fix(create): reject non-semver versions in org-template manifests

[fengmk2]

Malformed registry versions can place org-template files outside the cache root. readOrgManifest() now rejects versions that fail semver.valid(), including targets from dist-tags.latest and tags that match a requested version.

resolveExtractionDir() also checks that the extraction path stays within the cache root. Tests cover invalid versions, path traversal, and valid versions with prerelease or build metadata.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://fix-org-template-version-validation-viteplus-dev.voidzero-docs.workers.dev (commit 481b6f5)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://ad70f9b7-viteplus-dev.voidzero-docs.workers.dev	481b6f5	2026-09-11T08:53:25.761Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://c8c0e2f4-viteplus-dev.voidzero-docs.workers.dev	fe1a99c	2026-09-11T08:01:37.621Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://6c09a337-viteplus-dev.voidzero-docs.workers.dev	cd6f5ca	2026-09-11T07:06:44.683Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://4f1ca19c-viteplus-dev.voidzero-docs.workers.dev	0e24d6c	2026-09-11T04:07:47.759Z	Visit the dashboard ↗

[github-actions]

Registry bridge build (0e24d6c)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
vite-plus	0.0.0-commit.0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a
@voidzero-dev/vite-plus-core	0.0.0-commit.0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/voidzero-dev/vite-plus/0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a/packages/cli/install.sh | VP_PR_VERSION=2665 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/voidzero-dev/vite-plus/0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a/packages/cli/install-legacy.sh bash

# Windows (PowerShell)
$env:VP_PR_VERSION="2665"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/voidzero-dev/vite-plus/0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a/packages/cli/install.ps1 | iex

Or download the standalone Windows installer built from this commit:

Architecture	Installer
x64	vp-setup-x86_64-pc-windows-msvc.exe
Arm64	vp-setup-aarch64-pc-windows-msvc.exe

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	.npmrc: registry=https://registry-bridge.viteplus.dev/
Yarn (v2+)	.yarnrc.yml: npmRegistryServer: "https://registry-bridge.viteplus.dev/"

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.0e24d6c2139ea8733ee4a1dd70e4a2a1ba8b4a4a"
  }
}

[github-actions]

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
ghcr.io/voidzero-dev/vite-plus:pr-2665	228MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-2665 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-2665

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-2665 vp --version

See docs/guide/docker.md for usage.