[otaki0413]

Why

This PR updates every dependency to its latest allowed version. It also changes the supply-chain policy. minimumReleaseAge goes from 3 days (4320) to 1 day (1440).

The owner chose 1 day to pick up new releases and fixes sooner. 1440 is also pnpm's built-in default. The line stays explicit because an explicit value turns on minimumReleaseAgeStrict. With only the built-in default, pnpm is non-strict and silently adds too-new versions to the exclude list instead of gating them. The cost is less time to catch a compromised publish.

What changed

• pnpm-workspace.yaml:
  • minimumReleaseAge: 1440. The comment explains why the line is explicit.
  • minimumReleaseAgeExclude moves directly under it. Its entries are unchanged.
  • A new comment explains why the Vite+ and oxc toolchain is excluded. vite-plus bundles exact oxlint and oxfmt versions, so following a Vite+ release needs versions published at the same time.
• Dependencies move to the newest stable release older than 1 day. The exception is vite-plus, which comes in through the exclude list (see the note after the table).

Package	Before	After
vite-plus / @voidzero-dev/vite-plus-core (catalog)	1.1.0	1.3.0
packageManager pnpm	12.6.0	12.14.0
react / react-dom	19.2.8	19.3.1
@types/react / @types/react-dom	19.2.18 / 19.2.7	19.3.0
@tanstack/react-start	1.169.1	1.169.2
@cloudflare/vite-plugin	1.54.8	1.64.0
wrangler	4.131.1	4.151.0
@vitejs/plugin-react	6.1.1	6.1.2
@types/node	24.13.4	24.19.2
voidzero-dev/setup-vp (CI)	v1.17.0	v1.21.2 (SHA-pinned)

• vite-plus and vite-plus-core 1.3.0 were published 2026-10-16 05:40 UTC, which is inside the 1-day window. They install only because vite-plus and @voidzero-dev/* are in the existing minimumReleaseAgeExclude. Every other locked version is older than 1 day.
• wrangler.jsonc now sets "upload_source_maps": true explicitly, with a comment on how to opt out (see Breaking changes).
• worker-configuration.d.ts is regenerated for workerd 1.20261012.1. The lockfile is refreshed within the existing ranges, which drops stale optional peers (jsdom, tsx, esbuild 0.27).
• The AGENTS.md note that said vp test has no test files is corrected.
• These packages were already current: @tanstack/react-router-devtools, tailwindcss / @tailwindcss/vite, typescript 7.0.2, and actions/checkout v7.0.1.

Held back

• @tanstack/react-router stays on 1.170.44. Version 1.170.45 was published 2026-10-16 21:11 UTC, inside the window. react-start 1.169.2 also depends on exactly 1.170.44.
• @tanstack/react-start 1.169.3 was published 2026-10-16 21:10 UTC, inside the window.
• wrangler 4.151.1 was published 2026-10-16 09:55 UTC, inside the window. Plugin 1.64.0 depends on exactly wrangler 4.151.0.
• @types/node 26.x. CI runs Node 24.19.0, so the types stay on 24.x.
• The Cloudflare plugin 2.0 beta and the cf CLI are out of scope.

Breaking changes handled

• @cloudflare/vite-plugin 1.64.0 turns on Worker source maps by default.
  • vp build now writes 9 .map files under dist/server/.
  • vp run deploy uploads them to Cloudflare. They are stored privately and used only for readable stack traces. dist/client gets no .map files.
  • The template now sets upload_source_maps: true explicitly. Setting it to false turns this off.
  • The build prints one [plugin vite:css-post] [SOURCEMAP_BROKEN] warning. It is harmless: it comes from the Tailwind CSS transform, and the build exits 0.
• vite-plus 1.2 and 1.3: bundled oxlint 1.88 and oxfmt 0.73 can report new issues. vp check stays clean.
• React 19.3 and 19.3.1: new features and fixes only.
• @cloudflare/vite-plugin/experimental-config was removed. This repo does not import it.
• setup-vp 1.21.2: registry auth needs an explicit registry-url. CI uses only the public registry.

Scope

• Dependencies, the lockfile, generated types, the release-age policy, the source-map setting, CI pins, and one AGENTS.md line. No source code changes.
• allowBuilds is unchanged. The README CLI stays vp. The outdated Vite+ PATH note in README and AGENTS.md is left for a separate PR.

Blast Radius

Template users get React 19.3.1, vite-plus 1.3, newer Cloudflare tooling, and a shorter release-age window. Deploys now upload server source maps to the user's Cloudflare account.

Verification

• Node 24.19.0 (the CI version), after rm -rf node_modules dist: vp install --frozen-lockfile, vp run cf-typegen --check, vp check, vp test (1/1, Vitest 5.0.5), and vp build (exit 0, 9 server .map files, 0 client .map files) all pass.
• vp dev smoke check on Vite+ 1.3.0: GET / returns 200 with "Hello World!". GET /does-not-exist returns 404 with the custom 404 component. The dev log shows no errors.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T03:42:20.939534Z	7daf6a6	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-17T03:47:33.506361Z	7daf6a6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.