release: v1.0.0-rc.0: Vitest 5 migration and npm provenance checks (#2780)

Vite+ now uses Vitest 5, and `vp migrate` helps Vitest 4 projects adopt
the new APIs and defaults. Standalone installs and upgrades now require
verified npm provenance for release binaries.

### Breaking Changes

#### Vitest 5

`vp test` and the public `vite-plus/test*` exports now use
`vitest@5.0.1`
([#2551](#2551)), by
@fengmk2.

| Area | Old | New |
| --- | --- | --- |
| Test runner | `vitest@4.1.11` | `vitest@5.0.1` |
| CLI Node.js range | `^20.19.0 \|\| ^22.18.0 \|\| >=24.11.0` |
`^22.18.0 \|\| ^24.11.0 \|\| >=26.0.0` |
| `vite-plus/test/runners` and `vite-plus/test/suite` | Vite+
compatibility exports | Use supported APIs from `vite-plus/test`; review
unsupported runner and expect plugins |
| `vite-plus/test/browser-webdriverio` | Bundled export | Use the
community `@vitest/browser-webdriverio` package |

Run `vp migrate` from the workspace root before you install the new
dependencies. The migrator updates supported config, source, benchmark,
command, and import changes. It reports manual work as `BLOCK` or
`REVIEW` items. See the [Vitest 5 migration
guide](https://viteplus.dev/guide/vitest-v5) for the full process.
Projects can stay on the prior release until their runtimes and tests
are ready.

#### `vp staged` runtime requirements

`vp staged` now uses `lint-staged@17.5.1`
([#2754](#2754)), by
@fengmk2.

| Requirement | Old | New |
| --- | --- | --- |
| Node.js for `vp staged` | The Vite+ CLI runtime range | `^22.22.1 \|\|
^24.11.0 \|\| >=26.0.0` |
| Git | No separate documented minimum | `>=2.32.0` |

Update Node.js and Git on developer machines and CI runners that execute
`vp staged` or its pre-commit hook. Other workflows do not use these
extra requirements.

### Highlights

- Standalone installers, `vp upgrade`, and `vp-setup.exe` now reject
release binaries without supported SLSA provenance
([#2440](#2440)), by
@kazupon.
- Installers now show progress and the exact shell activation command.
Download progress preserves earlier terminal output
([#2744](#2744),
[#2741](#2741)), by
@fengmk2.
- System-first runtime and package-manager shims now use a fallback
directory at the end of `PATH`. Setup restores missing package-manager
preferences
([#2758](#2758),
[#2763](#2763)), by
@liangmiQwQ and @fengmk2.
- `vp run` now finishes when background processes remain. Large file
traces run without caching instead of killing the task
([#2767](#2767),
[vite-task#675](voidzero-dev/vite-task#675)), by
@wan9chi.

### Features

- `vp add` now supports shared install options such as `--offline`,
`--frozen-lockfile`, and `--lockfile-only`
([#2722](#2722)), by
@jong-kyung.
- `vp pm patch` and `vp pm patch-commit` now use the native commands in
npm 12 and later
([#2736](#2736)), by
@jong-kyung.
- `vp rebuild` now supports Yarn Berry and forwards package names and
extra arguments
([#2761](#2761)), by
@jong-kyung.
- The bundled tools update `oxlint` `1.83.0` -> `1.85.0`,
`oxlint-tsgolint` `7.0.2001` -> `7.0.2002`, and `oxfmt` `0.68.0` ->
`0.70.0` ([#2745](#2745),
[#2773](#2773),
[#2778](#2778)), by
@voidzero-guard[bot]. These versions can flag or format code that passed
before. Run `vp fmt` after upgrading if CI runs `vp check`.

### Fixes & Enhancements

- `oxlint` and `oxfmt` no longer expose bin wrappers that conflict with
upstream packages. Editors must use `vp lint --lsp`, `vp fmt --lsp`, or
`vp fmt --stdin-filepath`
([#2672](#2672)), by
@fengmk2.
- `vp create vite:generator` now replaces catalog references for package
managers that do not support catalogs
([#2720](#2720)), by
@SaKaNa-Y.
- Unpinned npm projects now use the npm version bundled with the
selected Node.js runtime. The same policy works during migration
([#2742](#2742),
[#2748](#2748)), by
@liangmiQwQ.
- The CLI now loads its local versions module through a file URL,
including on Windows paths
([#2749](#2749)), by
@YanChenBai.
- Package-manager commands now use pnpm when the project has no detected
package manager
([#2750](#2750)), by
@liangmiQwQ.
- `vp migrate` now removes unused `@oxlint/plugins` dependencies after
it rewrites plugin imports
([#2751](#2751)), by
@fengmk2.
- `vp update --no-save` now warns that Yarn Classic and Yarn Berry do
not support the option
([#2762](#2762)), by
@jong-kyung.
- `vp migrate` now explains its `tsdown@0.23` compatibility settings and
links to removal guidance
([#2769](#2769)), by
@fengmk2.
- Environment setup now installs and diagnoses the official `pn` and
`pnx` aliases for pnpm
([#2770](#2770)), by
@iruoy.
- Cached tasks now receive GitHub Actions OIDC variables, so npm Trusted
Publishing works through `vp run`
([vite-task#691](voidzero-dev/vite-task#691)),
by @naokihaba.
- Automatic task input tracking now records file access from signal
handlers
([vite-task#687](voidzero-dev/vite-task#687)),
by @wan9chi.

### Refactor

- `vp lint`, `vp fmt`, and `vp check` now use native config discovery.
Package commands keep matching workspace-root settings, while explicit
config flags take precedence
([#2731](#2731)), by
@fengmk2.

### Chore

- Generated workflows and `vp migrate` now use `setup-vp@v1.21.1`,
including its installation fixes
([#2760](#2760),
[#2772](#2772)), by
@renovate[bot] and @fengmk2.

### Bundled Versions

| Tool | Version | Source |
| --- | --- | --- |
| vite | `8.3.0` |
[`434e8e9`](vitejs/vite@434e8e9)
|
| rolldown | `1.2.9` |
[`5b4746e`](rolldown/rolldown@5b4746e)
|
| tsdown | `0.23.0` | [npm](https://npmx.dev/package/tsdown/v/0.23.0) |
| vitest | `5.0.1` | [npm](https://npmx.dev/package/vitest/v/5.0.1) |
| oxlint | `1.85.0` | [npm](https://npmx.dev/package/oxlint/v/1.85.0) |
| oxlint-tsgolint | `7.0.2002` |
[npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2002) |
| oxfmt | `0.70.0` | [npm](https://npmx.dev/package/oxfmt/v/0.70.0) |

### Upgrade

```bash
vp upgrade
```

### New Contributors

@YanChenBai, @iruoy

**Full Changelog**:
v0.3.3...v1.0.0-rc.0

---

Merging this PR will trigger the release workflow.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>

Author: voidzero-guard[bot]

Cargo.lock

@@ -4,7 +4,7 @@
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 info: Preparing Node.js and pnpm...
 info: Installing dependencies...
 ✓ Dependencies installed.

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/download_progress/snapshots/installation_progress_ci.md

@@ -6,7 +6,7 @@
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 ⠿ Preparing Node.js and pnpm... <duration>
 ```
 
@@ -16,7 +16,7 @@ info: installing vite-plus@0.3.3...
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 ⠿ Downloading pnpm <version>... <size> B (<size> B/s)
 ```
 
@@ -26,15 +26,15 @@ info: installing vite-plus@0.3.3...
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 ⠿ Installing dependencies... <duration>
 ```
 
 **← write-key:** `enter`
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 error: Setup error: Failed to install production dependencies (exit code: 17). See log for details: <workspace>/home/upgrade.log
 Failure log preserves pnpm stdout and stderr.
 After installation.

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/download_progress/snapshots/installation_progress_failure.md

@@ -6,7 +6,7 @@
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 ⠿ Preparing Node.js and pnpm... <duration>
 ```
 
@@ -16,7 +16,7 @@ info: installing vite-plus@0.3.3...
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 ⠿ Downloading pnpm <version>... <size> B (<size> B/s)
 ```
 
@@ -26,15 +26,15 @@ info: installing vite-plus@0.3.3...
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 ⠿ Installing dependencies... <duration>
 ```
 
