feat(deps): upgrade upstream dependencies

[Brooooooklyn]

Summary

• Automated daily upgrade of upstream dependencies.
• Bumps vite to v8.0.9 and the oxc toolchain (oxfmt, oxlint, @oxc-project/*, oxc-minify, oxc-parser, oxc-transform).
• Re-points the patched dotenv-expand entry from 12.0.3 to 13.0.0 to track vite upstream.
• Updates CLI snapshots to cover the new oxfmt --disable-nested-config flag, the vite --minify default change to oxc, and a new bun install slow-filesystem warning.

Dependency updates

Package	From	To
vite	6e585dc	v8.0.9 (ce729f5)
oxfmt	0.45.0	0.46.0
oxlint	1.60.0	1.61.0
@oxc-project/runtime	0.126.0	0.127.0
@oxc-project/types	0.126.0	0.127.0
oxc-minify	0.126.0	0.127.0
oxc-parser	0.126.0	0.127.0
oxc-transform	0.126.0	0.127.0

Unchanged dependencies

• rolldown: v1.0.0-rc.16 (edec4fa)
• vitest: 4.1.4
• tsdown: 0.21.9
• @oxc-node/cli: 0.1.0
• @oxc-node/core: 0.1.0
• oxlint-tsgolint: 0.21.1
• @vitejs/devtools: 0.1.14

Code changes

• Bump bundled vite version to 8.0.9 in packages/core/package.json.
• Update tracked vite upstream hash in packages/tools/.upstream-versions.json.
• Re-point patched dependency from dotenv-expand@12.0.3 to dotenv-expand@13.0.0 in pnpm-workspace.yaml.
• Refresh oxfmt wrapper snapshot for the new --disable-nested-config flag in packages/cli/snap-tests/bin-oxfmt-wrapper/snap.txt.
• Refresh helper snapshot for the new --disable-nested-config flag and vite --minify default change to oxc in packages/cli/snap-tests/command-helper/snap.txt.
• Refresh bun list snapshot for the new slow-filesystem warning in packages/cli/snap-tests-global/command-list-bun/snap.txt.

Build status

• sync-remote-and-build: success
• build-upstream: success

---

Note

Medium Risk
Upgrades core build/lint/format toolchain versions (Vite + OXC) and repoints a patched dependency, which can change CLI behavior and build output; snapshots were updated to match but downstream projects may see subtle diffs.

Overview
Upgrades the bundled upstream stack, including Vite 8.0.9 (tracked via updated upstream hash) and the OXC toolchain (@oxc-project/*, oxc-parser, oxc-transform, oxc-minify, oxfmt, oxlint) with corresponding lockfile/workspace catalog updates.

Repoints the workspace patchedDependencies entry from dotenv-expand@12.0.3 to dotenv-expand@13.0.0 and refreshes CLI snapshot tests to match new behavior/output (e.g. oxfmt --disable-nested-config, vp build --minify default now oxc, and a new Bun slow-filesystem warning line).

^{Reviewed by Cursor Bugbot for commit f395639. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	f395639
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/69e6d5f9f50bd00008bd19d8

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f395639. Configure here.}

[cursor]

Missing patch file for dotenv-expand@13.0.0

High Severity

The patchedDependencies entry was re-pointed from dotenv-expand@12.0.3 to dotenv-expand@13.0.0, referencing vite/patches/dotenv-expand@13.0.0.patch, but this patch file does not exist in the repository. The old dotenv-expand@12.0.3.patch file was also removed. This will cause pnpm install to fail when it attempts to apply the non-existent patch.

Additional Locations (1)

• pnpm-lock.yaml#L271-L274

 

^{Reviewed by Cursor Bugbot for commit f395639. Configure here.}

[fengmk2]

Update dependencies after v0.1.19 new version release