vlt v1.6.0: global installs and easier monorepo migrations
All Posts
vltclientfeatures

vlt v1.6.0: global installs and easier monorepo migrations

vlt v1.6.0 adds global installs with vlt install -g, links the workspaces that npm monorepos reference by plain ranges, and fixes a round of CLI bugs.

vlt v1.6.0 release

vlt v1.6.0 is out, and the main addition is Global installs. vlt install -g puts a command line tool on your machine the same way npm install -g does. Under the hood, global packages live in a regular vlt project of their own (vlt/global in the XDG data dir), where each tool gets a workspace with the tool as its only dependency and the whole set is recorded in one vlt-lock.json that you can source control in git and restore every tool on a new machine with a bare vlt install -g. Bins are linked next to vlt itself, so they run right away; when that folder isn't writable, vlt falls back to ~/.local/bin or <global-dir>/bin and, in a terminal, offers once to add it to your PATH, which vlt setup --path can also do.

vlt install -g vlt now updates vlt itself, the way it was installed.

bash

$ vlt install -g eslint
🔗 Linked eslint in ~/.local/bin

$ vlt ls -g
vlt-global
└─┬ eslint-ws@workspace:*
  └── eslint@10.13.0

Other changes

  • npm and Yarn v1 monorepos can link local dependencies. Add the graph modifier ":project > :workspace": "workspace:*" to vlt.json to link plain-range dependencies across the root and workspaces; the lockfile records it, so vlt ci keeps passing. The npm, Yarn and pnpm migration guides cover this alongside saved workspaces.
  • vlt skills finds skills in workspaces. Skills shipped by your own workspace packages, like a skills/* workspace with one skill per package, were never listed or linked, since vlt skills only looked inside the store. A workspace now counts like any package, so *, :not(:malware) and your allow-skills query pick it up; leave them out with :not(:workspace). See the skills docs.
  • VLT_TOKEN authenticates the default registry. The token was only sent when VLT_REGISTRY named the same registry, so a config written by vlt setup (just registries.npm) silently got no auth from it in CI. It now applies to the default registry alias, which is what the auth docs describe.
  • Unresolvable optional dependencies no longer break installs. An optionalDependencies entry the registry doesn't have, or has no matching version of, made every vlt install in the project fail with Dependency node could not be found. It's now skipped and the install finishes.
  • Shared bin names survive vlt uninstall. When two dependencies expose the same bin, uninstalling either one used to leave the command missing: removing the package that didn't own the link deleted it anyway, and removing the owner never handed it to the remaining package. Both are fixed, thanks to @drawliin.
  • ^0 means what it says. ^0, ^0.x and ^0.0 were parsed as the exact version 0.0.0, so a dependency like axios@^0.x could never resolve. They now match >=0.0.0 <1.0.0-0 (^0.0: >=0.0.0 <0.1.0-0), the same as node-semver.

Try it

You can find every patch note in the GitHub releases. To install or update vlt, run:

bash

curl -fsSL https://install.vlt.sh | bash

Already on vlt? From this release on, vlt install -g vlt does the same.

Next