fix(install): share the Node 24 pin with development and CI by fengmk2 · Pull Request #3269 · voidzero-dev/vite-plus

fengmk2 · 2026-10-29T06:00:46Z

The root .node-version pins Node.js 24.22.1 for development, CI, and installation of global CLI dependencies. Each release embeds this installation default at build time. Runtime commands retain their existing selection order and latest LTS fallback.

.github/workflows/upgrade-deps.yml updates the pin to the latest stable 24.x release. Nix follows the major; flake.lock controls its exact package version. Snapshot tests reuse prewarmed runtimes, including version ranges and the lts and latest aliases.

Platform packages publish the same pin as vpNodeVersion. vp upgrade reads this field and installs dependencies with the target release's Node.js version before activation. Missing metadata uses the running binary's embedded installation default. Invalid or incompatible pins stop the upgrade. Older clients keep their existing behavior.

flowchart LR
    subgraph Build["Release build"]
        A[".node-version"] --> B["Native vp<br/>Embedded installation Node pin"]
        A --> M["Platform package metadata<br/>vpNodeVersion"]
    end

    subgraph Install["Default installation"]
        C["install.sh<br/>Download target vp"] --> D["Target self-setup<br/>Use installation Node pin"]
    end

    subgraph Upgrade["vp upgrade"]
        U["Resolve target version<br/>Read platform metadata"] --> P["Install dependencies<br/>Use target Node pin"]
        P -->|"Success"| S["Activate target binary"]
    end

    B --> C
    B -->|"Target artifact"| U
    M --> U

cloudflare-workers-and-pages · 2026-10-29T06:01:15Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://fix-pin-default-node-24-viteplus-dev.voidzero-docs.workers.dev (commit `44f7ed9`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://9d8f1cc0-viteplus-dev.voidzero-docs.workers.dev	`44f7ed9`	2026-10-30T03:36:00.810Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://33004f26-viteplus-dev.voidzero-docs.workers.dev	`a92f303`	2026-10-30T02:12:18.473Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://d16d54b6-viteplus-dev.voidzero-docs.workers.dev	`da97d07`	2026-10-30T02:07:25.795Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://885b9966-viteplus-dev.voidzero-docs.workers.dev	`9850556`	2026-10-30T01:56:57.111Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://9533f2bb-viteplus-dev.voidzero-docs.workers.dev	`c4533d1`	2026-10-30T01:22:05.708Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://0c52db0a-viteplus-dev.voidzero-docs.workers.dev	`8c63847`	2026-10-30T01:13:08.342Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://2db64a84-viteplus-dev.voidzero-docs.workers.dev	`57987ee`	2026-10-29T14:36:21.818Z	Visit the dashboard ↗
Build: In progress 🔵 View logs ↗		`3c67091`	2026-10-29T14:12:52.854Z	View logs ↗
Build: In progress 🔵 View logs ↗		`e09f799`	2026-10-29T14:06:24.428Z	View logs ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://07944244-viteplus-dev.voidzero-docs.workers.dev	`5ccc08e`	2026-10-29T13:49:23.890Z	Visit the dashboard ↗

View all previews: View all previews ↗

github-actions · 2026-10-29T06:02:49Z

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: a92f303

github-actions · 2026-10-29T06:13:35Z

CLI artifact sizes (`44f7ed9`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.
The dist rows use the Linux build. The core total excludes .node files to match the release artifact.

Artifact	Format	Base	PR	Change
`packages/cli/dist`	Directory total	2.26 MiB	2.26 MiB	0 B (0.00%)
`packages/core/dist`	Directory total	4.07 MiB	4.07 MiB	0 B (0.00%)
Combined package dist	Directory total	6.34 MiB	6.34 MiB	0 B (0.00%)
`vp` (Linux x64)	Binary	8.27 MiB	8.26 MiB	-8.00 KiB (-0.09%)
`vp` (Linux x64)	gzip -9	3.78 MiB	3.77 MiB	-2.50 KiB (-0.06%)
NAPI (Linux x64)	Binary	35.53 MiB	35.53 MiB	0 B (0.00%)
NAPI (Linux x64)	gzip -9	14.15 MiB	14.15 MiB	0 B (0.00%)
`vp` (macOS ARM64)	Binary	5.39 MiB	5.39 MiB	-64 B (-0.00%)
`vp` (macOS ARM64)	gzip -9	3.21 MiB	3.21 MiB	-2.41 KiB (-0.07%)
NAPI (macOS ARM64)	Binary	42.30 MiB	42.30 MiB	0 B (0.00%)
NAPI (macOS ARM64)	gzip -9	18.29 MiB	18.29 MiB	0 B (0.00%)
`vp` (Windows x64)	Binary	6.12 MiB	6.12 MiB	-6.50 KiB (-0.10%)
`vp` (Windows x64)	gzip -9	2.83 MiB	2.83 MiB	-1.09 KiB (-0.04%)
NAPI (Windows x64)	Binary	31.55 MiB	31.55 MiB	0 B (0.00%)
NAPI (Windows x64)	gzip -9	12.85 MiB	12.85 MiB	+2 B (+0.00%)
Trampoline (Windows x64)	Binary	13.50 KiB	13.50 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	7.09 KiB	7.09 KiB	+1 B (+0.01%)
Installer (Windows x64)	Binary	4.68 MiB	4.65 MiB	-30.50 KiB (-0.64%)
Installer (Windows x64)	gzip -9	2.24 MiB	2.23 MiB	-13.71 KiB (-0.60%)

github-actions · 2026-10-29T15:14:48Z

Preview binary sizes (`a92f303`)

Compared with the latest stable release, v1.4.0. Preview build.
Each row measures one binary. Negative changes mean a smaller preview binary.

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	5.38 MiB	5.39 MiB	+16.31 KiB (+0.30%)
NAPI (macOS ARM64)	42.20 MiB	42.27 MiB	+64.55 KiB (+0.15%)
`vp` (macOS x64)	6.82 MiB	6.85 MiB	+32.12 KiB (+0.46%)
NAPI (macOS x64)	47.34 MiB	47.42 MiB	+84.12 KiB (+0.17%)
`vp` (Linux ARM64 GNU)	6.81 MiB	6.84 MiB	+24.05 KiB (+0.34%)
NAPI (Linux ARM64 GNU)	31.44 MiB	31.53 MiB	+87.25 KiB (+0.27%)
`vp` (Linux ARM64 musl)	6.88 MiB	6.91 MiB	+28.93 KiB (+0.41%)
NAPI (Linux ARM64 musl)	30.67 MiB	30.71 MiB	+43.19 KiB (+0.14%)
`vp` (Linux x64 GNU)	8.22 MiB	8.26 MiB	+36.05 KiB (+0.43%)
NAPI (Linux x64 GNU)	35.45 MiB	35.53 MiB	+79.31 KiB (+0.22%)
`vp` (Linux x64 musl)	8.29 MiB	8.33 MiB	+40.65 KiB (+0.48%)
NAPI (Linux x64 musl)	34.43 MiB	34.49 MiB	+52.38 KiB (+0.15%)
`vp` (Windows x64)	6.09 MiB	6.12 MiB	+26.50 KiB (+0.42%)
NAPI (Windows x64)	31.16 MiB	31.21 MiB	+49.00 KiB (+0.15%)
Trampoline (Windows x64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows x64)	4.67 MiB	4.66 MiB	-16.00 KiB (-0.33%)
`vp` (Windows ARM64)	5.33 MiB	5.36 MiB	+29.00 KiB (+0.53%)
NAPI (Windows ARM64)	27.57 MiB	27.60 MiB	+38.50 KiB (+0.14%)
Trampoline (Windows ARM64)	13.00 KiB	13.00 KiB	0 B (0.00%)
Installer (Windows ARM64)	3.85 MiB	3.83 MiB	-16.00 KiB (-0.41%)

gzip -9 sizes

Binary	Latest release	Preview	Change
`vp` (macOS ARM64)	3.20 MiB	3.21 MiB	+14.20 KiB (+0.43%)
NAPI (macOS ARM64)	18.25 MiB	18.28 MiB	+28.18 KiB (+0.15%)
`vp` (macOS x64)	3.38 MiB	3.40 MiB	+16.20 KiB (+0.47%)
NAPI (macOS x64)	19.44 MiB	19.48 MiB	+36.96 KiB (+0.19%)
`vp` (Linux ARM64 GNU)	3.69 MiB	3.71 MiB	+16.89 KiB (+0.45%)
NAPI (Linux ARM64 GNU)	13.31 MiB	13.34 MiB	+26.35 KiB (+0.19%)
`vp` (Linux ARM64 musl)	3.71 MiB	3.73 MiB	+15.39 KiB (+0.40%)
NAPI (Linux ARM64 musl)	13.01 MiB	13.03 MiB	+21.57 KiB (+0.16%)
`vp` (Linux x64 GNU)	3.76 MiB	3.77 MiB	+16.72 KiB (+0.43%)
NAPI (Linux x64 GNU)	14.12 MiB	14.15 MiB	+29.46 KiB (+0.20%)
`vp` (Linux x64 musl)	3.78 MiB	3.80 MiB	+16.23 KiB (+0.42%)
NAPI (Linux x64 musl)	13.66 MiB	13.68 MiB	+16.28 KiB (+0.12%)
`vp` (Windows x64)	2.82 MiB	2.83 MiB	+10.70 KiB (+0.37%)
NAPI (Windows x64)	12.69 MiB	12.71 MiB	+18.70 KiB (+0.14%)
Trampoline (Windows x64)	7.14 KiB	7.14 KiB	+1 B (+0.01%)
Installer (Windows x64)	2.24 MiB	2.23 MiB	-8.95 KiB (-0.39%)
`vp` (Windows ARM64)	2.69 MiB	2.70 MiB	+14.30 KiB (+0.52%)
NAPI (Windows ARM64)	12.05 MiB	12.07 MiB	+18.01 KiB (+0.15%)
Trampoline (Windows ARM64)	6.93 KiB	6.93 KiB	-1 B (-0.01%)
Installer (Windows ARM64)	2.14 MiB	2.12 MiB	-10.76 KiB (-0.49%)

