kB, a 51% reduction. It now includes only Markdown files from the documentation workspace. It no longer includes VitePress tooling, images, or deployment files (#2480),

   Features

   • With Bun 1.4 or later, Vite+ forwards these commands and flags to bun. Earlier Bun versions keep their fallback or unsupported behavior and report the required Bun version (#2513),

     • vp dedupe runs bun dedupe, including --check

     • vp pm prune runs bun prune

     • vp pm audit --fix runs bun audit fix

     • vp add, vp remove, and vp update send --filter to bun

     • vp add --save-catalog sends --catalog to bun

   • The upgrade check no longer delays fast commands. It runs in a separate process. It reports an available update during a later command, and commands no longer wait for the registry (#2380),

   • Upgrade the bundled toolchain (#2443, #2500, #2504, #2519, #2532), by @voidzero-guard[bot]:

     • vite: 8.2.1 to 8.2.2

     • rolldown: 1.2.3 to 1.2.5

     • vitest: 4.1.10 to 4.1.11

     • oxlint: 1.77.0 to 1.79.0

     • oxfmt: 0.62.0 to 0.64.0

     • Oxc packages and crates: 0.143.0 to 0.146.0

     • Vite+ now accepts @vitejs/devtools 0.5.x. The optional peer range is ^0.4.0 || ^0.5.0. This repository uses 0.5.2.

     • oxfmt and oxlint can report new issues after the upgrade. Run vp check locally. Use vp fmt to fix formatting changes.

   • vp toolchain draws its tree with Unicode glyphs. It no longer uses ASCII connectors (#2442),

   Fixes & Enhancements

   • At a workspace root, bare app commands now use defaultPackage or detected root configuration before they select a member package. A workspace without member packages runs the command in the root (#2530, #2533),

   • vp up no longer changes "vite": "catalog:" to a version alias under pnpm. Catalog references now stay unchanged during an update. Run vp migrate once to correct an existing project (#2425),

   • If the server accepts range requests, an interrupted runtime download continues from the bytes on disk. It does not start again (#2452),

   • The local CLI shows the install instructions when you run a global-only command such as env, upgrade, or implode (#2522),

9. 0.2.9

   12 August 2026
   Vp toolchain prints the tools, versions, and bundling relationships in the active release. vp hooks manages the Vite+ dispatcher for Git hooks, and removes the manual setup steps. vp run no longer fails in the default Codex CLI and Claude Code sandboxes. Those sandboxes deny Unix sockets and shared memory, which task IPC and file-access tracking used. The rest of the release makes the install path more reliable. It fixes npm 12 blocked install scripts, Yarn 2+ integrity pins, and baseline Bun builds for older CPUs. It also fixes downloads that stopped on slow connections.

   vp toolchain prints the tools, versions, and bundling relationships in the active release. vp hooks manages the Vite+ dispatcher for Git hooks, and removes the manual setup steps. vp run no longer fails in the default Codex CLI and Claude Code sandboxes. Those sandboxes deny Unix sockets and shared memory, which task IPC and file-access tracking used. The rest of the release makes the install path more reliable. It fixes npm 12 blocked install scripts, Yarn 2+ integrity pins, and baseline Bun builds for older CPUs. It also fixes downloads that stopped on slow connections.

   Highlights

   • New vp toolchain command. It prints the tools, versions, and bundling relationships in the active Vite+ release as a tree. The tree shows vite-plus, core, vite, rolldown, oxc, oxc-resolver, and the compiled Vite Task with its build time and revision. Give a tool name to select part of the tree. Use --json for machine-readable output. Use --global for the global release (#2111),

   • New vp hooks command. It manages the Vite+ dispatcher for Git hooks. enable installs or refreshes the dispatcher and sets core.hooksPath. disable removes the dispatcher and keeps that preference, so prepare and vp config do not install it again. status shows the current state. Use --hooks-dir to set a custom directory. Vite+ keeps that directory for later commands. Vite+ does not change project-owned hooks, staged config, or package.json lifecycle scripts (#2341),

   • vp run now works in the default Codex CLI and Claude Code sandboxes. Before this release, a cached task failed with Failed to set up task communication: Operation not permitted. The task code never started. Automatic file-access tracking also failed. Task caching and input tracking now work in both default profiles. You do not need extra sandbox permissions (vite-task#569, vite-task#576),

   Features

   • vp create now shows the dependencies whose install scripts npm 12 blocked. Before this release, Vite+ left those dependencies unbuilt and gave no message. To approve them, vp create runs vp pm approve-builds and then vp pm rebuild (#2336),

