vite-plus v0.1.16 — Security patches, Volta migration and Windows fixes

A broad release focused on security and ecosystem compatibility: 3 Vite dev server security fixes, Volta migration support, Bun object-form workspaces, JFrog registry support, and a wave of Windows and shell fixes.

Highlights

• Security: 3 Vite dev server vulnerabilities patched — Vite 8.0.5 fixes arbitrary file read via WebSocket (CVE-2026-39363, High — vite#22159), server.fs.deny bypass with query parameters (CVE-2026-39364, High — vite#22160), and path traversal in optimized deps .map handling (CVE-2026-39365, Moderate — vite#22161)
• Volta node version migration — vp migrate now migrates Volta-managed Node.js versions to .node-version (#1201)
• vp env off disables Node.js management globally — Disables Node.js management for all vp commands, not just the current shell (#1255)
• Bun object-form workspace support — Workspaces defined as objects in package.json are now properly detected (#1250)
• Windows install reliability — Fixed PowerShell install errors and scoped CI env vars to child processes (#1284, #1292)

Features

• Support volta node version migration to .node-version (#1201) — @naokihaba
• Make vp env off disable Node.js management for all vp commands (#1255) — @fengmk2
• Add explanations to migration prompts (#1270) — @hakshu25
• vp run --cache now supports running without a task specifier and opens the interactive task selector (vite-task#313) — @HaasStefan

Fixes & Enhancements

• Support JFrog registry metadata JSON format (#1249) — @fengmk2
• Support Bun object-form workspaces in package.json (#1250) — @fengmk2
• Resolve latest to absolute latest Node.js version (#1253) — @fengmk2
• Use bin.js entry point for TypeScript loader in justfile (#1252) — @jong-kyung
• Replace deprecated @tanstack/create-start with @tanstack/cli (#1259) — @jong-kyung
• Include additional supported config types from lint-staged (#1263) — @porada
• Add vitest to devDependencies for peer dep resolution (#1261) — @fengmk2
• Do not treat lint warnings as errors in exit code (#1268) — @fengmk2
• Resolve tsgolint on Windows with bun package manager (#1269) — @fengmk2
• Bypass package manager release age gates during vp upgrade (#1272) — @kazupon
• Wrap zsh completion in eval for dash compatibility (#1280) — @shaneturner
• Write merged LICENSE directly instead of LICENSE.md (#1281) — @fengmk2
• Update .yarnrc template to use node_modules (#1297) — @rChaoz
• Scope CI env var to child process in Windows install script (#1292) — @fengmk2
• Correctly resolve tsgolint in yarn monorepo packages (#1310) — @rChaoz
• Override rolldown panic hook with vite-plus branding (#1287) — @fengmk2
• Fix PowerShell install errors on Windows (#1284) — @fengmk2

Refactor

• Use .ts import extensions (#1274) — @fengmk2
• Migrate CLI build from tsc+rolldown to tsdown (#1276) — @fengmk2
  Replaces the split build strategy (tsc for local CLI code + rolldown for global modules) with a unified tsdown configuration. All third-party deps are now inlined at build time, eliminating the rolldown.config.ts and its manual external/path-rewriting plugins. Runtime dependencies dropped from 10 → 6:

  	Before (v0.1.15)	After (v0.1.16)
  dependencies	10	6
  Removed	cac, cross-spawn, jsonc-parser, picocolors	(inlined by tsdown)

Docs

• Document aliased package update steps (#1266) — @fengmk2
• Add custom Node.js mirror docs and rename VITE_NODE_DIST_MIRROR to VP_NODE_DIST_MIRROR (#1254) — @kazupon
• Add info about bun as pkg manager (#1294) — @TheAlexLichter
• Improve docs for core commands (#1304) — @connorshea
• Soften troubleshooting claims around vite config loading (#1313) — @FleetAdmiralJakob
• Remove redirect (#1306) — @connorshea

Chore

• Upgrade upstream dependencies: oxc 0.123.0, rolldown 1.0.0-rc.13, vite 8.0.5, esbuild 0.28.0, TypeScript 6.0.2, sass 1.99.0, oxlint-tsgolint 0.20.0, rolldown-plugin-dts 0.23.2, @vitejs/devtools 0.1.13, Vue 3.5.31 (#1267, #1279, #1319) — @Brooooooklyn
• Bump vite-task to 076cef48 (#1320) — @fengmk2
• Use matchDepNames for vite-task crates in renovate config (#1217) — @fengmk2
• Clarify Node.js version management prompt (#1273) — @fengmk2
• Update crate-ci/typos action to v1.45.0 (#1262)

Published Packages

• @voidzero-dev/vite-plus-core@0.1.16
• @voidzero-dev/vite-plus-test@0.1.16
• vite-plus@0.1.16

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Upgrade:

vp upgrade

New Contributors

Welcome to all new contributors! 🎉

@porada, @hakshu25, @shaneturner, @rChaoz, @FleetAdmiralJakob

Full Changelog: v0.1.15...v0.1.16