feat(deps): upgrade upstream dependencies

Cargo.toml

@@ -208,7 +208,7 @@ itertools = "0.15.0"
 itoa = "1.0.15"
 json-escape-simd = "3"
 json-strip-comments = "3"
-jsonschema = { version = "0.46.5", default-features = false }
+jsonschema = { version = "0.55.0", default-features = false }
 junction = "1.4.1"
 libtest-mimic = "0.8.2"
 memchr = "2.7.4"
@@ -270,7 +270,7 @@ sha1 = "0.10.6"
 sha2 = "0.10.9"
 shell-escape = "0.1.5"
 simdutf8 = "0.1.5"
-smallvec = { version = "1.15.1", features = ["union"] }
+smallvec = { version = "1.16.0", features = ["union"] }
 snapshot_test = { git = "https://github.com/voidzero-dev/vite-task.git", rev = "d05b1dcdbaabaa69643ee0b89cebe3cd390957e9" }
 string_cache = "0.9.0"
 sugar_path = { version = "3", features = ["cached_current_dir"] }
@@ -319,7 +319,7 @@ xxhash-rust = "0.8.15"
 zip = { version = "7.2", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 
 # oxc crates with the same version
-oxc = { version = "0.148.0", features = [
+oxc = { version = "0.149.0", features = [
   "ast_visit",
   "transformer",
   "minifier",
@@ -331,17 +331,17 @@ oxc = { version = "0.148.0", features = [
   "regular_expression",
   "cfg",
 ] }
-oxc_allocator = { version = "0.148.0", features = ["pool"] }
-oxc_ast = "0.148.0"
-oxc_ecmascript = "0.148.0"
-oxc_parser = "0.148.0"
-oxc_span = "0.148.0"
-oxc_napi = "0.148.0"
-oxc_str = "0.148.0"
-oxc_minify_napi = "0.148.0"
-oxc_parser_napi = "0.148.0"
-oxc_transform_napi = "0.148.0"
-oxc_traverse = "0.148.0"
+oxc_allocator = { version = "0.149.0", features = ["pool"] }
+oxc_ast = "0.149.0"
+oxc_ecmascript = "0.149.0"
+oxc_parser = "0.149.0"
+oxc_span = "0.149.0"
+oxc_napi = "0.149.0"
+oxc_str = "0.149.0"
+oxc_minify_napi = "0.149.0"
+oxc_parser_napi = "0.149.0"
+oxc_transform_napi = "0.149.0"
+oxc_traverse = "0.149.0"
 
 # oxc crates in their own repos
 oxc_index = { version = "5", features = ["rayon", "serde"] }

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_dlx_bun/snapshots.toml

@@ -3,8 +3,10 @@ name = "command_dlx_bun"
 vp = "global"
 local-registry = true
 skip-platforms = ["windows"]
+# bun x caches lockfiles under TMPDIR, separately from BUN_INSTALL_CACHE_DIR.
+# Isolate them so tarball URLs cannot refer to a previous test registry.
 steps = [
   { argv = ["vp", "dlx", "--help"], comment = "should show help message", continue-on-failure = true },
-  { argv = ["vp", "dlx", "-s", "cowsay", "hello"], comment = "should run cowsay with bun x", continue-on-failure = true },
-  { argv = ["vp", "dlx", "-s", "cowsay@1.6.0", "hello"], comment = "should run specific version", continue-on-failure = true },
+  { argv = ["vp", "dlx", "-s", "cowsay", "hello"], envs = [["TMPDIR", "${workspace}"]], comment = "should run cowsay with bun x", continue-on-failure = true },
+  { argv = ["vp", "dlx", "-s", "cowsay@1.6.0", "hello"], envs = [["TMPDIR", "${workspace}"]], comment = "should run specific version", continue-on-failure = true },
 ]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_dlx_bun/snapshots/command_dlx_bun.md

@@ -23,7 +23,7 @@ Options:
 Documentation: https://viteplus.dev/guide/vpx
 ```
 
-## `vp dlx -s cowsay hello`
+## `TMPDIR=${workspace} vp dlx -s cowsay hello`
 
 should run cowsay with bun x
 
@@ -38,7 +38,7 @@ should run cowsay with bun x
                 ||     ||
 ```
 
-## `vp dlx -s cowsay@1.6.0 hello`
+## `TMPDIR=${workspace} vp dlx -s cowsay@1.6.0 hello`
 
 should run specific version
 

crates/vp_static_config/src/lib.rs

@@ -148,7 +148,7 @@ fn parse_js_ts_config(source: &str, extension: &str) -> FieldMap {
     let parser = Parser::new(&allocator, source, source_type);
     let result = parser.parse();
 
-    if result.panicked || !result.diagnostics.is_empty() {
+    if result.fatal_error || !result.diagnostics.is_empty() {
         return FieldMap::unanalyzable();
     }
 
