fix(static_config): only trust `defineConfig` from`vite-plus` by liangmiQwQ · Pull Request #2060 · voidzero-dev/vite-plus

liangmiQwQ · 2026-07-06T02:30:08Z

At present, static config only checks if the export default statement's callee is defineConfig.

So, if I import defineConfig from other sources and modify the input in the function, or define a variable called defineConfig, the static config analyze will get broken.

For example, if you are using a preset which automatically generates tasks, you will get:

$ vpr build
Task "build" not found.
Select a task (↑/↓, Enter to run, type to search): build

  No matching tasks. Press Escape to clear search.

If the defineConfig modify its import structure, you may get:

$ vpr dev
error: Failed to load task graph
* Failed to load task config file for package at "/Users/liangmi/code/liangmiQwQ/is-github-bot/"
* unknown field `missions`, expected one of `cache`, `tasks`, `enablePrePostScripts`

This PR adds source check and only trust defineConfig from vite-plus package.

This problem is discovered when I am doing attempts in my personal Vite+ config preset.

🤖 Generated with Codex

netlify · 2026-07-06T02:30:12Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`4e5a3cb`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a4b5201915e6f0008f3e93e

liangmiQwQ · 2026-07-06T02:43:20Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf702d8c87

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…plus

liangmiQwQ · 2026-07-06T03:22:04Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d343cc552

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

liangmiQwQ · 2026-07-06T03:40:25Z

@codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4bded2ec89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

liangmiQwQ · 2026-07-06T03:54:00Z

@codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1cae72a270

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

liangmiQwQ · 2026-07-06T04:37:12Z

@codex review

chatgpt-codex-connector · 2026-07-06T04:41:37Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 3d2fc136cc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…plus

fengmk2

@liangmiQwQ That was indeed a problem, thank you for fixing it.

fengmk2 · 2026-07-06T06:21:52Z

@liangmiQwQ Could you add the error message to the PR description? This way, people can get a clearer understanding of the specific issue being fixed. Even if I know what the error is, others who are unfamiliar with it should be able to understand the problem at a glance.

liangmiQwQ · 2026-07-06T06:29:27Z

@fengmk2 It may just be simple task not found for most cases. Or if the function's input type is changed, it will prompt an error. I've added both of them to PR description

…plus

fengmk2 · 2026-07-06T06:33:50Z

@liangmiQwQ I will run a round simplify before I merge.

- Reuse oxc's ModuleExportName::name() instead of the hand-rolled three-variant matcher. - Collapse the eager import scan plus interleaved mutable flag into a single immutable pass over the program body. - Extract the duplicated "vite-plus" / "defineConfig" literals into named constants.

wip

9b73595

liangmiQwQ added 2 commits July 6, 2026 10:37

snap-test

d791693

unit tests

bf702d8

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread crates/vite_static_config/src/lib.rs Outdated

Comment thread crates/vite_static_config/src/lib.rs Outdated

Comment thread crates/vite_static_config/src/lib.rs Outdated

liangmiQwQ added 2 commits July 6, 2026 11:21

wip

9292b3f

Merge branch 'main' into fix/reject-defineConfig-import-not-from-vite…

2d343cc

…plus

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread crates/vite_static_config/src/lib.rs Outdated

Comment thread crates/vite_static_config/src/lib.rs Outdated

wip

4bded2e

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread crates/vite_static_config/src/lib.rs Outdated

enhance

1cae72a

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

liangmiQwQ added 2 commits July 6, 2026 12:23

wip

01a1035

wip

3d2fc13

liangmiQwQ changed the title ~~fix(static_config): reject defineConfig from untrusted sources~~ fix(static_config): only trust defineConfig fromvitest Jul 6, 2026

liangmiQwQ changed the title ~~fix(static_config): only trust defineConfig fromvitest~~ fix(static_config): only trust defineConfig fromvite-plus Jul 6, 2026

Merge branch 'main' into fix/reject-defineConfig-import-not-from-vite…

bf7eabb

…plus

liangmiQwQ marked this pull request as ready for review July 6, 2026 04:42

liangmiQwQ requested review from fengmk2 and wan9chi July 6, 2026 04:42

fengmk2 approved these changes Jul 6, 2026

View reviewed changes

Merge branch 'main' into fix/reject-defineConfig-import-not-from-vite…

854dcae

…plus

fengmk2 force-pushed the fix/reject-defineConfig-import-not-from-viteplus branch from 336d469 to 4e5a3cb Compare July 6, 2026 06:58

fengmk2 merged commit b9b15c4 into voidzero-dev:main Jul 6, 2026
44 checks passed

liangmiQwQ deleted the fix/reject-defineConfig-import-not-from-viteplus branch July 6, 2026 07:21

Uh oh!

Conversation

liangmiQwQ commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 6, 2026

Uh oh!

fengmk2 left a comment

Choose a reason for hiding this comment

Uh oh!

fengmk2 commented Jul 6, 2026

Uh oh!

liangmiQwQ commented Jul 6, 2026

Uh oh!

fengmk2 commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

liangmiQwQ commented Jul 6, 2026 •

edited

Loading

netlify Bot commented Jul 6, 2026 •

edited

Loading