MK

@fengmk2.bsky.social

Hello world

Vite+ is now in beta 🚀 One CLI for your whole toolchain, now more powerful than ever: ◆ Smarter caching (vp run auto-tracks files + reads Vite metadata) ◆ Better `vp migrate` for humans and agents ◆ Org templates for teams + proxy- & custom-CA-aware HTTP ◆ Hardened across every major OS & shell

Announcing Vite+ Beta

Vite+ Beta brings the tools needed to create, develop, check, test, and maintain modern web projects into one fast and consistent workflow.

voidzero.dev

Say goodbye to svelte.config.js - you don't need it anymore! The newest version of SvelteKit allows you to configure everything via its Vite plugin, and VS Code, svelte-check and SvelteKit itself can all read from it. On file less cluttering your project root.

SvelteKit Vite plugin configured with options

VoidZero is joining Cloudflare. Our mission stays the same: to make JavaScript developers more productive than ever before. Vite, Vitest, Rolldown, Oxc, and Vite+ remain MIT-licensed. Evan and the VoidZero team will continue leading them.

VoidZero + Cloudflare

We've published a Browser Mode security advisory. CDP-capable providers like Playwright Chromium with the browser API exposed to the network allowed attackers to run code on the host. Update vitest/browser to 5.0.0-beta.4, 4.1.8, or 3.2.6. Vite+ users: Upgrade to 0.1.24 github.com/vitest-dev/v...

Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

## Summary Vitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`,...

github.com

We've published two Windows-related security advisories: ◇ If Vite runs with `--host`, denied files may have been reachable over the network. ◇ launch-editor with NTLM enabled may leak NTLMv2 hashes via a malicious page. Update to Vite 8.0.16/7.3.5/6.4.3, Vite+ 0.1.24, and launch-editor 2.14.1.

One thing I like a lot about Vite Plus is how easy it makes working on multiple projects I can just use `vp install` and not care what package manager or Node version the project uses

There's some impressive work going on with 3rd party oxc powered coverage instrumentation that can replace Babel based istanbul-lib-instrument 👀 > 8-11x faster than babel-plugin-istanbul, 13-15x faster than swc-plugin-coverage-instrument (Rust/WASM), 25-30x faster than istanbul-lib-instrument.

GitHub - fallow-rs/oxc-coverage-instrument: Istanbul-compatible JavaScript/TypeScript coverage instrumentation using the Oxc AST

Istanbul-compatible JavaScript/TypeScript coverage instrumentation using the Oxc AST - fallow-rs/oxc-coverage-instrument

github.com

Congrats to @npmx.dev on launching their alpha! We share the same vision: making JavaScript developers more productive. They chose to build on the VoidZero toolchain, and their feedback has already shipped real performance improvements back to the community. This is open source at its best.

VoidZero and npmx: Building Better Tools Together

How VoidZero and npmx.dev share a vision for making JavaScript developers more productive, and how real-world feedback from open-source builders helps improve our tooling.

voidzero.dev

Do you prefer `.mjs` or `.js` for Node libraries? I used to favor `.js`, but `.mjs` seems to improve toolchain performance. Since Node will support CJS for the foreseeable future, we need an easier way to tell ESM and CJS apart. github.com/rolldown/tsd...

feat!: defaults `fixedExtension` to true when platform is `node` by sxzz · Pull Request #517 · rolldown/tsdown

Description Defaults fixedExtension to true when platform is node. Linked Issues Additional context

github.com