`vp upgrade` fails when `minimumReleaseAge` is configured

[mizdra]

Describe the bug

When pnpm's minimumReleaseAge option is set globally, the vp upgrade command may fail.

Reproduction

This bug can be reproduced with the vp upgrade command alone, so no reproduction repository is provided.

Steps to reproduce

# Downgrade previous version
vp upgrade 0.1.14

# Remove the cached version directory
rm -rf ~/.vite-plus/0.1.15

# Set minimumReleaseAge to a large value
pnpm config set --location=global minimumReleaseAge 1000000

# Upgrade to the latest version
vp upgrade

Running vp upgrade produces the following output and the command fails.

info: checking for updates...
info: found vite-plus@0.1.15 (current: 0.1.14)
info: downloading vite-plus@0.1.15 for darwin-arm64...
info: installing...
error: Upgrade error: Failed to install production dependencies (exit code: 1)

System Info

$ vp env current
VITE+ - The Unified Toolchain for the Web

Environment:
  Version  24.14.1
  Source   lts

Tool Paths:
  node  /Users/mizdra/.vite-plus/js_runtime/node/24.14.1/bin/node
  npm   /Users/mizdra/.vite-plus/js_runtime/node/24.14.1/bin/npm
  npx   /Users/mizdra/.vite-plus/js_runtime/node/24.14.1/bin/npx

$ vp --version
VITE+ - The Unified Toolchain for the Web

vp v0.1.14

Local vite-plus:
  vite-plus  Not found

Tools:
  vite             Not found
  rolldown         Not found
  vitest           Not found
  oxfmt            Not found
  oxlint           Not found
  oxlint-tsgolint  Not found
  tsdown           Not found

Environment:
  Package manager  Not found
  Node.js          v24.14.1

$ pnpm -v
10.28.0

Used Package Manager

pnpm

Logs

VITE_LOG=debug vp upgrade
2026-04-01T12:39:18.045254Z DEBUG vp: argv0: vp
2026-04-01T12:39:18.064133Z DEBUG vp::commands::upgrade: Platform: darwin-arm64
info: checking for updates...
2026-04-01T12:39:18.064155Z DEBUG vp::commands::upgrade::registry: Fetching main package metadata: https://registry.npmjs.org/vite-plus/latest
2026-04-01T12:39:18.064161Z DEBUG vite_install::request: Fetching JSON from: https://registry.npmjs.org/vite-plus/latest
2026-04-01T12:39:18.089733Z DEBUG hyper_util::client::legacy::connect::http: connecting to [2606:4700::6810:b22]:443
2026-04-01T12:39:18.095127Z DEBUG hyper_util::client::legacy::connect::http: connected to [2606:4700::6810:b22]:443
2026-04-01T12:39:18.140836Z DEBUG vp::commands::upgrade::registry: Fetching CLI package metadata: https://registry.npmjs.org/@voidzero-dev/vite-plus-cli-darwin-arm64/0.1.15
2026-04-01T12:39:18.140875Z DEBUG vite_install::request: Fetching JSON from: https://registry.npmjs.org/@voidzero-dev/vite-plus-cli-darwin-arm64/0.1.15
2026-04-01T12:39:18.142654Z DEBUG hyper_util::client::legacy::connect::http: connecting to [2606:4700::6810:622]:443
2026-04-01T12:39:18.148137Z DEBUG hyper_util::client::legacy::connect::http: connected to [2606:4700::6810:622]:443
info: found vite-plus@0.1.15 (current: 0.1.14)
info: downloading vite-plus@0.1.15 for darwin-arm64...
2026-04-01T12:39:18.356537Z DEBUG vite_install::request: Fetching bytes from: https://registry.npmjs.org/@voidzero-dev/vite-plus-cli-darwin-arm64/-/vite-plus-cli-darwin-arm64-0.1.15.tgz
2026-04-01T12:39:18.358703Z DEBUG hyper_util::client::legacy::connect::http: connecting to [2606:4700::6810:622]:443
2026-04-01T12:39:18.363947Z DEBUG hyper_util::client::legacy::connect::http: connected to [2606:4700::6810:622]:443
2026-04-01T12:39:18.810930Z DEBUG vp::commands::upgrade::integrity: Integrity verification successful
info: installing...
2026-04-01T12:39:18.832154Z DEBUG vp::commands::upgrade::install: Running vp install in /Users/mizdra/.vite-plus/0.1.15
2026-04-01T12:39:19.688314Z DEBUG vp::commands::upgrade: Cleaning up failed install at /Users/mizdra/.vite-plus/0.1.15
error: Upgrade error: Failed to install production dependencies (exit code: 1)

Validations

• Read the Contributing Guidelines.
• Check that there isn't already an issue for the same bug.
• Confirm this is a Vite+ issue and not an upstream issue (Vite, Vitest, tsdown, Rolldown, or Oxc).
• The provided reproduction is a minimal reproducible example.

[mizdra]

This issue is similar to #833. It could likely be fixed in the same way as #834, by placing an .npmrc in the version directory to override minimumReleaseAge with 0.

[fengmk2]

cc @kazupon

[kazupon]

Thank you for your reporting!
I'll try to take a quick look.

[connorshea]

I think it'd be good if the user were warned / asked for confirmation about this behavior when it's hit, if possible. I definitely wouldn't want vp upgrade to do this without my knowledge, given it has 45 total dependencies and if any were compromised this would circumvent the protection I set up intentionally to prevent this kind of attack.

Unless I'm mistaken and vp upgrade isn't performing the npm install on vite-plus, but it definitely seems to be?