   • Large downloads no longer stop on slow connections. Node.js tarballs and package-manager tarballs now use a 10 minute timeout. Before this release, they used the shared 2 minute per-request limit. That limit stopped healthy downloads below approximately 250 KB/s. It also made vp env install and vp migrate impossible to complete. Set VP_DOWNLOAD_TIMEOUT to a different number of seconds (#2386),

   • Package-manager downloads now show a byte progress bar. The managed Node.js runtime already showed one. A slow download no longer looks stopped (#2369),

   • You can now select JetBrains editors (IntelliJ, WebStorm, and similar) in the editor setup question. Vite+ writes the Oxc plugin ID to .idea/externalDependencies.xml. The docs now describe the gitignore strategy for .idea (#2204, #2378),

   • vp now shows a warning when it falls back to the global CLI in a project that has no project-local vite-plus. If the project declares the dependency, vp tells you to run vp install. If the project does not declare it, vp points to the migration guide. vp migrate and commands outside a project stay silent (#2362),

   • Generated editor settings now disable nested Oxlint config resolution. The Vite+ config stays authoritative (#2331),

   [!NOTE] Upstream toolchain upgrade: vite 8.2.0 -> 8.2.1, rolldown 1.2.2 -> 1.2.3, oxlint 1.76.0 -> 1.77.0, oxfmt 0.61.0 -> 0.62.0, and the oxc npm packages and Rust crates 0.142.0 -> 0.143.0. oxfmt and oxlint both changed. The new versions can report problems in code that passed before. If your CI runs vp check, run vp fmt after you upgrade (#2373),

   Fixes & Enhancements

   • Yarn 2+ pins from corepack use now verify against the extracted CLI (bin/yarn.js), not the npm tarball. vp install no longer fails on a cold cache. vp run no longer downloads Yarn again on every run (#2227),

   • vp dev no longer crashes at startup with ENOENT when experimental.bundledDev is enabled. The bundled dev client path now points to the packaged layout (#2384),

   • vp migrate now rejects a workspace member as its target. Before this release, it migrated the enclosing workspace instead. It now tells you to run the command from the workspace root (#2229),

   • VP_NODE_VERSION=22 and other partial versions now resolve to an exact Node.js release. This applies to shim-dispatched commands such as vp env exec node -v (#2411),

   • Managed bunx shims now dispatch through bun x. bunx <package> no longer starts a matching package script recursively. This applies to new Bun installations (#2151),

   • Managed Bun now selects the baseline build on x64 CPUs that do not have AVX2. Bun's standard builds require AVX2. Cached installations keep their current files (#2179),

   • Generated Nushell env files now escape and normalize paths correctly. A VP_HOME path that contains spaces or quotes now loads without an error (#2191),

   • vite-plus/test/browser-* type exports now add .js extensions to relative shim specifiers. Those specifiers now resolve with NodeNext module resolution (#2360),

   • Tool-backed help is now consistent with upstream. An exact vp <command> --help shows the local themed help. A command with more arguments (vp test --help --coverage, vp test list --help) goes to the bundled tool. Deep help and subcommand help stay complete (#2345),

   • Vite Task diagnostics now print paths and working directories without Rust debug formatting. Vite+ no longer prints quoted paths or escaped Windows backslashes (vite-task#534),

   • Broad workspace globs no longer find and run package scripts inside node_modules (vite-task#539),

   Bundled Versions

   Tool	Version	Source
   vite	8.2.1	4216158
   rolldown	1.2.3	52dbd19
   tsdown	0.22.14	npm
   vitest	4.1.10	npm
   oxlint	1.77.0	npm
   oxlint-tsgolint	7.0.2001	npm
   oxfmt	0.62.0	npm

   Upgrade

   vp upgrade

   Published Packages

10. 0.2.8

    5 August 2026
    Bare vp dev/build/preview/pack at a monorepo root now resolve a target package instead of silently running against the root, and three Vite+-specific environment variables move to the VP_* prefix without compatibility aliases. Two failures that broke Vite+ before it could run are also fixed: the crash on container images that ship no CA certificates, and the missing Rolldown binding under pnpm's global virtual store.

    Bare vp dev/build/preview/pack at a monorepo root now resolve a target package instead of silently running against the root, and three Vite+-specific environment variables move to the VP_* prefix without compatibility aliases. Two failures that broke Vite+ before it could run are also fixed: the crash on container images that ship no CA certificates, and the missing Rolldown binding under pnpm's global virtual store.

    Breaking Changes

    • breaking

      Rename three Vite+-specific environment variables to the VP_* prefix, with no compatibility aliases, so the old names stop working (#2312), by @jong-kyung:

      Old	New
      VITE_LOG	VP_LOG
      VITE_GLOBAL_CLI_JS_SCRIPTS_DIR	VP_GLOBAL_CLI_JS_SCRIPTS_DIR
      VITE_UPDATE_TASK_TYPES	VP_UPDATE_TASK_TYPES

      Update any shell profile, CI job, or Dockerfile that sets the old names.

    Highlights

    • Resolve a target package for vp dev, build, preview, and pack at a monorepo root: interactive shells get a fuzzy package picker, non-interactive runs list the candidates and exit 1 instead of building the root, and a new global -C <dir> flag or a defaultPackage setting (a single directory, or an object mapping each of the four commands to its own directory) skips the prompt (#2031, #2305),

    • Stop aborting with exit 134 on container images that ship no CA certificates (Debian slim, distroless): the shared HTTP client now retries once with the bundled Mozilla root list, like Node's own bundled roots, and reports a real error instead of panicking when it still cannot be built (#2273, #2295),

    • Resolve the bundled Rolldown binding through platform packages instead of an undeclared require back into vite-plus, fixing Cannot find module 'vite-plus/binding' under pnpm enable-global-virtual-store and in standalone @voidzero-dev/vite-plus-core installs (#2313),

    • Add vp pm ci for reproducible frozen-lockfile installs, and vp pm patch / vp pm patch-commit for editing dependencies in place on pnpm, bun, and Yarn Berry (npm and Yarn Classic warn and exit successfully) (#2082, #2308),

    Features

    • Upgrade the bundled toolchain: vite 8.1.5 -> 8.2.0, rolldown 1.2.0 -> 1.2.2, oxlint 1.75.0 -> 1.76.0, oxfmt 0.60.0 -> 0.61.0, and Vite DevTools 0.4.5 -> 0.4.10 (#2302, #2311), by @voidzero-guard[bot]. The new oxfmt and oxlint can flag code that passed before, so run vp fmt after upgrading if your CI runs vp check.

    • Read the Node.js version from .nvmrc when no other version source is present (#2244),

    • Support pnpm v12, which ships as a native binary: Vite+ now downloads the platform-specific @pnpm/exe.* package and generates native shims, so pnpm and pnpx work instead of failing to exec (#2289),

    • Verify the downloaded bun platform tarball against the registry dist.integrity hash (#2310),

    Fixes & Enhancements

    • Let vp config install the Git hook dispatcher without creating or modifying project hook scripts or staged-file configuration, so a custom .vite-hooks/pre-commit survives (#2280),

    • Nest immutable global package installs under packages/<package>/<uuid> instead of using # in the path, which Node treated as a URL fragment and which broke dynamic imports inside installed packages (#2222),

    • Keep the recorded version spec on global installs, so vp update -g follows a dist tag or range instead of silently resolving back to latest, vp outdated -g reports Wanted versus Latest, and vp update -g --latest explicitly moves packages back to latest (#2249),

    • Stop deleting a managed Node.js runtime that another process is concurrently installing (#2248),

    • Preserve the real exit code when a spawned process is terminated by a signal on Unix (#2154),

    • Honor an explicit vp create --package-manager outside monorepos instead of inheriting the manager from a non-monorepo ancestor directory (#2226),

    • Scaffold the vite:library template into a directory that contains only .git, while still refusing to overwrite existing user files (#2287),

    • Render help for delegated commands from the local CLI, so vp <command> --help matches the installed toolchain instead of drifting (#2184),

    • Resolve typeAware and typeCheck options inherited through Oxlint extends, so vp check --no-lint runs and classifies type checking correctly (#2228),

    • Report (no version) instead of unknown when globally installing a local package that has no version field (#2232),

    Bundled Versions

    Tool	Version	Source
    vite	8.2.0	fa79f9a
    rolldown	1.2.2	872b98a
    tsdown	0.22.14	npm
    vitest	4.1.10	npm
    oxlint	1.76.0	npm
    oxlint-tsgolint	7.0.2001	npm
    oxfmt	0.61.0	npm

    Upgrade

    vp upgrade

    Published Packages

    • @voidzero-dev/vite-plus-core@0.2.8

Major versions

• 1.xsince 28 September 2026 · latest 1.3.0 · 4 releases
• 0.xsince 30 January 2022 · latest 0.3.3 · 40 releases