fix(static_config): only trust `defineConfig` from`vite-plus` by liangmiQwQ · Pull Request #2060 · voidzero-dev/vite-plus

liangmiQwQ · 2026-07-06T02:30:08Z

At present, static config only checks if the export default statement's callee is defineConfig.

So, if I import defineConfig from other sources and modify the input in the function, or define a variable called defineConfig, the static config analyze will get broken.

For example, if you are using a preset which automatically generates tasks, you will get:

$ vpr build
Task "build" not found.
Select a task (↑/↓, Enter to run, type to search): build
No matching tasks. Press Escape to clear search.

If the defineConfig modify its import structure, you may get:

$ vpr dev
error: Failed to load task graph
* Failed to load task config file for package at "/Users/liangmi/code/liangmiQwQ/is-github-bot/"* unknown field `missions`, expected one of `cache`, `tasks`, `enablePrePostScripts`

This PR adds source check and only trust defineConfig from vite-plus package.

This problem is discovered when I am doing attempts in my personal Vite+ config preset.

🤖 Generated with Codex

netlify · 2026-07-06T02:30:12Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`4e5a3cb`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a4b5201915e6f0008f3e93e

liangmiQwQ · 2026-07-06T02:43:20Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:bf702d8c87

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…plus

liangmiQwQ · 2026-07-06T03:22:04Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:2d343cc552

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

liangmiQwQ · 2026-07-06T03:40:25Z

@codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:4bded2ec89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

liangmiQwQ · 2026-07-06T03:54:00Z

@codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:1cae72a270

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

liangmiQwQ · 2026-07-06T04:37:12Z

@codex review

chatgpt-codex-connector · 2026-07-06T04:41:37Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit:3d2fc136cc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…plus

fengmk2

@liangmiQwQ That was indeed a problem, thank you for fixing it.

fengmk2 · 2026-07-06T06:21:52Z

@liangmiQwQ Could you add the error message to the PR description? This way, people can get a clearer understanding of the specific issue being fixed. Even if I know what the error is, others who are unfamiliar with it should be able to understand the problem at a glance.

liangmiQwQ · 2026-07-06T06:29:27Z

@fengmk2 It may just be simple task not found for most cases. Or if the function's input type is changed, it will prompt an error. I've added both of them to PR description

…plus

fengmk2 · 2026-07-06T06:33:50Z

@liangmiQwQ I will run a round simplify before I merge.

- Reuse oxc's ModuleExportName::name() instead of the hand-rolled three-variant matcher. - Collapse the eager import scan plus interleaved mutable flag into a single immutable pass over the program body. - Extract the duplicated "vite-plus" / "defineConfig" literals into named constants.

@liangmiQwQ

…xes (#2081) Release vite-plus v0.2.3: config extraction, create, and `vp run` reliability fixes. A patch release that restores static config extraction for projects importing `defineConfig` from `vite`, fixes `vp create` for org templates on registries that strip custom package fields, cleans up terminal output after Ctrl-C during `vp run`, and updates bundled Vite to 8.1.3. ### Highlights - **Custom `VP_HOME` is honored on every run**: the global `vp` now respects a user-set `VP_HOME` for its home directory instead of falling back to `~/.vite-plus`, and persists it in the generated env files, so a custom install location no longer produces multiple instances or unusable packages ([#2029](#2029)), by @liangmiQwQ ### Features - Upgrade bundled Vite from `8.1.2` to `8.1.3` (inlined CSS after the shebang line, CSS preload for nested dynamic imports, SSR stacktrace column fix) ([#2042](#2042)), by @voidzero-guard[bot] ### Fixes & Enhancements - `vp run` no longer misreads a `vite.config.ts` when its `defineConfig` comes from a preset or a custom wrapper instead of `vite-plus` or `vite`. Such configs are now evaluated at runtime rather than assumed to be Vite+'s own, so projects that use them no longer wrongly report `Task "build" not found` ([#2060](#2060), [#2075](#2075)), by @liangmiQwQ and @fengmk2 - Killing a `vp run` task with Ctrl-C no longer leaves odd OSC escape sequences in the terminal; `vp` defers its own Ctrl-C handling until the child process exits ([#2079](#2079)), by @forehalo - `vp migrate`: rewriting a `package.json` prettier script now emits a single `--check`, so scripts that combined `--check` with `--list-different` / `-l` / `-c` no longer produce a duplicated `vp fmt --check --check` ([#2044](#2044)), by @shulaoda - `vp create @org:name`: read the org template catalog (`createConfig`) from the published tarball when the registry (e.g. GitHub Packages) strips custom fields from packument metadata ([#2063](#2063)), by @hiro-daikin - `vp run`: missing env vars requested through `@voidzero-dev/vite-task-client` now return `undefined` instead of `null`, preserving Vite production `NODE_ENV` semantics when builds run through `vp run` ([vite-task#508](voidzero-dev/vite-task#508), via [#2076](#2076)), by @wan9chi ### Refactor - `static_config`: drop the unreachable `vite.config.json` branch ([#2045](#2045)), and remove unused exported CLI helpers ([#2046](#2046)), by @shulaoda ### Docs - Update the announcement links and callout for the beta release ([#2027](#2027)), remove the stale `Dockerfile.alpine` comment ([#2068](#2068)), by @fengmk2 - Add the missing `pnpm-workspace.yaml` to the docs Dockerfile ([#2059](#2059)), by @wan-kong - Refresh the root agent guide ([#2072](#2072)), by @jong-kyung ### Chore - Cross-compile Windows tests and CLI binaries on Linux with cargo-xwin ([#1824](#1824)), install local vite-plus builds through a local npm registry ([#2021](#2021)), fast docs format check for docs-only PRs ([#2028](#2028)), pack local dirs for the registry bridge instead of pkg.pr.new ([#2038](#2038)), remove the stale create workflow updater ([#2061](#2061)), and add PTY-based interactive CLI snapshot tests ([#2052](#2052)), by @fengmk2 - Cache `vp run` output for docs builds ([#2006](#2006)), by @wan9chi - Remove legacy completion cleanup ([#2050](#2050)), by @nekomoyi - Update the crate-ci/typos action ([#2039](#2039)) and GitHub Actions ([#2055](#2055), [#1905](#1905)), by @renovate[bot] - Refresh the Node.js release keyring ([#2058](#2058)) and the docs trusted-stack stats ([#2064](#2064)), by @voidzero-guard[bot] ### Bundled Versions | Tool | Version | Source | | --- | --- | --- | | vite | `8.1.3` | [`578ffb8`](vitejs/vite@578ffb8) | | rolldown | `1.1.4` | [`6cbd233`](rolldown/rolldown@6cbd233) | | tsdown | `0.22.3` | [npm](https://npmx.dev/package/tsdown/v/0.22.3) | | vitest | `4.1.9` | [npm](https://npmx.dev/package/vitest/v/4.1.9) | | oxlint | `1.72.0` | [npm](https://npmx.dev/package/oxlint/v/1.72.0) | | oxlint-tsgolint | `0.24.0` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/0.24.0) | | oxfmt | `0.57.0` | [npm](https://npmx.dev/package/oxfmt/v/0.57.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @wan-kong and @hiro-daikin made their first contributions. **Full Changelog**: v0.2.2...v0.2.3 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: wan9chi <dk4rest@gmail.com>

