Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

install.sh resolves CLI dependencies at install time, project lockfile and overrides cannot pin them (std-env 4.3.0 404 broke CI)

Geschlossen
  • Stimmt etwas nicht?
#2,850 2 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
48/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
javascript, shell
Bereich
ci-cd, tooling

Rechercherichtung

Start by reading install.sh and tracing how it installs the pinned vite-plus version and resolves its CLI dependencies; compare that behavior with the issue's project lockfile and overrides example. The reproduction links a GitHub Actions run using voidzero-dev/setup-vp@v1. Done means the installer no longer depends on freshly resolved transitive versions that can fail during registry propagation.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Describe the bug

The install.sh installer used by voidzero-dev/setup-vp@v1 resolves the dependencies of the pinned vite-plus version fresh with pnpm at install time instead of installing a locked dependency tree. When any transitive dependency of the CLI publishes a new version that is not yet fully propagated on the npm registry, every CI job that bootstraps Vite+ fails, regardless of what the project itself has locked.

Today (2026-09-29, from about 12:40 UTC for roughly 15 minutes) std-env 4.3.0 was listed in the registry metadata while its tarball still returned 404. The installer resolved [email protected] (a dependency of [email protected]) with std-env ^4.0.0-rc.1, picked 4.3.0 and failed on all four retries across both installer URLs.

The project pins vite-plus to 0.2.6 in package.json and additionally overrides vitest and @vitest/mocker to 4.1.11 via npm overrides with a committed package-lock.json. None of that reaches the global CLI install in ~/.vite-plus: the installer pulls [email protected] with a floating dependency range, so the project's overrides and lockfile cannot protect the CI bootstrap.

Would it be possible for the installer to ship or consume a lockfile for the CLI's dependency tree (pnpm --frozen-lockfile against a lock published with the release), or to install the CLI from a self-contained tarball that does not resolve dependencies at install time? As it stands, any project using setup-vp is exposed to transient publish gaps of every transitive dependency of the CLI.

Reproduction

https://github.com/evcc-io/evcc/actions/runs/36569656072/attempts/1

Steps to reproduce
  • package.json with "vite-plus": "0.2.6" and overrides pinning vitest to 4.1.11
  • workflow step uses: voidzero-dev/setup-vp@v1 with node-version-file and cache: true
  • run while a transitive dependency of [email protected] (here std-env 4.3.0 via [email protected]) has registry metadata but no tarball yet

Reproducing on demand is not possible since it depends on registry propagation timing. Comparing the installer's resolved tree against the project's lockfile shows the mismatch at any time: the project locks vitest 4.1.11, the CLI install resolves vitest 4.1.10 with its own floating ranges.

System Info
GitHub Actions ubuntu-latest, Node.js 26 (from .node-version), vite-plus 0.2.6, setup-vp v1
Used Package Manager

npm (project) / pnpm (used by install.sh for the CLI dependencies)

Logs
Resolved Vite+ version '0.2.6' from package.json
Installing [email protected]...
Setting up VITE+...
info: vite-plus 0.2.6 does not support the split directory layout. Vite+ will install it in ~/.vite-plus.
error: Failed to install dependencies. Log output:
Progress: resolved 179, reused 0, downloaded 85, added 53
 ERR_PNPM_FETCH_404  GET https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz: Not Found - 404

This error happened while installing the dependencies of [email protected]
 at [email protected]

No authorization header was set for the request.
##[warning]Failed to install Vite+ from https://viteplus.dev/install.sh (exit code 1). Retrying in 2000ms... (attempt 2/4)
...
Error: Failed to install Vite+ after 4 attempts across 2 URL(s): exit code 1
Validations
  • Read the Contributing Guidelines.
  • Check that there isn't already an issue for the same bug.
  • Confirm this is a Vite+ issue and not an upstream issue (Vite, Vitest, tsdown, Rolldown, or Oxc).
  • The provided reproduction is a minimal reproducible example.

🤖 Generated with Claude Code

Vorherrschende Sprache
Rust
Sterne
6.5k
Forks
296
Ø Merge
1 T. 12 Std.
Gemergte PRs (30 T.)
229

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus voidzero-dev/vite-plus

Alle Issues in voidzero-dev/vite-plus

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.