feat(deps): upgrade upstream dependencies (#2519)

This PR upgrades upstream dependencies and adds two projects to
ecosystem CI.

Nuxt DevTools uses the `@vitejs/devtools` version from
`packages/core/package.json`.
Its test runs the build, type check, and unit tests on Linux and
Windows.
The fixture trusts the lockfile that the same CI job creates for the
local Vite+ registry.

The Tiptap test runs on Ubuntu.
It runs `vp run build && vp run build:demos`, `vp run lint`, and `vp run
test:unit`.
The fixture keeps Tiptap's upstream lint behavior after `vp migrate`.

The ecosystem workflow now uses the name `Ecosystem CI`.
The dependency upgrade workflow preserves the baseline PR details.
It adds verified release and commit links to the `Dependency updates`
table.

- This PR upgrades the upstream dependencies.
- It updates the pinned `vite` commit to `v8.2.2` (`de1111a`) and
`@vitejs/devtools` to `0.5.1`.
- `rolldown` stays on `v1.2.5` (`84c904b`). Vitest, tsdown, Oxlint,
Oxfmt, and the Oxc packages are unchanged.
- The required changes widen the `@vitejs/devtools` peer range and
update the recorded bundled Vite version. They also update one PTY
snapshot.

## Dependency updates

| Package | From | To |
| --- | --- | --- |
| `vite` | `v8.2.1`
([`4216158`](vitejs/vite@4216158))
| [`v8.2.2`](https://github.com/vitejs/vite/releases/tag/v8.2.2)
([`de1111a`](vitejs/vite@de1111a))
|
| `@vitejs/devtools` | `0.5.0` |
[`0.5.1`](https://github.com/vitejs/devtools/releases/tag/v0.5.1) |

<details><summary>Unchanged dependencies</summary>

- `rolldown`: `v1.2.5`
([`84c904b`](rolldown/rolldown@84c904b))
- `vitest`: `4.1.11`
- `@vitest/browser`: `4.1.11`
- `@vitest/browser-playwright`: `4.1.11`
- `@vitest/browser-preview`: `4.1.11`
- `@vitest/browser-webdriverio`: `4.1.11`
- `@vitest/expect`: `4.1.11`
- `@vitest/mocker`: `4.1.11`
- `@vitest/pretty-format`: `4.1.11`
- `@vitest/runner`: `4.1.11`
- `@vitest/snapshot`: `4.1.11`
- `@vitest/spy`: `4.1.11`
- `@vitest/utils`: `4.1.11`
- `tsdown`: `0.22.14`
- `@tsdown/css`: `0.22.14`
- `@tsdown/exe`: `0.22.14`
- `lightningcss`: `^1.33.0`
- `@oxc-node/cli`: `0.1.0`
- `@oxc-node/core`: `0.1.0`
- `oxfmt`: `0.64.0`
- `oxlint`: `1.79.0`
- `oxlint-tsgolint`: `7.0.2001`
- `@oxc-project/runtime`: `0.146.0`
- `@oxc-project/types`: `0.146.0`
- `oxc-minify`: `0.146.0`
- `oxc-parser`: `0.146.0`
- `oxc-transform`: `0.146.0`
- `VITEST_VERSION` constant: `4.1.11`
- README Vitest pins: `4.1.11`

</details>

## Code changes

- `packages/core/package.json` updates the `@vitejs/devtools` dependency
from `^0.5.0` to `^0.5.1`.
- The same file updates the peer range from `^0.4.0` to `^0.4.0 ||
^0.5.0`.
- The same file updates `bundledVersions.vite` from `8.2.1` to `8.2.2`.
- `packages/tools/.upstream-versions.json` updates the pinned Vite hash
to `de1111ab0be00879b404e7ed3b2a80e264edddc1`.
-
`crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_approve_builds_bun/snapshots/create_approve_builds_bun.md`
updates the recorded `bun pm trust <version> (...)` build hash.
- `pnpm-lock.yaml` refreshes the lockfile and its transitive
dependencies.
- `.github/workflows/e2e-test.yml` adds the Nuxt DevTools and Tiptap
tests. It also renames the workflow to `Ecosystem CI`.
- `ecosystem-ci/repo.json` adds the pinned Nuxt DevTools and Tiptap
repositories.
- `ecosystem-ci/patch-project.ts` aligns the DevTools version and trusts
the Nuxt lockfile. It also preserves Tiptap's lint behavior.
- `.github/workflows/upgrade-deps.yml` preserves baseline PR details. It
adds verified links to the dependency table.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: MK <fengmk2@gmail.com>

Author: voidzero-guard[bot]

