Repository navigation
feat(deps): upgrade upstream dependencies - #3284
Closed
voidzero-guard[bot] wants to merge 3 commits into
Closed
voidzero-guard[bot] wants to merge 3 commits into
voidzero-guard[bot] wants to merge 3 commits into
Conversation
- rolldown: 89d821c -> v1.2.16 (de6facf)
- tsdown: 0.23.3 -> 0.23.4
- @tsdown/css: 0.23.3 -> 0.23.4
- @tsdown/exe: 0.23.3 -> 0.23.4
Code changes:
- Cargo.toml: re-merge rolldown v1.2.16 workspace (add rolldown_devtools_metrics crate, oxc crates 0.155.0 -> 0.156.0, globstar 0.0.4 -> 0.0.6, jsonschema 0.58.0 -> 0.60.0, parking_lot 0.12.5 -> 0.13.0, saphyr 0.2.1 -> 0.3.0, add simd-utf16-len 0.3.0)
- .github/renovate.json: add simd-utf16-len to the vendored-crate ignore list
- packages/tools/src/patch-oxc-node.ts: follow oxc 0.156 `is_await` -> `is_await_using` rename in vendored oxc-node
- packages/tools/src/brand-vite.ts: drop the orphan rolldown-runtime d.ts chunk rolldown >= 1.2.16 emits in emitDtsOnly builds
- packages/cli/src/pack-bin.ts, packages/cli/src/help.ts: sync `--env-file` help text with tsdown 0.23.4
- crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/{command_helper,command_pack,command_tool_help}/snapshots/*.md: record the `--env-file` help text
- pnpm-workspace.yaml: catalog updates (emnapi/@emnapi 2.0.0-beta.2, @napi-rs/wasm-runtime 1.2.6, cac ^7.1.0, remeda ^2.53.0)
- packages/tools/src/__tests__/{patch-oxc-node,brand-vite}.spec.ts: cover the new patches
Contributor
Author
|
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://deps-upstream-update-viteplus-dev.voidzero-docs.workers.dev (commit 4fa15af)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
CLI artifact sizes (
|
| Artifact | Format | Base | PR | Change |
|---|---|---|---|---|
packages/cli/dist |
Directory total | 2.26 MiB | 2.26 MiB | -140 B (-0.01%) |
packages/core/dist |
Directory total | 4.07 MiB | 4.08 MiB | +9.41 KiB (+0.23%) |
| Combined package dist | Directory total | 6.34 MiB | 6.34 MiB | +9.28 KiB (+0.14%) |
vp (Linux x64) |
Binary | 8.26 MiB | 8.26 MiB | 0 B (0.00%) |
vp (Linux x64) |
gzip -9 | 3.77 MiB | 3.77 MiB | 0 B (0.00%) |
| NAPI (Linux x64) | Binary | 35.53 MiB | 36.35 MiB | +836.06 KiB (+2.30%) |
| NAPI (Linux x64) | gzip -9 | 14.15 MiB | 14.53 MiB | +389.77 KiB (+2.69%) |
vp (macOS ARM64) |
Binary | 5.39 MiB | 5.39 MiB | 0 B (0.00%) |
vp (macOS ARM64) |
gzip -9 | 3.21 MiB | 3.21 MiB | 0 B (0.00%) |
| NAPI (macOS ARM64) | Binary | 42.30 MiB | 42.98 MiB | +694.36 KiB (+1.60%) |
| NAPI (macOS ARM64) | gzip -9 | 18.29 MiB | 18.63 MiB | +350.17 KiB (+1.87%) |
vp (Windows x64) |
Binary | 6.12 MiB | 6.12 MiB | 0 B (0.00%) |
vp (Windows x64) |
gzip -9 | 2.83 MiB | 2.83 MiB | 0 B (0.00%) |
| NAPI (Windows x64) | Binary | 31.55 MiB | 32.28 MiB | +751.00 KiB (+2.32%) |
| NAPI (Windows x64) | gzip -9 | 12.85 MiB | 13.21 MiB | +366.79 KiB (+2.79%) |
| Trampoline (Windows x64) | Binary | 13.50 KiB | 13.50 KiB | 0 B (0.00%) |
| Trampoline (Windows x64) | gzip -9 | 7.09 KiB | 7.09 KiB | +1 B (+0.01%) |
| Installer (Windows x64) | Binary | 4.65 MiB | 4.65 MiB | 0 B (0.00%) |
| Installer (Windows x64) | gzip -9 | 2.23 MiB | 2.23 MiB | -2 B (-0.00%) |
Rolldown 1.2.16 moves `createRequire(import.meta.url)` from the binding loader into a shared `rolldown-runtime-<hash>.mjs` chunk. The VM linker in `rolldown_webcontainer_fallback` accepted only `node:module`, so the case failed on the new import. Load the runtime chunk from the same directory and give it the same `node:module` stub. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wan9chi
added a commit
that referenced
this pull request
Nov 1, 2026
