Skip to content

chore(deps): vite-plus sync - #3244

Closed
setchy wants to merge 3 commits into
mainfrom
chore/vite-plus-sync
Closed

chore(deps): vite-plus sync#3244
setchy wants to merge 3 commits into
mainfrom
chore/vite-plus-sync

Conversation

@setchy

@setchysetchy commented Aug 31, 2026•
edited by afonsojramos
Loading

Copy link
Copy Markdown
Member

Why

vite-plus, vite, vitest, and the @vitest/* family are version-coupled — vite-plus bundles/targets a specific vite/vitest release internally, and this project depends on the same real packages directly.

When they drift apart, pnpm loads two different vitest copies into the test workers, breaking every rejects/.resolves.toThrow() assertion.

This has already happened once on main (#3215, 152 test failures) and was narrowly avoided twice more by hand (#3224, #3226-era fix).

Two open Renovate PRs today — #3237 (@vitest/* → 4.1.11) and #3240 (vite-plus → 0.3.0) — could each merge independently and reproduce it a fourth time.

Supersedes #3237 and #3240.

What Changes

  • Dependency reconciliation — combined both PRs' intent and ran vp migrate, which went further than a manual fix would have: it aliased vite and vite-plus themselves to catalog references (not just @vitest/browser-playwright/@vitest/coverage-v8), making the pnpm catalog the single source of truth for the whole toolchain.
  • renovate.json — grouped vite-plus + vite + vitest + @vitest/** into one packageRules entry (same pattern as the existing @octokit/** group) so Renovate can never split them across PRs again. Added gitIgnoredAuthors for the new automation's commit identity.
  • New workflow (.github/workflows/renovate-vite-migrate.yml) — runs vp migrate --no-interactive on Renovate's grouped PR branch and pushes back any reconciliation, before human review. Triggers on changed dependency files rather than branch name (Renovate's grouped branch naming isn't confirmed yet).
  • New CI job (vite-toolchain-drift in lint.yml) — fails if vp migrate would produce a diff, catching drift from any source (Renovate or manual edit). Advisory only for now — not yet in required status checks, promote once proven stable across a few real PRs.
  • CONTRIBUTING.md — documented the coupling and why Mend's postUpgradeTasks/allowedCommands (the "native" alternative to the new workflow) wasn't pursued: it's a global, Mend-admin-only setting requiring an out-of-band request.

@setchy
chore(deps): vite-plus sync
a490c97
Signed-off-by: Adam Setch <adam.setch@outlook.com>
@github-actionsgithub-actionsBot added the dependency Dependency updates label Aug 31, 2026
github-advanced-security[bot]
github-advanced-securityBot found potential problems Aug 31, 2026
View reviewed changes
Comment thread.github/workflows/renovate-vite-migrate.yml Fixed
Comment thread.github/workflows/lint.yml
persist-credentials: false

- name: Setup Node.js
uses: ./.github/actions/setup-node

@setchysetchyAug 31, 2026

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this breaks our actionlint step

Comment thread.github/workflows/renovate-vite-migrate.yml
persist-credentials: true

- name: Setup Node.js
uses: ./.github/actions/setup-node

@setchysetchyAug 31, 2026

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this breaks our actionlint step

@setchy
fix: address GHAS/zizmor findings and lint regressions from vite-plus…
2d08c22
… 0.3.0
- renovate-vite-migrate.yml: route github.event.pull_request.head.ref
through an env var instead of interpolating it directly in a run:
script (actionlint/zizmor script-injection finding)
- renovate-vite-migrate.yml, lint.yml: use GitHub's self-repository
uses: $/... syntax instead of ./... for the local setup-node action
(zizmor self-repository finding)
- AvatarWithFallback.tsx: oxlint 1.79.0 (bundled by vite-plus 0.3.0)
now flags react(static-components) for selecting an icon component
via a function call and rendering it as a dynamic JSX tag. Replaced
with a small statically-declared component that renders a literal
JSX element per userType branch.
- SystemSettings.tsx: oxlint now flags react(set-state-in-effect) for
resetting liveModifierAccelerator synchronously inside an effect.
Reset it at the point recording starts (the button's onClick) instead
of synchronizing it via an effect.
Signed-off-by: Adam Setch <adam.setch@outlook.com>
@setchy
fix: revert to ./ local action syntax, actionlint 1.7.12 doesn't supp…
88f9474
…ort $/ yet
zizmor recommends GitHub's new self-repository uses: $/... syntax (added
July 2026), but the actionlint:1.7.12 container pinned in
.github/workflows/lint.yml predates it and errors with 'invalid format
because ref is missing'. actionlint is a required status check;
zizmor is advisory only (not in branch protection's required list), so
keep ./ for now. Revisit once actionlint's pin is upgraded to a version
that recognizes $/.
Signed-off-by: Adam Setch <adam.setch@outlook.com>
setchy
setchy commented Aug 31, 2026
View reviewed changes
Comment threadsrc/renderer/components/settings/SystemSettings.tsx
setchy
setchy commented Aug 31, 2026
View reviewed changes
Comment threadsrc/renderer/components/avatars/AvatarWithFallback.tsx
afonsojramos
afonsojramos requested changes Aug 31, 2026
View reviewed changes

@afonsojramosafonsojramos left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for digging into this. Seeing how much tooling is needed to keep Vite+ and its underlying dependencies aligned, I’d rather remove Vite+ and use Vite, Vitest, Oxlint, and Oxfmt directly. I don’t think the unified CLI provides enough value to justify the added coupling and maintenance. Happy to discuss tho!

@setchy

setchy commented Sep 1, 2026

Copy link
Copy Markdown
MemberAuthor

Thanks for digging into this. Seeing how much tooling is needed to keep Vite+ and its underlying dependencies aligned, I’d rather remove Vite+ and use Vite, Vitest, Oxlint, and Oxfmt directly. I don’t think the unified CLI provides enough value to justify the added coupling and maintenance. Happy to discuss tho!

I tend to agree... It's headscratching that this is how vite-plus handles optional deps. Maybe once it hits v1 it'll have a better solution...

I have one final play in motion - having vp migrate allow listed for our orgs by Renovate, that was we can reliably run it as a post upgrade task in their workflow without all this hackery...

If that turns out to be a dead end, let's pivot

@afonsojramos

afonsojramos commented Sep 1, 2026

Copy link
Copy Markdown
Member

@setchy but even if it does work, I'm not sure what it is adding. We are basically getting 2 benefits. Version alignment and centralised configs. And at the end of the day, we are only getting the centralised configs...

@setchy

setchy commented Sep 1, 2026

Copy link
Copy Markdown
MemberAuthor

Maybe we should raise an issue upstream with VP, at a minimum to share our feedback. We aren't that unique haha

github-advanced-security[bot]
github-advanced-securityBot found potential problems Sep 1, 2026
View reviewed changes
Comment thread.github/workflows/build.yml Fixed
Comment thread.github/workflows/lint.yml Fixed
Comment thread.github/workflows/publish.yml Fixed
Comment thread.github/workflows/renovate.yml Fixed
Comment thread.github/workflows/test.yml Fixed
Comment thread.github/workflows/test.yml Fixed
Comment thread.github/workflows/test.yml Fixed
@afonsojramosafonsojramos changed the title chore(deps): vite-plus syncrefactor(tooling): replace vite-plus with miseSep 1, 2026
@github-actionsgithub-actionsBot added the refactor Refactoring of existing feature label Sep 1, 2026
afonsojramos

This comment was marked as outdated.

Sign in to view

@afonsojramos
afonsojramos self-requested a review September 1, 2026 18:45
@afonsojramosafonsojramos changed the title refactor(tooling): replace vite-plus with misechore(deps): vite-plus syncSep 1, 2026
@github-actionsgithub-actionsBot removed the refactor Refactoring of existing feature label Sep 1, 2026
@afonsojramos
afonsojramos dismissed their stale reviewSeptember 1, 2026 18:47

Restoring the review state after removing the alternative implementation from this PR.

@sonarqubecloud

sonarqubecloudBot commented Sep 1, 2026

Copy link
Copy Markdown

Quality Gate PassedQuality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
80.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@afonsojramosafonsojramos mentioned this pull request Sep 1, 2026
Merged
@setchysetchy closed this Sep 2, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@afonsojramosafonsojramosAwaiting requested review from afonsojramosafonsojramos is a code owner
1 more reviewer
@github-advanced-securitygithub-advanced-security[bot]github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencyDependency updates

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@setchy@afonsojramos@github-advanced-security