.github/workflows/e2e-test.yml

@@ -1,4 +1,4 @@
-name: E2E Test
+name: Ecosystem CI
 
 permissions: {}
 
@@ -397,6 +397,18 @@ jobs:
               # submit a fix PR to varletjs/varlet after the next vite-plus release.
               vp run lint || true
               vp run test:coverage
+          - name: nuxt-devtools
+            node-version: 24
+            command: |
+              vp run build
+              vp run typecheck
+              vp run test:unit
+          - name: tiptap
+            node-version: 24
+            command: |
+              vp run build && vp run build:demos
+              vp run lint
+              vp run test:unit
         exclude:
           # frm-stack uses Docker (testcontainers) which doesn't work the same way on Windows
           - os: namespace-profile-windows-4c-8g
@@ -422,6 +434,10 @@ jobs:
           - os: namespace-profile-windows-4c-8g
             project:
               name: varlet
+          # tiptap upstream CI is ubuntu-only
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: tiptap
 
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

.github/workflows/upgrade-deps.yml

@@ -237,6 +237,8 @@ jobs:
             - Version changes (old -> new) in JSON: `${{ env.UPGRADE_DEPS_META_DIR }}/versions.json`
             - Baseline commit message: `${{ env.UPGRADE_DEPS_META_DIR }}/commit-message.txt`
             - Baseline PR body: `${{ env.UPGRADE_DEPS_META_DIR }}/pr-body.md`
+            - Read the baseline PR body before you write. Preserve each factual detail unless
+              `git diff` shows that the detail is no longer correct.
             - The working directory is the project root; all upgraded files are staged or modified.
               Use `git status` and `git diff` (including `git diff --stat` and focused per-file diffs)
               to discover what actually changed beyond the raw version bumps.
@@ -261,13 +263,20 @@ jobs:
               add a trailing `Code changes:` block listing each change with a file path.
 
             ### PR body format (Markdown)
-            Use these sections in order:
-            1. `## Summary` — 2-4 bullets describing what this PR does at a high level,
-               naming the most impactful upgrades (e.g., rolldown tag bump, vite bump,
-               vitest/tsdown bumps) and any required code adjustments.
+            Use this content in order:
+            1. Add 2-4 overview bullets without a `Summary` heading. Describe the most impactful
+               upgrades and all required code adjustments.
             2. `## Dependency updates` — a Markdown table with columns `Package | From | To`.
-               Use short 7-char SHAs for rolldown/vite hashes, and include the tag in the `To`
-               column when available. Omit packages whose old and new values are equal.
+               Link each target version to its changelog when a verified link is available.
+               Format the target version as inline code inside the Markdown link.
+               - Prefer an exact target-version release page in the official repository.
+               - If no release page exists, link to the target version in the official changelog.
+               - Use `gh api`, npm package metadata, and upstream repository files to verify links.
+               - Do not guess a URL. Keep the target version unlinked if you cannot verify a link.
+               Include the version and a short 7-char SHA in both `From` and `To` for `rolldown`
+               and `vite`. Link each SHA label to the full commit in the official repository.
+               Omit packages whose old and new values are equal.
+               Keep the baseline list of unchanged dependencies after the table.
             3. `## Code changes` — bullet list of the actual non-version edits, each naming
                the file(s) touched. If the only changes are version bumps + lockfile + generated
                bindings, write `- None beyond version bumps, lockfile, and formatter output.`.

ecosystem-ci/patch-project.ts

@@ -4,6 +4,7 @@ import { appendFile, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
 import { VITEST_VERSION } from '../packages/cli/src/utils/constants.ts';
+import vitePlusCorePkg from '../packages/core/package.json' with { type: 'json' };
 import { ecosystemCiDir, tgzDir, vitePlusTgzVersion } from './paths.ts';
 import repos from './repo.json' with { type: 'json' };
 
@@ -212,6 +213,37 @@ if (project === 'dify') {
   await writeFile(workspacePath, patched, 'utf-8');
 }
 
+if (project === 'nuxt-devtools') {
+  // The fixture's lockfile is generated earlier in this trusted CI job against
+  // the local registry. Trust that lockfile when package scripts invoke pnpm
+  // again: the registry's unpublished 0.0.0 tarballs do not have npm trust
+  // metadata, so a second supply-chain verification rejects them.
+  //
+  // Nuxt DevTools uses one YAML anchor for its Vite DevTools package family.
+  // Align that source with vite-plus-core so pnpm resolves the core package,
+  // kit, and optional integration peers as one compatible release family.
+  const workspacePath = join(repoRoot, 'pnpm-workspace.yaml');
+  const workspace = await readFile(workspacePath, 'utf-8');
+  const trustPolicy = 'trustPolicy: no-downgrade';
+  if (!workspace.includes(trustPolicy)) {
+    throw new Error(`nuxt-devtools patch: \`${trustPolicy}\` not found in ${workspacePath}`);
+  }
+  const viteDevtoolsVersionSource = /^([ \t]*vite-devtools:[ \t]+&vite-devtools[ \t]+)\S+[ \t]*$/m;
+  if (!viteDevtoolsVersionSource.test(workspace)) {
+    throw new Error(
+      `nuxt-devtools patch: Vite DevTools version source not found in ${workspacePath}`,
+    );
+  }
+  const viteDevtoolsVersion = vitePlusCorePkg.devDependencies['@vitejs/devtools'];
+  const patched = workspace
+    .replace(trustPolicy, `${trustPolicy}\ntrustLockfile: true`)
+    .replace(
+      viteDevtoolsVersionSource,
+      (_line, prefix: string) => `${prefix}${viteDevtoolsVersion}`,
+    );
+  await writeFile(workspacePath, patched, 'utf-8');
+}
+
 // Projects that already use vite-plus need VP_FORCE_MIGRATE=1 so
 // vp migrate runs full dependency rewriting instead of skipping.
 const forceFreshMigration = 'forceFreshMigration' in repoConfig && repoConfig.forceFreshMigration;
@@ -276,6 +308,22 @@ execSync(`${cli} migrate --no-agent --no-interactive`, {
   env: migrateEnv,
 });
 
+if (project === 'tiptap') {
+  // Keep Tiptap's upstream lint semantics. Migration enables type-aware type
+  // checking, which reports TypeScript diagnostics that upstream CI does not check.
+  const viteConfigPath = join(repoRoot, 'vite.config.mts');
+  const viteConfig = await readFile(viteConfigPath, 'utf-8');
+  const typeAwareOptions =
+    /,\s*(?:"options"|options):\s*\{\s*(?:"typeAware"|typeAware):\s*true,\s*(?:"typeCheck"|typeCheck):\s*true\s*\}/;
+  const patched = viteConfig.replace(typeAwareOptions, '');
+  if (patched === viteConfig) {
+    throw new Error(
+      `tiptap patch: migrated type-aware lint options not found in ${viteConfigPath}`,
+    );
+  }
+  await writeFile(viteConfigPath, patched, 'utf-8');
+}
+
 // Install through the local registry. `vp migrate` already pinned
 // `vite-plus@<version>` in package.json exactly like a real migration, so no
 // manual package.json rewrite is needed.

ecosystem-ci/repo.json

@@ -137,5 +137,16 @@
     "branch": "dev",
     "hash": "83f6c6a418ab9319e07d719d86d4fa952f99e266",
     "forceFreshMigration": true
+  },
+  "nuxt-devtools": {
+    "repository": "https://github.com/nuxt/devtools.git",
+    "branch": "main",
+    "hash": "a24195182241ddcce07f9d9e7972608eafbc93fb"
+  },
+  "tiptap": {
+    "repository": "https://github.com/ueberdosis/tiptap.git",
+    "branch": "main",
+    "hash": "f434577e6bb2010b321653cb132a57bda18764fa",
+    "forceFreshMigration": true
   }
 }

packages/core/package.json

@@ -128,7 +128,7 @@
     "@oxc-node/cli": "catalog:",
     "@tsdown/css": "catalog:",
     "@tsdown/exe": "catalog:",
-    "@vitejs/devtools": "^0.5.0",
+    "@vitejs/devtools": "^0.5.1",
     "es-module-lexer": "^1.7.0",
     "hookable": "^6.0.1",
     "magic-string": "^0.30.21",
@@ -150,7 +150,7 @@
   "peerDependencies": {
     "@arethetypeswrong/core": "^0.18.1",
     "@types/node": "^20.19.0 || >=22.12.0",
-    "@vitejs/devtools": "^0.4.0",
+    "@vitejs/devtools": "^0.4.0 || ^0.5.0",
     "esbuild": "^0.27.0 || ^0.28.0",
     "jiti": ">=1.21.0",
     "less": "^4.0.0",
@@ -226,7 +226,7 @@
     "node": "^20.19.0 || ^22.18.0 || >=24.11.0"
   },
   "bundledVersions": {
-    "vite": "8.2.1",
+    "vite": "8.2.2",
     "rolldown": "1.2.5",
     "tsdown": "0.22.14"
   }

packages/tools/.upstream-versions.json

@@ -7,6 +7,6 @@
   "vite": {
     "repo": "https://github.com/vitejs/vite.git",
     "branch": "main",
-    "hash": "421615865dad3ed39137d17281814fc78a41246c"
+    "hash": "de1111ab0be00879b404e7ed3b2a80e264edddc1"
   }
 }