 **← write-key:** `enter`
 
 ```
 Before installation: preserve this output.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 ✓ Dependencies installed.
 Setup:
   Preparing vite-plus environment.

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/download_progress/snapshots/installation_progress_interactive.md

@@ -6,7 +6,7 @@
 Before installation: preserve this output.
 Bootstrap stdout contains only shell assignments.
 After installation.
-info: installing vite-plus@0.3.3...
+info: installing vite-plus@<version>...
 info: Preparing Node.js and pnpm...
 info: Installing dependencies...
 ✓ Dependencies installed.

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/download_progress/snapshots/installation_progress_non_tty.md

@@ -10,5 +10,6 @@ stems, https:// URLs) survive.
 steps = [
   { argv = ["vpt", "print-native-path", "src/index.ts", "dist/assets/app.js"], comment = "prints OS-native separators; the snapshot must show forward slashes on every OS" },
   { argv = ["vpt", "print", "dist/assets/index-Dra_-aT4.js  0.71 kB / gzip: 0.40 kB / total 1 MB"], comment = "sizes and hash suffixes are masked" },
+  { argv = ["vpt", "print", "info: installing vite-plus@9.8.7-rc.6..."], comment = "standalone installer versions are masked" },
   { argv = ["vpt", "print", "keep vite-tsconfig.js and https://viteplus.dev/guide/ intact"], comment = "lowercase 8-letter stems and URLs survive redaction" },
 ]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/redaction/snapshots.toml

@@ -22,6 +22,14 @@ sizes and hash suffixes are masked
 dist/assets/index-<hash>.js  <size> kB / gzip: <size> kB / total <size> MB
 ```
 
+## `vpt print 'info: installing vite-plus@9.8.7-rc.6...'`
+
+standalone installer versions are masked
+
+```
+info: installing vite-plus@<version>...
+```
+
 ## `vpt print 'keep vite-tsconfig.js and https://viteplus.dev/guide/ intact'`
 
 lowercase 8-letter stems and URLs survive redaction

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/redaction/snapshots/redaction_selftest.md

@@ -120,6 +120,16 @@ static VP_VERSION_RE: LazyLock<regex::Regex> = LazyLock::new(|| {
     )
     .unwrap()
 });
+// Standalone installation progress prints the release version in
+// `info: installing vite-plus@0.3.3...`. The value changes for every release,
+// so mask only this status-line context and keep other `vite-plus@<version>`
+// output available for assertions.
+static VP_INSTALL_VERSION_RE: LazyLock<regex::Regex> = LazyLock::new(|| {
+    regex::Regex::new(
+        r"(installing vite-plus@)\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?",
+    )
+    .unwrap()
+});
 // `vp create`/`vp migrate` pin the exact resolved runtime and package-manager
 // version into a scaffolded manifest's `devEngines` block (`{ "name": "yarn",
 // "version": "4.17.0", ... }`, likewise pnpm/bun/node). Those track whatever
@@ -539,6 +549,9 @@ pub fn redact_output(
     // (see VP_VERSION_RE), which bumps on every release.
     output = VP_VERSION_RE.replace_all(&output, "${1}<version>").into_owned();
 
+    // Redact the release version in standalone installation progress output.
+    output = VP_INSTALL_VERSION_RE.replace_all(&output, "${1}<version>").into_owned();
+
     // Redact scaffolded devEngines runtime/package-manager pins by name
     // context (see DEV_ENGINES_VERSION_RE), which track upstream releases.
     output = DEV_ENGINES_VERSION_RE.replace_all(&output, "${1}<version>").into_owned();

crates/vp_cli_snapshots/tests/cli_snapshots/redact.rs

@@ -1,6 +1,6 @@
 [package]
 name = "vp_global_cli"
-version = "0.3.3"
+version = "1.0.0-rc.0"
 authors.workspace = true
 edition.workspace = true
 license.workspace = true

crates/vp_global_cli/Cargo.toml

@@ -1,4 +1,4 @@
-const localMigrationPrompt = `Without a global installation, run the target CLI through the package manager from the workspace root. For the 1.0.0 release, use \`pnpm dlx --package=vite-plus@1.0.0 vp migrate --no-interactive\` or \`npx --package=vite-plus@1.0.0 vp migrate --no-interactive\`. First run the same command with \`help migrate\` instead of \`migrate --no-interactive\` to read its help. These commands fetch the target CLI without replacing the old project dependencies first.`;
+const localMigrationPrompt = `Without a global installation, run the target CLI through the package manager from the workspace root. For the 1.0.0-rc.0 release, use \`pnpm dlx --package=vite-plus@1.0.0-rc.0 vp migrate --no-interactive\` or \`npx --package=vite-plus@1.0.0-rc.0 vp migrate --no-interactive\`. First run the same command with \`help migrate\` instead of \`migrate --no-interactive\` to read its help. These commands fetch the target CLI without replacing the old project dependencies first.`;
 
 const compatibilityReviewPrompt = `After establishing a passing baseline, try to remove the generated "Vitest v4 compatibility" settings with no code changes or small, localized fixes:
 