@@ -1320,6 +1320,19 @@ mod tests {
 
     // ── Not analyzable cases ─────────────────────────────────────────────
 
+    #[test]
+    fn syntax_errors_require_runtime_evaluation() {
+        for source in [
+            "export default { run: { cache: true }",
+            "export default { run: { cache: true } }; const missing;",
+        ] {
+            let result = parse(source);
+            assert_non_static(&result, "run");
+            assert_non_static(&result, "defaultPackage");
+            assert_eq!(result.get_declared("run"), None);
+        }
+    }
+
     #[test]
     fn returns_none_for_no_default_export() {
         assert_non_static(&parse_js_ts_config("export const config = { a: 1 };", "ts"), "run");

packages/cli/binding/index.cjs

@@ -1,4 +1,3 @@
-// prettier-ignore
 /* eslint-disable */
 // @ts-nocheck
 /* auto-generated by NAPI-RS */

packages/cli/binding/index.d.cts

@@ -306,6 +306,7 @@ export interface TreeShakeOptions {
    */
   invalidImportSideEffects?: boolean;
 }
+
 export interface Comment {
   type: 'Line' | 'Block';
   value: string;
@@ -332,6 +333,7 @@ export declare const enum Severity {
   Warning = 'Warning',
   Advice = 'Advice',
 }
+
 export declare class ParseResult {
   get program(): import('@oxc-project/types').Program;
   get module(): EcmaScriptModule;
@@ -610,6 +612,7 @@ export interface ValueSpan {
   start: number;
   end: number;
 }
+
 export declare class ResolverFactory {
   constructor(options?: NapiResolveOptions | undefined | null);
   static default(): ResolverFactory;
@@ -919,6 +922,7 @@ export interface TsconfigOptions {
    */
   references?: 'auto';
 }
+
 export interface SourceMap {
   file?: string;
   mappings: string;
@@ -929,6 +933,7 @@ export interface SourceMap {
   version: number;
   x_google_ignoreList?: Array<number>;
 }
+
 export interface ArrowFunctionsOptions {
   /**
    * This option enables the following:
@@ -1604,6 +1609,7 @@ export interface TypeScriptOptions {
    */
   rewriteImportExtensions?: 'rewrite' | 'remove' | boolean;
 }
+
 export declare class BindingBundleEndEventData {
   output: string;
   duration: number;
@@ -2180,6 +2186,7 @@ export interface BindingDevOptions {
   onAdditionalAssets?: undefined | ((output: BindingOutputs) => void | Promise<void>);
   rebuildStrategy?: BindingRebuildStrategy;
   watch?: BindingDevWatchOptions;
+  hotUpdate?: boolean;
 }
 
 export interface BindingDevtoolsOptions {
@@ -2705,6 +2712,7 @@ export interface BindingManualCodeSplittingOptions {
   maxSize?: number;
   minModuleSize?: number;
   maxModuleSize?: number;
+  internalInvalidateModuleInfoCache?: () => void;
 }
 
 export interface BindingMatchGroup {
@@ -3434,6 +3442,7 @@ export declare function startAsyncRuntime(): void;
 export interface ViteImportGlobMeta {
   isSubImportsPattern?: boolean;
 }
+
 /** Error from batch import rewriting */
 export interface BatchRewriteError {
   /** The file path that had an error */

packages/cli/src/__tests__/resolve-core.spec.ts

@@ -1,3 +1,4 @@
+import { execFileSync } from 'node:child_process';
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -113,7 +114,19 @@ describe('resolveCore', () => {
   it('does not fall back to the project when the CLI dependency is missing', () => {
     writeCore(projectCore);
     rmSync(bundled, { recursive: true });
-    expect(() => resolveCore('', project, cliModule)).toThrow('Could not resolve the bundled Vite');
+    // pnpm injects NODE_PATH, which can supply an unrelated Vite package.
+    // Check the missing dependency in a process without global search paths.
+    execFileSync(process.execPath, [
+      '--no-global-search-paths',
+      '--input-type=module',
+      '--eval',
+      `import { strict as assert } from 'node:assert';
+       import { resolveCore } from ${JSON.stringify(new URL('../resolve-core.ts', import.meta.url).href)};
+       assert.throws(
+         () => resolveCore('', ${JSON.stringify(project)}, ${JSON.stringify(cliModule)}),
+         /Could not resolve the bundled Vite/,
+       );`,
+    ]);
   });
 
   it.each(['project', 'bundled'])('rejects upstream Vite in the %s dependency', (location) => {

packages/core/package.json

@@ -125,7 +125,7 @@
     "@oxc-node/cli": "catalog:",
     "@tsdown/css": "catalog:",
     "@tsdown/exe": "catalog:",
-    "@vitejs/devtools": "^0.4.12",
+    "@vitejs/devtools": "^0.7.1",
     "es-module-lexer": "^1.7.0",
     "hookable": "^6.0.1",
     "magic-string": "^0.30.21",
@@ -147,7 +147,7 @@
   "peerDependencies": {
     "@arethetypeswrong/core": "^0.18.1",
     "@types/node": "^20.19.0 || >=22.12.0",
-    "@vitejs/devtools": "^0.4.0 || ^0.5.0",
+    "@vitejs/devtools": "^0.7.1",
     "esbuild": "^0.27.0 || ^0.28.0",
     "jiti": ">=1.21.0",
     "less": "^4.0.0",
@@ -223,8 +223,8 @@
     "node": "^20.19.0 || ^22.18.0 || >=24.11.0"
   },
   "bundledVersions": {
-    "vite": "8.2.2",
-    "rolldown": "1.2.7",
+    "vite": "8.3.0",
+    "rolldown": "1.2.8",
     "tsdown": "0.23.0"
   }
 }

packages/tools/.upstream-versions.json

@@ -2,11 +2,11 @@
   "rolldown": {
     "repo": "https://github.com/rolldown/rolldown.git",
     "branch": "main",
-    "hash": "26b4c6e56c5553d72a910d0f73d60fa331c0ed88"
+    "hash": "9704b565076baf57b3703c98ebde973855506a68"
   },
   "vite": {
     "repo": "https://github.com/vitejs/vite.git",
     "branch": "main",
-    "hash": "de1111ab0be00879b404e7ed3b2a80e264edddc1"
+    "hash": "434e8e9495436a60789f2b588a04a6a24a3d1661"
   }
 }