Repository navigation
docs(skill): refine release-manager guidance from the v1.3.0 release - #3084
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://docs-skill-release-manager-v1-3-0-viteplus-dev.voidzero-docs.workers.dev (commit 1a6990f)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
wan9chi
approved these changes
Oct 19, 2026
Merged
fengmk2
added a commit
that referenced
this pull request
Oct 23, 2026
Vite+ 1.4 runs TypeScript and JavaScript files with `vpx`, and `vp migrate` can move tsx scripts to it. It also adds `vp check --deny-warnings` and `vp pm team`, and installs the global CLI's dependencies from a lockfile published with each release. ### Features - `vpx <file>` runs a TypeScript or JavaScript file on the project's Node.js with the [oxc-node](https://github.com/oxc-project/oxc-node) loader that ships with Vite+, and `vpx --watch <file>` reruns it when a file it uses changes. In `package.json` scripts, the `vpx` bin of the `vite-plus` package runs scripts without the global CLI and runs package binaries only from `node_modules/.bin`, pointing to `vp dlx` for anything not installed ([docs](https://viteplus.dev/guide/vpx#running-scripts)) ([#2936](#2936), [#3164](#3164)), by @Brooooooklyn and @fengmk2. - `vp migrate` offers to move tsx scripts to `vpx`: `tsx a.ts`, `npx tsx a.ts`, `node --import tsx a.ts`, and `tsx watch a.ts` in `package.json` scripts, lint-staged tasks, and `#!/usr/bin/env tsx` shebangs become `vpx a.ts` or `vpx --watch a.ts`. A project already on Vite+ gets the offer with `vp migrate --full` ([docs](https://viteplus.dev/guide/migrate-rules#tsx-to-vpx)) ([#3179](#3179)), by @fengmk2. - `vp check --deny-warnings` fails the check on lint warnings, so CI no longer needs a separate `vp lint --deny-warnings` run ([docs](https://viteplus.dev/guide/check#usage)) ([#3075](#3075)), by @acalvino4. - `vp pm team` creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun ([#3040](#3040)), by @jong-kyung. - Security: `vp` no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades ([RUSTSEC-2026-0382](https://rustsec.org/advisories/RUSTSEC-2026-0382.html), [RUSTSEC-2026-0383](https://rustsec.org/advisories/RUSTSEC-2026-0383.html)), and it ships tokio 1.54.1, which fixes a race in `tokio::time::Interval` ([RUSTSEC-2026-0384](https://rustsec.org/advisories/RUSTSEC-2026-0384)) ([#3159](#3159), [#3202](#3202)), by @wan9chi and @fengmk2. - `vp pm` registry commands (`login`, `logout`, `whoami`, `owner`, `token`, `dist-tag`, `deprecate`, `search`, `ping`, and `publish`) run pnpm's own commands on pnpm 11 and later (`token` from 12.13.0), and `vp pm owner` and `vp pm publish` run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm ([#3044](#3044)), by @jong-kyung. - The installer and `vp upgrade` install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set `VP_SETUP_SKIP_INSTALL_LOCKFILE=1` to resolve them again if that installation fails ([docs](https://viteplus.dev/guide/global-cli#vp-setup-skip-install-lockfile)) ([#3117](#3117)), by @fengmk2. - Upgrade the bundled tools ([#3133](#3133), [#3158](#3158), [#3175](#3175)), by @voidzero-guard[bot] and @fengmk2: - `vite@8.3.4` to `vite@8.3.5`, with fixes for bundled dev mode, chunk import maps, CSS `url()` values containing `%`, and subpath imports with several `#` characters. - `rolldown@1.2.14` to `rolldown@1.2.15`, with fixes for `this.resolve` recursion between plugins using `skipSelf: true`, strict execution order, and chunk import maps. - `oxlint@1.88.0` to `oxlint@1.89.0`, with rule fixes that report cases missed before, for example in `prefer-const`, `no-param-reassign`, and `sort-imports`. - `oxfmt@0.73.0` to `oxfmt@0.74.0`, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown. - The new oxlint and oxfmt versions can flag code that passed before. If your CI runs `vp check`, run `vp fmt` after upgrading. - `vpx` scripts run on `oxc-node@1.0.0`. - `@vitejs/devtools` 0.8 is accepted as a peer dependency, alongside 0.7. ### Fixes & Enhancements - The standalone `vp` executable is 30%+ smaller ([#3086](#3086)), by @fengmk2. - `VP_SETUP_NODE_VERSION` selects the Node.js version the installer uses for the CLI's dependencies, so `setup-vp` can use the project's version and avoid downloading a second Node.js in CI ([docs](https://viteplus.dev/guide/global-cli#vp-setup-node-version)) ([#3087](#3087)), by @fengmk2. - When tasks miss the cache, `vp run` finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again ([vite-task#871](voidzero-dev/vite-task#871)), by @magurotuna. - Cached tasks no longer miss the cache when only pnpm's `node_modules/.modules.yaml` differs, for example after installing with another pnpm version, with `--ignore-scripts`, or on glibc and musl machines ([vite-task#850](voidzero-dev/vite-task#850)), by @wan9chi. - `vp run` in a package that sits inside a workspace folder but is not listed in