chore(deps): update vite-plus to v0.2.8 and rolldown to 1.2.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite-plus (source)	0.2.7 → 0.2.8

---

Release Notes

voidzero-dev/vite-plus (vite-plus)

v0.2.8: vite-plus v0.2.8: monorepo target resolution, breaking VP_* environment variable renames, and install fixes

Compare Source

Bare vp dev/build/preview/pack at a monorepo root now resolve a target package instead of silently running against the root, and three Vite+-specific environment variables move to the VP_* prefix without compatibility aliases. Two failures that broke Vite+ before it could run are also fixed: the crash on container images that ship no CA certificates, and the missing Rolldown binding under pnpm's global virtual store.

Breaking Changes

• Rename three Vite+-specific environment variables to the VP_* prefix, with no compatibility aliases, so the old names stop working (#​2312), by @​jong-kyung:

  Old	New
  VITE_LOG	VP_LOG
  VITE_GLOBAL_CLI_JS_SCRIPTS_DIR	VP_GLOBAL_CLI_JS_SCRIPTS_DIR
  VITE_UPDATE_TASK_TYPES	VP_UPDATE_TASK_TYPES

  Update any shell profile, CI job, or Dockerfile that sets the old names.

Highlights

• Resolve a target package for vp dev, build, preview, and pack at a monorepo root: interactive shells get a fuzzy package picker, non-interactive runs list the candidates and exit 1 instead of building the root, and a new global -C <dir> flag or a defaultPackage setting (a single directory, or an object mapping each of the four commands to its own directory) skips the prompt (#​2031, #​2305), by @​fengmk2
• Stop aborting with exit 134 on container images that ship no CA certificates (Debian slim, distroless): the shared HTTP client now retries once with the bundled Mozilla root list, like Node's own bundled roots, and reports a real error instead of panicking when it still cannot be built (#​2273, #​2295), by @​jbmusso and @​fengmk2
• Resolve the bundled Rolldown binding through platform packages instead of an undeclared require back into vite-plus, fixing Cannot find module 'vite-plus/binding' under pnpm enable-global-virtual-store and in standalone @voidzero-dev/vite-plus-core installs (#​2313), by @​fengmk2
• Add vp pm ci for reproducible frozen-lockfile installs, and vp pm patch / vp pm patch-commit for editing dependencies in place on pnpm, bun, and Yarn Berry (npm and Yarn Classic warn and exit successfully) (#​2082, #​2308), by @​forehalo and @​jong-kyung

Features

• Upgrade the bundled toolchain: vite 8.1.5 -> 8.2.0, rolldown 1.2.0 -> 1.2.2, oxlint 1.75.0 -> 1.76.0, oxfmt 0.60.0 -> 0.61.0, and Vite DevTools 0.4.5 -> 0.4.10 (#​2302, #​2311), by @​voidzero-guard[bot]. The new oxfmt and oxlint can flag code that passed before, so run vp fmt after upgrading if your CI runs vp check.
• Read the Node.js version from .nvmrc when no other version source is present (#​2244), by @​BlankParticle
• Support pnpm v12, which ships as a native binary: Vite+ now downloads the platform-specific @pnpm/exe.* package and generates native shims, so pnpm and pnpx work instead of failing to exec (#​2289), by @​jong-kyung
• Verify the downloaded bun platform tarball against the registry dist.integrity hash (#​2310), by @​jong-kyung

Fixes & Enhancements

• Let vp config install the Git hook dispatcher without creating or modifying project hook scripts or staged-file configuration, so a custom .vite-hooks/pre-commit survives (#​2280), by @​TheAlexLichter
• Nest immutable global package installs under packages/<package>/<uuid> instead of using # in the path, which Node treated as a URL fragment and which broke dynamic imports inside installed packages (#​2222), by @​liangmiQwQ
• Keep the recorded version spec on global installs, so vp update -g follows a dist tag or range instead of silently resolving back to latest, vp outdated -g reports Wanted versus Latest, and vp update -g --latest explicitly moves packages back to latest (#​2249), by @​TheAlexLichter
• Stop deleting a managed Node.js runtime that another process is concurrently installing (#​2248), by @​shulaoda
• Preserve the real exit code when a spawned process is terminated by a signal on Unix (#​2154), by @​liangmiQwQ
• Honor an explicit vp create --package-manager outside monorepos instead of inheriting the manager from a non-monorepo ancestor directory (#​2226), by @​jong-kyung
• Scaffold the vite:library template into a directory that contains only .git, while still refusing to overwrite existing user files (#​2287), by @​RSS1102
• Render help for delegated commands from the local CLI, so vp <command> --help matches the installed toolchain instead of drifting (#​2184), by @​liangmiQwQ
• Resolve typeAware and typeCheck options inherited through Oxlint extends, so vp check --no-lint runs and classifies type checking correctly (#​2228), by @​jong-kyung
• Report (no version) instead of unknown when globally installing a local package that has no version field (#​2232), by @​liangmiQwQ

Refactor

• Rename the Git hooks environment variable to VP_GIT_HOOKS, keeping VITE_GIT_HOOKS working as a deprecated alias (#​2195), by @​dennybiasiolli
• Consolidate the package manager infrastructure so typed command arguments are the source of truth for per-manager compatibility (#​2140), by @​forehalo
• Generate the Zed language settings from a language list instead of 17 near-identical blocks (#​2294), by @​jong-kyung
• Share the agent-file detect and write traversal helpers so both passes apply identical rules (#​2296), by @​jong-kyung
• Drop redundant clippy allow attributes in the global CLI (#​2235), by @​shulaoda

Docs

• Avoid a duplicate vp installation step in the onboarding prompt (#​2291), by @​Arcadi4
• Recommend stacked pull requests for submitting changes (#​2281), by @​fengmk2
• Correct stale delegation comments in the global CLI (#​2236), by @​shulaoda
• Improve the release draft review guidance in the release-manager skill (#​2285), by @​wan9chi

Chore

• Stop emitting unmet peer warnings for the vite-plus peer of oxfmt and oxlint on every install (#​2321), by @​fengmk2
• Remove duplicate direct dependency declarations so each build dependency is owned by one workspace (#​2318), by @​jong-kyung
• Declare @emnapi peers where @napi-rs/cli is used (#​2319), by @​jong-kyung
• Exclude rollup-tests from the workspace and update basic-ftp (#​2322), by @​fengmk2
• Remove unused EnvConfig fields (#​2320), by @​jong-kyung
• Remove the obsolete peer dependency merger tool (#​2303), by @​jong-kyung
• Stop the staging deploy from triggering on external pull requests (#​2293), by @​BlankParticle
• Kill the real vp process, and kill it before its children, in the env_install_interrupt snapshot test (#​2299, #​2316), by @​fengmk2
• Suppress racy optimizer logs in the vitest_browser_mode snapshot test (#​2297), by @​fengmk2
• Remove the obsolete auto-install environment from the snapshot tests (#​2163), by @​liangmiQwQ

Bundled Versions

Tool	Version	Source
vite	8.2.0	fa79f9a
rolldown	1.2.2	872b98a
tsdown	0.22.14	npm
vitest	4.1.10	npm
oxlint	1.76.0	npm
oxlint-tsgolint	7.0.2001	npm
oxfmt	0.61.0	npm

Upgrade

vp upgrade

New Contributors

@​jbmusso, @​Arcadi4, @​dennybiasiolli, @​RSS1102

Full Changelog: voidzero-dev/vite-plus@v0.2.7...v0.2.8

Published Packages

• @voidzero-dev/vite-plus-core@0.2.8
• vite-plus@0.2.8

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.8 vp build

Run any vp command without installing it; see the Docker guide for more.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview	Aug 13, 2026 3:33am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Aug 13, 2026 3:33am
npmx-lunaria	Ignored		Aug 13, 2026 3:33am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​voidzero-dev/​vite-plus-core@​0.2.8
	rolldown@​1.2.2
	vite-plus@​0.2.8

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[github-actions]

e18e dependency analysis

No dependency warnings found.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.