[dependabot]

Bumps voidzero-dev/setup-vp from 1.18.0 to 1.21.2.

Release notes

Sourced from voidzero-dev/setup-vp's releases.

v1.21.2

This patch release fixes command injection in GitLab inputs and Azure setupRef. GitLab and Azure now validate refs before downloading bootstrap scripts or runtimes.

The installer also prevents executable planting during sfw lookup. All integrations use Socket Firewall Free v1.15.4.

Registry authentication now requires an explicit registry-url input (registryUrl in Azure) or an existing auth entry in .npmrc. Jobs that previously relied on automatic token entries from registry URLs in repository files must update their configuration.

This release also isolates bundle rebuilds from the GitHub App token, expands native operating system test coverage, and updates dependencies.

What's Changed

• chore: upgrade Vite+ to 1.0.0-rc.0 by @​fengmk2 in voidzero-dev/setup-vp#173
• chore(deps): update pnpm to v12 by @​renovate[bot] in voidzero-dev/setup-vp#179
• chore(deps): update github actions (major) by @​renovate[bot] in voidzero-dev/setup-vp#176
• chore(deps): update vite-plus to v1.0.0 by @​renovate[bot] in voidzero-dev/setup-vp#174
• chore(deps): update dependency @​actions/cache to v6.3.0 by @​renovate[bot] in voidzero-dev/setup-vp#181
• chore(deps): update dependency socketdev/sfw-free to v1.15.4 by @​renovate[bot] in voidzero-dev/setup-vp#180
• chore(deps): update dependency vite-plus to v1 by @​renovate[bot] in voidzero-dev/setup-vp#177
• chore(deps): update pnpm package manager by @​renovate[bot] in voidzero-dev/setup-vp#178
• chore(deps): update vite-plus to v1.1.0 by @​renovate[bot] in voidzero-dev/setup-vp#182
• fix: prevent Azure setupRef command injection by @​fengmk2 in voidzero-dev/setup-vp#184
• ci: run the full unit suite on all supported operating systems by @​fengmk2 in voidzero-dev/setup-vp#185
• fix: isolate bundle rebuilds from the app token by @​fengmk2 in voidzero-dev/setup-vp#187
• fix: validate refs before CI bootstrap downloads by @​fengmk2 in voidzero-dev/setup-vp#188
• fix: publish rebuilt bundles from a trusted workflow by @​fengmk2 in voidzero-dev/setup-vp#189
• fix: require explicit registry input for generated auth by @​fengmk2 in voidzero-dev/setup-vp#191
• fix: prevent executable planting during sfw lookup by @​fengmk2 in voidzero-dev/setup-vp#190
• fix: prevent shell injection through GitLab inputs by @​fengmk2 in voidzero-dev/setup-vp#193

Full Changelog: voidzero-dev/setup-vp@v1.21.1...v1.21.2

v1.21.1

The GitHub Action now reuses a complete active installation when it matches the requested exact Vite+ version (0.3.0 or later). This avoids repeated CLI downloads on persistent runners. The installer still runs when the installation needs repair or environment overrides require configuration changes.

All integrations now use Socket Firewall Free v1.15.2. This release also updates the Vite+ build tools and zod.

What's Changed

• chore(deps): update vite-plus to v0.3.3 by @​renovate[bot] in voidzero-dev/setup-vp#167
• chore(deps): update dependency zod to v4.6.5 by @​renovate[bot] in voidzero-dev/setup-vp#169
• fix: reuse active Vite+ installations for exact versions by @​fengmk2 in voidzero-dev/setup-vp#146
• docs: streamline repository agent instructions by @​fengmk2 in voidzero-dev/setup-vp#170
• chore(deps): update dependency socketdev/sfw-free to v1.15.2 by @​renovate[bot] in voidzero-dev/setup-vp#168
• chore: release v1.21.1 by @​fengmk2 in voidzero-dev/setup-vp#172

Full Changelog: voidzero-dev/setup-vp@v1.21.0...v1.21.1

v1.21.0

GitLab and Azure now support version files, Node.js selection, project .npmrc authentication, and full YAML install inputs. GitLab adds a Windows template, native dependency caching, restore-only cache controls, and dotenv outputs. Azure adds named outputs and an sfw cache.

On Azure, nodeVersion now selects the project runtime through vp env use. Use bootstrapNodeVersion to control the Node.js version installed by UseNode@1.

... (truncated)

Commits

• 68f39c7 chore: release v1.21.2 (#195)
• 16e60ef fix: prevent shell injection through GitLab inputs (#193)
• 77e445c fix: prevent executable planting during sfw lookup (#190)
• 2fb3264 fix: require explicit registry input for generated auth (#191)
• 264e3f5 fix: publish rebuilt bundles from a trusted workflow (#189)
• 38584ab fix: validate refs before CI bootstrap downloads (#188)
• a0eccbf fix: isolate bundle rebuilds from the app token (#187)
• 9706c5f ci: run the full unit suite on all supported operating systems (#185)
• ad9155c fix: prevent Azure setupRef command injection (#184)
• 3e9ae84 chore(deps): update vite-plus to v1.1.0 (#182)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)