fix(global): keep the installed version spec on global update - #2249

…t variable renames, and install fixes (#2325)

Release vite-plus v0.2.8: monorepo target resolution, breaking `VP_*`
environment variable renames, and install fixes.

Bare `vp dev`/`build`/`preview`/`pack` at a monorepo root now resolve a
target package instead of silently running against the root, and three
Vite+-specific environment variables move to the `VP_*` prefix without
compatibility aliases. Two failures that broke Vite+ before it could run
are also fixed: the crash on container images that ship no CA
certificates, and the missing Rolldown binding under pnpm's global
virtual store.

### Breaking Changes

- Rename three Vite+-specific environment variables to the `VP_*`
prefix, with no compatibility aliases, so the old names stop working
([#2312](#2312)), by
@jong-kyung:

  | Old | New |
  | --- | --- |
  | `VITE_LOG` | `VP_LOG` |
  | `VITE_GLOBAL_CLI_JS_SCRIPTS_DIR` | `VP_GLOBAL_CLI_JS_SCRIPTS_DIR` |
  | `VITE_UPDATE_TASK_TYPES` | `VP_UPDATE_TASK_TYPES` |

Update any shell profile, CI job, or Dockerfile that sets the old names.

### Highlights

- Resolve a target package for `vp dev`, `build`, `preview`, and `pack`
at a monorepo root: interactive shells get a fuzzy package picker,
non-interactive runs list the candidates and exit 1 instead of building
the root, and a new global `-C <dir>` flag or a `defaultPackage` setting
(a single directory, or an object mapping each of the four commands to
its own directory) skips the prompt
([#2031](#2031),
[#2305](#2305)), by
@fengmk2
- Stop aborting with exit 134 on container images that ship no CA
certificates (Debian slim, distroless): the shared HTTP client now
retries once with the bundled Mozilla root list, like Node's own bundled
roots, and reports a real error instead of panicking when it still
cannot be built
([#2273](#2273),
[#2295](#2295)), by
@jbmusso and @fengmk2
- Resolve the bundled Rolldown binding through platform packages instead
of an undeclared require back into `vite-plus`, fixing `Cannot find
module 'vite-plus/binding'` under pnpm `enable-global-virtual-store` and
in standalone `@voidzero-dev/vite-plus-core` installs
([#2313](#2313)), by
@fengmk2
- Add `vp pm ci` for reproducible frozen-lockfile installs, and `vp pm
patch` / `vp pm patch-commit` for editing dependencies in place on pnpm,
bun, and Yarn Berry (npm and Yarn Classic warn and exit successfully)
([#2082](#2082),
[#2308](#2308)), by
@forehalo and @jong-kyung

### Features

- Upgrade the bundled toolchain: vite `8.1.5` -> `8.2.0`, rolldown
`1.2.0` -> `1.2.2`, oxlint `1.75.0` -> `1.76.0`, oxfmt `0.60.0` ->
`0.61.0`, and Vite DevTools `0.4.5` -> `0.4.10`
([#2302](#2302),
[#2311](#2311)), by
@voidzero-guard[bot]. The new oxfmt and oxlint can flag code that passed
before, so run `vp fmt` after upgrading if your CI runs `vp check`.
- Read the Node.js version from `.nvmrc` when no other version source is
present ([#2244](#2244)),
by @BlankParticle
- Support pnpm v12, which ships as a native binary: Vite+ now downloads
the platform-specific `@pnpm/exe.*` package and generates native shims,
so `pnpm` and `pnpx` work instead of failing to exec
([#2289](#2289)), by
@jong-kyung
- Verify the downloaded bun platform tarball against the registry
`dist.integrity` hash
([#2310](#2310)), by
@jong-kyung

### Fixes & Enhancements

- Let `vp config` install the Git hook dispatcher without creating or
modifying project hook scripts or staged-file configuration, so a custom
`.vite-hooks/pre-commit` survives
([#2280](#2280)), by
@TheAlexLichter
- Nest immutable global package installs under
`packages/<package>/<uuid>` instead of using `#` in the path, which Node
treated as a URL fragment and which broke dynamic imports inside
installed packages
([#2222](#2222)), by
@liangmiQwQ
- Keep the recorded version spec on global installs, so `vp update -g`
follows a dist tag or range instead of silently resolving back to
`latest`, `vp outdated -g` reports Wanted versus Latest, and `vp update
-g --latest` explicitly moves packages back to `latest`
([#2249](#2249)), by
@TheAlexLichter
- Stop deleting a managed Node.js runtime that another process is
concurrently installing
([#2248](#2248)), by
@shulaoda
- Preserve the real exit code when a spawned process is terminated by a
signal on Unix
([#2154](#2154)), by
@liangmiQwQ
- Honor an explicit `vp create --package-manager` outside monorepos
instead of inheriting the manager from a non-monorepo ancestor directory
([#2226](#2226)), by
@jong-kyung
- Scaffold the `vite:library` template into a directory that contains
only `.git`, while still refusing to overwrite existing user files
([#2287](#2287)), by
@RSS1102
- Render help for delegated commands from the local CLI, so `vp
<command> --help` matches the installed toolchain instead of drifting
([#2184](#2184)), by
@liangmiQwQ
- Resolve `typeAware` and `typeCheck` options inherited through Oxlint
`extends`, so `vp check --no-lint` runs and classifies type checking
correctly
([#2228](#2228)), by
@jong-kyung
- Report `(no version)` instead of `unknown` when globally installing a
local package that has no `version` field
([#2232](#2232)), by
@liangmiQwQ

### Refactor

- Rename the Git hooks environment variable to `VP_GIT_HOOKS`, keeping
`VITE_GIT_HOOKS` working as a deprecated alias
([#2195](#2195)), by
@dennybiasiolli
- Consolidate the package manager infrastructure so typed command
arguments are the source of truth for per-manager compatibility
([#2140](#2140)), by
@forehalo
- Generate the Zed language settings from a language list instead of 17
near-identical blocks
([#2294](#2294)), by
@jong-kyung
- Share the agent-file detect and write traversal helpers so both passes
apply identical rules
([#2296](#2296)), by
@jong-kyung
- Drop redundant clippy allow attributes in the global CLI
([#2235](#2235)), by
@shulaoda

### Docs

- Avoid a duplicate `vp` installation step in the onboarding prompt
([#2291](#2291)), by
@Arcadi4
- Recommend stacked pull requests for submitting changes
([#2281](#2281)), by
@fengmk2
- Correct stale delegation comments in the global CLI
([#2236](#2236)), by
@shulaoda
- Improve the release draft review guidance in the release-manager skill
([#2285](#2285)), by
@wan9chi

### Chore

- Stop emitting unmet peer warnings for the `vite-plus` peer of oxfmt
and oxlint on every install
([#2321](#2321)), by
@fengmk2
- Remove duplicate direct dependency declarations so each build
dependency is owned by one workspace
([#2318](#2318)), by
@jong-kyung
- Declare `@emnapi` peers where `@napi-rs/cli` is used
([#2319](#2319)), by
@jong-kyung
- Exclude `rollup-tests` from the workspace and update `basic-ftp`
([#2322](#2322)), by
@fengmk2
- Remove unused `EnvConfig` fields
([#2320](#2320)), by
@jong-kyung
- Remove the obsolete peer dependency merger tool
([#2303](#2303)), by
@jong-kyung
- Stop the staging deploy from triggering on external pull requests
([#2293](#2293)), by
@BlankParticle
- Kill the real `vp` process, and kill it before its children, in the
`env_install_interrupt` snapshot test
([#2299](#2299),
[#2316](#2316)), by
@fengmk2
- Suppress racy optimizer logs in the `vitest_browser_mode` snapshot
test ([#2297](#2297)), by
@fengmk2
- Remove the obsolete auto-install environment from the snapshot tests
([#2163](#2163)), by
@liangmiQwQ

### Bundled Versions

| Tool | Version | Source |
| --------------- | ---------- |
-------------------------------------------------------------------------------------------------
|
| vite | `8.2.0` |
[`fa79f9a`](vitejs/vite@fa79f9a)
|
| rolldown | `1.2.2` |
[`872b98a`](rolldown/rolldown@872b98a)
|
| tsdown | `0.22.14` | [npm](https://npmx.dev/package/tsdown/v/0.22.14)
|
| vitest | `4.1.10` | [npm](https://npmx.dev/package/vitest/v/4.1.10) |
| oxlint | `1.76.0` | [npm](https://npmx.dev/package/oxlint/v/1.76.0) |
| oxlint-tsgolint | `7.0.2001` |
[npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2001) |
| oxfmt | `0.61.0` | [npm](https://npmx.dev/package/oxfmt/v/0.61.0) |

### Upgrade

```bash
vp upgrade
```

### New Contributors

@jbmusso, @Arcadi4, @dennybiasiolli, @RSS1102

**Full Changelog**:
v0.2.7...v0.2.8

---

Merging this PR will trigger the release workflow.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: MK <fengmk2@gmail.com>