Timeouts in the Upgrade Upstream Dependencies workflow currently go unnoticed unless someone reads the run log. In [run 41210115268](https://github.com/voidzero-dev/vite-plus/actions/runs/41210115268), a Kimi K3 `Bash` call ("Rebuild binding with debug symbols") exceeded its 600s limit. The step later failed with a Kimi `429` usage-limit error. On 2026-05-22 and 2026-05-25, the Kimi step itself hit its 180-minute limit, and the job stopped without a PR. ## Changes - **Kimi step timeout:** the job continues with the partial fixes, and the PR stays a draft even if final validation passes. Final validation doesn't cover all fixups, such as the docs syncs. A new "Check Kimi K3 result" step still stops the job on any other Kimi failure, so a `429` behaves as before. - **Agent command timeouts:** `.github/scripts/agent-command-timeouts.ts` reads the Kimi transcript (the action's `execution_file`) for `Bash` calls with `timedOutAfterMs`, and passes them on as a job output. - **New `report-timeouts` job:** runs after `upgrade`, even when it fails or exceeds its own time limit. It reads step and job timeouts from the upgrade job's annotations, adds the command timeouts, and opens an issue labelled `upgrade-deps-timeout`. If one is already open, it comments instead. It's a separate job so the Kimi steps never get a token with `issues: write`. - **Step names in the issue:** hosted runners report a step timeout as `The action has timed out.`, without the step name. The report job finds that message in the upgrade job's log and names the step that was running. The runner logs it as the step ends, in the same second the next step starts, so the job picks the last step that started in an earlier second. If the log can't be read, the issue falls back to the plain message. - **PR description step:** gets a 30-minute limit; it normally takes 1–7 minutes. A hang there can no longer exhaust the job's 360-minute limit. - **PR build status:** now includes a `kimi-fixups` line (`success` or `timed out`). ## Verification - actionlint, zizmor (no new findings), and oxfmt pass. - The new spec passes. I ran it with upstream Vitest 5.0.5 aliased as `vite-plus/test`, because the local pnpm install was broken. - The script, run on the transcript rebuilt from run 41210115268, reports exactly the 600s timeout. - The annotation filter matches the real May timeouts (`The action has timed out.`, the wording hosted runners still use) and the newer wording in the runner source, which names the step. It ignores unrelated "timed out" messages. - I ran the check step's script locally for four cases: success, an early failure, a step timeout, and an unreadable transcript. - **End-to-end on GitHub:** [run 41268780486](https://github.com/voidzero-dev/vite-plus/actions/runs/41268780486) was dispatched from a throwaway branch with this PR's workflow plus one test-only commit. That commit set the Kimi limit to 1 minute and skipped final validation, the second Kimi step, and the PR steps, so the real upgrade PR #3284 was untouched. The Kimi step was stopped at 73s (`The action has timed out.`). "Check Kimi K3 result" let the job continue, the computed `draft` was `true`, and `report-timeouts` created #3307 with the new `upgrade-deps-timeout` label. - **Re-run with step names:** [run 41273740227](https://github.com/voidzero-dev/vite-plus/actions/runs/41273740227) repeated that setup with the step-naming change. Because #3307 was still open, it [commented on #3307](#3307 (comment)) instead of opening a new issue, with `Check upgrade dependencies with Kimi K3`: The action has timed out. Before pushing, I dry-ran the report script against the first run's real data, including the fallback when the job log can't be read. - The agent command-timeout path was not exercised on GitHub. It's covered by the transcript check above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rolldownto v1.2.16 andtsdown/@tsdown/css/@tsdown/exeto 0.23.4.Cargo.toml(newrolldown_devtools_metricscrate, oxc crates 0.156.0, aligned transitive crates) and regenerate the NAPI binding types.is_await->is_await_usingrename, and drop the orphanrolldown-runtimed.ts chunk that rolldown 1.2.16 emits in Vite'semitDtsOnlybuild.vp pack --env-filehelp text with tsdown 0.23.4 and update the CLI snapshots.Dependency updates
rolldown1.2.1589d821cv1.2.16de6facftsdown0.23.30.23.4@tsdown/css0.23.30.23.4@tsdown/exe0.23.30.23.4Unchanged dependencies
vite:v8.3.5 (981f07f)oxc-node:v1.0.1 (6d5376d)vitest:5.0.5@vitest/browser:5.0.5@vitest/browser-playwright:5.0.5@vitest/browser-preview:5.0.5@vitest/mocker:5.0.5@vitest/pretty-format:5.0.5@vitest/snapshot:5.0.5@vitest/spy:5.0.5@vitest/utils:5.0.5lightningcss:^1.33.0lint-staged:17.6.0@oxc-node/cli:1.0.1@oxc-node/core:1.0.1oxfmt:0.75.0oxlint:1.90.0@oxlint/plugins:1.90.0oxlint-tsgolint:7.0.2005@oxc-project/runtime:0.156.0@oxc-project/types:0.156.0oxc-parser:0.156.0VITEST_VERSION constant:5.0.5yuku-parser:0.19.0postcss:^8.5.30fsevents:~2.3.3Code changes
Cargo.toml: re-merge the rolldown v1.2.16 workspace — add therolldown_devtools_metricspath crate; bump the oxc crates 0.155.0 -> 0.156.0,globstar0.0.4 -> 0.0.6,jsonschema0.58.0 -> 0.60.0,parking_lot0.12.5 -> 0.13.0,saphyr0.2.1 -> 0.3.0; addsimd-utf16-len0.3.0.Cargo.lockregenerated..github/renovate.json: addsimd-utf16-lento the ignore list for crates synchronized with vendored Rolldown/oxc-node.packages/tools/src/patch-oxc-node.ts: newfixOxc156ApiRenamespatch following oxc 0.156'sVariableDeclarationKind::is_await->is_await_usingrename in vendored oxc-node. Upstream fix: chore(deps): update oxc to 0.156 oxc-project/oxc-node#896. The existingexposeLoaderInitializationpatch has an upstream fix in fix(core): keep the loader initialization APIs for embedders oxc-project/oxc-node#895.packages/tools/src/brand-vite.ts: new patch step dropping the orphanrolldown-runtimed.ts chunk that rolldown >= 1.2.16 emits inemitDtsOnlybuilds; also restoresrolldown.dts.config.tsfrom upstream HEAD before patching.packages/tools/src/__tests__/patch-oxc-node.spec.ts,packages/tools/src/__tests__/brand-vite.spec.ts: coverage for the two new patches.packages/cli/src/pack-bin.ts,packages/cli/src/help.ts: sync the--env-filedescription with tsdown 0.23.4 ("Load environment variables from a file, can be repeated").crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_helper/snapshots/command_helper.md,crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack/snapshots/command_pack.md,crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_tool_help/snapshots/command_tool_help.md: record the new--env-filehelp text.packages/cli/binding/index.d.cts: regenerated binding types (BindingOutputChunk.getCodeIdentity(),BindingRenderedModule.renderedLength,BindingDevtoolsOptions.mode).pnpm-workspace.yaml: catalog updates —@emnapi/core/@emnapi/runtime/emnapi2.0.0-alpha.5 -> 2.0.0-beta.2,@napi-rs/wasm-runtime~1.2.5 -> 1.2.6,cac^7.0.0 -> ^7.1.0,remeda^2.50.0 -> ^2.53.0.pnpm-lock.yamlregenerated.crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/rolldown_webcontainer_fallback/verify.mjs: rolldown 1.2.16 movescreateRequire(import.meta.url)from the binding loader into a sharedrolldown-runtime-<hash>.mjschunk. The VM linker now loads that chunk from the same directory and gives it the samenode:modulestub. The recorded snapshot does not change.Pre-existing Security Analysis failures
mainlocks the same crate versions, so this PR does not cause these failures:zstd0.13.3 /zstd-safe7.3.0 through vite-task (vt). Fix: chore(deps): bump zstd to 0.14.3 vite-task#922, then a vite-task bump.crypto-bigint0.5.5 throughpgp0.21.0 invp_js_runtime.