its `pnpm-workspace.yaml` `packages` or `package.json` `workspaces` runs that package's own tasks with its own `packageManager`, instead of treating the enclosing workspace as its root ([vite-task#859](voidzero-dev/vite-task#859)), by @liangmiQwQ. - A mistyped or misplaced task setting fails with an error that names it, such as `unknown field outputs`, instead of `data did not match any variant of untagged enum UserTaskDefinition` ([vite-task#815](voidzero-dev/vite-task#815)), by @tlq5l. - `vp run` no longer panics on scripts that contain non-ASCII characters, such as `echo こんにちは`, and no longer cuts those commands off in its output ([vite-task#861](voidzero-dev/vite-task#861)), by @magurotuna. - In cached tasks on Linux and macOS, programs that pass `-1` as a directory descriptor, such as `ps -p <pid>` from procps-ng 4.0.6 and later, no longer abort ([vite-task#862](voidzero-dev/vite-task#862)), by @magurotuna. - On Linux, cached tasks such as `pnpm dlx` no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup ([vite-task#854](voidzero-dev/vite-task#854)), by @fengmk2. - On Windows, `vp run` and the global `vpx` wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately ([#3167](#3167)), by @fengmk2. - `vp migrate` and the `prefer-vite-plus-imports` lint autofix leave `vite/rolldown` and `vite/rolldown/*` imports unchanged, instead of rewriting them to `vite-plus/rolldown` subpaths that `vite-plus` does not export ([#3070](#3070), [#3191](#3191)), by @Crimson341 and @Dunqing. - `vp migrate` keeps existing `.nvmrc` files instead of converting them to `.node-version`, so nvm, fnm, and other tools that read `.nvmrc` keep working and the selected Node.js version does not change ([#3126](#3126)), by @liangmiQwQ. - `vp migrate` converts Oxlint configs that `extends` shared JSON files into TypeScript modules imported through `lint.extends`, so the inherited rules keep applying after migration ([#3097](#3097)), by @fengmk2. - `vp migrate` skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting ([#3118](#3118)), by @0froq. - `vp migrate` keeps the workspace members declared in `package.json` `workspaces` when it selects pnpm for a project without a lockfile, so recursive commands still include them ([#2863](#2863)), by @SaKaNa-Y. - `vp migrate` no longer reports `unawaited-assertion` for a local assertion promise that the function later awaits or returns ([#3180](#3180)), by @fengmk2. - `pnpm create vite-plus` and `yarn create vite-plus` no longer fail during dependency installation when `vp` is not on `PATH`, and no longer run a different global `vp` version for installation, formatting, and hooks ([#3181](#3181)), by @fengmk2. - `vp create` and `vp migrate` resolve the npm registry and credentials as npm does: a `.npmrc` above the project is no longer read, `userconfig` and `globalconfig` are honored, and registry hosts in credential keys match regardless of case ([#3124](#3124)), by @liangmiQwQ. - `vp pack` and `vp create` find the monorepo root the same way as `vp run` and `vp install`, and `vp pack` at a monorepo root without a `vite.config` no longer picks up a config from the directory above ([#3101](#3101)), by @liangmiQwQ. - `defineConfig` keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as `vike()`, work under Vite+ ([#3154](#3154)), by @liangmiQwQ. - `vp dev` with `experimental.bundledDev` no longer fails with `ERR_MODULE_NOT_FOUND` when no separate `rolldown` package is installed, and no longer picks up the runtime of an unrelated installed `rolldown` ([#3111](#3111)), by @fengmk2. - With `nodeShimMode: system_first`, `vp node` and `vp env exec` run the system tool that the shell would find, instead of downloading and running the managed Node.js ([#3100](#3100)), by @liangmiQwQ. - `VP_NODE_VERSION=22` and other partial versions resolve to an exact release in `vp env install`, `vp env exec`, and `vp env clean`, instead of failing with a 404 download error ([#3038](#3038)), by @Dev-next-gen. - `vp env pin` and `vp env unpin` show the file and field they changed. Package-manager pins from a workspace member update the workspace root `package.json`, and the help and guide now say so ([#3103](#3103)), by @SaKaNa-Y. - In PowerShell, a bare `--` reaches `vp` again, so `vp create vite -- --template react-ts` forwards `--template` to create-vite ([#3083](#3083)), by @fengmk2. - Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ `env.nu` calls, such as `update`. Run `vp env setup` again to regenerate `env.nu` ([#3123](#3123)), by @naokihaba. - Package-manager commands reject options that the selected version would silently ignore, such as `--dry-run` or `--provenance` with an npm whose version is unknown, instead of running without them ([#3122](#3122)), by @jong-kyung. - Fresh Bun installs verify the integrity hash in a `packageManager` pin and reject a mismatched download, as pnpm 12 