# What changed in vite-plus

> 72 changes in vite-plus 0.1 to 1 from its official release notes, upgrade guides and advisories: 5 breaking, 10 security, 9 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/vite-plus/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## vite-plus 1

### Breaking changes

- The coding agent picker lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option; --agent claude and existing CLAUDE.md files still work. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- The coding agent picker lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option; --agent claude and existing CLAUDE.md files still work. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Hooks use the inherited environment with the project's `node_modules/.bin` first and no longer append legacy Vite+ bin directories to `PATH`. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Commands fail when the project's package manager does not support a named option instead of silently dropping it and continuing. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Asks users to type boom instead of uninstall to confirm. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)

### Security

- The installer verifies each downloaded platform archive against the registry's SHA-512 integrity digest and stops if it is missing or mismatched. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- The installer verifies each downloaded platform archive against the registry's SHA-512 integrity digest and stops if it is missing or mismatched. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Stops processing organization template archives that exceed fixed size, compression-ratio, or entry-count limits. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (1.1.0) — [security advisory](https://github.com/advisories/GHSA-R825-W8MM-5PXW)
- launch-editor: escapeCmdArgs() omits % escaping on Windows (1.1.0) — [security advisory](https://github.com/advisories/GHSA-698V-4R3X-3VCV)
- launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (1.1.0) — [security advisory](https://github.com/advisories/GHSA-587H-7WMJ-H5PM)

### New APIs and options

- Run Vite+ project creation through a package manager without installing the global vp CLI. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- The vp pm licenses command accepts this option for machine-readable output. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- The bundled Rolldown update adds the output.charset option. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- List dependency licenses through supported package managers. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Get, set, delete, and fix package.json through the detected package manager, subject to the stated package-manager version requirements. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Vite+ supports authenticated private npm registries. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Detailed output shows the cache input and output exclusions that allow a task to be cached. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Bun 1.4.1+ receives the --offline option. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Bun 1.4.1+ receives the --prefer-offline option. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)

### Performance

- Import rewriting is up to 14 times faster on large projects. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Tasks start faster on Linux. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Concurrent commands needing the same uninstalled Node.js version download it once; others wait and reuse the installation. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Sourcing the environment script in POSIX shells is much faster with a long `PATH`. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Reaches the local URL about 24% sooner and uses about 30% less parent-process memory because Vite and Vitest are no longer loaded there before the dev server starts. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)

### Behavior and default changes

- Accepts npm dist-tags in package-manager specs; pin resolves the tag to an exact version, while default follows the tag on each use. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Prints one result line per task instead of the task list and Git progress, while keeping warnings, errors, and rollback results visible. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- After a successful upgrade, reminds users of projects on an older Vite+ version to run vp migrate. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- On macOS, tasks can run Node.js single executable applications and `deno compile` outputs. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Oxfmt formats TOML in Markdown code blocks and frontmatter. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- On additional platforms without file-access tracking, tasks must configure both input and output explicitly to be cached. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Adds legacy tsdown compatibility settings only for projects using an older tsdown, preserving modern defaults for later versions. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- The summary reports cache hits among cache-enabled tasks and counts successful tasks instead of failed tasks. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- When a task reads and writes the same file and cannot be cached, its summary explains that it modified its inputs. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Tasks run through `vp run` remain cacheable with Vitest's on-disk caches enabled by default. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Shows a progress bar while downloading the new platform package. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- vp migrate now keeps the React Refresh option because the bundled Oxlint supports it. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn so tools use the project's package manager instead of falling back to npm. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)

### Tooling

- Generated generators add `rootDir: "src"` to `tsconfig.json` and use Zod 4 option schemas. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Keeps Oxlint rules written with plugin aliases and removes unsupported rules, listing removed rules in a warning. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)

### Fixes and other changes

- Now takes effect in vp dev, vp build, and vp preview. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Now takes effect in vp dev, vp build, and vp preview. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Now takes effect in vp dev, vp build, and vp preview. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Shows task output when used with vp staged. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- The bundled update fixes browser mode, hook cleanup after a failing hook, and --changed with quoted file names. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Prints Vite's ready in N ms line, preventing scripts that wait for it from timing out after vp migrate. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Stops when the build output is missing, matching vite preview behavior. (1.3.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.3.0)
- Works when the PowerShell profile enables `Set-StrictMode` and leaves the caller's strict mode unchanged. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Node.js and package-manager version ranges follow npm's semver rules. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Line disable comments apply to type-aware diagnostics again; comments moved for v1.1.0 need to move back above the statement. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Dependency reinstalls, installs at another path, and pnpm dependency rechecks no longer cause task cache misses. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Cached tasks can run scripts with shebang interpreter paths longer than 126 bytes. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- In PowerShell, failing commands set `$?` to `False` and stop `&&` chains, matching direct calls to `vp.exe`. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Skips Git config writes that change nothing, preventing concurrent setup in linked worktrees from failing after the first setup. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Keeps Prettier and continues migration when the Prettier config uses a format bundled Oxfmt cannot read. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Fails with an error suggesting `vp cache clean` when outputs from a cache hit cannot be restored. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- Concurrent tasks writing to a full output pipe no longer cause every task to stop. (1.2.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.2.0)
- On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at the termination prompt. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Playwright browser provider options keep their types. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- In an existing pnpm workspace, adds the catalog entries the new application needs so installation does not fail with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Reports a short error for a directory without package.json instead of an ENOENT stack trace. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Finds installed Vue language tools and TypeScript Go for declaration generation with isolated dependency layouts such as pnpm's global virtual store. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- On Windows, watch mode rebuilds with the new options after the config file changes. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- In Bun projects, falls back to npm as its warning says. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Yarn Classic accepts a single --filter option. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)
- Runs the Vitest doctor and complete subcommands instead of treating them as test file filters. (1.1.0) — [release notes](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.1.0)

## vite-plus 0.1

### Security

- launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (0.1.24) — [security advisory](https://github.com/advisories/GHSA-V6WH-96G9-6WX3)
- vite: `server.fs.deny` bypass on Windows alternate paths (0.1.24) — [security advisory](https://github.com/advisories/GHSA-FX2H-PF6J-XCFF)
- Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE (0.1.24) — [security advisory](https://github.com/advisories/GHSA-G8MR-85JM-7XHM)
- Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME (0.1.17) — [security advisory](https://github.com/advisories/GHSA-33R3-4WHC-44C2)