Raw sizes are uncompressed file sizes. gzip sizes recompress each binary at level 9; they are not package or download archive sizes.
The baseline uses published release files, including NAPI packages from npm at the same version. Build versions and toolchains can affect the difference.

github-actions · 2026-10-29T15:17:39Z

Registry bridge build (`a92f303`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5`
`create-vite-plus`	`0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/voidzero-dev/vite-plus/a92f3032cc7f27db653214b4800e101a5b3d36c5/packages/cli/install.sh | VP_PR_VERSION=3269 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/voidzero-dev/vite-plus/a92f3032cc7f27db653214b4800e101a5b3d36c5/packages/cli/install-legacy.sh bash

# Windows (PowerShell)
$env:VP_PR_VERSION="3269"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/voidzero-dev/vite-plus/a92f3032cc7f27db653214b4800e101a5b3d36c5/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/a92f3032cc7f27db653214b4800e101a5b3d36c5/packages/cli/install.ps1 | iex

Or download the standalone Windows installer built from this commit:

Architecture	Installer
x64	`vp-setup-x86_64-pc-windows-msvc.exe`
Arm64	`vp-setup-aarch64-pc-windows-msvc.exe`

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or create a new project from this commit without installing the CLI:

export npm_config_registry=https://registry-bridge.viteplus.dev/ pnpm_config_registry=https://registry-bridge.viteplus.dev/
pnpm create vite-plus@0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5 # or: npm create vite-plus@0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5

$env:npm_config_registry="https://registry-bridge.viteplus.dev/"; $env:pnpm_config_registry="https://registry-bridge.viteplus.dev/"
pnpm create vite-plus@0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5 # or: npm create vite-plus@0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5

pnpm 11+ reads pnpm_config_registry, npm and older pnpm read npm_config_registry. The new project pins this build, so keep the registry set for later installs, or configure it as below.

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.a92f3032cc7f27db653214b4800e101a5b3d36c5"
  }
}

github-actions · 2026-10-29T15:18:43Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-3269`	218MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-3269 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-3269

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-3269 vp --version

See docs/guide/docker.md for usage.

The docs deployment uses `void@0.23.0`, which skips `docs/public/_redirects` without a `routing` configuration. This leaves `/vp-setup` and the moved guide URLs returning `404`. The deployment now uses `void@1.3.0` and explicitly connects to `https://api.void.cloud`. It keeps the existing project selection and token, and includes the redirect rules in static deployments. It uses the shared Node.js pin from `.node-version`, introduced by #3269. This change also removes `netlify.toml`, the `build:netlify` script, and the related CI path exclusion. The installer RFC now references `docs/public/_redirects`.

@fengmk2

Vite+ 1.5 adds an official Homebrew tap, runs TypeScript through Node.js with `node --import vite-plus/register`, and lets `vp migrate` move `oxnode` and transpile-only `ts-node` scripts to `vpx`. ### Features - Install `vp` from the official Homebrew tap on macOS and glibc Linux ([docs](https://viteplus.dev/guide/homebrew)) ([#2740](#2740)), by @fengmk2: ```bash brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus brew install voidzero-dev/vite-plus/vp ``` - `node --import vite-plus/register` runs TypeScript with the same loader as `vpx`, so tools that start Node.js themselves, such as the Node.js test runner, AVA, or a `NODE_OPTIONS` setting, can run TypeScript files ([docs](https://viteplus.dev/guide/vpx#using-node-js-directly)) ([#3208](#3208)), by @fengmk2. - `vp migrate` moves `oxnode` commands and transpile-only `ts-node` commands to `vpx`, and moves their Node.js preloads and literal `NODE_OPTIONS` values to `vite-plus/register`. `ts-node` commands that type-check stay unchanged with a warning, and the `ts-node` dependency is removed only when nothing still uses it. A project already on Vite+ gets this migration with `vp migrate --full` ([docs](https://viteplus.dev/guide/migrate-rules#oxnode-to-vpx)) ([#3209](#3209), [#3210](#3210)), by @fengmk2. - `vp migrate` warns when it finds Rollup, Rolldown, or Jest dependencies with matching configuration, and explains how to move them to Vite, tsdown, or Vitest. The warnings show during the first migration, or with `vp migrate --full` in a project already on Vite+ ([#3275](#3275)), by @KTrain5169 and @fengmk2. - `vite-plus` exports `resolveConfigFromFile(configFile, options?)`, which resolves a config relative to the config file's directory instead of `process.cwd()`, so editor plugins with several workspace folders load the files of the right project ([#3249](#3249)), by @leaysgur and @fengmk2. - Security: the CLI ships `minimatch@11.0.4`, which fixes a denial of service through glob pattern amplification ([GHSA-g3hv-75wg-m249](GHSA-g3hv-75wg-m249), medium), and `zstd@0.13.4`, which fixes [RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391), [RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398), and [RUSTSEC-2026-0403](https://rustsec.org/advisories/RUSTSEC-2026-0403) ([#3328](#3328), [#3331](#3331)), by @renovate[bot] and @wan9chi. - Upgrade the bundled tools ([#3205](#3205), [#3236](#3236), [#3261](#3261), [#3206](#3206), [#3330](#3330), [#3338](#3338)), by @voidzero-guard[bot] and @fengmk2: - `rolldown@1.2.15` to `rolldown@1.2.16`, with `experimentalInlineCommonChunks` in dev mode and no crash when the working directory was deleted. - `tsdown@0.23.1` to `tsdown@0.23.4`: `vp pack --env-file` can be repeated to load several env files, the config has a JSON schema, and `?inline` CSS imported from dependencies is inlined. - `vitest@5.0.5` to `vitest@5.1.0`, with `--last-failed` and `--since-last-run`, fake timers for `node:timers`, and interactive review of failed snapshots. Browser mode now uses port 23315 by default. - `oxlint@1.89.0` to `oxlint@1.91.0` and `oxlint-tsgolint@7.0.2004` to `oxlint-tsgolint@7.0.2005`, with the new type-aware rule `typescript/no-unsafe-enum-assignment`, wider checks in rules such as `array-callback-return`, `no-useless-concat`, and `no-control-regex`, and two rules moved into the `suspicious` category. - `oxfmt@0.74.0` to `oxfmt@0.76.0`, with a new HTML formatter and JavaScript and TypeScript fixes for parentheses, array layout, and line width with wide characters. - The new oxlint and oxfmt versions can flag code that passed before. If your CI runs `vp check`, run `vp fmt` after upgrading. - `vpx` and `vite-plus/register` run on `oxc-node@1.0.1`, which resolves a `.jsx` specifier to its `.tsx` or `.ts` source. ### Fixes & Enhancements - `vp create` into a target path that is a symbolic link removes only the link after confirmation, instead of deleting the contents of the linked directory, and the overwrite prompt names symbolic links and files ([#2418](#2418)), by @leslieeilsel and @fengmk2. - `vp implode` removes only directories and shims that it can verify as Vite+ installations, and refuses the home directory, its parents, and filesystem roots even with `--yes`, so a `VP_HOME` that points at another directory cannot delete unrelated files ([#3228](#3228)), by @jong-kyung. - `vp run` starts faster in workspaces whose tasks share cache `input` and `output` patterns, because each pattern is parsed once. In a 138-package workspace this saves about 2 seconds of CPU on every run ([vite-task#887](voidzero-dev/vite-task#887), [vite-task#890](voidzero-dev/vite-task#890)), by @jasonkuhrt and @wan9chi. - `vp run` and package-manager commands in npm projects start about 110 ms sooner, because `vp` reads the npm version from npm's `package.json` instead of running `npm --version` ([#3259](#3259)), by @magurotuna. - `vp migrate` checks Vitest prerequisites faster in workspaces, because it parses each lockfile once ([#3212](#3212)), by @jong-kyung. - The installer and `vp upgrade` install the global CLI's dependencies with the Node.js version that the release pins (24.22.2 for this release), instead of the latest LTS ([docs](https://viteplus.dev/guide/ci#node-js-during-installation)) ([#3269](#3269)), by @fengmk2. - The Node.js `latest` alias in `vp env use`, `vp env default`, `vp env pin`, `vp env install`, and `.nvmrc` resolves to the newest stable release instead of a `27.0.0-alpha` build, and `vp env list-remote` marks that stable release as latest ([#3335](#3335)), by @voidzero-bot[bot] and @fengmk2. - `VP_NODE_VERSION=22` and other partial versions work for project commands such as `vp build`, `vp run`, and `vp list`, instead of failing with a 404 download error ([#3341](#3341)), by @jong-kyung. - Two `vp install -g` commands that run at the same time no longer delete each other's active package, and a command that starts while a package manager is being installed no longer runs its shim before the shim is executable ([#3185](#3185), [#3248](#3248)), by @jong-kyung. - `vp config` waits and retries when another linked git worktree holds the shared git config lock, so a `prepare` script no longer fails when two worktrees install at the same time ([#3199](#3199)), by @naokihaba. - `vp env doctor` reports Node.js resolution failures, unreadable config, a failing system `node`, and missing shims as errors and exits with code 1. When it finds only warnings, the summary says `Some warnings found` instead of `All checks passed` ([#3215](#3215), [#3222](#3222)), by @liangmiQwQ. - Nushell completions for `vp` and `vpr` use the named completer input, so Nushell 0.116 shows no deprecation warning, and they fall back to file completion when fish is not installed. Run `vp env setup --refresh` to regenerate `env.nu` ([#3267](#3267), [#3276](#3276)), by @naokihaba. - `vp migrate` removes the `tsx` dependency even when a comment still contains a `tsx` command or code fence, and keeps it for JSDoc type imports that need it ([#3299](#3299)), by @voidzero-bot[bot] and @fengmk2. - The `prefer-vite-plus-imports` lint rule and its autofix leave the `vite` and `vitest` imports that `vp migrate` keeps, such as `vitest` imports in a package that lists `vitest` in `peerDependencies`, so `vp lint --fix` no longer breaks the package for its plain Vitest users ([#3192](#3192)), by @Dunqing. - Generated Zed settings no longer force `typeAware` and `unusedDisableDirectives`, so editor diagnostics follow the `lint.options` in `vite.config.ts`. Existing editor settings stay unchanged ([#2357](#2357)), by @pweyck. - `vp dlx` with npm runs the right executable for scoped packages such as `@angular/cli` ([#3229](#3229)), by @jong-kyung. - `vp outdated -r` in npm projects checks the workspaces instead of transitive dependencies, and requires npm 7.14.0 or later ([#3240](#3240)), by @jong-kyung. - Dependency filters such as `--prod` and `--dev` work with npm 6, and filters that npm 6 cannot apply are rejected instead of passed through ([#3251](#3251)), by @jong-kyung. - Package-manager commands that the selected version does not have, such as `vp pm stage` before npm 11.15.0, are skipped with a warning. Unsupported `pnpm dlx` and `pnpm pack` options, and project-only flags on managed global commands such as `vp install -g`, are rejected instead of silently ignored ([#3286](#3286), [#3285](#3285)), by @jong-kyung. - `vp toolchain -g` is short for `vp toolchain --global` ([#3189](#3189)), by @jong-kyung. - On Linux and macOS, programs in tasks with automatic file-access tracking no longer abort when they call `exec` with an empty path or `execl` with 32 or more arguments ([vite-task#896](voidzero-dev/vite-task#896), [vite-task#865](voidzero-dev/vite-task#865)), by @wan9chi and @tlq5l. ### Refactor - Remove the test-only package download wrapper ([#3224](#3224)), by @jong-kyung. ### Docs - Explain that `vp check` stops at formatting failures, and that `vp check` flags go before file paths ([#3262](#3262)), by @SaKaNa-Y. - Show how to align an existing `vite` dependency with its override during a manual npm installation, to avoid `EOVERRIDE` ([#3157](#3157)), by @SaKaNa-Y. - Explain how environment variable prefixes such as `FOO=bar command` work in task commands on every platform ([#3161](#3161)), by @tartelettie. - Restore the `/vp-setup` redirect and the redirects for moved guide pages ([#3271](#3271)), by @fengmk2. - Align the labels of "See [...]" section links with their target titles ([#3231](#3231)), by @yamaurakazuto. ### Chore - Bump vite-task to `40cb9ca`; its user-facing changes are listed above ([#3246](#3246), [#3280](#3280)), by @wan9chi. - Keep CI working on the Node.js 26 LTS and Ubuntu 24.04, cap job runtimes, reduce Node.js downloads, avoid upgrade build and snapshot download timeouts, pin Nushell, and restore Namespace Linux runners ([#3198](#3198), [#3258](#3258), [#3266](#3266), [#3268](#3268), [#3303](#3303), [#3309](#3309), [#3320](#3320), [#3332](#3332)), by @fengmk2 and @wan9chi. - Add automated issue triage ([#3253](#3253), [#3260](#3260)), by @Boshen and @fengmk2. - Run the upstream dependency upgrade with Kimi K3.1 Pro and report its timeouts ([#3314](#3314), [#3304](#3304)), by @Brooooooklyn and @wan9chi. - Stabilize and trim tests: rerun ESLint and Prettier migration fixtures with `--full`, stabilize pnpm setup and Bun snapshots, update the tiptap ecosystem pin, use a recorded package in the install shortcut case, and remove duplicate `devEngines` parse tests ([#3193](#3193), [#3196](#3196), [#3242](#3242), [#3305](#3305), [#3301](#3301)), by @liangmiQwQ, @fengmk2, @wan9chi, and @Brooooooklyn. - Update Rust crates, synchronize workspace dependency requirements, and stop installing `dprint` and `taplo` in `just init` ([#3234](#3234), [#3310](#3310), [#3250](#3250)), by @renovate[bot], @leaysgur, and @fengmk2. - Refine contributor guidance: the release-manager skill, isolated CLI bootstrap checks in `AGENTS.md`, and the Rolldown exports in the CLI bundling notes ([#3207](#3207), [#3238](#3238), [#3316](#3316)), by @fengmk2 and @liangmiQwQ. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | vite | `8.3.5` | [`981f07f`](vitejs/vite@981f07f) | unchanged | | rolldown | `1.2.16` | [`de6facf`](rolldown/rolldown@de6facf) | [1.2.16](https://github.com/rolldown/rolldown/releases/tag/v1.2.16) | | oxc-node | `1.0.1` | [`7ff14c3`](oxc-project/oxc-node@7ff14c3) | [1.0.1](https://github.com/oxc-project/oxc-node/releases/tag/v1.0.1) | | tsdown | `0.23.4` | [npm](https://npmx.dev/package/tsdown/v/0.23.4) | [0.23.2](https://github.com/rolldown/tsdown/releases/tag/v0.23.2), [0.23.3](https://github.com/rolldown/tsdown/releases/tag/v0.23.3), [0.23.4](https://github.com/rolldown/tsdown/releases/tag/v0.23.4) | | vitest | `5.1.0` | [npm](https://npmx.dev/package/vitest/v/5.1.0) | [5.1.0](https://github.com/vitest-dev/vitest/releases/tag/v5.1.0) | | oxlint | `1.91.0` | [npm](https://npmx.dev/package/oxlint/v/1.91.0) | [1.90.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.90.0), [1.91.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.91.0) | | oxlint-tsgolint | `7.0.2005` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2005) | [7.0.2005](https://github.com/oxc-project/tsgolint/releases/tag/v7.0.2005) | | oxfmt | `0.76.0` | [npm](https://npmx.dev/package/oxfmt/v/0.76.0) | [0.75.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.75.0), [0.76.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.76.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @yamaurakazuto, @tartelettie, @pweyck, @jasonkuhrt **Full Changelog**: v1.4.0...v1.5.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…nd package managers (#3233) ## Summary Part of #1899 (letting NixOS and similar systems use only system Node.js and package managers). Follows #3143. `VP_ENV_FORBIDDEN=1` stops Vite+ from managing Node.js and every package-manager family. Vite+ then never downloads, reuses from the cache, or resolves over the network a managed runtime or package manager, whatever `config.json` or the `VP_*_MANAGER` variables say. Shims and the tools Vite+ selects itself use only the system tools on PATH. `VP_ENV_FORBIDDEN` stays undocumented until the follow-up PR covers the remaining commands. Without it, nothing changes. ## What's Changed **Switch and safety net** - Only the exact value `1` enables it. It covers Node.js and all package-manager families; per-tool or mixed setups are not supported. - The managed entry points fail with `DisabledByEnvForbidden` before their cache lookups: the Node.js download and version index, the package-manager download, binary lookup and bootstrap, and registry version resolution. **Shims and tool selection** - With `VP_ENV_FORBIDDEN=1`, the `node` and package-manager shims never search PATH or forward, including under `VP_BYPASS`. - With managed `config.json`, the error suggests `vp env off <component>`. - With `system_first`, reaching a shim means no system tool comes before it. - Where Vite+ selects a tool itself (`vp env exec`, `vpx`, global package binaries), it uses the first PATH match only. `vp_command::classify_first_path_match` reports a Vite+ shim or a managed install there as an error instead of skipping it. - Vite+ adds no managed directory to child PATHs. **Installers and `vp upgrade`** A `vp` without this change would ignore `VP_ENV_FORBIDDEN` and download managed tools, so installers and `vp upgrade` refuse such a target while it is set. - `vp` answers `VP_SELF_SETUP_SUPPORT_CHECK=env-forbidden` with a second line, `vite-plus-self-setup-env-forbidden`. The response to the existing check (`vite-plus-self-setup-v1`) is unchanged, because released installers compare it exactly. - `install.sh`, `install.ps1`, and `vp_installer` probe with the new value only when `VP_ENV_FORBIDDEN=1`, and fail before the legacy installer path. - `vp upgrade` checks the extracted binary before installing dependencies, and `vp upgrade --rollback` checks the previous version before switching. **Installation-time setup** - First-start setup saves every component as `system_first`, even when `VP_*_MANAGER=yes` is set, so the shims sit after the system tools. The Homebrew setup does the same. - Vite+'s own dependencies are installed with the first `node` and `pnpm` on PATH, which must be system tools. Both tools and the release's `engines.node` are checked before the installation is changed. For `vp upgrade`, `engines.node` comes from the `vite-plus` metadata that is already fetched. - pnpm cannot download another pnpm: the wrapper `package.json` omits `packageManager`, and pnpm runs with `--config.manage-package-manager-versions=false` and `--ignore-scripts`. It gets the PATH used for the check, so its `#!/usr/bin/env node` finds the checked `node`. - `VP_SETUP_NODE_VERSION` is ignored with a warning. This relaxes two guarantees from #3269, only when `VP_ENV_FORBIDDEN=1` is set: - The exact installation Node.js (`.node-version` / `vpNodeVersion`) becomes any system Node.js that satisfies `engines.node`. - pnpm `10.34.7` becomes the system pnpm. If it cannot use the installation lockfile, the error and `upgrade.log` point to `VP_SETUP_SKIP_INSTALL_LOCKFILE=1`. ## Scope Follow-up PR: - Errors for commands that only make sense for managed tools, such as `vp env use`, `vp env install`, and `vp env pin <version>`. - Delegated commands (`vp install`, `vp run`, …) and status commands use the system tools without network resolution. - The local CLI, and documentation including the NixOS setup. Until then, these commands download nothing: the delegated commands fail with `DisabledByEnvForbidden`. ## Testing - [x] `just check`, `just lint`, `just test` - [x] Unit tests for the system-tool checks, the pnpm arguments and wrapper `package.json`, `engines.node` resolution, the cached pnpm bootstrap, the support probe, and `vp upgrade` keeping the current version when the system tools are rejected - [x] Snapshot cases: - `shim_system_first_fallback`: `env_forbidden_overrides_managed_shims` (unreachable Node.js mirror and registry; no managed install is created), `env_forbidden_child_processes` - `command_self_setup`: `command_self_setup_env_forbidden_probe`, `command_self_setup_env_forbidden_config`, `command_self_setup_env_forbidden_in_place` (the system-tool check runs before setup changes anything) - `command_self_setup_external`: `command_self_setup_external_homebrew_env_forbidden` - [x] `.github/scripts/test-install-bootstrap.sh`, `.github/scripts/test-install-bootstrap.ps1`, and `test-install-legacy-remote.ps1` cover the `env-forbidden` scenarios (CI) - [x] Windows (CI) Some existing `command_self_setup` and shim snapshot cases fail locally on NixOS before and after this change (same cases), so CI covers them. --------- Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>

fengmk2 changed the title ~~fix(runtime): pin default Node.js to 24 and automate updates~~ fix(runtime): use .node-version for the shared Node 24 pin Oct 29, 2026

fengmk2 force-pushed the fix/pin-default-node-24 branch from 1f99415 to 08cd4b1 Compare October 29, 2026 06:27

fengmk2 changed the base branch from main to ci/arm64-libatomic October 29, 2026 06:28

fengmk2 added this pull request to stack #3270 October 29, 2026 06:31

fengmk2 force-pushed the fix/pin-default-node-24 branch from 08cd4b1 to ed0ab24 Compare October 29, 2026 06:59

Base automatically changed from ci/arm64-libatomic to main October 29, 2026 07:28

fengmk2 force-pushed the fix/pin-default-node-24 branch from ed0ab24 to 4a00d4a Compare October 29, 2026 07:28

fengmk2 marked this pull request as draft October 29, 2026 08:08

fengmk2 mentioned this pull request Oct 29, 2026

fix(docs): restore redirects with Void 1.3.0 #3271

Merged

fengmk2 marked this pull request as ready for review October 29, 2026 08:51

fengmk2 self-assigned this Oct 29, 2026

fengmk2 requested review from Brooooooklyn and cpojer October 29, 2026 08:51

cpojer approved these changes Oct 29, 2026

View reviewed changes

fengmk2 force-pushed the fix/pin-default-node-24 branch from bf2ee2e to 82f9cb6 Compare October 29, 2026 12:19

fengmk2 added the preview-build Publish this PR's commits to the registry bridge as preview builds label Oct 29, 2026 — with ChatGPT Codex Connector

fengmk2 mentioned this pull request Oct 29, 2026

feat: add official Homebrew tap #2740

Merged

fengmk2 force-pushed the fix/pin-default-node-24 branch from 3c67091 to 57987ee Compare October 29, 2026 14:34

fengmk2 added 11 commits October 30, 2026 10:20

fix(runtime): pin shared Node.js version to 24.22.1

873efba

test(cli): reuse prewarmed Node in nvmrc install snapshot

34303b4

test(cli): reuse prepared runtimes and prewarm Node selectors

17aa378

docs(ci): link to the shared Node.js version pin

bc58eeb

style(deps): simplify the Node.js pin comment

f62ead4

docs(runtime): describe the embedded Node.js default consistently

b4f69c4

fix(upgrade): prepare dependencies with the target binary

e1ac739

docs(upgrade): move preparation details into RFCs

a19e794

revert: defer upgrade runtime consistency to Homebrew setup

dae7364

docs(runtime): simplify the embedded Node pin comment

7ab932f

fix(upgrade): use the target Node pin from package metadata

c4533d1

fengmk2 removed the preview-build Publish this PR's commits to the registry bridge as preview builds label Oct 30, 2026

fengmk2 force-pushed the fix/pin-default-node-24 branch from 8c63847 to c4533d1 Compare October 30, 2026 01:20

fengmk2 added the preview-build Publish this PR's commits to the registry bridge as preview builds label Oct 30, 2026 — with ChatGPT Codex Connector

fengmk2 added 2 commits October 30, 2026 10:29

test(upgrade): snapshot Node metadata observations

9850556

fix(env): keep the LTS fallback separate from installation

da97d07

fengmk2 changed the title ~~fix(runtime): use .node-version for the shared Node 24 pin~~ fix(install): share the Node 24 pin with development and CI Oct 30, 2026

docs(env): remove installer details from runtime selection

a92f303

fengmk2 removed the preview-build Publish this PR's commits to the registry bridge as preview builds label Oct 30, 2026

fengmk2 added the preview-build Publish this PR's commits to the registry bridge as preview builds label Oct 30, 2026 — with ChatGPT Codex Connector

fengmk2 added 2 commits October 30, 2026 12:14

refactor: clarify Node installation helpers and fixtures

58fa405

chore: remove redundant Node type reference

44f7ed9

fengmk2 merged commit b41070d into main Oct 30, 2026
145 of 146 checks passed

fengmk2 deleted the fix/pin-default-node-24 branch October 30, 2026 04:26

fengmk2 mentioned this pull request Nov 3, 2026

release: v1.5.0 #3336

Merged

BrewTestBot mentioned this pull request Nov 4, 2026

vite-plus 1.5.0 Homebrew/homebrew-core#323336

Merged

myuron mentioned this pull request Nov 5, 2026

feat(env): add VP_ENV_FORBIDDEN to restrict Vite+ to system Node.js and package managers #3233

Merged

5 tasks done

Navigation Menu

Repository navigation

fix(install): share the Node 24 pin with development and CI - #3269

fix(install): share the Node 24 pin with development and CI#3269
fengmk2 merged 20 commits into
mainfrom
fix/pin-default-node-24

fengmk2 commented Oct 29, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

fengmk2 commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://fix-pin-default-node-24-viteplus-dev.voidzero-docs.workers.dev (commit 44f7ed9)

This URL reflects your latest Preview deployment

Preview Deployments by commit

View all previews: View all previews ↗

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI artifact sizes (44f7ed9)

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview binary sizes (a92f303)

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Registry bridge build (a92f303)

Uh oh!

github-actions Bot commented Oct 29, 2026

🐳 Docker preview image

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fengmk2 commented Oct 29, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Oct 29, 2026 •

edited

Loading

Preview URL: https://fix-pin-default-node-24-viteplus-dev.voidzero-docs.workers.dev (commit `44f7ed9`)

github-actions Bot commented Oct 29, 2026 •

edited

Loading

github-actions Bot commented Oct 29, 2026 •

edited

Loading

CLI artifact sizes (`44f7ed9`)

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Preview binary sizes (`a92f303`)

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Registry bridge build (`a92f303`)