feat(deps): upgrade upstream dependencies (#1435)

## Summary

- Automated daily upgrade of upstream dependencies.
- Bumps vite to v8.0.9, vitest to 4.1.5, and the oxc toolchain (oxfmt
0.46.0, oxlint 1.61.0, `@oxc-project/*` and `oxc-*` 0.127.0).
- Re-points the `dotenv-expand` patch from 12.0.3 to 13.0.0 to match the
new vite dependency graph.
- Refreshes CLI help snapshots to capture new oxfmt/vite/vitest options
exposed by the upgrades.

## Dependency updates

| Package | From | To |
| --- | --- | --- |
| `vite` | `6e585dc` | `v8.0.9 (ce729f5)` |
| `vitest` | `4.1.4` | `4.1.5` |
| `oxfmt` | `0.45.0` | `0.46.0` |
| `oxlint` | `1.60.0` | `1.61.0` |
| `@oxc-project/runtime` | `0.126.0` | `0.127.0` |
| `@oxc-project/types` | `0.126.0` | `0.127.0` |
| `oxc-minify` | `0.126.0` | `0.127.0` |
| `oxc-parser` | `0.126.0` | `0.127.0` |
| `oxc-transform` | `0.126.0` | `0.127.0` |

<details><summary>Unchanged dependencies</summary>

- `rolldown`: `v1.0.0-rc.16 (edec4fa)`
- `tsdown`: `0.21.9`
- `@oxc-node/cli`: `0.1.0`
- `@oxc-node/core`: `0.1.0`
- `oxlint-tsgolint`: `0.21.1`
- `@vitejs/devtools`: `0.1.14`

</details>

## Code changes

- Re-point the `dotenv-expand` patched dependency from `12.0.3` to
`13.0.0` in `pnpm-workspace.yaml`.
- Update `packages/cli/snap-tests/bin-oxfmt-wrapper/snap.txt` for the
new oxfmt `--disable-nested-config` flag.
- Update `packages/cli/snap-tests/command-helper/snap.txt` for the oxfmt
`--disable-nested-config` flag, vite's new `oxc` minifier default, and
vitest's new `minimal` reporter.

## Build status

- `sync-remote-and-build`: success
- `build-upstream`: success

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Primarily dependency bumps (Vite/Vitest/OXC toolchain) plus
regenerated CLI help snapshots; risk is moderate due to potential
behavior changes in build/test tooling despite no core logic changes.
> 
> **Overview**
> **Upgrades upstream toolchain dependencies** across the workspace:
Vite to `8.0.9`, Vitest to `4.1.5`, and the OXC toolchain
(`@oxc-project/*`, `oxc-*`, `oxfmt`, `oxlint`) to `0.127.0` / `0.46.0` /
`1.61.0`, with corresponding `package.json` bundled version bumps and a
large `pnpm-lock.yaml` refresh.
> 
> **Aligns patching and CLI expectations** by repointing the patched
`dotenv-expand` version (to match Vite’s updated graph) and regenerating
CLI help snapshots to capture new flags/options like `oxfmt
--disable-nested-config`, Vite’s `--minify oxc` default, and Vitest’s
`minimal` reporter.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
416e604. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: Brooooooklyn

packages/cli/snap-tests/bin-oxfmt-wrapper/snap.txt

@@ -24,6 +24,7 @@ Output Options:
 Config Options
     -c, --config=PATH        Path to the configuration file (.json, .jsonc, .ts, .mts, .cts, .js,
                              .mjs, .cjs)
+        --disable-nested-config  Do not search for configuration files in subdirectories
 
 Ignore Options
         --ignore-path=PATH   Path to ignore file(s). Can be specified multiple times. If not
@@ -64,6 +65,7 @@ Output Options:
 Config Options
     -c, --config=PATH        Path to the configuration file (.json, .jsonc, .ts, .mts, .cts, .js,
                              .mjs, .cjs)
+        --disable-nested-config  Do not search for configuration files in subdirectories
 
 Ignore Options
         --ignore-path=PATH   Path to ignore file(s). Can be specified multiple times. If not

packages/cli/snap-tests/command-helper/snap.txt

@@ -95,6 +95,7 @@ Output Options:
 Config Options
     -c, --config=PATH        Path to the configuration file (.json, .jsonc, .ts, .mts, .cts, .js,
                              .mjs, .cjs)
+        --disable-nested-config  Do not search for configuration files in subdirectories
 
 Ignore Options
         --ignore-path=PATH   Path to ignore file(s). Can be specified multiple times. If not
@@ -234,7 +235,7 @@ Options:
   --assetsInlineLimit <number>  [number] static asset base64 inline threshold in bytes (default: 4096) 
   --ssr [entry]                 [string] build specified entry for server-side rendering 
   --sourcemap [output]          [boolean | "inline" | "hidden"] output source maps for build (default: false) 
-  --minify [minifier]           [boolean | "terser" | "esbuild"] enable/disable minification, or specify minifier to use (default: esbuild) 
+  --minify [minifier]           [boolean | "oxc" | "terser" | "esbuild"] enable/disable minification, or specify minifier to use (default: oxc) 
   --manifest [name]             [boolean | string] emit build manifest json 
   --ssrManifest [name]          [boolean | string] emit ssr manifest json 
   --emptyOutDir                 [boolean] force empty outDir when it's outside of root 
@@ -293,7 +294,7 @@ Options:
   --api [port]                                               Specify server port. Note if the port is already being used, Vite will automatically try the next available port so this may not be the actual port the server ends up listening on. If true will be set to 51204. Use '--help --api' for more info. 
   --silent [value]                                           Silent console output from tests. Use 'passed-only' to see logs from failing tests only. 
   --hideSkippedTests                                         Hide logs for skipped tests 
-  --reporter <name>                                          Specify reporters (default, agent, blob, verbose, dot, json, tap, tap-flat, junit, tree, hanging-process, github-actions) 
+  --reporter <name>                                          Specify reporters (default, agent, minimal, blob, verbose, dot, json, tap, tap-flat, junit, tree, hanging-process, github-actions) 
   --outputFile <filename/-s>                                 Write test results to a file when supporter reporter is also specified, use cac's dot notation for individual outputs of multiple reporters (example: --outputFile.tap=./tap.txt) 
   --coverage                                                 Enable coverage report. Use '--help --coverage' for more info. 
   --mode <name>                                              Override Vite mode (default: test or benchmark) 

packages/core/package.json

@@ -217,7 +217,7 @@
     "node": "^20.19.0 || >=22.12.0"
   },
   "bundledVersions": {
-    "vite": "8.0.8",
+    "vite": "8.0.9",
     "rolldown": "1.0.0-rc.16",
     "tsdown": "0.21.9"
   }

packages/test/package.json

@@ -293,17 +293,17 @@
     "@blazediff/core": "1.9.1",
     "@oxc-node/cli": "catalog:",
     "@oxc-node/core": "catalog:",
-    "@vitest/browser": "4.1.4",
-    "@vitest/browser-playwright": "4.1.4",
-    "@vitest/browser-preview": "4.1.4",
-    "@vitest/browser-webdriverio": "4.1.4",
-    "@vitest/expect": "4.1.4",
-    "@vitest/mocker": "4.1.4",
-    "@vitest/pretty-format": "4.1.4",
-    "@vitest/runner": "4.1.4",
-    "@vitest/snapshot": "4.1.4",
-    "@vitest/spy": "4.1.4",
-    "@vitest/utils": "4.1.4",
+    "@vitest/browser": "4.1.5",
+    "@vitest/browser-playwright": "4.1.5",
+    "@vitest/browser-preview": "4.1.5",
+    "@vitest/browser-webdriverio": "4.1.5",
+    "@vitest/expect": "4.1.5",
+    "@vitest/mocker": "4.1.5",
+    "@vitest/pretty-format": "4.1.5",
+    "@vitest/runner": "4.1.5",
+    "@vitest/snapshot": "4.1.5",
+    "@vitest/spy": "4.1.5",
+    "@vitest/utils": "4.1.5",
     "chai": "^6.2.1",
     "convert-source-map": "^2.0.0",
     "estree-walker": "^3.0.3",
@@ -316,16 +316,16 @@
     "rolldown": "workspace:*",
     "rolldown-plugin-dts": "catalog:",
     "tinyrainbow": "^3.1.0",
-    "vitest-dev": "^4.1.4",
+    "vitest-dev": "^4.1.5",
     "why-is-node-running": "^2.3.0"
   },
   "peerDependencies": {
     "@edge-runtime/vm": "*",
     "@opentelemetry/api": "^1.9.0",
     "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-    "@vitest/coverage-istanbul": "4.1.4",
-    "@vitest/coverage-v8": "4.1.4",
-    "@vitest/ui": "4.1.4",
+    "@vitest/coverage-istanbul": "4.1.5",
+    "@vitest/coverage-v8": "4.1.5",
+    "@vitest/ui": "4.1.5",
     "happy-dom": "*",
     "jsdom": "*",
     "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -363,6 +363,6 @@
     "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
   },
   "bundledVersions": {
-    "vitest": "4.1.4"
+    "vitest": "4.1.5"
   }
 }

packages/tools/.upstream-versions.json

@@ -7,6 +7,6 @@
   "vite": {
     "repo": "https://github.com/vitejs/vite.git",
     "branch": "main",
-    "hash": "6e585dcb05a3b159fba7ae57f7faf0b1eca7a390"
+    "hash": "ce729f5fa1a5adca373b2adcb0e1b18099164a14"
   }
 }