@@ -28,7 +28,7 @@ Use the CLI from the target Vite+ 1.0 release or its preview build. Use a suppor
 - With a global vp installation, follow ${__DOCS_ORIGIN__}/guide/upgrade to select the target release and check \`vp toolchain --global\`. Run \`vp help\` and \`vp help migrate\`, then \`vp migrate --no-interactive\` from the workspace root.
 - ${localMigrationPrompt}
 
-Replace 1.0.0 with the intended release version. For a preview, use the version from its PR and pass \`--registry=https://registry-bridge.viteplus.dev\` to pnpm or npx before the vp command.
+Replace 1.0.0-rc.0 with the intended release version. For a preview, use the version from its PR and pass \`--registry=https://registry-bridge.viteplus.dev\` to pnpm or npx before the vp command.
 
 Do not run migration with an old project's node_modules/.bin/vp. Migrate monorepos from the workspace root so shared manifests, catalogs, overrides, and lockfiles remain consistent.
 
@@ -64,7 +64,7 @@ Use the CLI from the target Vite+ 1.0 release or its preview build. A global ins
 - With a global vp installation, follow ${__DOCS_ORIGIN__}/guide/upgrade to upgrade it and check \`vp toolchain --global\`. Run \`vp help migrate\`, then \`vp migrate --no-interactive\` from the workspace root.
 - ${localMigrationPrompt}
 
-Replace 1.0.0 with the intended release version. For a preview, use the version from its PR and pass \`--registry=https://registry-bridge.viteplus.dev\` to pnpm or npx before the vp command. Do not run migration with the old project's node_modules/.bin/vp. Keep the existing project setup; do not use --full unless I request it.
+Replace 1.0.0-rc.0 with the intended release version. For a preview, use the version from its PR and pass \`--registry=https://registry-bridge.viteplus.dev\` to pnpm or npx before the vp command. Do not run migration with the old project's node_modules/.bin/vp. Keep the existing project setup; do not use --full unless I request it.
 
 Resolve BLOCK findings and rerun migration. Review each REVIEW finding using its documentation link, even if migration exits with success. Preserve test intent and keep the generated Vitest v4 and tsdown <0.23 compatibility settings and comments for the first validation run.
 
@@ -91,7 +91,7 @@ A global installation is optional. To install the global \`vp\` CLI when it is n
 
 Open a new terminal after installation. Follow ${__DOCS_ORIGIN__}/guide/upgrade to select the target release or preview and check \`vp toolchain --global\` before scaffolding.
 
-Without a global installation, use a supported Node.js runtime from the compatibility guide. For the 1.0.0 release, run \`pnpm dlx --package=vite-plus@1.0.0 vp create\` or \`npx --package=vite-plus@1.0.0 vp create\`. Replace 1.0.0 with the intended release version. For a preview, use the version from its PR and pass \`--registry=https://registry-bridge.viteplus.dev\` to pnpm or npx before the vp command.
+Without a global installation, use a supported Node.js runtime from the compatibility guide. For the 1.0.0-rc.0 release, run \`pnpm dlx --package=vite-plus@1.0.0-rc.0 vp create\` or \`npx --package=vite-plus@1.0.0-rc.0 vp create\`. Replace 1.0.0-rc.0 with the intended release version. For a preview, use the version from its PR and pass \`--registry=https://registry-bridge.viteplus.dev\` to pnpm or npx before the vp command.
 
 Run \`vp install\`, \`vp check\`, and \`vp test\`, then \`vp build\` for applications or \`vp pack\` for libraries. Without a global CLI, install with the project's package manager and run the local CLI through it, such as \`pnpm exec vp check\` or \`npm exec -- vp check\`. Explain how to use \`vp dev\` for the dev server and \`vp run <task>\` for project scripts or tasks. Report the setup changes, validation results, and any remaining work. Do not commit or push unless I ask.