Skip to content

build(deps-dev): bump vite-plus from 0.1.21 to 0.2.4#75

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vite-plus-0.2.4
Closed

build(deps-dev): bump vite-plus from 0.1.21 to 0.2.4#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vite-plus-0.2.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor

Bumps vite-plus from 0.1.21 to 0.2.4.

Release notes

Sourced from vite-plus's releases.

vite-plus v0.2.4: Vitest security hotfix

This hotfix updates the bundled Vitest Browser Mode packages to 4.1.10, which includes the fix for GHSA-p63j-vcc4-9vmv. The advisory is critical and affects @vitest/browser <=4.1.9.

Highlights

  • Critical Vitest Browser Mode advisory fixed: bundled vitest and @vitest/browser* move from 4.1.9 to 4.1.10, addressing GHSA-p63j-vcc4-9vmv, where provider commands could bypass the file access permission gate (#2089), by @​voidzero-guard[bot]

Chore

  • Add the standard release-manager skill for vite-plus release operations (#2019), by @​fengmk2

Bundled Versions

Tool Version Source
vite 8.1.3 578ffb8
rolldown 1.1.4 6cbd233
tsdown 0.22.3 npm
vitest 4.1.10 npm
oxlint 1.72.0 npm
oxlint-tsgolint 0.24.0 npm
oxfmt 0.57.0 npm

Upgrade

vp upgrade

New Contributors

No new contributors in this release.

Full Changelog: voidzero-dev/vite-plus@v0.2.3...v0.2.4

Published Packages

  • @voidzero-dev/vite-plus-core@0.2.4
  • vite-plus@0.2.4

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex
</tr></table> 

... (truncated)

Commits
  • 1ca9f0f release: v0.2.4: Vitest security hotfix
  • 747f0e5 fix(deps): upgrade vitest to 4.1.10
  • 7f70680 release: v0.2.3: config extraction, create, and vp run reliability fixes (#2081)
  • 4a5d742 fix(static_config): trust defineConfig from vite (#2075)
  • 603140d feat(test): PTY-based interactive CLI snapshot tests (#2052)
  • dcae79f fix(create): read org manifest from the tarball when the registry strips crea...
  • b9b15c4 fix(static_config): only trust defineConfig fromvite-plus (#2060)
  • 98cc0db ci: pack local dirs for the registry bridge instead of pkg.pr.new (#2038)
  • 638c447 fix(global): respect custom VP_HOME (#2029)
  • b99c778 refactor(cli): remove unused exported helpers (#2046)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) from 0.1.21 to 0.2.4.
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v0.2.4/packages/cli)

---
updated-dependencies:
- dependency-name: vite-plus
  dependency-version: 0.2.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #78.

@dependabot dependabot Bot closed this Jul 20, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/vite-plus-0.2.4 branch July 20, 2026 02:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants