fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@vitejs/devtools (source)	^0.4.1 → ^0.4.8			devDependencies	patch	0.4.9
@vitejs/plugin-react (source)	^6.0.3 → ^6.0.4			devDependencies	patch
@​voidzero-dev/vitepress-theme	^5.0.2 → ^5.0.4			devDependencies	patch
baseline-browser-mapping	^2.10.43 → ^2.11.3			devDependencies	minor	2.11.4
browserslist	^4.28.6 → ^4.28.7			dependencies	patch
eslint (source)	10.7.0 → 10.8.0				minor
less (source)	^4.7.0 → ^4.8.0			devDependencies	minor
lint-staged	^17.1.0 → ^17.2.0			devDependencies	minor
magic-string	^1.0.0 → ^1.1.0			dependencies	minor
magic-string	^1.0.0 → ^1.1.0			devDependencies	minor
miniflare (source)	^4.20260714.0 → ^4.20260722.0			devDependencies	minor
oxfmt (source)	^0.59.0 → ^0.60.0			devDependencies	minor
oxlint (source)	^1.74.0 → ^1.75.0			devDependencies	minor
playwright-chromium (source)	^1.61.1 → ^1.62.0			devDependencies	minor
postcss (source)	^8.5.20 → ^8.5.23			dependencies	patch
react (source)	^19.2.7 → ^19.2.8			dependencies	patch
react (source)	19.2.7 → 19.2.8			dependencies	patch
react (source)	^19.2.7 → ^19.2.8			devDependencies	patch
react-dom (source)	^19.2.7 → ^19.2.8			dependencies	patch
react-dom (source)	^19.2.7 → ^19.2.8			devDependencies	patch
react-fake-client (source)	^19.2.7 → ^19.2.8			devDependencies	patch
react-fake-server (source)	^19.2.7 → ^19.2.8			devDependencies	patch
sass	^1.101.0 → ^1.102.0			devDependencies	minor
svelte (source)	^5.56.6 → ^5.56.8			devDependencies	patch
typescript-eslint (source)	8.64.0 → 8.65.0				minor
typescript-eslint (source)	^8.64.0 → ^8.65.0			devDependencies	minor
vue-tsc (source)	^3.3.7 → ^3.3.8			devDependencies	patch
zizmorcore/zizmor-action	v0.6.0 → v0.6.1			action	patch

---

Release Notes

vitejs/devtools (@​vitejs/devtools)

v0.4.8

Compare Source

   🚀 Features

• core: Add passive mode for the injected overlay  -  by @​antfubot in #​465 (c1440)

   🐞 Bug Fixes

• core: Keep a group's defaultChildId reachable regardless of visibility, respecting when  -  by @​antfubot in #​472 (a93cf)

    View changes on GitHub

v0.4.7

Compare Source

   🚀 Features

• core: Support render-only visibility on dock entries  -  by @​antfubot in #​470 (f4fd7)

    View changes on GitHub

v0.4.6

Compare Source

   🚀 Features

• core:
  • Fold group side nav overflow into a height-based show-more  -  by @​antfubot in #​467 (08127)
  • Re-bucket pinned docks into a dedicated ~pinned category  -  by @​antfubot in #​466 (7ccd6)
  • Allow a group entry to override its in-group sub-category order  -  by @​antfubot in #​468 (69bed)

    View changes on GitHub

v0.4.5

Compare Source

   🚀 Features

• core: Shared-iframe soft navigation (devframe 0.7.11)  -  by @​antfubot in #​464 (5cb6e)

   🐞 Bug Fixes

• kit: Disable devframe auth prompt fallback  -  by @​antfu in #​463 (0e9be)

    View changes on GitHub

v0.4.4

Compare Source

   🚀 Features

• core: Treat a grouped dock entry's category as an in-group sub-category  -  by @​antfubot and @​antfu in #​462 (17213)
• oxc: Open lint results in pages  -  by @​yuyinws in #​460 (dcd9e)
• vite: Add cache for rpc functions  -  by @​webfansplz in #​458 (c2898)

   🐞 Bug Fixes

• core: Clamp popovers to viewport  -  by @​webfansplz in #​461 (02128)

