[dependabot]

Bumps the dependencies group with 2 updates: @deepseek-ai/schemastery and vite-plus.

Updates @deepseek-ai/schemastery from 3.18.6-alpha.1 to 3.19.0

Commits

• See full diff in compare view

Updates vite-plus from 1.4.0 to 1.5.0

Release notes

Sourced from vite-plus's releases.

vite-plus v1.5.0

Vite+ 1.5 adds an official Homebrew tap, runs TypeScript through Node.js with node --import vite-plus/register, and lets vp migrate move oxnode and transpile-only ts-node scripts to vpx.

Features

• Install vp from the official Homebrew tap on macOS and glibc Linux (docs) (#2740), by @​fengmk2:

  brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
  brew install voidzero-dev/vite-plus/vp

• node --import vite-plus/register runs TypeScript with the same loader as vpx, so tools that start Node.js themselves, such as the Node.js test runner, AVA, or a NODE_OPTIONS setting, can run TypeScript files (docs) (#3208), by @​fengmk2.
• vp migrate moves oxnode commands and transpile-only ts-node commands to vpx, and moves their Node.js preloads and literal NODE_OPTIONS values to vite-plus/register. ts-node commands that type-check stay unchanged with a warning, and the ts-node dependency is removed only when nothing still uses it. A project already on Vite+ gets this migration with vp migrate --full (docs) (#3209, #3210), by @​fengmk2.
• vp migrate warns when it finds Rollup, Rolldown, or Jest dependencies with matching configuration, and explains how to move them to Vite, tsdown, or Vitest. The warnings show during the first migration, or with vp migrate --full in a project already on Vite+ (#3275), by @​KTrain5169 and @​fengmk2.
• vite-plus exports resolveConfigFromFile(configFile, options?), which resolves a config relative to the config file's directory instead of process.cwd(), so editor plugins with several workspace folders load the files of the right project (#3249), by @​leaysgur and @​fengmk2.
• Security: the CLI ships minimatch@11.0.4, which fixes a denial of service through glob pattern amplification (GHSA-g3hv-75wg-m249, medium), and zstd@0.13.4, which fixes RUSTSEC-2026-0391, RUSTSEC-2026-0398, and RUSTSEC-2026-0403 (#3328, #3331), by @​renovate[bot] and @​wan9chi.
• Upgrade the bundled tools (#3205, #3236, #3261, #3206, #3330, #3338), by @​voidzero-guard[bot] and @​fengmk2:
  • rolldown@1.2.15 to rolldown@1.2.16, with experimentalInlineCommonChunks in dev mode and no crash when the working directory was deleted.
  • tsdown@0.23.1 to tsdown@0.23.4: vp pack --env-file can be repeated to load several env files, the config has a JSON schema, and ?inline CSS imported from dependencies is inlined.
  • vitest@5.0.5 to vitest@5.1.0, with --last-failed and --since-last-run, fake timers for node:timers, and interactive review of failed snapshots. Browser mode now uses port 23315 by default.
  • oxlint@1.89.0 to oxlint@1.91.0 and oxlint-tsgolint@7.0.2004 to oxlint-tsgolint@7.0.2005, with the new type-aware rule typescript/no-unsafe-enum-assignment, wider checks in rules such as array-callback-return, no-useless-concat, and no-control-regex, and two rules moved into the suspicious category.
  • oxfmt@0.74.0 to oxfmt@0.76.0, with a new HTML formatter and JavaScript and TypeScript fixes for parentheses, array layout, and line width with wide characters.
  • The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
  • Known issue: oxlint@1.91.0 can report react/immutability for a let declared inside an effect and reassigned by a closure in that effect (oxc#28401).
  • vpx and vite-plus/register run on oxc-node@1.0.1, which resolves a .jsx specifier to its .tsx or .ts source.

Fixes & Enhancements

• vp create into a target path that is a symbolic link removes only the link after confirmation, instead of deleting the contents of the linked directory, and the overwrite prompt names symbolic links and files (#2418), by @​leslieeilsel and @​fengmk2.
• vp implode removes only directories and shims that it can verify as Vite+ installations, and refuses the home directory, its parents, and filesystem roots even with --yes, so a VP_HOME that points at another directory cannot delete unrelated files (#3228), by @​jong-kyung.
• vp run starts faster in workspaces whose tasks share cache input and output patterns, because each pattern is parsed once. In a 138-package workspace this saves about 2 seconds of CPU on every run (vite-task#887, vite-task#890), by @​jasonkuhrt and @​wan9chi.
• vp run and package-manager commands in npm projects start about 110 ms sooner, because vp reads the npm version from npm's package.json instead of running npm --version (#3259), by @​magurotuna.
• vp migrate checks Vitest prerequisites faster in workspaces, because it parses each lockfile once (#3212), by @​jong-kyung.
• The installer and vp upgrade install the global CLI's dependencies with the Node.js version that the release pins (24.22.2 for this release), instead of the latest LTS (docs) (#3269), by @​fengmk2.
• The Node.js latest alias in vp env use, vp env default, vp env pin, vp env install, and .nvmrc resolves to the newest stable release instead of a 27.0.0-alpha build, and vp env list-remote marks that stable release as latest (#3335), by @​voidzero-bot[bot] and @​fengmk2.
• VP_NODE_VERSION=22 and other partial versions work for project commands such as vp build, vp run, and vp list, instead of failing with a 404 download error (#3341), by @​jong-kyung.
• Two vp install -g commands that run at the same time no longer delete each other's active package, and a command that starts while a package manager is being installed no longer runs its shim before the shim is executable (#3185, #3248), by @​jong-kyung.
• vp config waits and retries when another linked git worktree holds the shared git config lock, so a prepare script no longer fails when two worktrees install at the same time (#3199), by @​naokihaba.
• vp env doctor reports Node.js resolution failures, unreadable config, a failing system node, and missing shims as errors and exits with code 1. When it finds only warnings, the summary says Some warnings found instead of All checks passed (#3215, #3222), by @​liangmiQwQ.
• Nushell completions for vp and vpr use the named completer input, so Nushell 0.116 shows no deprecation warning, and they fall back to file completion when fish is not installed. Run vp env setup --refresh to regenerate env.nu (#3267, #3276), by @​naokihaba.
• vp migrate removes the tsx dependency even when a comment still contains a tsx command or code fence, and keeps it for JSDoc type imports that need it (#3299), by @​voidzero-bot[bot] and @​fengmk2.
• The prefer-vite-plus-imports lint rule and its autofix leave the vite and vitest imports that vp migrate keeps, such as vitest imports in a package that lists vitest in peerDependencies, so vp lint --fix no longer breaks the package for its plain Vitest users (#3192), by @​Dunqing.
• Generated Zed settings no longer force typeAware and unusedDisableDirectives, so editor diagnostics follow the lint.options in vite.config.ts. Existing editor settings stay unchanged (#2357), by @​pweyck.
• vp dlx with npm runs the right executable for scoped packages such as @angular/cli (#3229), by @​jong-kyung.
• vp outdated -r in npm projects checks the workspaces instead of transitive dependencies, and requires npm 7.14.0 or later (#3240), by @​jong-kyung.
• Dependency filters such as --prod and --dev work with npm 6, and filters that npm 6 cannot apply are rejected instead of passed through (#3251), by @​jong-kyung.
• Package-manager commands that the selected version does not have, such as vp pm stage before npm 11.15.0, are skipped with a warning. Unsupported pnpm dlx and pnpm pack options, and project-only flags on managed global commands such as vp install -g, are rejected instead of silently ignored (#3286, #3285), by @​jong-kyung.
• vp toolchain -g is short for vp toolchain --global (#3189), by @​jong-kyung.
• On Linux and macOS, programs in tasks with automatic file-access tracking no longer abort when they call exec with an empty path or execl with 32 or more arguments (vite-task#896, vite-task#865), by @​wan9chi and @​tlq5l.

Refactor

... (truncated)

Commits

• 671b5e4 release: v1.5.0 (#3336)
• 62ea11f feat(deps): upgrade upstream dependencies (#3330)
• b08be8d fix(create): avoid following target symlinks (#2418)
• 5deeca1 chore(deps): upgrade Vitest to 5.1.0 (#3206)
• 94d4e6f feat(migrate): migrate transpile-only ts-node scripts and preloads (#3210)
• 028bf16 feat(migrate): migrate oxnode scripts and preloads (#3209)
• eca0e13 feat(cli): support node --import vite-plus/register (#3208)
• 039b67a fix(editor): remove overrides from default config (#2357)
• d8e8def fix(lint): keep imports that vp migrate keeps per package (#3192)
• e6ed964 fix(cli): ignore commented tsx references during migration (#3299)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.