
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
vite-version-manifest
Advanced tools
vite-version-manifest 是一个面向 Vite 项目的构建期版本清单插件,用于统一处理版本元信息注入与 version.json 生成。
它负责在构建阶段完成以下工作:
__APP_VERSION____APP_BUILD_TIME____APP_BUILD_ID____APP_BASE_URL__这个包通常与 vue3-version-update 配套使用,但也可以单独使用。
npm install -D vite-version-manifest
import fs from 'fs'
import path from 'path'
import { defineConfig } from 'vite'
import { createVersionBuildMeta, createVersionManifestPlugin } from 'vite-version-manifest'
const pkg = JSON.parse(fs.readFileSync(path.resolve(__dirname, 'package.json'), 'utf-8'))
const versionMeta = createVersionBuildMeta(pkg.version || '0.0.0')
export default defineConfig({
define: versionMeta.define,
plugins: [createVersionManifestPlugin(versionMeta)]
})
默认会生成以下内容:
__APP_VERSION____APP_BUILD_TIME____APP_BUILD_ID____APP_BASE_URL__dist/version.json示例:
{
"version": "1.0.0",
"buildTime": "2026-03-24T10:00:00.000Z",
"buildId": "1.0.0-2026-03-24T10:00:00.000Z"
}
createVersionBuildMeta(version, buildTime?)统一生成构建期版本元信息,供 define 和版本清单文件复用。
createVersionManifestPlugin(meta, options?)创建一个 Vite 插件,在生产构建时输出版本清单文件。
import { createVersionBuildMeta, createVersionManifestPlugin } from 'vite-version-manifest'
const meta = createVersionBuildMeta('1.0.0')
export default defineConfig({
define: meta.define,
plugins: [
createVersionManifestPlugin(meta, {
fileName: 'version.json',
pretty: true
})
]
})
options.fileNamestringversion.jsonoptions.prettybooleantrueVersionBuildMetainterface VersionBuildMeta {
version: string
buildTime: string
buildId: string
define: Record<string, string>
}
VersionManifestPluginOptionsinterface VersionManifestPluginOptions {
fileName?: string
pretty?: boolean
}
package.json 的 version如果只依赖 version:
因此这里使用:
versionbuildTimebuildId = version + buildTime这样即使版本号没有变化,只要重新构建,buildId 也会变化。
因为很多项目的真正缓存问题来自固定路径资源,例如:
index.htmlversion.json而不是带 hash 的 assets/*.js。运行时主动请求一个轻量版本清单,比依赖整页刷新后才知道新版本更稳。
vue3-version-update 一起使用不是。它可以单独用于任何 Vite 项目,只要你需要在构建产物里生成标准化版本清单。
不会。它只负责生成版本数据。真正的缓存头仍然需要部署层配置。
version.json可以。当前版本会在 vite serve 阶段直接通过中间件返回 version.json,这样开发环境和生产环境都能统一请求同一个版本清单地址。
__APP_BASE_URL__在微前端场景里,子应用请求 version.json 时不能简单依赖基座域名。插件会把当前项目的 base 作为 __APP_BASE_URL__ 注入到运行时,配合 vue3-version-update 可以正确拼出子应用自己的版本清单地址。
vue3-version-update:Vue 3 运行时版本检测与更新提示包FAQs
Vite 构建期版本清单插件,用于注入版本常量并生成 version.json。
The npm package vite-version-manifest receives a total of 12 weekly downloads. As such, vite-version-manifest popularity was classified as not popular.
We found that vite-version-manifest demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.