    View changes on GitHub

v0.4.3

Compare Source

   🚀 Features

• Upgrade devframe to v0.7.6  -  by @​antfu (572e0)
• Add pnpm run play playground picker  -  by @​antfubot in #​453 (14f51)
• Move viteplus group to framework category  -  by @​antfu (ff8d8)
• kit:
  • Let launchers offer selectable launch roots  -  by @​antfubot in #​448 (6dd78)
  • Revert serve launchers to launcher mode when their process exits  -  by @​antfubot in #​451 (f22f1)
  • Track install launcher progress in a terminal session  -  by @​antfubot in #​457 (77db1)
  • Adopt @​devframes/json-render (devframe v0.7.9)  -  by @​antfubot in #​454 (89b16)
• oxc:
  • Vite-plus detection  -  by @​yuyinws in #​449 (03e71)
• rolldown:
  • Add "Run build with devtools" button  -  by @​antfubot in #​431 (0b4a1)
  • Rework landing page with session panel, filtering and actions  -  by @​antfubot and @​antfu in #​452 (dff26)

    View changes on GitHub

v0.4.2

Compare Source

   🚀 Features

• Client vip  -  by @​yuyinws (a9547)
• Client vip  -  by @​yuyinws (98714)
• Update  -  by @​yuyinws (92737)
• Update  -  by @​yuyinws (fb42c)
• Add generate time  -  by @​yuyinws (9ffb5)
• Update  -  by @​yuyinws (60fd6)
• Update  -  by @​yuyinws (eda24)
• Update  -  by @​yuyinws (f9d15)
• Overview page  -  by @​yuyinws (c7da9)
• Add formatter configuration page and RPC function to retrieve formatter settings  -  by @​yuyinws (4d381)
• Enhance lint command to automatically append .oxc-inspector to .gitignore and improve version retrieval logic  -  by @​yuyinws (759dd)
• Upgrade devframe to 0.6.2 and adopt integration-owned built-in docks  -  by @​antfubot in #​411 (18c0d)
• Add production playground for testing the real user install path  -  by @​antfubot and @​antfu in #​413 (22e90)
• Unify devtools logos  -  by @​antfu (d8791)
• core:
  • Dependency-light install-launcher shell for built-in integrations  -  by @​antfubot and @​antfu in #​409 (a5766)
• kit:
  • Enrich launcher view with command binding, terminal digest, and session navigation  -  by @​antfubot in #​435 (c6644)
• oxc:
  • Build in turbo and mount in the core playground  -  by @​antfubot (76bc5)
  • Adopt oxc-inspector as the first-party @​vitejs/devtools-oxc package  -  by @​antfu (31dcf)
  • Migrate the DevTools UI onto @​vitejs/devtools-ui + UnoCSS  -  by @​antfubot in #​430 (40cd2)
  • Lint results inspecteor  -  by @​yuyinws and @​antfubot in #​432 (2a7a5)
• rolldown:
  • Show enable-devtools snippet in empty session state  -  by @​antfubot and @​antfu in #​410 (eca8f)
  • Group session list by date with collapsible sections  -  by @​antfubot in #​425 (53326)
• vitest:
  • Add Vitest UI launcher in the Vite+ group; mount Vite & Vitest as builtins  -  by @​antfubot and @​antfu in #​407 (0ddfa)

   🐞 Bug Fixes

• Project setup  -  by @​yuyinws (0f682)
• Add --yes flag to npx command in wrapOxlintCommand function  -  by @​yuyinws (79894)
• Grammar in README.md  -  by @​WuMingDao in #​1 (d37f1)
• Update RPC types and improve session page logic [close #​3]  -  by @​yuyinws in #​3 (d0cd0)
• Remove extraneous character in session page template  -  by @​yuyinws (b1a09)
• Adjust layout structure in index.vue for better responsiveness and visual consistency  -  by @​yuyinws (dc737)
• Update output message in lint command to clarify log generation location  -  by @​yuyinws (bb918)
• Update package and README descriptions for clarity  -  by @​yuyinws (95fa6)
• Web font path  -  by @​antfu (06712)
• core:
  • Use standalone root for integration detection  -  by @​webfansplz in #​423 (b0f43)
  • Restore integration cwd detection and harden build exit  -  by @​antfubot in #​427 (ba8a9)
  • Match settings toggle switches and checkboxes to primary color  -  by @​antfubot in #​426 (7f50b)
  • Inherit group category when grouping dock members  -  by @​SaKaNa-Y in #​437 (d35d0)
  • Handle keyboard shortcuts in popup windows  -  by @​SaKaNa-Y in #​440 (0c518)
  • Hide CommandPalette while dock popup is open  -  by @​SaKaNa-Y in #​438 (c9e0a)
• dock:
  • Prevent group buttons from sharing popover state  -  by @​SaKaNa-Y in #​442 (b2533)
• e2e:
  • Ignore HTTPS cert errors when fetching Iconify fallback icons  -  by @​antfubot in #​416 (b8608)
• kit:
  • Serve RPC connection meta at each devframe base  -  by @​antfubot and @​antfu in #​414 (11ea6)
• shortcuts:
  • Hide shortcut binding for non-executable commands  -  by @​SaKaNa-Y in #​441 (81c80)
• vite:
  • Correct font assets dir to Nuxt public dir  -  by @​antfubot in #​408 (9e778)

    View changes on GitHub

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.4

Compare Source

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined.
This error is now fixed.

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.11.3

Compare Source

v2.11.1

Compare Source

v2.11.0

Compare Source

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #​134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.44

Compare Source

browserslist/browserslist (browserslist)

v4.28.7

Compare Source

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

eslint/eslint (eslint)

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

less/less.js (less)

v4.8.0

Compare Source

Changes

• #​4473 fix(mixing): resolves issue #​4234 (@​puckowski)
• #​4472 Fix boolean() parsing for comparisons between inline condition expressions (@​app/copilot-swe-agent)

Deprecation Warnings

• #​4475 Deprecate numeric-leading and dash-only variable names, dash-only mixin names, and dynamic @charset interpolation for removal in Less 5.x. Less 4 preserves the existing output while warning; migrate names to valid identifiers and use a static quoted @charset declaration. (@​matthew-dean)

lint-staged/lint-staged (lint-staged)

v17.2.0

Compare Source

Minor Changes

• #​1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @​type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

  Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

  Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

  /** @​type {import('lint-staged').Configuration} */
  export default {
    "*.js": {
      title: "Log staged JS files to console",
      task: async (files) => {
        console.log("Staged JS files:", files);
      },
    },
  };

v17.1.1

Compare Source

Patch Changes

• #​1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

Rich-Harris/magic-string (magic-string)

v1.1.0

Compare Source

Bug Fixes

• trim replacements longer than the range they replace (#​312) (ec1a139)

Performance Improvements

• use a Map for tracking chunks (#​313) (25d7461)

cloudflare/workers-sdk (miniflare)

v4.20260722.0

Compare Source

Minor Changes

• #​14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #​14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #​14772 c079ba3 Thanks @​chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

  When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

• #​14493 95b026e Thanks @​petebacondarwin! - Update sharp to 0.35.2

  sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

  This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

• #​14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

v4.20260721.0

Compare Source

Minor Changes

• #​14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

  Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

• #​14715 42af66d Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260714.1	^5.20260721.1
  workerd	1.20260714.1	1.20260721.1

• #​14766 4815711 Thanks @​gianghungtien! - Report the Worker's error for HEAD requests instead of an internal JSON parse error

  A Worker that threw on a HEAD request (for example curl -I) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it.

  The error is now also carried in a header, which survives HEAD, so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure.

oxc-project/oxc (oxfmt)

v0.60.0

Compare Source

oxc-project/oxc (oxlint)

v1.75.0

Compare Source

🚀 Features

• dd18383 linter/node: Implement no-top-level-await rule (#​24634) (Connor Shea)
• 16a65f2 linter/react: Implement function-component-definition rule (#​24471) (Cole Ellison)
• 7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#​24519) (Mikhail Baev)
• 99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#​24502) (camc314)

🐛 Bug Fixes

• 8694167 linter/eslint/prefer-dest

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.