vite-plus v0.1.16 — Security patches, Volta migration and Windows fixes

A broad release focused on security and ecosystem compatibility: 3 Vite dev server security fixes, Volta migration support, Bun object-form workspaces, JFrog registry support, and a wave of Windows and shell fixes.

Highlights

• Security: 3 Vite dev server vulnerabilities patched — Vite 8.0.5 fixes arbitrary file read via WebSocket (CVE-2026-39363, High — vite#22159), server.fs.deny bypass with query parameters (CVE-2026-39364, High — vite#22160), and path traversal in optimized deps .map handling (CVE-2026-39365, Moderate — vite#22161)
• Volta node version migration — vp migrate now migrates Volta-managed Node.js versions to .node-version (#1201)
• vp env off disables Node.js management globally — Disables Node.js management for all vp commands, not just the current shell (#1255)
• Bun object-form workspace support — Workspaces defined as objects in package.json are now properly detected (#1250)
• Windows install reliability — Fixed PowerShell install errors and scoped CI env vars to child processes (#1284, #1292)

Features

• Support volta node version migration to .node-version (#1201) — @naokihaba
• Make vp env off disable Node.js management for all vp commands (#1255) — @fengmk2
• Add explanations to migration prompts (#1270) — @hakshu25
• vp run --cache now supports running without a task specifier and opens the interactive task selector (vite-task#313) — @HaasStefan

Fixes & Enhancements

• Support JFrog registry metadata JSON format (#1249) — @fengmk2
• Support Bun object-form workspaces in package.json (#1250) — @fengmk2
• Resolve latest to absolute latest Node.js version (#1253) — @fengmk2
• Use bin.js entry point for TypeScript loader in justfile (#1252) — @jong-kyung
• Replace deprecated @tanstack/create-start with @tanstack/cli (#1259) — @jong-kyung
• Include additional supported config types from lint-staged (#1263) — @porada
• Add vitest to devDependencies for peer dep resolution (#1261) — @fengmk2
• Do not treat lint warnings as errors in exit code (#1268) — @fengmk2
• Resolve tsgolint on Windows with bun package manager (#1269) — @fengmk2
• Bypass package manager release age gates during vp upgrade (#1272) — @kazupon
• Wrap zsh completion in eval for dash compatibility (#1280) — @shaneturner
• Write merged LICENSE directly instead of LICENSE.md (#1281) — @fengmk2
• Update .yarnrc template to use node_modules (#1297) — @rChaoz
• Scope CI env var to child process in Windows install script (#1292) — @fengmk2
• Correctly resolve tsgolint in yarn monorepo packages (#1310) — @rChaoz
• Override rolldown panic hook with vite-plus branding (#1287) — @fengmk2
• Fix PowerShell install errors on Windows (#1284) — @fengmk2

Refactor

• Use .ts import extensions (#1274) — @fengmk2
• Migrate CLI build from tsc+rolldown to tsdown (#1276) — @fengmk2
  Replaces the split build strategy (tsc for local CLI code + rolldown for global modules) with a unified tsdown configuration. All third-party deps are now inlined at build time, eliminating the rolldown.config.ts and its manual external/path-rewriting plugins. Runtime dependencies dropped from 10 → 6:

  	Before (v0.1.15)	After (v0.1.16)
  dependencies	10	6
  Removed	cac, cross-spawn, jsonc-parser, picocolors	(inlined by tsdown)

Docs

• Document aliased package update steps (#1266) — @fengmk2
• Add custom Node.js mirror docs and rename VITE_NODE_DIST_MIRROR to VP_NODE_DIST_MIRROR (#1254) — @kazupon
• Add info about bun as pkg manager (#1294) — @TheAlexLichter
• Improve docs for core commands (#1304) — @connorshea
• Soften troubleshooting claims around vite config loading (#1313) — @FleetAdmiralJakob
• Remove redirect (#1306) — @connorshea

Chore

• Upgrade upstream dependencies: oxc 0.123.0, rolldown 1.0.0-rc.13, vite 8.0.5, esbuild 0.28.0, TypeScript 6.0.2, sass 1.99.0, oxlint-tsgolint 0.20.0, rolldown-plugin-dts 0.23.2, @vitejs/devtools 0.1.13, Vue 3.5.31 (#1267, #1279, #1319) — @Brooooooklyn
• Bump vite-task to 076cef48 (#1320) — @fengmk2
• Use matchDepNames for vite-task crates in renovate config (#1217) — @fengmk2
• Clarify Node.js version management prompt (#1273) — @fengmk2
• Update crate-ci/typos action to v1.45.0 (#1262)

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16
• @voidzero-dev/vite-plus-test@0.1.16
• vite-plus@0.1.16

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Upgrade:

vp upgrade

New Contributors

Welcome to all new contributors! 🎉

@porada, @hakshu25, @shaneturner, @rChaoz, @FleetAdmiralJakob

Full Changelog: v0.1.15...v0.1.16

vite-plus v0.1.16-alpha.4

vite-plus v0.1.16-alpha.4

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16-alpha.4
• @voidzero-dev/vite-plus-test@0.1.16-alpha.4
• vite-plus@0.1.16-alpha.4

