release: v0.2.8: monorepo target resolution, VP_* environment variables, and container reliability

[voidzero-guard]

Release vite-plus v0.2.8: monorepo target resolution, VP_* environment variables, and container reliability.

Bare vp dev/build/preview/pack at a monorepo root now resolve a target package instead of silently running against the root, Vite+-specific environment variables move to the VP_* prefix, and Vite+ installs and runs correctly on slim/distroless container images and under stricter package-manager layouts.

Highlights

• Resolve a target package for vp dev, build, preview, and pack at a monorepo root: interactive shells get a fuzzy package picker, non-interactive runs list the candidates and exit 1 instead of building the root, and a new global -C <dir> flag or a defaultPackage setting (a single directory, or an object mapping each of the four commands to its own directory) skips the prompt (#2031, #2305), by @fengmk2
• Rename Vite+-specific environment variables to the VP_* prefix, so VITE_* stays reserved for env vars exposed to your application: VP_GIT_HOOKS (the old VITE_GIT_HOOKS is still accepted as a deprecated alias), plus VP_LOG, VP_GLOBAL_CLI_JS_SCRIPTS_DIR, and VP_UPDATE_TASK_TYPES, which have no compatibility aliases (#2195, #2312), by @dennybiasiolli and @jong-kyung
• Stop aborting with exit 134 on container images that ship no CA certificates (Debian slim, distroless): the shared HTTP client now retries once with the bundled Mozilla root list, like Node's own bundled roots, and reports a real error instead of panicking when it still cannot be built (#2273, #2295), by @jbmusso and @fengmk2
• Resolve the bundled Rolldown binding through platform packages instead of an undeclared require back into vite-plus, fixing Cannot find module 'vite-plus/binding' under pnpm enable-global-virtual-store, Yarn PnP, and standalone @voidzero-dev/vite-plus-core installs (#2313), by @fengmk2
• Add vp pm ci for reproducible frozen-lockfile installs, and vp pm patch / vp pm patch-commit for editing dependencies in place on pnpm, bun, and Yarn Berry (npm and Yarn Classic warn and exit successfully) (#2082, #2308), by @forehalo and @jong-kyung

Features

• Upgrade the bundled toolchain: vite 8.1.5 -> 8.2.0, rolldown 1.2.0 -> 1.2.2, oxlint 1.75.0 -> 1.76.0, oxfmt 0.60.0 -> 0.61.0, and Vite DevTools 0.4.5 -> 0.4.10 (#2302, #2311), by @voidzero-guard[bot]
• Read the Node.js version from .nvmrc when no other version source is present (#2244), by @BlankParticle
• Support pnpm v12, which ships as a native binary: Vite+ now downloads the platform-specific @pnpm/exe.* package and generates native shims, so pnpm and pnpx work instead of failing to exec (#2289), by @jong-kyung
• Verify the downloaded bun platform tarball against the registry dist.integrity hash (#2310), by @jong-kyung

Fixes & Enhancements

• Let vp config install the Git hook dispatcher without creating or modifying project hook scripts or staged-file configuration, so a custom .vite-hooks/pre-commit survives (#2280), by @TheAlexLichter
• Nest immutable global package installs under packages/<package>/<uuid> instead of using # in the path, which Node treated as a URL fragment and which broke dynamic imports inside installed packages (#2222), by @liangmiQwQ
• Keep the recorded version spec on global installs, so vp update -g follows a dist tag or range instead of silently resolving back to latest, vp outdated -g reports Wanted versus Latest, and vp update -g --latest explicitly moves packages back to latest (#2249), by @TheAlexLichter
• Stop deleting a managed Node.js runtime that another process is concurrently installing (#2248), by @shulaoda
• Preserve the real exit code when a spawned process is terminated by a signal on Unix (#2154), by @liangmiQwQ
• Honor an explicit vp create --package-manager outside monorepos instead of inheriting the manager from a non-monorepo ancestor directory (#2226), by @jong-kyung
• Scaffold the vite:library template into a directory that contains only .git, while still refusing to overwrite existing user files (#2287), by @RSS1102
• Render help for delegated commands from the local CLI, so vp <command> --help matches the installed toolchain instead of drifting (#2184), by @liangmiQwQ
• Resolve typeAware and typeCheck options inherited through Oxlint extends, so vp check --no-lint runs and classifies type checking correctly (#2228), by @jong-kyung
• Report (no version) instead of unknown when globally installing a local package that has no version field (#2232), by @liangmiQwQ

Refactor

• Consolidate the package manager infrastructure so typed command arguments are the source of truth for per-manager compatibility (#2140), by @forehalo
• Generate the Zed language settings from a language list instead of 17 near-identical blocks (#2294), by @jong-kyung
• Share the agent-file detect and write traversal helpers so both passes apply identical rules (#2296), by @jong-kyung
• Drop redundant clippy allow attributes in the global CLI (#2235), by @shulaoda

Docs

• Avoid a duplicate vp installation step in the onboarding prompt (#2291), by @Arcadi4
• Recommend stacked pull requests for submitting changes (#2281), by @fengmk2
• Correct stale delegation comments in the global CLI (#2236), by @shulaoda
• Improve the release draft review guidance in the release-manager skill (#2285), by @wan9chi

Chore

• Stop emitting unmet peer warnings for the vite-plus peer of oxfmt and oxlint on every install (#2321), by @fengmk2
• Remove duplicate direct dependency declarations so each build dependency is owned by one workspace (#2318), by @jong-kyung
• Declare @emnapi peers where @napi-rs/cli is used (#2319), by @jong-kyung
• Exclude rollup-tests from the workspace and update basic-ftp (#2322), by @fengmk2
• Remove unused EnvConfig fields (#2320), by @jong-kyung
• Remove the obsolete peer dependency merger tool (#2303), by @jong-kyung
• Refresh the trusted stack stats on the docs site (#2304), by @voidzero-guard[bot]
• Stop the staging deploy from triggering on external pull requests (#2293), by @BlankParticle
• Kill the real vp process, and kill it before its children, in the env_install_interrupt snapshot test (#2299, #2316), by @fengmk2
• Suppress racy optimizer logs in the vitest_browser_mode snapshot test (#2297), by @fengmk2
• Remove the obsolete auto-install environment from the snapshot tests (#2163), by @liangmiQwQ

Bundled Versions

Tool	Version	Source
vite	8.2.0	fa79f9a
rolldown	1.2.2	872b98a
tsdown	0.22.14	npm
vitest	4.1.10	npm
oxlint	1.76.0	npm
oxlint-tsgolint	7.0.2001	npm
oxfmt	0.61.0	npm

Upgrade

vp upgrade

New Contributors

@jbmusso, @Arcadi4, @dennybiasiolli, @RSS1102

Full Changelog: v0.2.7...v0.2.8

---

Merging this PR will trigger the release workflow.

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	8b23a00
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a71e32f1b20ec0008e3db16

[github-actions]

Native binary sizes (8b23a00)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact	Format	Base	PR	Change
vp (Linux x64)	Binary	10.52 MiB	10.52 MiB	0 B (0.00%)
vp (Linux x64)	gzip -9	4.55 MiB	4.55 MiB	+1.49 KiB (+0.03%)
NAPI (Linux x64)	Binary	33.66 MiB	33.66 MiB	0 B (0.00%)
NAPI (Linux x64)	gzip -9	13.05 MiB	13.04 MiB	-605 B (-0.00%)
vp (macOS ARM64)	Binary	7.84 MiB	7.84 MiB	0 B (0.00%)
vp (macOS ARM64)	gzip -9	3.96 MiB	3.96 MiB	-15 B (-0.00%)
NAPI (macOS ARM64)	Binary	40.95 MiB	40.95 MiB	0 B (0.00%)
NAPI (macOS ARM64)	gzip -9	17.26 MiB	17.26 MiB	-161 B (-0.00%)
vp (Windows x64)	Binary	8.43 MiB	8.43 MiB	0 B (0.00%)
vp (Windows x64)	gzip -9	3.67 MiB	3.67 MiB	-206 B (-0.01%)
NAPI (Windows x64)	Binary	27.81 MiB	27.81 MiB	0 B (0.00%)
NAPI (Windows x64)	gzip -9	10.88 MiB	10.88 MiB	+1.09 KiB (+0.01%)
Trampoline (Windows x64)	Binary	203.00 KiB	203.00 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	97.91 KiB	97.91 KiB	-1 B (-0.00%)
Installer (Windows x64)	Binary	4.46 MiB	4.46 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.09 MiB	2.09 MiB	0 B (0.00%)

[github-actions]

Registry bridge build (8b23a00)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
vite-plus	0.0.0-commit.8b23a00f98df4a9270ac87a4f80b2ce1b669040b
@voidzero-dev/vite-plus-core	0.0.0-commit.8b23a00f98df4a9270ac87a4f80b2ce1b669040b

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://vite.plus | VP_PR_VERSION=2325 bash

# Windows (PowerShell)
$env:VP_PR_VERSION="2325"; irm https://vite.plus/ps1 | iex

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	.npmrc: registry=https://registry-bridge.viteplus.dev/
Yarn (v2+)	.yarnrc.yml: npmRegistryServer: "https://registry-bridge.viteplus.dev/"

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.8b23a00f98df4a9270ac87a4f80b2ce1b669040b",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.8b23a00f98df4a9270ac87a4f80b2ce1b669040b"
  }
}

[github-actions]

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
ghcr.io/voidzero-dev/vite-plus:pr-2325	236MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-2325 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-2325

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-2325 vp --version

See docs/guide/docker.md for usage.

[liangmiQwQ]

• Rename Vite+-specific environment variables to the VP_* prefix, so VITE_* stays reserved for env vars exposed to your application: VP_GIT_HOOKS (the old VITE_GIT_HOOKS is still accepted as a deprecated alias), plus VP_LOG, VP_GLOBAL_CLI_JS_SCRIPTS_DIR, and VP_UPDATE_TASK_TYPES, which have no compatibility aliases (#2195, #2312), by @dennybiasiolli and @jong-kyung

@fengmk2 Should we mark the part two as a breaking change and follow semvar (v0.3.x for example) here?

[dennybiasiolli]

@liangmiQwQ not really breaking at the moment, because the old one is still supported, look here: https://github.com/voidzero-dev/vite-plus/blob/main/packages/cli/src/config/hooks.ts#L147-L152

But maybe adding a deprecation notice when the old one is used might be a good idea

[liangmiQwQ]

@liangmiQwQ not really breaking at the moment, because the old one is still supported, look here: https://github.com/voidzero-dev/vite-plus/blob/main/packages/cli/src/config/hooks.ts#L147-L152

But maybe adding a deprecation notice when the old one is used might be a good idea

Ah, I mean #2312, #2195 is indeed not a breaking change :)