chore(deps): bump vite-plus to v0.1.24 - #21
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates several dependencies, including Vue, oxlint, oxfmt, and vite-plus packages, to newer preview versions from pkg.pr.new. Feedback on the changes highlights a lockfile duplication issue caused by using the PR number (@1738) in package.json and pnpm-workspace.yaml instead of the exact commit hash (@65dd309c37cdae71d62c19868b943ff6b889a598). This mismatch leads to pnpm installing duplicate instances of the packages, which can cause runtime errors and broken module checks. It is recommended to update these URLs to target the commit hash directly.
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1738", | ||
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1738" |
There was a problem hiding this comment.
There is a lockfile duplication issue because the manually specified dependency URLs use the PR number (@1738), whereas the published pkg.pr.new packages internally pin their peer/dependencies to the exact commit hash (@65dd309c37cdae71d62c19868b943ff6b889a598).
This causes pnpm to install two separate instances of @voidzero-dev/vite-plus-test and @voidzero-dev/vite-plus-core (one for @1738 and one for @65dd309c37cdae71d62c19868b943ff6b889a598), which can lead to runtime issues, duplicate module execution, and broken instanceof checks.
To fix this and allow proper deduplication, please update the URLs to use the commit hash 65dd309c37cdae71d62c19868b943ff6b889a598 instead of the PR number 1738.
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1738", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1738" | |
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@65dd309c37cdae71d62c19868b943ff6b889a598", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@65dd309c37cdae71d62c19868b943ff6b889a598" |
| 'entities': '^7.0.1' | ||
| 'estree-walker': ^2.0.2 | ||
| 'vite': npm:@voidzero-dev/vite-plus-core@latest | ||
| 'vite': https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1738 |
There was a problem hiding this comment.
To prevent lockfile duplication and ensure that vite (which maps to @voidzero-dev/vite-plus-core) is fully deduplicated with the transitive dependencies of vite-plus and vitest, please update this URL to use the commit hash 65dd309c37cdae71d62c19868b943ff6b889a598 instead of the PR number 1738.
'vite': https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@65dd309c37cdae71d62c19868b943ff6b889a598
Summary
Bump
vite-plusand related packages to the pkg.pr.new prerelease build for v0.1.24.Updated where applicable:
vite-plus-> pkg.pr.newvite/vitestaliases and overrides ->@voidzero-dev/vite-plus-core/@voidzero-dev/vite-plus-test@voidzero-dev/vite-plus-*direct deps,overrides/resolutions/pnpm.overrides/ catalogsminimum-release-agewith vite-plus stack excluded (pnpm / npm / bun / yarn as applicable)pnpm.*package.json fields intopnpm-workspace.yamlwhere presentTest plan