chore(deps): bump vite-plus to v0.1.24

[fengmk2]

Summary

Bump vite-plus and related packages to the pkg.pr.new prerelease build for v0.1.24.

Updated where applicable:

• vite-plus -> pkg.pr.new prerelease
• vite / vitest aliases and overrides -> @voidzero-dev/vite-plus-core / @voidzero-dev/vite-plus-test prerelease
• @voidzero-dev/vite-plus-* direct deps, overrides / resolutions / pnpm.overrides / catalogs
• Enabled minimum-release-age with vite-plus stack excluded (pnpm / npm / bun / yarn as applicable)
• Moved deprecated pnpm.* package.json fields into pnpm-workspace.yaml where present

Test plan

• CI passes

[gemini-code-assist]

Code Review

This pull request updates several dependencies, including @voidzero-dev/vite-plus-core and vite-plus, to use specific preview tarball URLs, while also updating oxfmt and oxc-project packages. Additionally, it restructures the pnpm workspace configuration by moving onlyBuiltDependencies from package.json to pnpm-workspace.yaml. Feedback on these changes highlights critical supply-chain security concerns in pnpm-workspace.yaml, specifically advising against reducing the global minimumReleaseAge to 60 minutes and disabling blockExoticSubdeps, as both modifications expose the repository to potential dependency-based vulnerabilities.

[gemini-code-assist]

Reducing the global minimumReleaseAge to 60 minutes (1 hour) severely weakens the supply-chain security of the repository for all other dependencies. Since you have already excluded the vite-plus stack and related packages using minimumReleaseAgeExclude, please keep the global minimumReleaseAge at its previous secure value of 7200 minutes (5 days).

minimumReleaseAge: 7200

[gemini-code-assist]

Changing blockExoticSubdeps to false allows transitive dependencies to be resolved from non-registry sources (like git, file, or tarball URLs), which is a known supply-chain attack vector. Since direct exotic dependencies (like the pkg.pr.new tarballs used here) are still allowed with blockExoticSubdeps: true, please keep this setting enabled for security.

blockExoticSubdeps: true

[github-actions]

React Doctor found 3 files changed in this pull request, but none matched the files covered by its enabled checks.

Scope: 3 files changed on update-vite-plus-prerelease-test-0.1.24 vs. main.

View workflow run

Generated by React Doctor. Questions? Contact founders@million.dev.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2

npm i https://pkg.pr.new/react-doctor@2

commit: 36402ac