feat(deps): upgrade upstream dependencies (#2670)

Upgrade Rolldown to `1.2.8`, Vite to `8.3.0`, Oxlint to `1.82.0`, and
Oxfmt to `0.67.0`.

Update the Rust parser for the Oxc `fatal_error` field. Add a test for
invalid configuration files and keep the generated NAPI updates. Isolate
the missing-dependency test from pnpm’s `NODE_PATH` and the Bun fixture
from old `bun x` caches.

## Dependency updates

| Package | From | To |
| --- | --- | --- |
| `rolldown` | `1.2.7`
([`26b4c6e`](rolldown/rolldown@26b4c6e))
| [`1.2.8`](https://github.com/rolldown/rolldown/releases/tag/v1.2.8)
([`9704b56`](rolldown/rolldown@9704b56))
|
| `vite` | `8.2.2`
([`de1111a`](vitejs/vite@de1111a))
| [`8.3.0`](https://github.com/vitejs/vite/releases/tag/v8.3.0)
([`434e8e9`](vitejs/vite@434e8e9))
|
| `oxfmt` | `0.66.0` |
[`0.67.0`](https://github.com/oxc-project/oxc/releases/tag/apps_v1.82.0)
|
| `oxlint` | `1.81.0` |
[`1.82.0`](https://github.com/oxc-project/oxc/releases/tag/apps_v1.82.0)
|
| `@oxc-project/runtime` | `0.148.0` |
[`0.149.0`](https://github.com/oxc-project/oxc/releases/tag/crates_v0.149.0)
|
| `@oxc-project/types` | `0.148.0` |
[`0.149.0`](https://github.com/oxc-project/oxc/releases/tag/crates_v0.149.0)
|
| `oxc-minify` | `0.148.0` |
[`0.149.0`](https://github.com/oxc-project/oxc/releases/tag/crates_v0.149.0)
|
| `oxc-parser` | `0.148.0` |
[`0.149.0`](https://github.com/oxc-project/oxc/releases/tag/crates_v0.149.0)
|
| `oxc-transform` | `0.148.0` |
[`0.149.0`](https://github.com/oxc-project/oxc/releases/tag/crates_v0.149.0)
|
| `@vitejs/devtools` development range | `^0.4.12` | `^0.7.1` |
| `@vitejs/devtools` peer range | `^0.4.0 \|\| ^0.5.0` | `^0.7.1` |
| `@napi-rs/cli` catalog | `^3.8.2` | `^3.9.0` |
| `web-tree-sitter` catalog | `^0.26.0` | `^0.27.0` |
| Rust Oxc crates | `0.148.0` |
[`0.149.0`](https://github.com/oxc-project/oxc/releases/tag/crates_v0.149.0)
|
| `jsonschema` workspace range | `0.46.5` | `0.55.0` |
| `smallvec` workspace range | `1.15.1` | `1.16.0` |

<details><summary>Unchanged dependencies</summary>

- `vitest`: `4.1.11`
- `@vitest/browser`: `4.1.11`
- `@vitest/browser-playwright`: `4.1.11`
- `@vitest/browser-preview`: `4.1.11`
- `@vitest/browser-webdriverio`: `4.1.11`
- `@vitest/expect`: `4.1.11`
- `@vitest/mocker`: `4.1.11`
- `@vitest/pretty-format`: `4.1.11`
- `@vitest/runner`: `4.1.11`
- `@vitest/snapshot`: `4.1.11`
- `@vitest/spy`: `4.1.11`
- `@vitest/utils`: `4.1.11`
- `tsdown`: `0.23.0`
- `@tsdown/css`: `0.23.0`
- `@tsdown/exe`: `0.23.0`
- `lightningcss`: `^1.33.0`
- `@oxc-node/cli`: `0.1.0`
- `@oxc-node/core`: `0.1.0`
- `oxlint-tsgolint`: `7.0.2001`
- `VITEST_VERSION constant`: `4.1.11`
- `README vitest pins`: `4.1.11`

</details>

## Code changes

- `crates/vp_static_config/src/lib.rs`: use `ParserReturn.fatal_error`
and test runtime fallback for invalid syntax.
- `packages/cli/src/__tests__/resolve-core.spec.ts`: run the
missing-dependency test without global Node search paths.
-
`crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_dlx_bun/`:
isolate `TMPDIR` and update the recorded command headings.
- `Cargo.toml`: match the changed Rolldown workspace dependencies.
- `packages/core/package.json`: sync the Vite DevTools ranges and
bundled versions.
- `pnpm-workspace.yaml`: exempt Vite DevTools packages from the minimum
release age, as with other bundled upstream packages.
- `packages/cli/binding/index.cjs` and
`packages/cli/binding/index.d.cts`: keep the regenerated loader and
declarations.

## Build status

- `sync-remote-and-build`: passed.
- `build-upstream`: passed on `aarch64-apple-darwin`.
- `just build`, Rust checks, lint, and unit tests: passed.
- Full CLI snapshots: passed, with 819 cases and one ignored case.

Author: fengmk2

Cargo.lock

@@ -208,7 +208,7 @@ itertools = "0.15.0"
 itoa = "1.0.15"
 json-escape-simd = "3"
 json-strip-comments = "3"
-jsonschema = { version = "0.46.5", default-features = false }
+jsonschema = { version = "0.55.0", default-features = false }
 junction = "1.4.1"
 libtest-mimic = "0.8.2"
 memchr = "2.7.4"
@@ -270,7 +270,7 @@ sha1 = "0.10.6"
 sha2 = "0.10.9"
 shell-escape = "0.1.5"
 simdutf8 = "0.1.5"
-smallvec = { version = "1.15.1", features = ["union"] }
+smallvec = { version = "1.16.0", features = ["union"] }
 snapshot_test = { git = "https://github.com/voidzero-dev/vite-task.git", rev = "d05b1dcdbaabaa69643ee0b89cebe3cd390957e9" }
 string_cache = "0.9.0"
 sugar_path = { version = "3", features = ["cached_current_dir"] }
@@ -319,7 +319,7 @@ xxhash-rust = "0.8.15"
 zip = { version = "7.2", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 
 # oxc crates with the same version
-oxc = { version = "0.148.0", features = [
+oxc = { version = "0.149.0", features = [
   "ast_visit",
   "transformer",
   "minifier",
@@ -331,17 +331,17 @@ oxc = { version = "0.148.0", features = [
   "regular_expression",
   "cfg",
 ] }
-oxc_allocator = { version = "0.148.0", features = ["pool"] }
-oxc_ast = "0.148.0"
-oxc_ecmascript = "0.148.0"
-oxc_parser = "0.148.0"
-oxc_span = "0.148.0"
-oxc_napi = "0.148.0"
-oxc_str = "0.148.0"
-oxc_minify_napi = "0.148.0"
-oxc_parser_napi = "0.148.0"
-oxc_transform_napi = "0.148.0"
-oxc_traverse = "0.148.0"
+oxc_allocator = { version = "0.149.0", features = ["pool"] }
+oxc_ast = "0.149.0"
+oxc_ecmascript = "0.149.0"
+oxc_parser = "0.149.0"
+oxc_span = "0.149.0"
+oxc_napi = "0.149.0"
+oxc_str = "0.149.0"
+oxc_minify_napi = "0.149.0"
+oxc_parser_napi = "0.149.0"
+oxc_transform_napi = "0.149.0"
+oxc_traverse = "0.149.0"
 
 # oxc crates in their own repos
 oxc_index = { version = "5", features = ["rayon", "serde"] }

Cargo.toml

@@ -3,8 +3,10 @@ name = "command_dlx_bun"
 vp = "global"
 local-registry = true
 skip-platforms = ["windows"]
+# bun x caches lockfiles under TMPDIR, separately from BUN_INSTALL_CACHE_DIR.
+# Isolate them so tarball URLs cannot refer to a previous test registry.
 steps = [
   { argv = ["vp", "dlx", "--help"], comment = "should show help message", continue-on-failure = true },
-  { argv = ["vp", "dlx", "-s", "cowsay", "hello"], comment = "should run cowsay with bun x", continue-on-failure = true },
-  { argv = ["vp", "dlx", "-s", "cowsay@1.6.0", "hello"], comment = "should run specific version", continue-on-failure = true },
+  { argv = ["vp", "dlx", "-s", "cowsay", "hello"], envs = [["TMPDIR", "${workspace}"]], comment = "should run cowsay with bun x", continue-on-failure = true },
+  { argv = ["vp", "dlx", "-s", "cowsay@1.6.0", "hello"], envs = [["TMPDIR", "${workspace}"]], comment = "should run specific version", continue-on-failure = true },
 ]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_dlx_bun/snapshots.toml

@@ -23,7 +23,7 @@ Options:
 Documentation: https://viteplus.dev/guide/vpx
 ```
 
-## `vp dlx -s cowsay hello`
+## `TMPDIR=${workspace} vp dlx -s cowsay hello`
 
 should run cowsay with bun x
 
@@ -38,7 +38,7 @@ should run cowsay with bun x
                 ||     ||
 ```
 
-## `vp dlx -s cowsay@1.6.0 hello`
+## `TMPDIR=${workspace} vp dlx -s cowsay@1.6.0 hello`
 
 should run specific version
 

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_dlx_bun/snapshots/command_dlx_bun.md

@@ -148,7 +148,7 @@ fn parse_js_ts_config(source: &str, extension: &str) -> FieldMap {
     let parser = Parser::new(&allocator, source, source_type);
     let result = parser.parse();
 
-    if result.panicked || !result.diagnostics.is_empty() {
+    if result.fatal_error || !result.diagnostics.is_empty() {
         return FieldMap::unanalyzable();
     }
 
@@ -1320,6 +1320,19 @@ mod tests {
 
     // ── Not analyzable cases ─────────────────────────────────────────────
 
+    #[test]
+    fn syntax_errors_require_runtime_evaluation() {
+        for source in [
+            "export default { run: { cache: true }",
+            "export default { run: { cache: true } }; const missing;",
+        ] {
+            let result = parse(source);
+            assert_non_static(&result, "run");
+            assert_non_static(&result, "defaultPackage");
+            assert_eq!(result.get_declared("run"), None);
+        }
+    }
+
     #[test]
     fn returns_none_for_no_default_export() {
         assert_non_static(&parse_js_ts_config("export const config = { a: 1 };", "ts"), "run");

crates/vp_static_config/src/lib.rs

@@ -1,4 +1,3 @@
-// prettier-ignore
 /* eslint-disable */
 // @ts-nocheck
 /* auto-generated by NAPI-RS */

packages/cli/binding/index.cjs

@@ -306,6 +306,7 @@ export interface TreeShakeOptions {
    */
   invalidImportSideEffects?: boolean;
 }
+
 export interface Comment {
   type: 'Line' | 'Block';
   value: string;
@@ -332,6 +333,7 @@ export declare const enum Severity {
   Warning = 'Warning',
   Advice = 'Advice',
 }
+
 export declare class ParseResult {
   get program(): import('@oxc-project/types').Program;
   get module(): EcmaScriptModule;
@@ -610,6 +612,7 @@ export interface ValueSpan {
   start: number;
   end: number;
 }
+
 export declare class ResolverFactory {
   constructor(options?: NapiResolveOptions | undefined | null);
   static default(): ResolverFactory;
@@ -919,6 +922,7 @@ export interface TsconfigOptions {
    */
   references?: 'auto';
 }
+
 export interface SourceMap {
   file?: string;
   mappings: string;
@@ -929,6 +933,7 @@ export interface SourceMap {
   version: number;
   x_google_ignoreList?: Array<number>;
 }
+
 export interface ArrowFunctionsOptions {
   /**
    * This option enables the following:
@@ -1604,6 +1609,7 @@ export interface TypeScriptOptions {
    */
   rewriteImportExtensions?: 'rewrite' | 'remove' | boolean;
 }
+
 export declare class BindingBundleEndEventData {
   output: string;
   duration: number;
@@ -2180,6 +2186,7 @@ export interface BindingDevOptions {
   onAdditionalAssets?: undefined | ((output: BindingOutputs) => void | Promise<void>);
   rebuildStrategy?: BindingRebuildStrategy;
   watch?: BindingDevWatchOptions;
+  hotUpdate?: boolean;
 }
 
 export interface BindingDevtoolsOptions {
@@ -2705,6 +2712,7 @@ export interface BindingManualCodeSplittingOptions {
   maxSize?: number;
   minModuleSize?: number;
   maxModuleSize?: number;
+  internalInvalidateModuleInfoCache?: () => void;
 }
 
 export interface BindingMatchGroup {
@@ -3434,6 +3442,7 @@ export declare function startAsyncRuntime(): void;
 export interface ViteImportGlobMeta {
   isSubImportsPattern?: boolean;
 }
+
 /** Error from batch import rewriting */
 export interface BatchRewriteError {
   /** The file path that had an error */

packages/cli/binding/index.d.cts

@@ -1,3 +1,4 @@
+import { execFileSync } from 'node:child_process';
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -113,7 +114,19 @@ describe('resolveCore', () => {
   it('does not fall back to the project when the CLI dependency is missing', () => {
     writeCore(projectCore);
     rmSync(bundled, { recursive: true });
-    expect(() => resolveCore('', project, cliModule)).toThrow('Could not resolve the bundled Vite');
+    // pnpm injects NODE_PATH, which can supply an unrelated Vite package.
+    // Check the missing dependency in a process without global search paths.
+    execFileSync(process.execPath, [
+      '--no-global-search-paths',
+      '--input-type=module',
+      '--eval',
+      `import { strict as assert } from 'node:assert';
+       import { resolveCore } from ${JSON.stringify(new URL('../resolve-core.ts', import.meta.url).href)};
+       assert.throws(
+         () => resolveCore('', ${JSON.stringify(project)}, ${JSON.stringify(cliModule)}),
+         /Could not resolve the bundled Vite/,
+       );`,
+    ]);
   });
 
   it.each(['project', 'bundled'])('rejects upstream Vite in the %s dependency', (location) => {

packages/cli/src/__tests__/resolve-core.spec.ts

@@ -125,7 +125,7 @@
     "@oxc-node/cli": "catalog:",
     "@tsdown/css": "catalog:",
     "@tsdown/exe": "catalog:",
-    "@vitejs/devtools": "^0.4.12",
+    "@vitejs/devtools": "^0.7.1",
     "es-module-lexer": "^1.7.0",
     "hookable": "^6.0.1",
     "magic-string": "^0.30.21",
@@ -147,7 +147,7 @@
   "peerDependencies": {
     "@arethetypeswrong/core": "^0.18.1",
     "@types/node": "^20.19.0 || >=22.12.0",
-    "@vitejs/devtools": "^0.4.0 || ^0.5.0",
+    "@vitejs/devtools": "^0.7.1",
     "esbuild": "^0.27.0 || ^0.28.0",
     "jiti": ">=1.21.0",
     "less": "^4.0.0",
@@ -223,8 +223,8 @@
     "node": "^20.19.0 || ^22.18.0 || >=24.11.0"
   },
   "bundledVersions": {
-    "vite": "8.2.2",
-    "rolldown": "1.2.7",
+    "vite": "8.3.0",
+    "rolldown": "1.2.8",
     "tsdown": "0.23.0"
   }
 }

packages/core/package.json

@@ -2,11 +2,11 @@
   "rolldown": {
     "repo": "https://github.com/rolldown/rolldown.git",
     "branch": "main",
-    "hash": "26b4c6e56c5553d72a910d0f73d60fa331c0ed88"
+    "hash": "9704b565076baf57b3703c98ebde973855506a68"
   },
   "vite": {
     "repo": "https://github.com/vitejs/vite.git",
     "branch": "main",
-    "hash": "de1111ab0be00879b404e7ed3b2a80e264edddc1"
+    "hash": "434e8e9495436a60789f2b588a04a6a24a3d1661"
   }
 }