chore(deps): bump vite-plus to v0.2.2

[fengmk2]

Summary

Bump vite-plus and related packages to the pkg.pr.new prerelease build for v0.2.2 (registry-bridge commit build) to smoke-test the prerelease.

• vite-plus + vite (alias to @voidzero-dev/vite-plus-core) and vitest pinned to the commit build across deps / overrides / catalogs
• minimumReleaseAge enabled with the vite-plus / @voidzero-dev/* / oxc / oxlint stack excluded
• .npmrc (or .yarnrc.yml) points the package manager at the registry bridge (prerelease scaffolding)

Test plan

• CI passes

[gemini-code-assist]

Code Review

This pull request introduces a pnpm-workspace.yaml file to configure a pnpm workspace, migrating several dependencies to use pnpm catalogs and setting up a registry bridge in .npmrc. The review feedback highlights two important issues: first, the minimumReleaseAge is set to 60 minutes, which is likely too short to provide effective protection against supply chain attacks; second, native bundlers like esbuild and rolldown need to be explicitly added to allowBuilds to prevent installation failures under pnpm 10/11's strict build rules.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Since vite-plus relies on esbuild and rolldown under the hood, and both of these native bundlers use postinstall scripts to fetch their platform-specific binaries, they must be explicitly allowed in allowBuilds.

With strictDepBuilds enabled by default in pnpm 10/11, omitting them will cause the installation to fail or prevent the native binaries from being fetched, breaking the development and build workflows.

allowBuilds:
  edgedriver: true
  geckodriver: true
  esbuild: true
  rolldown: true

[gemini-code-assist]

The minimumReleaseAge setting in pnpm is configured in minutes, not days or hours. Setting it to 60 means a cooldown of only 1 hour, which is typically too short to effectively protect against supply chain attacks (as malicious packages often take several hours or days to be detected and yanked).

If the intention was to set a longer quarantine period, consider using:

• 1440 for 1 day
• 4320 for 3 days
• 10080 for 7 days