Skip to content

feat(deps): upgrade upstream dependencies#2176

Closed
voidzero-guard[bot] wants to merge 1 commit into
mainfrom
deps/upstream-update
Closed

feat(deps): upgrade upstream dependencies#2176
voidzero-guard[bot] wants to merge 1 commit into
mainfrom
deps/upstream-update

Conversation

@voidzero-guard

Copy link
Copy Markdown
Contributor

Summary

  • Automated upgrade of upstream oxc-family dependencies: oxfmt 0.58.0 -> 0.59.0, oxlint 1.73.0 -> 1.74.0, and the @oxc-project/* / oxc-* packages 0.139.0 -> 0.140.0.
  • Bumps @vitejs/devtools 0.4.0 -> 0.4.1 in packages/core.
  • rolldown (v1.1.5) and vite (v8.1.4), along with vitest/tsdown and their subpackages, are unchanged this run.
  • Includes two supporting code adjustments so migration and install-testing stay reliable right after a toolchain release.

Dependency updates

Package From To
oxfmt 0.58.0 0.59.0
oxlint 1.73.0 1.74.0
@oxc-project/runtime 0.139.0 0.140.0
@oxc-project/types 0.139.0 0.140.0
oxc-minify 0.139.0 0.140.0
oxc-parser 0.139.0 0.140.0
oxc-transform 0.139.0 0.140.0
@vitejs/devtools 0.4.0 0.4.1

Code changes

  • packages/cli/src/migration/migrator/eslint.ts: runOxlintMigrateStep now accepts a list of @oxlint/migrate candidates and falls through from the version pinned to bundled oxlint to the latest published migrate when the pinned version isn't on npm yet, reusing the resolved version for later steps.
  • packages/tools/src/local-npm-registry.ts: intercept whole-packument GETs and rewrite every publish timestamp to LOCAL_PACKAGE_TIME (cached per package) so package-manager minimum-release-age gates don't quarantine a just-published upstream dependency.

Build status

  • sync-remote-and-build: success
  • build-upstream: success

- oxfmt: 0.58.0 -> 0.59.0
- oxlint: 1.73.0 -> 1.74.0
- @oxc-project/runtime: 0.139.0 -> 0.140.0
- @oxc-project/types: 0.139.0 -> 0.140.0
- oxc-minify: 0.139.0 -> 0.140.0
- oxc-parser: 0.139.0 -> 0.140.0
- oxc-transform: 0.139.0 -> 0.140.0
- @vitejs/devtools: 0.4.0 -> 0.4.1

Code changes:
- packages/cli/src/migration/migrator/eslint.ts: fall back to the latest
  published @oxlint/migrate when the version pinned to bundled oxlint isn't
  on npm yet (migrate can lag oxlint by a few hours after a release)
- packages/tools/src/local-npm-registry.ts: neutralize publish times on
  proxied packuments so package-manager minimum-release-age gates don't
  quarantine freshly published upstream deps in tests
@netlify

netlify Bot commented Jul 15, 2026

Copy link
Copy Markdown

Deploy Preview for viteplus-preview canceled.

Name Link
🔨 Latest commit 0835b7a
🔍 Latest deploy log https://app.netlify.com/projects/viteplus-preview/deploys/6a56f33761bd8c0008dbd13f

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​oxc-project/​types@​0.140.01001007295100
Addednpm/​@​vitejs/​devtools@​0.4.1771007497100
Addednpm/​@​oxc-project/​runtime@​0.140.01001007596100
Addednpm/​oxfmt@​0.59.0861008996100
Addednpm/​oxc-parser@​0.140.09010010095100
Addednpm/​oxc-transform@​0.140.0911009695100

View full report

@github-actions

Copy link
Copy Markdown
Contributor

Native binary sizes (0835b7a)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact Format Base PR Change
vp (Linux x64) Binary 10.32 MiB 10.32 MiB 0 B (0.00%)
vp (Linux x64) gzip -9 4.42 MiB 4.42 MiB 0 B (0.00%)
NAPI (Linux x64) Binary 33.42 MiB 33.42 MiB 0 B (0.00%)
NAPI (Linux x64) gzip -9 12.78 MiB 12.78 MiB 0 B (0.00%)
vp (macOS ARM64) Binary 7.64 MiB 7.64 MiB 0 B (0.00%)
vp (macOS ARM64) gzip -9 3.83 MiB 3.83 MiB 0 B (0.00%)
NAPI (macOS ARM64) Binary 40.78 MiB 40.78 MiB 0 B (0.00%)
NAPI (macOS ARM64) gzip -9 17.05 MiB 17.05 MiB +102 B (+0.00%)
vp (Windows x64) Binary 8.37 MiB 8.37 MiB 0 B (0.00%)
vp (Windows x64) gzip -9 3.64 MiB 3.64 MiB +2 B (+0.00%)
NAPI (Windows x64) Binary 27.88 MiB 27.88 MiB 0 B (0.00%)
NAPI (Windows x64) gzip -9 10.78 MiB 10.78 MiB -6 B (-0.00%)
Trampoline (Windows x64) Binary 203.00 KiB 203.00 KiB 0 B (0.00%)
Trampoline (Windows x64) gzip -9 97.91 KiB 97.91 KiB +3 B (+0.00%)
Installer (Windows x64) Binary 4.46 MiB 4.46 MiB 0 B (0.00%)
Installer (Windows x64) gzip -9 2.08 MiB 2.08 MiB +3 B (+0.00%)

@voidzero-guard voidzero-guard Bot closed this Jul 16, 2026
@voidzero-guard voidzero-guard Bot deleted the deps/upstream-update branch July 16, 2026 02:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants