Uh oh!
There was an error while loading. Please reload this page.
fix(migrate): keep catalog: specs intact through vp up under pnpm - #2425
Merged
Conversation
✅ Deploy Preview for viteplus-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
✅ Staging deployment successful! Preview: https://viteplus-staging.void.app/ |
fengmk2force-pushed
the
fix/vp-up-catalog-protocol
branch
from
August 12, 2026 05:48
19982a8 to
3d8f17bComparefengmk2
commented
Aug 12, 2026
MemberAuthor
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:3d8f17baf2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
fengmk2
commented
Aug 12, 2026
MemberAuthor
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:4321a19ebe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
fengmk2force-pushed
the
fix/vp-up-catalog-protocol
branch
from
August 14, 2026 09:20
47cc4bb to
8b2ce1dComparefengmk2
commented
Aug 14, 2026
MemberAuthor
@codex review |
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
fengmk2force-pushed
the
fix/vp-up-catalog-protocol
branch
from
August 14, 2026 15:11
8b2ce1d to
8eb791cComparefengmk2
marked this pull request as ready for review
August 14, 2026 15:49
fengmk2
commented
Aug 14, 2026
MemberAuthor
@codex review |
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Contributor
Registry bridge build ( |
| Package | Version |
|---|---|
vite-plus | 0.0.0-commit.ccf26fd42e409003faf2e0031531261c59303851 |
@voidzero-dev/vite-plus-core | 0.0.0-commit.ccf26fd42e409003faf2e0031531261c59303851 |
Install the Vite+ CLI built from this commit, then migrate a project:
# macOS / Linux
curl -fsSL https://vite.plus | VP_PR_VERSION=2425 bash# Windows (PowerShell)$env:VP_PR_VERSION="2425"; irm https://vite.plus/ps1 | iexAfter installing, upgrade the current project's vite-plus to this test build with:
vp migrateOr point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:
| Package manager | Registry config |
|---|---|
| npm / pnpm / Bun | .npmrc: registry=https://registry-bridge.viteplus.dev/ |
| Yarn (v2+) | .yarnrc.yml: npmRegistryServer: "https://registry-bridge.viteplus.dev/" |
Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):
{
"devDependencies": {
"vite-plus": "0.0.0-commit.ccf26fd42e409003faf2e0031531261c59303851",
"vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.ccf26fd42e409003faf2e0031531261c59303851"
}
}Contributor
🐳 Docker preview imageBuilt from this PR's registry bridge build:
# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-2425 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-2425Quick check: docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-2425 vp --versionSee docs/guide/docker.md for usage. |
wan9chi
approved these changes
Aug 16, 2026
pnpm applies overrides through a read-package hook that replaces the declared spec on every manifest, importers included, before resolution runs. A bare override key carries no range, and pnpm treats "no range" as "matches every declared spec", `catalog:` included. An importer declaring `vite: "catalog:"` therefore loses its catalog provenance during resolution, so `pnpm update` writes the resolved core alias back into its package.json (`vite: "npm:@voidzero-dev/vite-plus-core@0.2.7"`). Range-qualify the managed pnpm override keys (`vite@*`, `vitest@*`). `*` is a valid range and intersects every real semver range, which is what the transitive and peer `vite` declarations the override exists for always use, while `catalog:` is not a valid range and so never matches. Nothing changes about what gets installed: an importer referencing the catalog already resolves to the aliased core through its catalog entry. Migration re-keys a project still carrying the bare key, preserving its `catalog:<name>` choice, and pending-detection reads a bare managed key as unsatisfied so one `vp migrate` repairs an existing project. npm/bun `overrides` and yarn `resolutions` keep bare keys; they have no `catalog:` importer specs to lose. Closes#2309
…sion The fixture hand-wrote `vite: npm:@voidzero-dev/vite-plus-core@latest` in the catalog, so `vp up` had a real version bump to perform and the clobber read as a side effect of that resolution. The reported case pins an exact version, where the update is a NO-OP and the catalog reference is still destroyed, which is both the reporter's shape and the sharper repro. Let `vp migrate` write the pinned version instead of hard-coding one that would churn each release, then rewind the override key to the pre-fix bare spelling with `vpt replace-file-content` (which also fails loudly if migrate ever stops writing the ranged key). `vp up` now reports "Already up to date" and still rewrites `vite: "catalog:"` to the pinned alias. Reverts the redaction widening from the previous commit: with an exact pin no snapshot produces the `@^0.2.8` range form any more.
These 11 fixtures timed out on the local recording pass (slow managed Node/package-manager downloads), so they kept the pre-#2309 bare `vite` override key and failed CI on all three platforms. Every diff is the key rename; no behavior changed.
pnpm 12 fixes the clobber upstream: on 12.0.0-rc.3 a bare override key no longer strips a catalog: importer spec, verified by A/B on identical config (pnpm 11.20.0 rewrites it, 12.0.0-rc.3 does not). The range-qualified key vite-plus writes stays correct there, and still redirects an incompatible transitive edge, so it is not merely a pnpm 9-11 workaround. The vp up screen is omitted: pnpm 12's update summary reports a package-count delta that churns with the bundled dependency graph.
Apply ASD-STE100 style to the comments and guide text added by this branch: one instruction per sentence, active voice, no ellipsis, and sentences under 25 words. The longest sentence was 52 words. Also removes the em dashes these additions introduced. Comments and documentation only. No code changed.
Four gaps in the range-qualified override key change. The monorepo root writer was missed. `rewriteMonorepo` routes root pnpm settings through `rewriteRootWorkspacePackageJson`, not the standalone writer, and its pre-10.6.2 branch still spread bare `...managed` keys into `pkg.pnpm.overrides`. Those workspace-wide bare keys kept matching child `catalog:` declarations, so `vp up` could still replace them. Both writers now share one `mergeManagedPnpmOverrides` helper, which is what let the paths drift apart in the first place. That helper also carries a legacy bare key's `catalog:<name>` value onto the ranged key. The package.json paths previously replaced it with the concrete managed alias, which disconnected the override from the user's named catalog and contradicted the documented preservation behaviour. A `file:` managed spec still wins, since force-override mode has no catalog. `overridesSatisfyVitePlus` read only the ranged key in `pnpm-ranged` mode, so a map holding BOTH `vite@*` and a legacy bare `vite` reported satisfied. The fast path then skipped the rewrite and left the clobbering key active. Any remaining bare managed key now reports unsatisfied. The managed-vitest sweep was over-broad. `removeManagedVitestEntry` and `removeYamlMapVitestEntry` deleted `vitest@*` from every sink, but only pnpm overrides use that spelling. npm also accepts a range in an override key, so a user-authored `"vitest@*"` in npm `overrides` was silently deleted. Both now take a key style and sweep the ranged spelling for pnpm sinks only. Each fix has a unit test that fails without it.
Codex review on 4321a19: `vite@*` does not match a declaration pinning an exact prerelease. pnpm compares with semver.intersects(declaredSpec, keyRange), which is asymmetric for prereleases: intersects('8.0.0-beta.18', '*') is false while the reverse is true. My earlier justification checked the wrong argument order. Verified on pnpm 11.20.0: a bare key redirects an exact-prerelease declaration, the ranged key does not. No range string avoids it, because node-semver only admits a prerelease when a comparator carries the same version tuple. A prerelease RANGE (^8.0.0-beta.1) still matches, and pnpm 12.0.0-rc.3 matches the exact form too, so the gap is pnpm 9-11 only. A bare key would close it but is what clobbers catalog:, so below pnpm 12 the two cannot both hold. Corrects the comments and guide text that claimed the range keeps the override on every valid semver range.
The pnpm 9 to 11 exact-prerelease gap stays in the `pnpmOverrideKey` comment. The migrate-rules and upgrade guides drop it per review. Apply STE style to the prose added after 98a2fd3: split sentences over the length limits, keep one statement per sentence, use active voice, and remove the em dash from the pnpm override bullet.