and later already did ([#3134](#3134)), by @jong-kyung. - A failed `vp install -g` restores the executables and npm links that existed before, instead of deleting files it never created ([#3119](#3119)), by @jong-kyung. - `vp install -g` skips package binaries with unsafe names or targets instead of linking them, as pnpm does ([#3156](#3156)), by @jong-kyung. - `npm uninstall -g <package> --dry-run` no longer removes the package's commands from Vite+ ([#3112](#3112)), by @jong-kyung. ### Refactor - Replace `glob` with `tinyglobby` in the CLI and share `.nvmrc` line parsing between reading and pinning. Workspace discovery in `vp create` and `vp migrate` now honors negated patterns such as `!packages/foo` and follows symlinked directories in `**` patterns, as pnpm does ([#3099](#3099), [#3125](#3125)), by @liangmiQwQ. - Share clap error diagnostics, manager preference parsing, external tool lookup, and native shell parsing for migration rewrites, and remove a redundant git hooks wrapper ([#3172](#3172), [#3143](#3143), [#3138](#3138), [#3173](#3173)), by @jong-kyung, @myuron, and @fengmk2. ### Docs - Note that `run.cache` can only be set in the workspace root's `vite.config.ts` ([#3139](#3139)), by @yusuke99. ### Chore - Bump vite-task to `a3c087a`; its user-facing changes are listed above ([#3153](#3153), [#3168](#3168), [#3184](#3184)), by @wan9chi. - Run Node.js, runtime download, and package-manager tests against local mirrors and offline fixtures, serve snapshot registry traffic from local fixtures and a shared cache, replace sleeps with deterministic waits, keep snapshot setup off the npm registry, and fix or remove tests that checked nothing ([#3067](#3067), [#3169](#3169), [#3170](#3170), [#3171](#3171), [#3144](#3144), [#3146](#3146), [#3145](#3145), [#3147](#3147), [#3148](#3148), [#3194](#3194), [#3203](#3203)), by @fengmk2 and @liangmiQwQ. - Cover package-manager detection for nested projects and owner listing with pnpm 11.28.7, and allow time for the Playwright type check on slow runners ([#3051](#3051), [#3174](#3174), [#3082](#3082)), by @liangmiQwQ, @jong-kyung, and @fengmk2. - Update the Node.js versions used for development, CI, and release publishing to the [October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases): 22.23.4, 24.22.1, and 26.12.1 ([#3186](#3186)), by @fengmk2. - Reduce GitHub Actions cache storage and enable the e18e lint rules for the repository ([#3149](#3149), [#3088](#3088)), by @fengmk2. - Upgrade JavaScript dependencies and Rust crates, including `@ast-grep/napi@0.51.0` and `serial_test@4` ([#3108](#3108), [#3109](#3109)), by @renovate[bot]. - Refine the release-manager and vite-task bump guidance ([#3084](#3084), [#3160](#3160)), by @fengmk2 and @wan9chi. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | --------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | vite | `8.3.5` | [`981f07f`](vitejs/vite@981f07f) | [8.3.5](https://github.com/vitejs/vite/releases/tag/v8.3.5) | | rolldown | `1.2.15` | [`89d821c`](rolldown/rolldown@89d821c) | [1.2.15](https://github.com/rolldown/rolldown/releases/tag/v1.2.15) | | oxc-node | `1.0.0` | [`4759ced`](oxc-project/oxc-node@4759ced) | [1.0.0](https://github.com/oxc-project/oxc-node/releases/tag/v1.0.0) | | tsdown | `0.23.1` | [npm](https://npmx.dev/package/tsdown/v/0.23.1) | unchanged | | vitest | `5.0.5` | [npm](https://npmx.dev/package/vitest/v/5.0.5) | unchanged | | oxlint | `1.89.0` | [npm](https://npmx.dev/package/oxlint/v/1.89.0) | [1.89.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.89.0) | | oxlint-tsgolint | `7.0.2004` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2004) | unchanged | | oxfmt | `0.74.0` | [npm](https://npmx.dev/package/oxfmt/v/0.74.0) | [0.74.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.74.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @acalvino4, @Dev-next-gen, @0froq, @Crimson341, @Dunqing, @magurotuna, @tlq5l **Full Changelog**: v1.3.0...v1.4.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fold the v1.3.0 release lessons into the release-manager skill.
pnpm create vite-plusexample.release.ymland thereleaseenvironment before merging. Without it, the publish fails withERR_PNPM_AUTH_TOKEN_EXCHANGE ... (status code 404)aftervite-plusis already onlatest, and the GitHub release, Docker image, docs deployment, and Discord notification are skipped.Releasefailures: use "Re-run failed jobs", never "Re-run all jobs". A full rerun repeatscheck, which then sees the new version onlatestand skips the release. Publishing is idempotent, so a failed-jobs rerun uploads only what is missing. Whoever starts the rerun cannot approve it.--prefer-onlinewhen a fresh version reportsETARGETlocally. pnpm 11 and later default to a one-dayminimumReleaseAge, sopnpm create vite-plusresolves to the previouscreate-vite-plusfor a day after publishing.🤖 Generated with Claude Code