Repository navigation
chore(deps): update junction, zip, rustls, and ast-grep - #1783
Conversation
|
✅ Deploy Preview for viteplus-preview canceled.
|
af3cd19 to
79e2650
Compare
44bd38e to
bf03de2
Compare
c4a933f to
d551305
Compare
91a6582 to
87b4e56
Compare
This comment was marked as resolved.
This comment was marked as resolved.
300ca25 to
722ccaf
Compare
CLI artifact sizes (
|
| Artifact | Format | Base | PR | Change |
|---|---|---|---|---|
packages/cli/dist |
Directory total | 2.20 MiB | 2.20 MiB | 0 B (0.00%) |
packages/core/dist |
Directory total | 4.08 MiB | 4.08 MiB | 0 B (0.00%) |
| Combined package dist | Directory total | 6.28 MiB | 6.28 MiB | 0 B (0.00%) |
vp (Linux x64) |
Binary | 10.19 MiB | 10.21 MiB | +20.00 KiB (+0.19%) |
vp (Linux x64) |
gzip -9 | 4.50 MiB | 4.50 MiB | +5.90 KiB (+0.13%) |
| NAPI (Linux x64) | Binary | 33.65 MiB | 34.53 MiB | +900.06 KiB (+2.61%) |
| NAPI (Linux x64) | gzip -9 | 13.42 MiB | 13.81 MiB | +392.70 KiB (+2.86%) |
vp (macOS ARM64) |
Binary | 7.61 MiB | 7.62 MiB | +16.22 KiB (+0.21%) |
vp (macOS ARM64) |
gzip -9 | 3.93 MiB | 3.94 MiB | +13.57 KiB (+0.34%) |
| NAPI (macOS ARM64) | Binary | 40.91 MiB | 41.52 MiB | +629.77 KiB (+1.50%) |
| NAPI (macOS ARM64) | gzip -9 | 17.63 MiB | 17.98 MiB | +358.80 KiB (+1.99%) |
vp (Windows x64) |
Binary | 8.25 MiB | 8.29 MiB | +34.50 KiB (+0.41%) |
vp (Windows x64) |
gzip -9 | 3.64 MiB | 3.66 MiB | +17.47 KiB (+0.47%) |
| NAPI (Windows x64) | Binary | 29.77 MiB | 30.60 MiB | +851.00 KiB (+2.79%) |
| NAPI (Windows x64) | gzip -9 | 12.14 MiB | 12.51 MiB | +378.04 KiB (+3.04%) |
| Trampoline (Windows x64) | Binary | 13.50 KiB | 13.50 KiB | 0 B (0.00%) |
| Trampoline (Windows x64) | gzip -9 | 7.09 KiB | 7.09 KiB | -1 B (-0.01%) |
| Installer (Windows x64) | Binary | 3.61 MiB | 3.63 MiB | +25.50 KiB (+0.69%) |
| Installer (Windows x64) | gzip -9 | 1.77 MiB | 1.78 MiB | +12.24 KiB (+0.68%) |
5faff68 to
b13e78f
Compare
e043766 to
6391c35
Compare
3441999 to
34eae95
Compare
2a83696 to
fec42eb
Compare
3fbf598 to
cab3f21
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 18ef9b49a1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
<!-- claude-projects-attribution: {"github_login":"Brooooooklyn"} -->
_Requested by **Brooklyn** · [project
thread](https://claude.ai/code/project/chan_018s9RxRdtH424j2EhXdzV3N?thread=cmsg_018s9RxRdtH424j2EhXdzV3NQxbeR8Pt7qaqSQwoq9rEFo)_
<!-- routine:prune-tests:duplicate-shell-and-helper-tests -->
Before: `vp_global_cli` and `vp_pm_cli` carried Rust unit tests that
could not fail when the product broke: an `assert!(true)` in
`create.rs`, four `env use` shell-detection tests that repeat
`commands::shell` tests for code `env use` only imports, and three tests
of test-only helpers. `upgrade_check.rs` had 20 hand-unrolled lookup
tests.
After: those 8 tests are gone and the 20 lookup tests are 2 table-driven
tests that keep every row and comment, with the failing row named in the
assertion message. Only test code changes: every hunk is inside a
`#[cfg(test)]` module or the `#[cfg(test)]`-only
`resolution::test_utils` module.
How: each candidate was defended by mutating product code with the most
realistic regression only it would catch, running the crate's tests, and
reverting. No deleted test failed alone on any mutation.
### Totals
| | Before (origin/main c04bcf6) | After |
|---|---|---|
| Files touched | – | 5 |
| `vp_global_cli` cases collected (Linux) | 502 (+2 ignored) | 479 (+2
ignored) |
| `vp_pm_cli` cases collected | 923 (+2 ignored) | 920 (+2 ignored) |
- Cases deleted: **8** of 1,425 collected in the two touched crates.
Repo-wide: about 2,432 `#[test]`/`#[tokio::test]` attributes in tracked
Rust (static count) and 1,492 static `it`/`test` calls in 101 JS spec
files (not collected; Vitest needs a full `packages/core` build).
- Cases folded: **20 into 2**, every row and comment kept.
Runner-collected total: −26.
- Net lines: **−159** (+42 / −201).
- Runtime saved: about 0.03 s (the 8 deleted cases each report 0.000 s;
the 20 folded cases summed 0.028 s against 0.011 s for the 2
replacements).
- Test-binary time on this shared machine: `vp_global_cli` 3.13 s → 3.32
s, `vp_pm_cli` 27.81 s → 29.06 s (noise).
### Per file
1. **`crates/vp_global_cli/src/commands/create.rs` ›
`test_create_command_module_exists`**
- Class: tautology (`assert!(true)`).
- Best defense: M1 (delegate `"new"` instead of `"create"`) passes all
502 tests, so this test cannot fail. The whole `mod tests` goes.
- Coverage gap (pre-existing, unchanged by this PR): no unit test covers
`vp create` delegation. It may be covered by the PTY snapshot suite,
which was not run.
2. **`crates/vp_global_cli/src/commands/env/use.rs` ›
`test_detect_shell_vp_shell_{powershell,fish,nu}`,
`test_detect_shell_posix_default`**
- Class: duplicates of stronger tests. `detect_shell` /
`Shell::from_str` live in `commands/shell.rs`; `env use` only imports
them.
- Still covered: `fish` is byte-identical to
`commands::shell::tests::test_detect_shell_vp_shell_fish`; `nu` to
`test_detect_shell_vp_shell_explicit`; lowercase `powershell` by
`test_shell_from_str` and `test_detect_shell_vp_shell_case_insensitive`;
`posix_default` by `test_detect_shell_defaults_without_vp_shell`.
- Best defenses M2–M5: each failed the nominee together with at least
one `commands::shell` test.
- The `use vp_shared::env_vars;` import is now `#[cfg(windows)]`, since
only the three Windows-only tests in the module still use it.
3. **`crates/vp_pm_cli/src/resolution/test_utils.rs` ›
`parses_args_without_a_program_name`,
`parses_subcommands_without_a_program_name`**
- Class: test tooling testing test tooling.
- Best defense: M7 fails 122 tests and M8 fails 17; every resolution
parser test exercises these helpers.
4. **`crates/vp_pm_cli/src/resolution/commands/list.rs` ›
`list_args_helper_keeps_pattern`** (and its test-only `list_args`
helper, which had no other caller)
- Class: test tooling testing test tooling; it only checked struct
construction.
- Best defenses: M9 fails only
`test_list_with_pattern_and_pass_through_args`; M10 fails
`test_parser_accepts_short_dev_and_global_flags` and
`cli::tests::projects_managed_global_commands`. The nominee passes both.
### Folds (`crates/vp_global_cli/src/upgrade_check.rs`)
- The 9 `is_newer_version_*` tests → `is_newer_version_compares_semver`
(12 rows, original comments kept, one comment added for the `0.0.0`
dev-build row).
- The 11 `should_run_for_*` / `should_not_run_for_*` tests →
`should_run_for_command_skips_excluded_and_machine_readable_commands`
(11 rows).
- M11, M12 and M13 still fail the folded tables.
### Kept after defense — do not re-nominate
None: no nominee survived its defense.
### Case counts
| file | before | after | delta | expected delta |
|---|---|---|---|---|
| vp_global_cli `commands/create.rs` | 1 | 0 | −1 | −1 |
| vp_global_cli `commands/env/use.rs` (Linux) | 16 | 12 | −4 | −4 |
| vp_global_cli `upgrade_check.rs` | 36 | 18 | −18 | −18 (20 folded into
2) |
| vp_pm_cli `resolution/commands/list.rs` | 45 | 44 | −1 | −1 |
| vp_pm_cli `resolution/test_utils.rs` | 2 | 0 | −2 | −2 |
| **Crates total** | 1,425 | 1,399 | −26 | −26 |
**0 new failures** (0 failed and 4 ignored, before and after).
### Mutations
Each was temporary and reverted (`git status` clean afterwards).
1. M1 `create.rs:15`: delegate `"new"` instead of `"create"`. Failed:
none.
2. M2 `shell.rs:30`: `"fish"` → `"fishshell"`. Failed: `use::…_fish`,
`shell::test_shell_from_str`, `shell::…_fish`.
3. M3 `shell.rs:31`: `"nu" | "nushell"` → `"nushell"`. Failed:
`use::…_nu`, `shell::…_explicit`, `shell::test_shell_from_str`.
4. M4 `shell.rs:32`: drop `"powershell"`. Failed: `use::…_powershell`,
`shell::…_case_insensitive`, `shell::test_shell_from_str`.
5. M5 `shell.rs:54`: default always `Cmd`. Failed:
`use::…_posix_default`, `shell::…_defaults_without_vp_shell`,
`shell::…_invalid_vp_shell_falls_back_to_default`.
6. M6 `shell.rs:49`: upper-case the value. Failed: none (equivalent
mutation; `from_str` lowercases).
7. M7 `test_utils.rs:70`: `test_argv` no longer prepends a program name.
Failed: 122 tests, including both nominees.
8. M8 `test_utils.rs:57`: `parse_subcommand` gets raw args. Failed: 17
tests (`config`, `dist_tag`, `owner`, `stage`, `token`, plus the
nominee).
9. M9 `list.rs:78-80`: pnpm drops the pattern. Failed:
`test_list_with_pattern_and_pass_through_args` only.
10. M10 `list.rs:11`: `pattern` becomes `#[arg(long)]`. Failed:
`test_parser_accepts_short_dev_and_global_flags`,
`cli::tests::projects_managed_global_commands`.
11. M11 `upgrade_check.rs:170` (after the fold): `>` → `>=`. Failed:
`is_newer_version_compares_semver`.
12. M12 `upgrade_check.rs:338` (after the fold): `Upgrade` removed from
the excluded commands. Failed:
`should_run_for_command_skips_excluded_and_machine_readable_commands`.
13. M13 `upgrade_check.rs:165` (after the fold): the `0.0.0` early
return removed. Failed: `is_newer_version_compares_semver`.
### What ran and what did not
- Ran, at origin/main and on this branch: `cargo test -p vp_global_cli`
and `cargo test -p vp_pm_cli` with `--report-time`; `cargo clippy -p
vp_global_cli -p vp_pm_cli --all-targets --all-features -- --deny
warnings` with the `just lint` allow-list; `cargo fmt --all -- --check`;
`git diff --check`. All pass.
- Not run: the full workspace `just test` / `just lint` / `just check`;
Windows targets (none installed here, so the `#[cfg(windows)]` import
gate was reviewed but not compiled; Windows CI will compile it); the
JS/Vitest suite; the PTY snapshot suite.
### Excluded pull requests
55 open PRs touch 737 files between them; none of the 5 files here is
among them. #3055 #3052 #3051 #3049 #3047 #3046 #3044 #3040 #3038 #3037
#3020 #3018 #3014 #3012 #3009 #3008 #3000 #2986 #2981 #2966 #2936 #2922
#2900 #2863 #2862 #2810 #2792 #2740 #2721 #2699 #2695 #2574 #2557 #2552
#2549 #2543 #2542 #2541 #2483 #2475 #2463 #2462 #2461 #2456 #2428 #2418
#2357 #2267 #2125 #1958 #1783 #1782 #1614 #1517 #1180.
### Age check (cutoff: 30 days, 2026-09-14)
First-added dates from `git log -S`, followed across the `vite_*` →
`vp_*` crate rename.
| Test | First added |
|---|---|
| `test_create_command_module_exists` | 2026-02-10 (a29ac83, #570) |
| `test_detect_shell_posix_default` | 2026-02-07 (194c0dc, #524) |
| `test_detect_shell_vp_shell_{powershell,fish,nu}` | 2026-05-24
(53ae721, #1658) |
| `test_utils` tests and `list_args_helper_keeps_pattern` | 2026-08-03
(c1574dd, #2140) |
| The 20 folded `upgrade_check` tests | 2026-03-30 (db75675) |
None was added for a bug or incident, and none is in a permission,
security or entitlement suite.
### Checks
| Check | Before | After |
|---|---|---|
| Tests `vp_global_cli` | 502 pass | 479 pass |
| Tests `vp_pm_cli` | 923 pass | 920 pass |
| Clippy (deny warnings) | pass | pass |
| rustfmt | – | pass |
| `git diff --check` | – | clean |
To revert: `git revert 687935d`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01PxVsmvB9xfZKfVnUonY8kf
---
_Generated by [Claude
Code](https://claude.ai/code/session_01PxVsmvB9xfZKfVnUonY8kf)_
Co-authored-by: Claude <noreply@anthropic.com>
18ef9b4 to
f708797
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
90f3977 to
b0f9e4d
Compare
c78a4bb to
1438b2b
Compare
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Vite+ 1.3 adds `create-vite-plus`, so `npm create vite-plus@latest` starts a project without the global `vp`. It adds `vp pm pkg` for editing `package.json` and `vp pm licenses list` for dependency licenses, and lets `vp env` take package-manager dist-tags such as `pnpm@latest-10`. It also makes `vp migrate` import rewriting much faster on large projects and makes `vp dev` print Vite's `ready in` line and honor `--debug`, `--filter`, and `--profile`. ### Features - Create a Vite+ project without installing the global `vp` through `pnpm create vite-plus`, `npm create vite-plus@latest`, `yarn create vite-plus`, or `bun create vite-plus`, which run `vp create` with the same arguments ([docs](https://viteplus.dev/guide/create#without-the-global-cli)) ([#3028](#3028), [#3048](#3048)), by @liangmiQwQ. - `vp pm pkg get`, `set`, `delete`, and `fix` read and update `package.json` through the detected package manager: npm 7.20.0 and later (`fix` from 9.8.0), pnpm 11.3.0 and later, and Bun 1.2.19 and later ([docs](https://viteplus.dev/guide/package-management#package-manifest)) ([#3020](#3020)), by @jong-kyung. - `vp pm licenses list` (or `ls`) lists dependency licenses through pnpm 7.17.0 and later, Yarn Classic, or Bun 1.4.0 and later, with `--json` for machine-readable output ([#3037](#3037)), by @jong-kyung. - `vp env` accepts npm dist-tags in package-manager specs: `vp env pin pnpm@latest-10` pins the exact version the tag points to, and `vp env default pnpm@latest-10` follows the tag on each use ([#3047](#3047)), by @liangmiQwQ. - Upgrade the bundled tools ([#3058](#3058), [#3078](#3078)), by @voidzero-guard[bot] and @fengmk2: - `rolldown@1.2.13` to `rolldown@1.2.14`. Rolldown adds the `output.charset` option and fixes several tree-shaking, code-splitting, and renaming bugs. - `vitest@5.0.4` to `vitest@5.0.5`, with fixes for browser mode, hook cleanup after a failing hook, and `--changed` with quoted file names. ### Fixes & Enhancements - Import rewriting in `vp migrate` is up to 14 times faster on large projects, for example 78 s to 5.6 s on Dify ([#2987](#2987)), by @fengmk2. - `vp dev` prints Vite's `ready in N ms` line, so scripts that wait for it no longer time out after `vp migrate`. `--debug`, `--filter`, and `--profile` now take effect in `vp dev`, `vp build`, and `vp preview`, and `vp preview` stops when the build output is missing, as `vite preview` does ([#3056](#3056)), by @fengmk2. - `vp staged` prints one result line per task, such as `✔ vp check --fix`, instead of the task list and Git progress. Warnings, errors, and rollback results stay visible, `--verbose` shows task output, and `--debug` keeps the full log ([#3060](#3060)), by @fengmk2. - After a successful upgrade, `vp upgrade` reminds you to run `vp migrate` in projects that use an older Vite+ version ([#3063](#3063)), by @KTrain5169. - The coding agent picker in `vp create` and `vp migrate` lists Claude Code under `AGENTS.md` and no longer offers a separate `CLAUDE.md` option. `--agent claude` and existing `CLAUDE.md` files still work ([#3055](#3055)), by @fengmk2. ### Docs - Recommend setting `runtimeOnFail: ignore` and `pmOnFail: ignore` in the project's `pnpm-workspace.yaml` for pnpm 11 and later, since pnpm does not read `runtimeOnFail` from its global config ([#3077](#3077)), by @liangmiQwQ. ### Chore - Speed up CI with ThinLTO native test builds, a pinned prepacked Windows SDK, and a precompiled std for trampoline tests, keep dependencies in Cargo caches, switch Linux runners, and update Windows build pins with Renovate ([#3026](#3026), [#2995](#2995), [#3009](#3009), [#3000](#3000), [#3073](#3073), [#3049](#3049)), by @fengmk2. - Stabilize CLI snapshots during slow package-manager downloads, isolate Vitest browser and UI server ports, skip slow snapshot cases on Linux and Windows, and remove duplicate Rust unit tests ([#3043](#3043), [#3061](#3061), [#3059](#3059), [#3057](#3057)), by @fengmk2 and @Brooooooklyn. - Upgrade Rust crates and JavaScript dependencies, including `rustls@0.23.46` and `ast-grep@0.51.0`, and remove unused catalog entries ([#1780](#1780), [#1782](#1782), [#1783](#1783)), by @renovate[bot] and @fengmk2. - Refine the release-manager guidance ([#3052](#3052)), by @fengmk2. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | vite | `8.3.4` | [`b6c20f6`](vitejs/vite@b6c20f6) | unchanged | | rolldown | `1.2.14` | [`c9a8cda`](rolldown/rolldown@c9a8cda) | [1.2.14](https://github.com/rolldown/rolldown/releases/tag/v1.2.14) | | tsdown | `0.23.1` | [npm](https://npmx.dev/package/tsdown/v/0.23.1) | unchanged | | vitest | `5.0.5` | [npm](https://npmx.dev/package/vitest/v/5.0.5) | [5.0.5](https://github.com/vitest-dev/vitest/releases/tag/v5.0.5) | | oxlint | `1.88.0` | [npm](https://npmx.dev/package/oxlint/v/1.88.0) | unchanged | | oxlint-tsgolint | `7.0.2004` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2004) | unchanged | | oxfmt | `0.73.0` | [npm](https://npmx.dev/package/oxfmt/v/0.73.0) | unchanged | ### Upgrade ```bash vp upgrade ``` **Full Changelog**: v1.2.0...v1.3.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Update
junctionfrom1.4.2to2.1.0andzipfrom7.2.0to9.0.3. Updaterustlsto0.23.46to fix the reported TLS vulnerabilities.Update
ast-grep-config,ast-grep-core, andast-grep-languagefrom0.50.0to0.51.0. This removesserde_yamland the unmaintainedunsafe-libyamldependency.Keep
serial_teston3.5.0to preserve compatibility with the declared Rust minimum of1.92.0. Version4.0.1requires Rust1.93.1.