Skip to content

build(deps): bump the node-dependencies group across 1 directory with 4 updates - #24

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/node-dependencies-a26ad2f716
Closed

build(deps): bump the node-dependencies group across 1 directory with 4 updates#24
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/node-dependencies-a26ad2f716

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the node-dependencies group with 4 updates in the / directory: @napi-rs/cli, @types/node, vite-plus and vitest.

Updates @napi-rs/cli from 3.10.8 to 3.10.9

Release notes

Sourced from @​napi-rs/cli's releases.

@​napi-rs/cli@​3.10.9

What's Changed

New Contributors

... (truncated)

Commits
  • bafc7db chore(release): publish
  • 8603be9 chore(deps): update dependency oxfmt to ^0.74.0 (#3629)
  • 3caf68e chore(deps): update dependency vite to v8.3.3 [security] (#3632)
  • 0ad70a7 fix(cli): take over the WASI flavor of a binding a postbuild fallback swaps i...
  • 5547cd4 fix(cli): resolve null when the incarnation probe's spawn throws synchronousl...
  • b3bb7a4 feat(napi): cancel a ReadableStream through its Reader, and fix ReadableStrea...
  • 55657a5 chore(deps): update dependency oxc-parser to ^0.155.0 (#3628)
  • 9699c60 chore(deps): update release-plz/action action to v0.5.143 (#3627)
  • f85954a fix(napi): set the custom GC aborted flag before Node closes its tsfn (#3626)
  • d03a856 test(cli): cover FreeBSD arm64 (#3620)
  • Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

Updates vite-plus from 1.2.0 to 1.4.0

Release notes

Sourced from vite-plus's releases.

vite-plus v1.4.0

Vite+ 1.4 runs TypeScript and JavaScript files with vpx, and vp migrate can move tsx scripts to it. It also adds vp check --deny-warnings and vp pm team, and installs the global CLI's dependencies from a lockfile published with each release.

Features

  • vpx <file> runs a TypeScript or JavaScript file on the project's Node.js with the oxc-node loader that ships with Vite+, and vpx --watch <file> reruns it when a file it uses changes. In package.json scripts, the vpx bin of the vite-plus package runs scripts without the global CLI and runs package binaries only from node_modules/.bin, pointing to vp dlx for anything not installed (docs) (#2936, #3164), by @​Brooooooklyn and @​fengmk2.
  • vp migrate offers to move tsx scripts to vpx: tsx a.ts, npx tsx a.ts, node --import tsx a.ts, and tsx watch a.ts in package.json scripts, lint-staged tasks, and #!/usr/bin/env tsx shebangs become vpx a.ts or vpx --watch a.ts. A project already on Vite+ gets the offer with vp migrate --full (docs) (#3179), by @​fengmk2.
  • vp check --deny-warnings fails the check on lint warnings, so CI no longer needs a separate vp lint --deny-warnings run (docs) (#3075), by @​acalvino4.
  • vp pm team creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun (#3040), by @​jong-kyung.
  • Security: vp no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades (RUSTSEC-2026-0382, RUSTSEC-2026-0383), and it ships tokio 1.54.1, which fixes a race in tokio::time::Interval (RUSTSEC-2026-0384) (#3159, #3202), by @​wan9chi and @​fengmk2.
  • vp pm registry commands (login, logout, whoami, owner, token, dist-tag, deprecate, search, ping, and publish) run pnpm's own commands on pnpm 11 and later (token from 12.13.0), and vp pm owner and vp pm publish run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm (#3044), by @​jong-kyung.
  • The installer and vp upgrade install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to resolve them again if that installation fails (docs) (#3117), by @​fengmk2.
  • Upgrade the bundled tools (#3133, #3158, #3175), by @​voidzero-guard[bot] and @​fengmk2:
    • vite@8.3.4 to vite@8.3.5, with fixes for bundled dev mode, chunk import maps, CSS url() values containing %, and subpath imports with several # characters.
    • rolldown@1.2.14 to rolldown@1.2.15, with fixes for this.resolve recursion between plugins using skipSelf: true, strict execution order, and chunk import maps.
    • oxlint@1.88.0 to oxlint@1.89.0, with rule fixes that report cases missed before, for example in prefer-const, no-param-reassign, and sort-imports.
    • oxfmt@0.73.0 to oxfmt@0.74.0, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown.
    • The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
    • vpx scripts run on oxc-node@1.0.0.
    • @vitejs/devtools 0.8 is accepted as a peer dependency, alongside 0.7.

Fixes & Enhancements

  • The standalone vp executable binary size is ~30% smaller (#3086), by @​fengmk2.
  • VP_SETUP_NODE_VERSION selects the Node.js version the installer uses for the CLI's dependencies, so setup-vp can use the project's version and avoid downloading a second Node.js in CI (docs) (#3087), by @​fengmk2.
  • When tasks miss the cache, vp run finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again (vite-task#871), by @​magurotuna.
  • Cached tasks no longer miss the cache when only pnpm's node_modules/.modules.yaml differs, for example after installing with another pnpm version, with --ignore-scripts, or on glibc and musl machines (vite-task#850), by @​wan9chi.
  • vp run in a package that sits inside a workspace folder but is not listed in its pnpm-workspace.yaml packages or package.json workspaces runs that package's own tasks with its own packageManager, instead of treating the enclosing workspace as its root (vite-task#859), by @​liangmiQwQ.
  • A mistyped or misplaced task setting fails with an error that names it, such as unknown field outputs, instead of data did not match any variant of untagged enum UserTaskDefinition (vite-task#815), by @​tlq5l.
  • vp run no longer panics on scripts that contain non-ASCII characters, such as echo こんにちは, and no longer cuts those commands off in its output (vite-task#861), by @​magurotuna.
  • In cached tasks on Linux and macOS, programs that pass -1 as a directory descriptor, such as ps -p <pid> from procps-ng 4.0.6 and later, no longer abort (vite-task#862), by @​magurotuna.
  • On Linux, cached tasks such as pnpm dlx no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup (vite-task#854), by @​fengmk2.
  • On Windows, vp run and the global vpx wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately (#3167), by @​fengmk2.
  • vp migrate and the prefer-vite-plus-imports lint autofix leave vite/rolldown and vite/rolldown/* imports unchanged, instead of rewriting them to vite-plus/rolldown subpaths that vite-plus does not export (#3070, #3191), by @​Crimson341 and @​Dunqing.
  • vp migrate keeps existing .nvmrc files instead of converting them to .node-version, so nvm, fnm, and other tools that read .nvmrc keep working and the selected Node.js version does not change (#3126), by @​liangmiQwQ.
  • vp migrate converts Oxlint configs that extends shared JSON files into TypeScript modules imported through lint.extends, so the inherited rules keep applying after migration (#3097), by @​fengmk2.
  • vp migrate skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting (#3118), by @​0froq.
  • vp migrate keeps the workspace members declared in package.json workspaces when it selects pnpm for a project without a lockfile, so recursive commands still include them (#2863), by @​SaKaNa-Y.
  • vp migrate no longer reports unawaited-assertion for a local assertion promise that the function later awaits or returns (#3180), by @​fengmk2.
  • pnpm create vite-plus and yarn create vite-plus no longer fail during dependency installation when vp is not on PATH, and no longer run a different global vp version for installation, formatting, and hooks (#3181), by @​fengmk2.
  • vp create and vp migrate resolve the npm registry and credentials as npm does: a .npmrc above the project is no longer read, userconfig and globalconfig are honored, and registry hosts in credential keys match regardless of case (#3124), by @​liangmiQwQ.
  • vp pack and vp create find the monorepo root the same way as vp run and vp install, and vp pack at a monorepo root without a vite.config no longer picks up a config from the directory above (#3101), by @​liangmiQwQ.
  • defineConfig keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as vike(), work under Vite+ (#3154), by @​liangmiQwQ.
  • vp dev with experimental.bundledDev no longer fails with ERR_MODULE_NOT_FOUND when no separate rolldown package is installed, and no longer picks up the runtime of an unrelated installed rolldown (#3111), by @​fengmk2.
  • With nodeShimMode: system_first, vp node and vp env exec run the system tool that the shell would find, instead of downloading and running the managed Node.js (#3100), by @​liangmiQwQ.
  • VP_NODE_VERSION=22 and other partial versions resolve to an exact release in vp env install, vp env exec, and vp env clean, instead of failing with a 404 download error (#3038), by @​Dev-next-gen.
  • vp env pin and vp env unpin show the file and field they changed. Package-manager pins from a workspace member update the workspace root package.json, and the help and guide now say so (#3103), by @​SaKaNa-Y.
  • In PowerShell, a bare -- reaches vp again, so vp create vite -- --template react-ts forwards --template to create-vite (#3083), by @​fengmk2.
  • Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ env.nu calls, such as update. Run vp env setup again to regenerate env.nu (#3123), by @​naokihaba.
  • Package-manager commands reject options that the selected version would silently ignore, such as --dry-run or --provenance with an npm whose version is unknown, instead of running without them (#3122), by @​jong-kyung.

... (truncated)

Commits
  • 102fe8e release: v1.4.0 (#3201)
  • b2abe27 fix(create): run child commands without a global vp (#3181)
  • c891e5d feat(migrate): migrate tsx scripts to vpx (#3179)
  • 0a96bd9 fix(lint): keep vite/rolldown imports in prefer-vite-plus-imports (#3191)
  • cbb9fee fix(migrate): recognize awaited local assertion promises (#3180)
  • 74c8d18 refactor(cli): share clap error diagnostics (#3172)
  • 2162b28 feat(deps): upgrade upstream dependencies (#3175)
  • f8d9da8 fix(cli): keep own properties of promise plugins in defineConfig (#3154)
  • 0445f73 refactor(migrate): remove redundant git hooks wrapper (#3173)
  • 13ac064 fix(vpx): handle --experimental-config-file and Windows Ctrl+C (#3167)
  • Additional commits viewable in compare view

Updates vitest from 5.0.4 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the node-dependencies group across 1 directory with…
f29caef 
… 4 updates

Bumps the node-dependencies group with 4 updates in the / directory: [@napi-rs/cli](https://github.com/napi-rs/napi-rs), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `@napi-rs/cli` from 3.10.8 to 3.10.9
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](https://github.com/napi-rs/napi-rs/compare/@napi-rs/cli@3.10.8...@napi-rs/cli@3.10.9)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vite-plus` from 1.2.0 to 1.4.0
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v1.4.0/packages/cli)

Updates `vitest` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@napi-rs/cli"
  dependency-version: 3.10.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: node-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: node-dependencies
- dependency-name: vite-plus
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: node-dependencies
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: node-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 4, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/node-dependencies-a26ad2f716 branch November 4, 2026 10:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants