unstale

npm / vite-plus

vite-plus

What changed in vite-plus 0.1 to 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

5 breaking10 security9 new APIs and options5 performance14 behavior and defaults2 tooling27 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

vite-plus 168 changes

Breaking changes 5

  • The coding agent picker lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option; --agent claude and existing CLAUDE.md files still work.

    1.3.0release notes

  • The coding agent picker lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option; --agent claude and existing CLAUDE.md files still work.

    1.3.0release notes

  • Hooks use the inherited environment with the project's node_modules/.bin first and no longer append legacy Vite+ bin directories to PATH.

    1.2.0release notes

  • Commands fail when the project's package manager does not support a named option instead of silently dropping it and continuing.

    1.1.0release notes

  • Asks users to type boom instead of uninstall to confirm.

    1.1.0release notes

Security 6

  • The installer verifies each downloaded platform archive against the registry's SHA-512 integrity digest and stops if it is missing or mismatched.

    1.2.0release notes

  • The installer verifies each downloaded platform archive against the registry's SHA-512 integrity digest and stops if it is missing or mismatched.

    1.2.0release notes

  • Stops processing organization template archives that exceed fixed size, compression-ratio, or entry-count limits.

    1.2.0release notes

  • launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

    1.1.0security advisory

  • launch-editor: escapeCmdArgs() omits % escaping on Windows

    1.1.0security advisory

  • launch-editor: fs.existsSync() existence check can be bypassed on Windows

    1.1.0security advisory

New APIs and options 9

  • Run Vite+ project creation through a package manager without installing the global vp CLI.

    1.3.0release notes

  • The vp pm licenses command accepts this option for machine-readable output.

    1.3.0release notes

  • The bundled Rolldown update adds the output.charset option.

    1.3.0release notes

  • List dependency licenses through supported package managers.

    1.3.0release notes

  • Get, set, delete, and fix package.json through the detected package manager, subject to the stated package-manager version requirements.

    1.3.0release notes

  • Vite+ supports authenticated private npm registries.

    1.2.0release notes

  • Detailed output shows the cache input and output exclusions that allow a task to be cached.

    1.2.0release notes

  • Bun 1.4.1+ receives the --offline option.

    1.1.0release notes

  • Bun 1.4.1+ receives the --prefer-offline option.

    1.1.0release notes

Performance 5

  • Import rewriting is up to 14 times faster on large projects.

    1.3.0release notes

  • Tasks start faster on Linux.

    1.2.0release notes

  • Concurrent commands needing the same uninstalled Node.js version download it once; others wait and reuse the installation.

    1.2.0release notes

  • Sourcing the environment script in POSIX shells is much faster with a long PATH.

    1.2.0release notes

  • Reaches the local URL about 24% sooner and uses about 30% less parent-process memory because Vite and Vitest are no longer loaded there before the dev server starts.

    1.1.0release notes

Behavior and default changes 14

  • Accepts npm dist-tags in package-manager specs; pin resolves the tag to an exact version, while default follows the tag on each use.

    1.3.0release notes

  • Prints one result line per task instead of the task list and Git progress, while keeping warnings, errors, and rollback results visible.

    1.3.0release notes

  • After a successful upgrade, reminds users of projects on an older Vite+ version to run vp migrate.

    1.3.0release notes

  • On macOS, tasks can run Node.js single executable applications and deno compile outputs.

    1.2.0release notes

  • Oxfmt formats TOML in Markdown code blocks and frontmatter.

    1.2.0release notes

  • On additional platforms without file-access tracking, tasks must configure both input and output explicitly to be cached.

    1.2.0release notes

  • Adds legacy tsdown compatibility settings only for projects using an older tsdown, preserving modern defaults for later versions.

    1.2.0release notes

  • The summary reports cache hits among cache-enabled tasks and counts successful tasks instead of failed tasks.

    1.2.0release notes

  • When a task reads and writes the same file and cannot be cached, its summary explains that it modified its inputs.

    1.2.0release notes

  • Tasks run through vp run remain cacheable with Vitest's on-disk caches enabled by default.

    1.2.0release notes

  • Shows a progress bar while downloading the new platform package.

    1.2.0release notes

  • vp migrate now keeps the React Refresh option because the bundled Oxlint supports it.

    1.1.0release notes

  • Prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions.

    1.1.0release notes

  • Sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn so tools use the project's package manager instead of falling back to npm.

    1.1.0release notes

Tooling 2

  • Generated generators add rootDir: "src" to tsconfig.json and use Zod 4 option schemas.

    1.2.0release notes

  • Keeps Oxlint rules written with plugin aliases and removes unsupported rules, listing removed rules in a warning.

    1.1.0release notes

Fixes and other changes 27

  • Now takes effect in vp dev, vp build, and vp preview.

    1.3.0release notes

  • Now takes effect in vp dev, vp build, and vp preview.

    1.3.0release notes

  • Now takes effect in vp dev, vp build, and vp preview.

    1.3.0release notes

  • Shows task output when used with vp staged.

    1.3.0release notes

  • The bundled update fixes browser mode, hook cleanup after a failing hook, and --changed with quoted file names.

    1.3.0release notes

  • Prints Vite's ready in N ms line, preventing scripts that wait for it from timing out after vp migrate.

    1.3.0release notes

  • Stops when the build output is missing, matching vite preview behavior.

    1.3.0release notes

  • Works when the PowerShell profile enables Set-StrictMode and leaves the caller's strict mode unchanged.

    1.2.0release notes

  • Node.js and package-manager version ranges follow npm's semver rules.

    1.2.0release notes

  • Line disable comments apply to type-aware diagnostics again; comments moved for v1.1.0 need to move back above the statement.

    1.2.0release notes

  • Dependency reinstalls, installs at another path, and pnpm dependency rechecks no longer cause task cache misses.

    1.2.0release notes

  • Cached tasks can run scripts with shebang interpreter paths longer than 126 bytes.

    1.2.0release notes

  • In PowerShell, failing commands set $? to False and stop && chains, matching direct calls to vp.exe.

    1.2.0release notes

  • Skips Git config writes that change nothing, preventing concurrent setup in linked worktrees from failing after the first setup.

    1.2.0release notes

  • Keeps Prettier and continues migration when the Prettier config uses a format bundled Oxfmt cannot read.

    1.2.0release notes

  • Fails with an error suggesting vp cache clean when outputs from a cache hit cannot be restored.

    1.2.0release notes

  • Concurrent tasks writing to a full output pipe no longer cause every task to stop.

    1.2.0release notes

  • On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at the termination prompt.

    1.1.0release notes

  • Playwright browser provider options keep their types.

    1.1.0release notes

  • In an existing pnpm workspace, adds the catalog entries the new application needs so installation does not fail with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC.

    1.1.0release notes

  • Leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one.

    1.1.0release notes

  • Reports a short error for a directory without package.json instead of an ENOENT stack trace.

    1.1.0release notes

  • Finds installed Vue language tools and TypeScript Go for declaration generation with isolated dependency layouts such as pnpm's global virtual store.

    1.1.0release notes

  • On Windows, watch mode rebuilds with the new options after the config file changes.

    1.1.0release notes

  • In Bun projects, falls back to npm as its warning says.

    1.1.0release notes

  • Yarn Classic accepts a single --filter option.

    1.1.0release notes

  • Runs the Vitest doctor and complete subcommands instead of treating them as test file filters.

    1.1.0release notes

vite-plus 0.14 changes

Security 4

  • launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

    0.1.24security advisory

  • vite: server.fs.deny bypass on Windows alternate paths

    0.1.24security advisory

  • Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

    0.1.24security advisory

  • Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

    0.1.17security advisory