wip
9b73595

liangmiQwQ added 2 commits July 6, 2026 10:37

snap-test
d791693

unit tests
bf702d8

chatgpt-codex-connectorBot reviewed Jul 6, 2026
View reviewed changes

Comment threadcrates/vite_static_config/src/lib.rs Outdated
Comment threadcrates/vite_static_config/src/lib.rs Outdated
Comment threadcrates/vite_static_config/src/lib.rs Outdated

liangmiQwQ added 2 commits July 6, 2026 11:21

wip
9292b3f

Merge branch 'main' into fix/reject-defineConfig-import-not-from-vite…
2d343cc
…plus

chatgpt-codex-connectorBot reviewed Jul 6, 2026
View reviewed changes

Comment threadcrates/vite_static_config/src/lib.rs Outdated
Comment threadcrates/vite_static_config/src/lib.rs Outdated

wip
4bded2e

chatgpt-codex-connectorBot reviewed Jul 6, 2026
View reviewed changes

Comment threadcrates/vite_static_config/src/lib.rs Outdated

enhance
1cae72a

chatgpt-codex-connectorBot reviewed Jul 6, 2026
View reviewed changes

Comment threadcrates/vite_static_config/src/lib.rs Outdated
Comment threadcrates/vite_static_config/src/lib.rs Outdated
Comment threadcrates/vite_static_config/src/lib.rs Outdated
Comment threadcrates/vite_static_config/src/lib.rs Outdated
Comment threadcrates/vite_static_config/src/lib.rs Outdated

liangmiQwQ added 2 commits July 6, 2026 12:23

wip
01a1035

wip
3d2fc13

liangmiQwQ changed the title ~~fix(static_config): reject defineConfig from untrusted sources~~fix(static_config): only trust defineConfig fromvitestJul 6, 2026

liangmiQwQ changed the title ~~fix(static_config): only trust defineConfig fromvitest~~fix(static_config): only trust defineConfig fromvite-plusJul 6, 2026

Merge branch 'main' into fix/reject-defineConfig-import-not-from-vite…
bf7eabb
…plus

liangmiQwQ marked this pull request as ready for review July 6, 2026 04:42

liangmiQwQ requested review from fengmk2 and wan9chi July 6, 2026 04:42

fengmk2 approved these changes Jul 6, 2026
View reviewed changes

Merge branch 'main' into fix/reject-defineConfig-import-not-from-vite…
854dcae
…plus

fengmk2 force-pushed the fix/reject-defineConfig-import-not-from-viteplus branch from 336d469 to 4e5a3cbCompare July 6, 2026 06:58

fengmk2 merged commit b9b15c4 into voidzero-dev:mainJul 6, 2026
44 checks passed

liangmiQwQ deleted the fix/reject-defineConfig-import-not-from-viteplus branch July 6, 2026 07:21

wan9chi mentioned this pull request Jul 7, 2026
release: v0.2.3: config extraction, create, and vp run reliability fixes #2081
Merged

Uh oh!

Conversation

liangmiQwQ commented Jul 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlifyBot commented Jul 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connectorBot commented Jul 6, 2026

Uh oh!

fengmk2 left a comment

Choose a reason for hiding this comment

Uh oh!

fengmk2 commented Jul 6, 2026

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

fengmk2 commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

liangmiQwQ commented Jul 6, 2026•
edited
Loading

netlifyBot commented Jul 6, 2026•
edited
Loading