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.16-alpha.4 bash

Windows:

\$env:VP_VERSION=\"0.1.16-alpha.4\"; irm https://vite.plus/ps1 | iex

View the full commit: 5560431

vite-plus v0.1.16-alpha.3

vite-plus v0.1.16-alpha.3

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16-alpha.3
• @voidzero-dev/vite-plus-test@0.1.16-alpha.3
• vite-plus@0.1.16-alpha.3

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.16-alpha.3 bash

Windows:

\$env:VP_VERSION=\"0.1.16-alpha.3\"; irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: 6153ccb

vite-plus v0.1.16-alpha.2

vite-plus v0.1.16-alpha.2

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16-alpha.2
• @voidzero-dev/vite-plus-test@0.1.16-alpha.2
• vite-plus@0.1.16-alpha.2

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.16-alpha.2 bash

Windows:

\$env:VP_VERSION=\"0.1.16-alpha.2\"; irm https://vite.plus/ps1 | iex

View the full commit: f72d8a1

vite-plus v0.1.16-alpha.1

vite-plus v0.1.16-alpha.1

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16-alpha.1
• @voidzero-dev/vite-plus-test@0.1.16-alpha.1
• vite-plus@0.1.16-alpha.1

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.16-alpha.1 bash

Windows:

\$env:VP_VERSION=\"0.1.16-alpha.1\"; irm https://vite.plus/ps1 | iex

View the full commit: 38aa60a

vite-plus v0.1.16-alpha.0

vite-plus v0.1.16-alpha.0

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16-alpha.0
• @voidzero-dev/vite-plus-test@0.1.16-alpha.0
• vite-plus@0.1.16-alpha.0

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.16-alpha.0 bash

Windows:

\$env:VP_VERSION=\"0.1.16-alpha.0\"; irm https://vite.plus/ps1 | iex

View the full commit: a015d78

vite-plus v0.1.15 -- Task runner concurrency controls, `vpr` shorthand and bun support

A packed release with task runner concurrency controls, a new vpr shorthand, dynamic shell completions, bun package manager support, and 10x migration performance improvement.

Highlights

• Task runner concurrency controls -- New --concurrency-limit flag to limit concurrent tasks (defaults to 4) and --parallel flag to ignore task dependencies and run all tasks at once (vite-task#288, vite-task#309)
• vpr standalone shorthand -- Run tasks faster with vpr build instead of vp run build (#1178)
• Dynamic shell completions -- vp run and vpr now offer tab-completion for available tasks across all major shells (#1181)
• Bun package manager support -- vp create and install scripts now support bun as a first-class package manager (#1005)
• 10x migration speedup -- rewriteAllImports uses cached rules, pre-filtering, and rayon parallelism for dramatically faster migrations (#1172)

Breaking Changes

• vp run argument order -- Flags must now come before the task name: vp run -r build instead of vp run build -r, because arguments after the task name are now passed through to the task instead of consumed by vp (vite-task#286, vite-task#290) -- @liangmiQwQ, @branchseer
• VITE_PLUS_* env vars renamed to VP_* -- All environment variables now use the shorter VP_ prefix (#1166) -- @jong-kyung

Features

• Add vpr as standalone shorthand for vp run (#1178) -- @fengmk2
• Implement dynamic shell completion with vp run task support (#1181) -- @nekomoyi
• Add shell completion for vpr command (#1227) -- @nekomoyi
• Add bun as a package manager (#1005) -- @fengmk2
• Non-blocking upgrade check with rate-limited notice (#1173) -- @fengmk2
• Migrate .nvmrc to .node-version during vp migrate (#1159) -- @naokihaba
• Expose bundled tool versions via vite-plus/versions export (#1162) -- @kazupon
• Export JS API from oxfmt under vite-plus/fmt (#1235) -- @leaysgur
• Enable task cache by default in monorepo template (#1230) -- @fengmk2
• Task runner: --concurrency-limit flag to limit the number of tasks running at the same time (defaults to 4) (vite-task#288, vite-task#309) -- @branchseer
• Task runner: --parallel flag to ignore task dependencies and run all tasks at once with unlimited concurrency (unless --concurrency-limit is also specified) (vite-task#309) -- @branchseer
• Task runner: add VP_* to DEFAULT_UNTRACKED_ENV (vite-task#297) -- @jong-kyung
• Upgrade upstream dependencies: Rolldown 1.0.0-rc.12, Vite 8.0.3, Vitest 4.1.2, tsdown 0.21.7, oxfmt 0.43.0, oxlint 1.58.0, @oxc-project/runtime 0.122.0, TypeScript peer range ^6.0.0 (#1147, #1161, #1191, #1244) -- @Brooooooklyn

Fixes & Enhancements

• Speed up rewriteAllImports ~10x with cached rules, pre-filter, and rayon (#1172) -- @fengmk2
• Adapt vp run argument order for flags-before-task breaking change (#1170) -- @fengmk2
• Show helpful error for unknown vite: templates (#1130) -- @naokihaba
• Upgrade reqwest from 0.12 to 0.13 and rename rustls-tls feature (#1068) -- @Giorno-Giovana
• Suggest vp run for all templates (#1127) -- @jong-kyung
• Remove misleading PATH position check in vp env doctor (#1140) -- @jong-kyung
• Fix fish shell wrapper for vp env use (#1141) -- @nekomoyi
• Exclude node_modules/.vite-temp from cache input tracking (#1096) -- @fengmk2
• Correctly inform about prettierignore (#1160) -- @TheAlexLichter
• Allow registry commands to work outside a project (#1151) -- @fengmk2
• Auto-set git core.hooksPath without prompting (#1157) -- @fengmk2
• Inject default fmt: {} config and rebrand oxfmt messages (#1163) -- @fengmk2
• Auto-remove esModuleInterop: false from tsconfig.json (#1148) -- @fengmk2
• Auto-remove allowSyntheticDefaultImports: false from tsconfig.json (#1153) -- @fengmk2
• Get vite_plus_home from node wrapper's path (#1185) -- @liangmiQwQ
• Support JSONC format in oxlintrc/oxfmtrc migration (#1195) -- @connorshea
• Rewrite vitest self-references in globals.d.ts for type-aware linting (#1177) -- @fengmk2
• Remove setting oxlint configPath option in Zed editor config (#1205) -- @camc314
• Stop intercepting vite as vp and synthesize vpr in task scripts (#1186) -- @fengmk2
• Add package-scoped negative globs to prevent cache miss in monorepos (#1198) -- @fengmk2
• Add peerDependencyRules for standalone pnpm projects (#1222) -- @fengmk2
• Remove defineConfig export from oxlint (#1234) -- @leaysgur
• Preserve browser provider peer deps and fix version warning (#1236) -- @fengmk2
• Pin @oxlint/migrate to bundled oxlint version (#1243) -- @fengmk2
• Task runner: Ctrl-C now prevents future tasks from being scheduled and prevents caching of in-flight task results (vite-task#309) -- @branchseer
• Task runner: restore terminal state on Ctrl+C during interactive task selection (vite-task#306) -- @kazupon

Refactoring

• Simplify vp --version by using generated versions module (#1164) -- @kazupon
• Remove PM fallback from vp run, always delegate to vite-plus (#1179) -- @fengmk2
• Move pnpm config into pnpm-workspace.yaml (#1237) -- @fengmk2

Chore

• Pin node version to avoid flaky tests (#1135) -- @fengmk2
• Bump vite-task rev and adapt spawn API (#1155) -- @jong-kyung
• Add snap test sharding with --shard=X/Y support (#1189) -- @fengmk2
• Use --no-frozen-lockfile in install E2E test (#1199) -- @fengmk2
• Retry failed snap test cases instead of skipping flaky tests (#1209) -- @fengmk2
• Update GitHub Actions to latest versions (#1212) -- @fengmk2
• Add #[serial] to env-var tests to prevent concurrent access races (#1223) -- @fengmk2
• Enforce .js file extensions in imports via nodenext module resolution (#1232) -- @fengmk2
• Bump vite-task to 1ef4e2f6 (#1240) -- @branchseer
• Disable upgrade deps in fork (#1242) -- @hyoban
• Task runner: port packages/tools bins to single Rust binary (vtt) (vite-task#291) -- @branchseer
• Task runner: add ctrl-c tests for labeled mode and cached tasks (vite-task#307) -- @branchseer
• Task runner: add ctrl-c propagation test for SIGINT handling (vite-task#303) -- @branchseer
• Task runner: make snapshot tests self-contained ([vi...

vite-plus v0.1.15-alpha.7

vite-plus v0.1.15-alpha.7

Published Packages

• @voidzero-dev/vite-plus-core@0.1.15-alpha.7
• @voidzero-dev/vite-plus-test@0.1.15-alpha.7
• vite-plus@0.1.15-alpha.7

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.15-alpha.7 bash

Windows:

\$env:VP_VERSION=\"0.1.15-alpha.7\"; irm https://vite.plus/ps1 | iex

View the full commit: f922d5f

vite-plus v0.1.15-alpha.6

vite-plus v0.1.15-alpha.6

Published Packages

• @voidzero-dev/vite-plus-core@0.1.15-alpha.6
• @voidzero-dev/vite-plus-test@0.1.15-alpha.6
• vite-plus@0.1.15-alpha.6

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VP_VERSION=0.1.15-alpha.6 bash

Windows:

\$env:VP_VERSION=\"0.1.15-alpha.6\"; irm https://vite.plus/ps1 | iex

View the full commit: 6cd75f4

vite-plus v0.1.15-alpha.5

vite-plus v0.1.15-alpha.5

Published Packages

• @voidzero-dev/vite-plus-core@0.1.15-alpha.5
• @voidzero-dev/vite-plus-test@0.1.15-alpha.5
• vite-plus@0.1.15-alpha.5

Installation

macOS/Linux:

curl -fsSL https://vite.plus | VITE_PLUS_VERSION=0.1.15-alpha.5 bash

Windows:

\$env:VITE_PLUS_VERSION=\"0.1.15-alpha.5\"; irm https://vite.plus/ps1 | iex

View the full commit: dbe191e