Apply the /simplify review findings on this branch's code: - Drop the `deleteYamlMapKey` helper. Its premise was wrong: yaml 2.9.0's `YAMLMap.delete` resolves a plain string key through `findPair`, verified against the installed package. The YAML sink now deletes the bare key directly, with the same missing-map guard. - Probe the two managed `vitest` key spellings directly instead of scanning every sink entry through a predicate; `managedVitestOverrideKeys` now owns the spelling list and `isManagedVitestOverrideKey` is gone. - Fold the force-override `vite-plus` pin into `mergeManagedPnpmOverrides`, so both package.json `pnpm.overrides` writers really do go through the one helper and the twin call-site blocks collapse to one line each. - Restructure `ensureOverrideEntries` to move-then-check: the bare key moves onto the ranged key first, which removes the trailing re-materialize branch and its cross-branch `changed` invariant. - Write the lingering-vitest check so the ranged spelling only appears under `keyStyle === 'pnpm-ranged'`; the old disjunction read the same key twice for bare sinks.
fengmk2force-pushed
the
fix/vp-up-catalog-protocol
branch
from
August 16, 2026 12:57
ccf26fd to
c7480fcCompareUh oh!
There was an error while loading. Please reload this page.
fengmk2 pushed a commit
that referenced
this pull request
Aug 24, 2026
…1.4 support (#2536) Fresh installs now use a split directory layout instead of a single `~/.vite-plus` root. Unix follows the XDG base directory specification, and Windows uses the standard `%LOCALAPPDATA%` and `%APPDATA%` folders. Existing `~/.vite-plus` installs keep their current directory layout. `vp migrate` also converts `tsup` projects, and `vp` now sends Bun `1.4` package-manager commands to `bun` directly. The published npm package shrank by about half, and the upgrade check no longer delays each command. ### Breaking Changes - Fresh installs now use a split directory layout instead of a single root: XDG base directories on Unix, and the standard known folders on Windows. Existing `~/.vite-plus` installs keep their current layout, and the installer does not move their files. `VP_HOME` still selects the single-root layout ([#2346](#2346)), by @forehalo | Category | Unix default | Windows default | Single-root (`VP_HOME`) | | --- | --- | --- | --- | | bin | `~/.local/share/vite-plus/bin` | `%LOCALAPPDATA%\vite-plus\bin` | `<root>/bin` | | data | `~/.local/share/vite-plus` | `%LOCALAPPDATA%\vite-plus\data` | `<root>` | | cache | `~/.cache/vite-plus` | `%LOCALAPPDATA%\vite-plus\cache` | `<root>/cache` | | config | `~/.config/vite-plus` | `%APPDATA%\vite-plus` | `<root>` | | state | `~/.local/state/vite-plus` | `%LOCALAPPDATA%\vite-plus\state` | `<root>` | The installer configures your shell for the new location, and CI that installs through `setup-vp` keeps the single-root layout automatically. Update each hard-coded `~/.vite-plus/bin` path, such as a path in a Dockerfile. ### Highlights - `vp migrate` now converts `tsup` projects. It replaces the `tsup` dependency and script with `vp pack`. It also changes `tsup.config.ts` to a `tsdown.config.ts` that imports from `vite-plus/pack` ([#2434](#2434)), by @KTrain5169 - Shell integrations now accept the global `-C` flag. `vp -C <dir> env use` changes the environment of your current shell. The `-C<dir>` and `-C=<dir>` forms also work. In zsh, Fish, Nushell, and PowerShell, `vpr` completion keeps the working directory when it changes the command to `vp run` ([#2508](#2508)), by @simulacre7 - The published `vite-plus` npm package shrank from 1.05 MB to 516 kB, a 51% reduction. It now includes only Markdown files from the documentation workspace. It no longer includes VitePress tooling, images, or deployment files ([#2480](#2480)), by @liangmiQwQ ### Features - With Bun `1.4` or later, Vite+ forwards these commands and flags to `bun`. Earlier Bun versions keep their fallback or unsupported behavior and report the required Bun version ([#2513](#2513)), by @jong-kyung - `vp dedupe` runs `bun dedupe`, including `--check` - `vp pm prune` runs `bun prune` - `vp pm audit --fix` runs `bun audit fix` - `vp add`, `vp remove`, and `vp update` send `--filter` to `bun` - `vp add --save-catalog` sends `--catalog` to `bun` - The upgrade check no longer delays fast commands. It runs in a separate process. It reports an available update during a later command, and commands no longer wait for the registry ([#2380](#2380)), by @liangmiQwQ - Upgrade the bundled toolchain ([#2443](#2443), [#2500](#2500), [#2504](#2504), [#2519](#2519), [#2532](#2532)), by @voidzero-guard[bot]: - `vite`: `8.2.1` to `8.2.2` - `rolldown`: `1.2.3` to `1.2.5` - `vitest`: `4.1.10` to `4.1.11` - `oxlint`: `1.77.0` to `1.79.0` - `oxfmt`: `0.62.0` to `0.64.0` - Oxc packages and crates: `0.143.0` to `0.146.0` - Vite+ now accepts `@vitejs/devtools` `0.5.x`. The optional peer range is `^0.4.0 || ^0.5.0`. This repository uses `0.5.2`. - `oxfmt` and `oxlint` can report new issues after the upgrade. Run `vp check` locally. Use `vp fmt` to fix formatting changes. - `vp toolchain` draws its tree with Unicode glyphs. It no longer uses ASCII connectors ([#2442](#2442)), by @liangmiQwQ ### Fixes & Enhancements - At a workspace root, bare app commands now use `defaultPackage` or detected root configuration before they select a member package. A workspace without member packages runs the command in the root ([#2530](#2530), [#2533](#2533)), by @fengmk2 - `vp up` no longer changes `"vite": "catalog:"` to a version alias under `pnpm`. Catalog references now stay unchanged during an update. Run `vp migrate` once to correct an existing project ([#2425](#2425)), by @fengmk2 - If the server accepts range requests, an interrupted runtime download continues from the bytes on disk. It does not start again ([#2452](#2452)), by @tarikermis - The local CLI shows the install instructions when you run a global-only command such as `env`, `upgrade`, or `implode` ([#2522](#2522)), by @jong-kyung - `vp up -g` asks npm for globally installed package versions. A project-level setting no longer makes the lookup fail and hide an available update ([#2438](#2438)), by @jong-kyung - When hooks are disabled through `HUSKY=0`, `VP_GIT_HOOKS=0`, or `VITE_GIT_HOOKS=0`, `vp config` skips the Git lookup. This lets `vp config` run in a container without Git ([#2458](#2458)), by @tarikermis - `vp create vite:monorepo` now asks once about Git and runs `git init` once ([#2417](#2417)), by @jong-kyung - `vp create` does not ask about pre-commit hooks when you choose not to initialize Git ([#2477](#2477)), by @liangmiQwQ - `vp pack --no-config` does not read the Vite config. A local `vite.config.*` file, its `pack` options, and its hooks no longer run ([#2486](#2486)), by @jong-kyung - `vp pack --help` shows the supported `--no-config` options ([#2487](#2487)), by @jong-kyung - `vp staged --no-concurrent` works again. `--concurrent` accepts `true`, `false`, or a number greater than `0`. It rejects other values. Vite+ also rejects `--no-cwd`, `--no-diff`, and `--no-diff-filter` ([#2501](#2501)), by @RSS1102 - `vp` reads about 450 kB less JavaScript at start. It loads the `--init` and `--migrate` helpers only when a command needs them ([#2490](#2490)), by @jong-kyung - The standalone `vp` binary is smaller. Vite+ no longer copies the package-manager command tree, and it disables unused tar and dialoguer features ([#2507](#2507)), by @liangmiQwQ - A generated Fish environment file escapes the special characters in a path ([#2492](#2492)), by @fengmk2 - A generated POSIX shell environment file escapes the special characters in a path. It also removes each duplicate Vite+ bin entry ([#2494](#2494)), by @fengmk2 - The generated `cmd.exe` wrapper preserves the exit status from `vp env use`. It does not apply output after a failed command ([#2496](#2496)), by @fengmk2 - `vp exec` resolves a relative `PATH` entry such as `./node_modules/.bin` against the working directory of the command ([#2350](#2350)), by @RSS1102 - Older GitLab `setup-vp` templates continue to work. The installer selects the legacy layout for them. A template can select the new layout with `VP_VPDIRS_AWARE=1` ([#2520](#2520)), by @fengmk2 - The Windows installer checks the directory variables and the requested version before it downloads a payload. It also repairs a broken `current` junction ([#2505](#2505)), by @fengmk2 - `install.sh` does not show shell configuration warnings when `CI=true` ([#2511](#2511)), by @fengmk2 - On Windows, `vp implode` can remove Vite+ roots that contain long or locked paths. A native helper does this work, and it retries cleanup and writes an error log if cleanup fails ([#2510](#2510)), by @fengmk2 - A Windows trampoline sidecar must have a `vite-plus-shim-v1` header. The trampoline rejects one without that header instead of guessing the install layout ([#2526](#2526)), by @fengmk2 ### Docs - Document the `vite-plus/test` import surface ([#2413](#2413)), by @jong-kyung - Add `vp hooks` to the README command list ([#2446](#2446)), by @lyzno1 ### Chore - Add Yii to the core team ([#2435](#2435)), by @forehalo - Include install e2e in the aggregate CI status ([#2439](#2439)), by @jong-kyung - Use the catalog for shared dependencies ([#2447](#2447)), by @liangmiQwQ - Replace `husky` with `vp` git hooks in this repo ([#1001](#1001)), by @Arthie - Exclude test fixtures from Renovate scanning ([#2457](#2457)), by @fengmk2 - Keep the binary size report in the job summary for fork PRs ([#2448](#2448)), by @fengmk2 - Update crate-ci/typos action to v1.49.0 ([#2467](#2467)), by @renovate[bot] - Update GitHub Actions ([#2474](#2474)), by @renovate[bot] - Update the `napi` crate to `3.12.2` ([#2527](#2527)), by @fengmk2 - Ignore every `vite-task` git dependency in Renovate ([#2478](#2478)), by @fengmk2 - Link preview installers and pin install scripts in CI ([#2499](#2499)), by @fengmk2 - Cover PowerShell setup in tests ([#2495](#2495)), by @fengmk2 - Cover Nushell file-based use in tests ([#2497](#2497)), by @fengmk2 - Remove redundant dist/test inclusion from the CLI package ([#2506](#2506)), by @jong-kyung - Redact the `bun` build hash in snapshots ([#2514](#2514)), by @jong-kyung - Align the command-routing RFC with the current global CLI ([#2528](#2528)), by @jong-kyung - Fold v0.2.9 release learnings into the release-manager skill ([#2429](#2429)), by @fengmk2 - Add `vp_pm_cli_macros` and `vp_toolchain` to the repo map ([#2524](#2524)), by @jong-kyung ### Bundled Versions | Tool | Version | Source | | --------------- | ---------- | --------------------------------------------------------------------------------- | | vite | `8.2.2` | [`de1111a`](vitejs/vite@de1111a) | | rolldown | `1.2.5` | [`84c904b`](rolldown/rolldown@84c904b) | | tsdown | `0.22.14` | [npm](https://npmx.dev/package/tsdown/v/0.22.14) | | vitest | `4.1.11` | [npm](https://npmx.dev/package/vitest/v/4.1.11) | | oxlint | `1.79.0` | [npm](https://npmx.dev/package/oxlint/v/1.79.0) | | oxlint-tsgolint | `7.0.2001` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2001) | | oxfmt | `0.64.0` | [npm](https://npmx.dev/package/oxfmt/v/0.64.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @simulacre7 **Full Changelog**: v0.2.9...v0.3.0
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#2309.
vp uprewrote"vite": "catalog:"to the concretenpm:@voidzero-dev/vite-plus-core@xalias. The catalog already pins the version, so the update was a no-op that destroyed the reference.vp uppasses through topnpm update. pnpm applies an override by replacing the declared spec on every manifest, and a bare override key matches any spec,catalog:included.The fix range-qualifies the managed override keys:
vite@*andvitest@*. The range matches the semver ranges that transitive and peer declarations use, and never matchescatalog:, which is not a valid range. Onevp migratere-keys existing projects.Caveats: pnpm does not document this override-key behavior. Verified on pnpm 10.34.4 through 12.0.0-rc.3 (pnpm 12 also fixes the clobber upstream); the snapshot fixtures are the tripwire if pnpm changes it. On pnpm 9 to 11 the ranged key skips a declaration that pins an exact prerelease; the
pnpmOverrideKeydoc comment records that gap.Repro: https://github.com/why-reproductions-are-required/vite-plus-up-catalog-protocol-2309