Skip to content

feat(deps): upgrade upstream dependencies#2210

Open
voidzero-guard[bot] wants to merge 1 commit into
mainfrom
deps/upstream-update
Open

feat(deps): upgrade upstream dependencies#2210
voidzero-guard[bot] wants to merge 1 commit into
mainfrom
deps/upstream-update

Conversation

@voidzero-guard

@voidzero-guard voidzero-guard Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Automated upgrade of upstream dependencies, headlined by the rolldown tag bump (f09947a -> v1.2.0) and the vite bump (a477454 -> v8.1.5).
  • tsdown moves 0.22.7 -> 0.22.12 (with @tsdown/css/@tsdown/exe), and the oxc/oxlint/oxfmt toolchain steps up (oxc 0.139.0 -> 0.140.0, oxlint 1.73.0 -> 1.74.0, oxfmt 0.58.0 -> 0.59.0).
  • Required code adjustments to the tsdown bundling in packages/core/build.ts, the @oxlint/migrate pin in the migrator, the regenerated NAPI bindings, plus Rust crate and pnpm catalog bumps.
  • Both build steps failed; see Build status.

Dependency updates

Package From To
rolldown f09947a v1.2.0 (03e1e34)
vite a477454 v8.1.5 (5e7fe12)
tsdown 0.22.7 0.22.12
@tsdown/css 0.22.7 0.22.12
@tsdown/exe 0.22.7 0.22.12
oxfmt 0.58.0 0.59.0
oxlint 1.73.0 1.74.0
oxlint-tsgolint 0.24.0 0.25.0
@oxc-project/runtime 0.139.0 0.140.0
@oxc-project/types 0.139.0 0.140.0
oxc-minify 0.139.0 0.140.0
oxc-parser 0.139.0 0.140.0
oxc-transform 0.139.0 0.140.0
@vitejs/devtools 0.4.0 0.4.1

Additional (Cargo / pnpm catalog) bumps not tracked in the version manifest:

Package From To
oxc (Rust) 0.139.0 0.140.0
oxc_resolver 11.23.0 11.24.2
itertools 0.14.0 0.15.0
jsonschema 0.46.5 0.47.0
phf 0.13.0 0.14.0
sugar_path 2.0.1 3
@napi-rs/cli 3.7.2 3.7.3
rolldown-plugin-dts 0.26.0 0.27.0
Unchanged dependencies
  • vitest: 4.1.10
  • @vitest/browser: 4.1.10
  • @vitest/browser-playwright: 4.1.10
  • @vitest/browser-preview: 4.1.10
  • @vitest/browser-webdriverio: 4.1.10
  • @vitest/expect: 4.1.10
  • @vitest/mocker: 4.1.10
  • @vitest/pretty-format: 4.1.10
  • @vitest/runner: 4.1.10
  • @vitest/snapshot: 4.1.10
  • @vitest/spy: 4.1.10
  • @vitest/utils: 4.1.10
  • lightningcss: ^1.32.0
  • @oxc-node/cli: 0.1.0
  • @oxc-node/core: 0.1.0
  • VITEST_VERSION constant: 4.1.10
  • README vitest pins: 4.1.10

Code changes

  • packages/cli/src/migration/migrator/eslint.ts: pin @oxlint/migrate to the bundled oxlint major (e.g. @1) instead of the exact version, so vp dlx resolves a published, compatible release when @oxlint/migrate lags a freshly released oxlint version.
  • packages/core/build.ts: ensure the branded tsdown logger chunk imports the color helpers (bold/red/yellow) it references, and rework the bundled @tsdown/css wiring to rely on rolldown's static-import chunking (asserting the CssPlugin chunk is imported) instead of rewriting the import("@tsdown/css") call site.
  • packages/cli/binding/index.d.cts: regenerated NAPI binding type declarations following the rolldown/vite bump (dev-engine client/payload APIs, BindingHmrUpdate shape, BindingRebuildStrategy enum, JsOutputChunk fields).
  • Cargo.toml: bump Rust dependencies alongside oxc 0.139 -> 0.140 (oxc_resolver, itertools, jsonschema, phf with macros, sugar_path).
  • pnpm-workspace.yaml: add @jridgewell/trace-mapping to the catalog, bump @napi-rs/cli and rolldown-plugin-dts, and drop the postcss-modules@9.0.0 patched dependency.

Build status

  • sync-remote-and-build: failure
  • build-upstream: failure

@voidzero-guard
feat(deps): upgrade upstream dependencies
c839b17 
- rolldown: f09947a -> v1.2.0 (03e1e34)
- vite: a477454 -> v8.1.5 (5e7fe12)
- tsdown: 0.22.7 -> 0.22.12
- @tsdown/css: 0.22.7 -> 0.22.12
- @tsdown/exe: 0.22.7 -> 0.22.12
- oxfmt: 0.58.0 -> 0.59.0
- oxlint: 1.73.0 -> 1.74.0
- oxlint-tsgolint: 0.24.0 -> 0.25.0
- @oxc-project/runtime: 0.139.0 -> 0.140.0
- @oxc-project/types: 0.139.0 -> 0.140.0
- oxc-minify: 0.139.0 -> 0.140.0
- oxc-parser: 0.139.0 -> 0.140.0
- oxc-transform: 0.139.0 -> 0.140.0
- @vitejs/devtools: 0.4.0 -> 0.4.1

Code changes:
- packages/cli/src/migration/migrator/eslint.ts: pin @oxlint/migrate to the
  bundled oxlint major instead of the exact version, so `vp dlx` resolves a
  published, compatible release when @oxlint/migrate lags a fresh oxlint bump.
- packages/core/build.ts: ensure the branded tsdown logger imports the color
  helpers (bold/red/yellow) it references, and rework the bundled `@tsdown/css`
  wiring to match rolldown's static-import chunking instead of rewriting the
  import site.
- packages/cli/binding/index.d.cts: regenerated NAPI binding type declarations
  following the rolldown/vite bump (dev-engine client APIs, HMR update shape,
  rebuild-strategy enum, chunk output fields).
- Cargo.toml: bump Rust deps alongside oxc 0.139 -> 0.140 (oxc_resolver
  11.23.0 -> 11.24.2, itertools 0.14 -> 0.15, jsonschema 0.46 -> 0.47,
  phf 0.13 -> 0.14 with macros, sugar_path 2 -> 3).
- pnpm-workspace.yaml: add @jridgewell/trace-mapping to the catalog, bump
  @napi-rs/cli (3.7.2 -> 3.7.3) and rolldown-plugin-dts (0.26 -> 0.27), and
  drop the postcss-modules@9.0.0 patchedDependency.
@netlify

netlify Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for viteplus-preview canceled.

Name Link
🔨 Latest commit c839b17
🔍 Latest deploy log https://app.netlify.com/projects/viteplus-preview/deploys/6a5ed7397b28ad0008945ce5

@socket-security

socket-security Bot commented Jul 21, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​tsdown/​exe@​0.22.12721007398100
Addednpm/​typescript-eslint@​8.64.01001007498100
Addednpm/​@​vitejs/​devtools@​0.4.1771007497100
Addednpm/​@​tsdown/​css@​0.22.12751008098100
Addednpm/​@​oxc-project/​runtime@​0.140.01001007596100
Addednpm/​@​vitejs/​release-scripts@​1.8.0831008190100
Addednpm/​@​napi-rs/​cli@​3.7.3921008596100
Addednpm/​oxfmt@​0.59.0861008996100
Addednpm/​tsdown@​0.22.12981008898100
Addednpm/​oxc-transform@​0.140.0911009695100
Addednpm/​oxlint-tsgolint@​0.25.0991009693100
Addednpm/​eslint-plugin-n@​18.2.29910010093100
Updatedcargo/​oxc_allocator@​0.139.0 ⏵ 0.140.010010093100100
Updatedcargo/​oxc_ast@​0.139.0 ⏵ 0.140.010010093100100
Updatedcargo/​oxc_parser@​0.139.0 ⏵ 0.140.010010093100100
Updatedcargo/​oxc_resolver@​11.23.0 ⏵ 11.24.29710093100100
Updatedcargo/​oxc_span@​0.139.0 ⏵ 0.140.010010093100100

View full report

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Native binary sizes (c839b17)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact Format Base PR Change
vp (Linux x64) Binary 10.32 MiB 10.32 MiB 0 B (0.00%)
vp (Linux x64) gzip -9 4.42 MiB 4.42 MiB +692 B (+0.01%)
NAPI (Linux x64) Binary 33.46 MiB 33.35 MiB -112.19 KiB (-0.33%)
NAPI (Linux x64) gzip -9 12.80 MiB 12.77 MiB -23.84 KiB (-0.18%)
vp (macOS ARM64) Binary 7.65 MiB 7.65 MiB 0 B (0.00%)
vp (macOS ARM64) gzip -9 3.83 MiB 3.83 MiB +1.17 KiB (+0.03%)
NAPI (macOS ARM64) Binary 40.73 MiB 40.64 MiB -96.91 KiB (-0.23%)
NAPI (macOS ARM64) gzip -9 17.03 MiB 17.01 MiB -21.11 KiB (-0.12%)
vp (Windows x64) Binary 8.37 MiB 8.37 MiB +1.50 KiB (+0.02%)
vp (Windows x64) gzip -9 3.64 MiB 3.64 MiB +350 B (+0.01%)
NAPI (Windows x64) Binary 27.78 MiB 27.67 MiB -110.50 KiB (-0.39%)
NAPI (Windows x64) gzip -9 10.74 MiB 10.72 MiB -25.31 KiB (-0.23%)
Trampoline (Windows x64) Binary 203.00 KiB 203.00 KiB 0 B (0.00%)
Trampoline (Windows x64) gzip -9 97.91 KiB 97.91 KiB -1 B (-0.00%)
Installer (Windows x64) Binary 4.46 MiB 4.46 MiB 0 B (0.00%)
Installer (Windows x64) gzip -9 2.08 MiB 2.08 MiB +1 B (+0.00%)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants