[dependabot]

Bumps the tooling group with 4 updates: @e2e-dev/web, e2e, knip and vite-plus.

Updates @e2e-dev/web from 0.15.2 to 0.15.3

Changelog

Sourced from @​e2e-dev/web's changelog.

0.15.3

Patch Changes

• #1041 491199e Thanks @​rudycelekli! - Add browser.unrouteAll to clear every route registered through the browser fixture while preserving configured site headers.

• #1275 6a59d1a Thanks @​kacperkapusciak! - Update dependencies: the web engine drives Playwright 1.64.1 (and the Chromium it installs), and smol machines boot the matching mcr.microsoft.com/playwright:v1.64.1-noble image. The runner moves to oxc-parser, oxc-transform, and @oxc-project/runtime 0.154.0, @vitest/expect 5.0.5, and @ai-sdk/provider 4.0.28.

• #1050 f7c7672 Thanks @​rudycelekli! - Expose the native dialog kind to browser.onDialog handlers.

• #900 d7a6518 Thanks @​rudycelekli! - Exclude explicitly hidden select options before applying the observation choice limit, retaining normal closed-select choices and disabled states.

• #1049 137b50f Thanks @​rudycelekli! - Add locator.or(other), which matches either locator in document order and stays strict when both match. Third-party engines must handle the new union kind of LocatorExpression.

• #1320 c23944c Thanks @​kblok! - Keep a Playwright timeout an OPERATION_TIMEOUT when its call log mentions a detached element or a navigation, instead of reporting a retryable NODE_STALE.

• #1022 ff3bf39 Thanks @​Bortlesboat! - Allow browser.waitForResponse before the first browser.goto or app.open.

• #871 f56be22 Thanks @​nvtoan0201-swe! - The tree ignores role="presentation" and role="none" on a focusable element or one with a global ARIA attribute, and keeps an <img alt=""> with a title, tabindex, or global ARIA attribute an image, matching getByRole.

• #1209 ef977f4 Thanks @​knowbody! - Engine disposal receives optional revocable permission to preserve run-owned resources for a replacement worker. Final shutdown, forced termination, and parent disconnect revoke that permission while disposal is pending. Each worker still invokes an engine's disposal hook one time. Missing permission requests final cleanup, including direct and standalone calls.

Commits

• 69e123b chore: version packages (#1346)
• 137b50f feat(locator): combine alternatives with or (#1049)
• f56be22 fix(web): a presentational role is ignored on focusable controls and named im...
• d7a6518 fix(web): exclude hidden select choices before observation limits (#900)
• c23944c fix(web): keep a timeout a timeout in staleOr and navigationStaleOr (#1320)
• 6a59d1a chore(deps): batch Dependabot updates (Playwright 1.64.1, oxc 0.154) (#1275)
• 491199e feat(web): clear all browser fixture routes (#1041)
• f7c7672 feat(web): expose native dialog kinds to handlers (#1050)
• ff3bf39 fix(web): observe responses before the first navigation (#1022)
• See full diff in compare view

Updates e2e from 0.21.2 to 0.21.3

Changelog

Sourced from e2e's changelog.

0.21.3

Patch Changes

• #1219 f589a32 Thanks @​okwasniewski! - Add onAction to agent.act: a hook that runs after each action once the screen settles, for replayed actions too. Use it to take a screenshot per action.

• #1326 04acca1 Thanks @​okwasniewski! - app.screenshot() returns the absolute path of the file it wrote, not a path relative to the attempt directory.

• #1218 58a5cec Thanks @​okwasniewski! - Keep screenshots after a secret fill. app.screenshot(), toHaveScreenshot(), and assertion and failure screenshots no longer stop once a test fills a secret. They mask secure fields only, and toHaveScreenshot() still fails when the engine can't prove they are masked. The model still gets no pixels after a fill.

• #1072 689620d Thanks @​rudycelekli! - Do not report a cache entry as evicted when a custom store rejects its deletion.

• #1310 329e03f Thanks @​kacperkapusciak! - Add --action-timeout <ms> and --assertion-timeout <ms> to e2e run. They replace the config's actionTimeout and assertionTimeout for one run, so a wrong locator can fail in 5 s instead of 30 s while you write a test. A call's own timeout still wins, and a value that is not an integer from 1 through 2147483647 is a usage error, exit 2. Watch mode keeps them for every rerun.

• #1240 332b934 Thanks @​kacperkapusciak! - Add e2e upgrade (alias e2e update): upgrades e2e to the latest release, a dist-tag such as nightly, or one version, and moves each @e2e-dev/* package the project lists from the registry to the newest release whose peer ranges accept it. Linked packages and ones the registry doesn't have stay as they are. The project's package manager installs them; --dry-run prints the plan. Each upgrade sends an e2e_upgrade_completed telemetry event with the result and the e2e versions before and after. The update notice now suggests e2e upgrade instead of an install command for e2e alone.

• #1321 72abddd Thanks @​KrzysztofMoch! - The e2e plugin now installs in Cursor, from a copy in ~/.cursor/plugins/local/, with the same three skills as the Claude Code and Codex plugin. Grok Build reads the Claude Code files, so the repository works there as a marketplace too.

• #1345 47127f7 Thanks @​okwasniewski! - decisionFilter leaves nothing out when the config file the run loaded changed, whatever its name, such as e2e list --config e2e.ci.config.ts --changed-since origin/main after an edit to e2e.ci.config.ts. A test filter reads that file as context.configFile.

• #1275 6a59d1a Thanks @​kacperkapusciak! - Update dependencies: the web engine drives Playwright 1.64.1 (and the Chromium it installs), and smol machines boot the matching mcr.microsoft.com/playwright:v1.64.1-noble image. The runner moves to oxc-parser, oxc-transform, and @oxc-project/runtime 0.154.0, @vitest/expect 5.0.5, and @ai-sdk/provider 4.0.28.

• #1286 a39c1c3 Thanks @​KrzysztofMoch! - expect(await response.json()).toMatchSchema(schema) type-checks: expect no longer hands the engine's json<T>() a locator type to infer, so the value matchers apply.

• #1252 3bd32ef Thanks @​KrzysztofMoch! - e2e explore and the MCP open_session now launch a device target's pinned app before their first observation, as a test's app.open() does. They no longer depend on the engine's warm-up having opened it, which it skips for a target with an app.appPath, and used to fail with APP_NOT_OPEN.

• #1306 3df649c Thanks @​knowbody! - Let retiring workers use the configured cleanup timeout for engine disposal so cleanup can finish and report errors before the worker exits.

• #1318 bbb13bf Thanks @​kacperkapusciak! - e2e init --example <name> starts a new project from one of the repository's example apps (with-vite, with-next, with-astro, with-expo, with-swiftui, with-compose, with-kotlin-multiplatform, with-flutter, with-maui). It downloads the example from the GitHub tag of the running CLI into an empty directory, points its e2e and engine ranges at this release, and then runs the usual skill, MCP, and install steps in the example's e2e project.

• #1280 1071933 Thanks @​kacperkapusciak! - Find e2e.config.js and e2e.config.mjs as well as e2e.config.ts and e2e.config.mts, so a project written in plain JavaScript needs no --config flag. A TypeScript config still wins in its directory, so the e2e.config.js that tsc emits beside it is ignored. e2e init leaves an existing JavaScript config alone and writes its example test as tests/example.e2e.js, and a run that finds only *.e2e.js files names the tests glob to set. The quickstart shows the JavaScript setup, and the config reference the details.

• #1317 9ceb071 Thanks @​kacperkapusciak! - Every action in an e2e mcp session now answers with the test line that repeats it, such as Test line: await screen.getByRole("button", "Save").tap();, so a coding agent can write the test while it walks the flow. The locator comes from the node as the agent saw it and is checked against the live screen first: it must match that node and nothing else, and twins are narrowed with { visible: true }, a container, or .nth(). When no locator works, the result says why and prints no line. Fills name credentials.user(name) or secrets.get(name), never a value. The new read-only test_lines catalog tool returns the session's lines in order as a draft test body. A project tool can no longer be named test_lines, and the e2e_mcp_session telemetry event counts its calls under its own name.

• #973 93f77d8 Thanks @​A220man! - A model that refuses a request (finish reason content-filter) now fails the step as MODEL_REFUSED instead of MODEL_PROVIDER_FAILED with "No output generated". Rephrase the instruction or use another model.

• #1284 90e6fb8 Thanks @​KrzysztofMoch! - tap_at and hover_at, in agent.act and e2e mcp, now act on the bare point the model aimed at whenever the engine takes one, instead of snapping to the listed control under it and acting on that control's center. Before, a point outside an iOS popover snapped to the full-screen dismiss region and tapped its center, inside the popover, so the popover never closed. An engine that taps listed nodes only still gets the control by id.

• #1049 137b50f Thanks @​rudycelekli! - Add locator.or(other), which matches either locator in document order and stays strict when both match. Third-party engines must handle the new union kind of LocatorExpression.

• #1151 84bd64a Thanks @​TheTuso! - Agent steps on Claude Opus 5.5, Sonnet 5.5, and Fable 5.1 no longer fail with Invalid signature in thinking block. The block is bound to a different conversation on a worker's first step or after an earlier screen or screenshot was elided.

• #1301 82039ad Thanks @​nguyenvanhieu1710! - Record observationTruncated: true on an agent step when any semantic observation in the step was incomplete.

• #1239 d7ec0ec Thanks @​okwasniewski! - Add screen.tree() and screen.debug(). tree() returns the whole screen as the agent reads it, one node per line with secrets redacted. debug() prints the same text to the test's output.

• #1314 b8cb0b3 Thanks @​kacperkapusciak! - The bundled agent skill now gives a coding agent a fast loop for fixing a test: rerun only that test by file:line with --action-timeout 5000, keep the replay cache on so goals that passed replay without model calls, add --retries 0 when the config sets retries, don't rename the test or reword a passing goal mid-loop, and, when the test passes, run it one time with --no-cache. The coding agents guide no longer tells agents to add --no-cache after every change, and the caching guide has a section on rerunning a test while you fix it.

• #1309 c5e3248 Thanks @​kacperkapusciak! - The e2e skill now tells a coding agent how to fix a failed test. It fixes from the terminal's failure block and the trace page, every line that evidence covers at once, and checks the lines after the failure before the next run. To see a screen the evidence leaves out, it goes straight there in an MCP session instead of walking the flow again from the start.

... (truncated)

Commits

• 69e123b chore: version packages (#1346)
• af1ebd5 fix(agent): keep the test title out of the system prompt so prompt caching sp...
• 47127f7 fix(decision): leave nothing out when the loaded config changes (#1345)
• 90e6fb8 fix(agent): tap_at and hover_at send the bare point when the engine takes one...
• da13624 feat(runner): run only the tests a pull request can affect (#1206)
• 7e72ea2 fix(runner): validate numeric SDK list shards (#996)
• 137b50f feat(locator): combine alternatives with or (#1049)
• e62486d docs(quickstart): list the common config options (#1332)
• 0f6c3ef feat(e2e): put the test title in agent context (#1323)
• 689620d fix(cache): report eviction only after store deletion succeeds (#1072)
• Additional commits viewable in compare view

Updates knip from 6.42.1 to 6.43.0

Release notes

Sourced from knip's releases.

Release 6.43.0

• Document and pin exports that only keep each other alive (#2160) (39af70abb32523a992a7d6152b8cd95ef317f237)
• Don't add config files without an extension as entry files (resolve #2168) (46a825ddf15d3073b899ed6ef34689e5da5508f2)
• Recognize unscoped ~name workspace packages (resolve #2172) (ba527f7386e7741507f2f18d84864058e02ac907)
• Follow imports and re-exports in ambient modules (resolve #2174) (dbd3a8b8b0429433e5385371c09e805b808a32c2) - thanks @​tlq5l!
• Follow @reference in Tailwind CSS compiler (#2177) (219f16de95e174cdcfd6a90782bcef13cf79bd64) - thanks @​mkantautas!
• Support { find, replacement } array form of Vite alias (#2179) (5d0779bc4cf8c0469c50d5b2cda1a6bd1f053d81) - thanks @​mkantautas!
• fix(expo): treat local config plugins as entry files (#2176) (100ef491509a88b00ea9956ba40dbc1b0ac0c205) - thanks @​Cayan!
• fix(next): detect Turbopack loaders in shared config factories (#2161) (9cf928be5022928a38c12fe8001cec7bf467040c) - thanks @​jakeleventhal!
• Ignore osascript as global binary (#2182) (c301e44c7975442d4d25595f084e6b853f07a434) - thanks @​abrahamguo!
• Skip --fix for exports in multi-declarator variable statements (#2178) (326afd9c1e66eef04d986b83ed829b506f506c48) - thanks @​mkantautas!
• Watch the project directory instead of process.cwd() (#2183) (16d9932d0239f649cf2c1349cc7bc893850cd4f0) - thanks @​abrahamguo!
• Follow directory paths in tsconfig references (#2186) (d741c46e3f2a9caaf6bf4e81e9d4c8cfca48623e) - thanks @​mkantautas!
• Handle @plugin options blocks in Tailwind CSS compiler (#2187) (9fae773eb75bcba03e62f44ce3e9aa0b889bf4ac) - thanks @​mkantautas!
• Remove anonymous default-exported functions and classes in --fix (#2188) (6748259fbb2ea9a5940ea3861626f77677610a86) - thanks @​mkantautas!
• Recognize bun fmt as a built-in command (#2189) (e971b0924bcb7ff8dcab01a180d3016cc08b675d) - thanks @​TomasHubelbauer!
• Add plugin for @​bufbuild/buf (#2142) (90216c261c2273967125669beb611bf763d762c7) - thanks @​ryanquinn3!
• Pass isSsrBuild to Vite config functions (#2191) (d2aa101c55e5d7e8d26548808ce008b214622099) - thanks @​mkantautas!
• Follow src of <script> and <style> blocks in Vue SFCs (#2193) (3d148393d5129a096a182fab36a873b9f710f388) - thanks @​mkantautas!
• Remove import attributes with emptied re-exports in --fix (#2192) (231026cf9c21cc7890f21d048f4af6ea7233d7b8) - thanks @​mkantautas!
• Update npmx.dev snapshot (b2cc439006ec98ff5bbc1c99b99bc1ac5203b6b2)
• Read string parserOptions.parser in ESLint flat configs (#2198) (302f908aa135669d6fe96869ec6452b7570856a4) - thanks @​mkantautas!
• Resolve directory matches in Vitest test.projects to their config (#2195) (4d386138011c27e01e6e910be6d58266e07c9cf1) - thanks @​fixfon!
• Ignore custom elements named script-* when extracting script blocks (#2199) (23e6479b233e1882ddaf29736390309d0f3f040f) - thanks @​mkantautas!
• feat(mcp): add MCP plugin (#2180) (fc92470a9f687e2f1da60b84612ebf3e59a8bbb9) - thanks @​jakeleventhal!
• Handle non-Error plugin config failures (8f21ea2182fac5a96edd7d6d4280a0fa1051e434)
• Update articles list (6569cdcde1a79a6196a35a934b6c0d9d0e23faa4)
• Skip --fix export ranges inside a larger removal (204a8091baf91cb8cfb4e7a9aa70d461cc926baa)
• Detect .travis.yml with a stat instead of a glob (3601c6e32afef3d1d76a3944e540225da5190b9b)
• Mark YAML catalog entries fixed only when their line is removed (#2201) (813fa30e55ef3a8ed749d9d6d5a02a00810cfe72) - thanks @​mkantautas!
• Add Electron Forge plugin (#2158) (12e4355a43ea63c417d3b9ebfbbac1c8510b139e) - thanks @​mehdimirzafaruk!
• Resolve function and promise entries in Vitest test.projects (#2197) (ec293d1a33d30a8b0521725d1148e6e72c6e4220) - thanks @​mkantautas!
• Follow npm lifecycle scripts and run-script aliases (#2202) (89dfdc881e6865aef326c2b9dc700cf5c46b73b4) - thanks @​sushanta-neupane!
• Follow pnpm t, tst and run-script aliases (ce91e230e0823433dfcc1ee4562335c34d2b73ef)
• Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils) (db9aa7443c5b3839df5c0fe320d78ea42f0f3446)
• Ignore tool output before the first report section in ecosystem snapshots (9434bf678e60d16832f13e892d7c1ebc2b9e6ed1)
• Update dependencies (21c3b75fc4ae94208311abb630ff129fcd9fe820)
• Bump engines.node to follow Astro's (9d7a5e07212b093f9d422cab813fad5d01273fc6)

Commits

• 0712156 Release knip@6.43.0
• 21c3b75 Update dependencies
• db9aa74 Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils)
• ce91e23 Follow pnpm t, tst and run-script aliases
• 89dfdc8 Follow npm lifecycle scripts and run-script aliases (#2202)
• ec293d1 Resolve function and promise entries in Vitest test.projects (#2197)
• 12e4355 Add Electron Forge plugin (#2158)
• 813fa30 Mark YAML catalog entries fixed only when their line is removed (#2201)
• 3601c6e Detect .travis.yml with a stat instead of a glob
• 204a809 Skip --fix export ranges inside a larger removal
• Additional commits viewable in compare view

Updates vite-plus from 1.3.0 to 1.4.0

Release notes

Sourced from vite-plus's releases.

vite-plus v1.4.0

Vite+ 1.4 runs TypeScript and JavaScript files with vpx, and vp migrate can move tsx scripts to it. It also adds vp check --deny-warnings and vp pm team, and installs the global CLI's dependencies from a lockfile published with each release.

Features

• vpx <file> runs a TypeScript or JavaScript file on the project's Node.js with the oxc-node loader that ships with Vite+, and vpx --watch <file> reruns it when a file it uses changes. In package.json scripts, the vpx bin of the vite-plus package runs scripts without the global CLI and runs package binaries only from node_modules/.bin, pointing to vp dlx for anything not installed (docs) (#2936, #3164), by @​Brooooooklyn and @​fengmk2.
• vp migrate offers to move tsx scripts to vpx: tsx a.ts, npx tsx a.ts, node --import tsx a.ts, and tsx watch a.ts in package.json scripts, lint-staged tasks, and #!/usr/bin/env tsx shebangs become vpx a.ts or vpx --watch a.ts. A project already on Vite+ gets the offer with vp migrate --full (docs) (#3179), by @​fengmk2.
• vp check --deny-warnings fails the check on lint warnings, so CI no longer needs a separate vp lint --deny-warnings run (docs) (#3075), by @​acalvino4.
• vp pm team creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun (#3040), by @​jong-kyung.
• Security: vp no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades (RUSTSEC-2026-0382, RUSTSEC-2026-0383), and it ships tokio 1.54.1, which fixes a race in tokio::time::Interval (RUSTSEC-2026-0384) (#3159, #3202), by @​wan9chi and @​fengmk2.
• vp pm registry commands (login, logout, whoami, owner, token, dist-tag, deprecate, search, ping, and publish) run pnpm's own commands on pnpm 11 and later (token from 12.13.0), and vp pm owner and vp pm publish run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm (#3044), by @​jong-kyung.
• The installer and vp upgrade install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to resolve them again if that installation fails (docs) (#3117), by @​fengmk2.
• Upgrade the bundled tools (#3133, #3158, #3175), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.4 to vite@8.3.5, with fixes for bundled dev mode, chunk import maps, CSS url() values containing %, and subpath imports with several # characters.
  • rolldown@1.2.14 to rolldown@1.2.15, with fixes for this.resolve recursion between plugins using skipSelf: true, strict execution order, and chunk import maps.
  • oxlint@1.88.0 to oxlint@1.89.0, with rule fixes that report cases missed before, for example in prefer-const, no-param-reassign, and sort-imports.
  • oxfmt@0.73.0 to oxfmt@0.74.0, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown.
  • The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
  • vpx scripts run on oxc-node@1.0.0.
  • @vitejs/devtools 0.8 is accepted as a peer dependency, alongside 0.7.

Fixes & Enhancements

• The standalone vp executable binary size is ~30% smaller (#3086), by @​fengmk2.
• VP_SETUP_NODE_VERSION selects the Node.js version the installer uses for the CLI's dependencies, so setup-vp can use the project's version and avoid downloading a second Node.js in CI (docs) (#3087), by @​fengmk2.
• When tasks miss the cache, vp run finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again (vite-task#871), by @​magurotuna.
• Cached tasks no longer miss the cache when only pnpm's node_modules/.modules.yaml differs, for example after installing with another pnpm version, with --ignore-scripts, or on glibc and musl machines (vite-task#850), by @​wan9chi.
• vp run in a package that sits inside a workspace folder but is not listed in its pnpm-workspace.yaml packages or package.json workspaces runs that package's own tasks with its own packageManager, instead of treating the enclosing workspace as its root (vite-task#859), by @​liangmiQwQ.
• A mistyped or misplaced task setting fails with an error that names it, such as unknown field outputs, instead of data did not match any variant of untagged enum UserTaskDefinition (vite-task#815), by @​tlq5l.
• vp run no longer panics on scripts that contain non-ASCII characters, such as echo こんにちは, and no longer cuts those commands off in its output (vite-task#861), by @​magurotuna.
• In cached tasks on Linux and macOS, programs that pass -1 as a directory descriptor, such as ps -p <pid> from procps-ng 4.0.6 and later, no longer abort (vite-task#862), by @​magurotuna.
• On Linux, cached tasks such as pnpm dlx no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup (vite-task#854), by @​fengmk2.
• On Windows, vp run and the global vpx wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately (#3167), by @​fengmk2.
• vp migrate and the prefer-vite-plus-imports lint autofix leave vite/rolldown and vite/rolldown/* imports unchanged, instead of rewriting them to vite-plus/rolldown subpaths that vite-plus does not export (#3070, #3191), by @​Crimson341 and @​Dunqing.
• vp migrate keeps existing .nvmrc files instead of converting them to .node-version, so nvm, fnm, and other tools that read .nvmrc keep working and the selected Node.js version does not change (#3126), by @​liangmiQwQ.
• vp migrate converts Oxlint configs that extends shared JSON files into TypeScript modules imported through lint.extends, so the inherited rules keep applying after migration (#3097), by @​fengmk2.
• vp migrate skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting (#3118), by @​0froq.
• vp migrate keeps the workspace members declared in package.json workspaces when it selects pnpm for a project without a lockfile, so recursive commands still include them (#2863), by @​SaKaNa-Y.
• vp migrate no longer reports unawaited-assertion for a local assertion promise that the function later awaits or returns (#3180), by @​fengmk2.
• pnpm create vite-plus and yarn create vite-plus no longer fail during dependency installation when vp is not on PATH, and no longer run a different global vp version for installation, formatting, and hooks (#3181), by @​fengmk2.
• vp create and vp migrate resolve the npm registry and credentials as npm does: a .npmrc above the project is no longer read, userconfig and globalconfig are honored, and registry hosts in credential keys match regardless of case (#3124), by @​liangmiQwQ.
• vp pack and vp create find the monorepo root the same way as vp run and vp install, and vp pack at a monorepo root without a vite.config no longer picks up a config from the directory above (#3101), by @​liangmiQwQ.
• defineConfig keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as vike(), work under Vite+ (#3154), by @​liangmiQwQ.
• vp dev with experimental.bundledDev no longer fails with ERR_MODULE_NOT_FOUND when no separate rolldown package is installed, and no longer picks up the runtime of an unrelated installed rolldown (#3111), by @​fengmk2.
• With nodeShimMode: system_first, vp node and vp env exec run the system tool that the shell would find, instead of downloading and running the managed Node.js (#3100), by @​liangmiQwQ.
• VP_NODE_VERSION=22 and other partial versions resolve to an exact release in vp env install, vp env exec, and vp env clean, instead of failing with a 404 download error (#3038), by @​Dev-next-gen.
• vp env pin and vp env unpin show the file and field they changed. Package-manager pins from a workspace member update the workspace root package.json, and the help and guide now say so (#3103), by @​SaKaNa-Y.
• In PowerShell, a bare -- reaches vp again, so vp create vite -- --template react-ts forwards --template to create-vite (#3083), by @​fengmk2.
• Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ env.nu calls, such as update. Run vp env setup again to regenerate env.nu (#3123), by @​naokihaba.
• Package-manager commands reject options that the selected version would silently ignore, such as --dry-run or --provenance with an npm whose version is unknown, instead of running without them (#3122), by @​jong-kyung.

... (truncated)

Commits

• 102fe8e release: v1.4.0 (#3201)
• b2abe27 fix(create): run child commands without a global vp (#3181)
• c891e5d feat(migrate): migrate tsx scripts to vpx (#3179)
• 0a96bd9 fix(lint): keep vite/rolldown imports in prefer-vite-plus-imports (#3191)
• cbb9fee fix(migrate): recognize awaited local assertion promises (#3180)
• 74c8d18 refactor(cli): share clap error diagnostics (#3172)
• 2162b28 feat(deps): upgrade upstream dependencies (#3175)
• f8d9da8 fix(cli): keep own properties of promise plugins in defineConfig (#3154)
• 0445f73 refactor(migrate): remove redundant git hooks wrapper (#3173)
• 13ac064 fix(vpx): handle --experimental-config-file and Windows Ctrl+C (#3167)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions