dependabot: bump the npm-deps group across 2 directories with 33 updates

[dependabot]

Bumps the npm-deps group with 32 updates in the / directory:

Package	From	To
@trivago/prettier-plugin-sort-imports	6.0.0	6.0.2
cve-lite-cli	1.18.1	1.37.0
prettier	3.6.2	3.9.9
prettier-plugin-tailwindcss	0.7.1	0.8.1
@types/node	24.10.1	24.19.0
jscodeshift	17.3.0	17.4.0
tsdown	0.16.6	0.23.0
vite-plugin-node-polyfills	0.24.0	0.28.0
vitest	4.1.8	4.1.11
@eslint/js	9.39.1	9.39.5
@vitest/coverage-v8	4.1.8	4.1.11
eslint-import-resolver-typescript	4.4.4	4.4.5
eslint-plugin-jsdoc	61.4.0	61.7.1
eslint-plugin-redos-detector	3.1.1	3.1.2
jsdom	27.2.0	27.4.0
typescript-eslint	8.47.0	8.70.1
vite	7.2.4	7.3.6
@vercel/speed-insights	1.2.0	1.3.1
monaco-editor	0.55.1	0.57.0
@builder.io/qwik	1.19.2	1.20.1
@shikijs/rehype	4.1.0	4.4.3
@tailwindcss/vite	4.1.17	4.3.3
@vercel/og	0.7.2	0.11.1
dotenv	17.2.3	17.4.2
eslint-plugin-qwik	1.19.2	1.20.1
sharp	0.34.5	0.35.4
shiki	4.1.0	4.4.3
tailwindcss	4.1.17	4.3.3
undici	7.16.0	7.30.0
vercel	48.10.10	48.12.1
vite-imagetools	9.0.0	9.0.3
wrangler	4.101.0	4.141.0
@vercel/speed-insights	1.2.0	1.3.1
jscodeshift	17.3.0	17.4.0
monaco-editor	0.55.1	0.57.0
@builder.io/qwik	1.19.2	1.20.1
@eslint/js	9.39.1	9.39.5
@shikijs/rehype	4.1.0	4.4.3
@tailwindcss/vite	4.1.17	4.3.3
@types/node	24.10.1	24.19.0
@vercel/og	0.7.2	0.11.1
dotenv	17.2.3	17.4.2
eslint-plugin-qwik	1.19.2	1.20.1
prettier	3.6.2	3.9.9
sharp	0.34.5	0.35.4
shiki	4.1.0	4.4.3
tailwindcss	4.1.17	4.3.3
typescript-eslint	8.47.0	8.70.1
undici	7.16.0	7.30.0
vercel	48.10.10	48.12.1
vite	7.2.4	7.3.6
vite-imagetools	9.0.0	9.0.3
vite-plugin-node-polyfills	0.24.0	0.28.0
wrangler	4.101.0	4.141.0

Bumps the npm-deps group with 23 updates in the /website directory:

Package	From	To
prettier	3.6.2	3.9.9
@types/node	24.10.1	24.19.0
jscodeshift	17.3.0	17.4.0
vite-plugin-node-polyfills	0.24.0	0.28.0
@eslint/js	9.39.1	9.39.5
typescript-eslint	8.47.0	8.70.1
vite	7.2.4	7.3.6
@vercel/speed-insights	1.2.0	1.3.1
monaco-editor	0.55.1	0.57.0
@builder.io/qwik	1.19.2	1.20.1
@builder.io/qwik-city	1.19.2	1.20.1
@shikijs/rehype	4.1.0	4.4.3
@tailwindcss/vite	4.1.17	4.3.3
@vercel/og	0.7.2	0.11.1
dotenv	17.2.3	17.4.2
eslint-plugin-qwik	1.19.2	1.20.1
sharp	0.34.5	0.35.4
shiki	4.1.0	4.4.3
tailwindcss	4.1.17	4.3.3
undici	7.16.0	7.30.0
vercel	48.10.10	48.12.1
vite-imagetools	9.0.0	9.0.3
wrangler	4.101.0	4.141.0
@vercel/speed-insights	1.2.0	1.3.1
jscodeshift	17.3.0	17.4.0
monaco-editor	0.55.1	0.57.0
@builder.io/qwik	1.19.2	1.20.1
@eslint/js	9.39.1	9.39.5
@shikijs/rehype	4.1.0	4.4.3
@tailwindcss/vite	4.1.17	4.3.3
@types/node	24.10.1	24.19.0
@vercel/og	0.7.2	0.11.1
dotenv	17.2.3	17.4.2
eslint-plugin-qwik	1.19.2	1.20.1
prettier	3.6.2	3.9.9
sharp	0.34.5	0.35.4
shiki	4.1.0	4.4.3
tailwindcss	4.1.17	4.3.3
typescript-eslint	8.47.0	8.70.1
undici	7.16.0	7.30.0
vercel	48.10.10	48.12.1
vite	7.2.4	7.3.6
vite-imagetools	9.0.0	9.0.3
vite-plugin-node-polyfills	0.24.0	0.28.0
wrangler	4.101.0	4.141.0

Updates @trivago/prettier-plugin-sort-imports from 6.0.0 to 6.0.2

Release notes

Sourced from @​trivago/prettier-plugin-sort-imports's releases.

v6.0.2

What's Changed

• Fix recognising mandatory prefix built-in imports by @​TomFryersMidsummer in trivago/prettier-plugin-sort-imports#389

New Contributors

• @​TomFryersMidsummer made their first contribution in trivago/prettier-plugin-sort-imports#389

Full Changelog: trivago/prettier-plugin-sort-imports@v6.0.1...v6.0.2

v6.0.1

What's Changed

• ignore eslint errors due to undefined export variables by @​vladislavarsenev in trivago/prettier-plugin-sort-imports#391

Full Changelog: trivago/prettier-plugin-sort-imports@v6.0.0...v6.0.1

Changelog

Sourced from @​trivago/prettier-plugin-sort-imports's changelog.

6.0.2

Bug fixes

• Fix recognising mandatory prefix built-in imports #389 by @​TomFryersMidsummer - Fixed detection of Node.js built-in modules that are only accessible with the node: prefix (like node:test, node:sqlite) to be correctly recognized when using <BUILTIN_MODULES> placeholder

6.0.1

Bug fixes

• Fix Svelte export snippet parsing #390 - Fixed by adding support for new Svelte snippet syntax

Commits

• d9c690f bump version. update changelog.
• 97214c3 Merge pull request #389 from TomFryersMidsummer/patch-1
• 7235355 Merge branch 'main' into patch-1
• 0c37c9d bump version
• 035e20a Merge pull request #391 from trivago/svelte-snippet-support
• d626e1b ignore eslint errors due to undefined export variables
• 0b1dc59 Fix recognising mandatory prefix built-in imports
• See full diff in compare view

Updates cve-lite-cli from 1.18.1 to 1.37.0

Release notes

Sourced from cve-lite-cli's releases.

v1.37.0 - Choose where output files land, and stop calling fixable findings unfixable

Upgrade note. 1.36.1 could report a finding that has a confirmed fix as having no safe upgrade at all, and describe the package as possibly unmaintained, in the same scan that named the fix. If you act on the fix plan, take this release.

Added

• --output <dir> sets the directory for the --json, --sarif and --sbom files. They previously always landed in the working directory under a timestamped name, so a CI job had to glob and rename before it could hand a path to the next step. Relative paths resolve against the working directory and the directory is created when missing; the default is unchanged. --output without one of those three flags is an error rather than a silent no-op, and a flag-like value is rejected. The GitHub Action gains a matching output input.

Fixed

• A finding carrying a confirmed fix version could be routed to the skipped list as having no safe upgrade, with the package described as possibly unmaintained, in the same scan that named the fix. The confirmation pass advanced one candidate counter and not the other, so for a single-version window the two compared equal and the plan read that as "every version is vulnerable". The counters now describe the same set, and the decision no longer rests on comparing them.

• Our own semver range handling rejected most legal range syntax. Compound ranges (>=1.18.0 <2), unions, wildcards and hyphen ranges all read as invalid, which made override hygiene report a correct bounded override as though it were pinned to latest, and caused two other override rules to skip such overrides without evaluating them. Separately, a pre-release version had its tag stripped before comparison, so a vulnerable 1.2.3-beta.1 was not matched by an advisory covering <1.2.3.

• Advisory fix versions written with fewer than three components were discarded, and a finding whose every candidate was discarded reported "no fix available". fixed: "1.22" now resolves to 1.22.0. Values that are not versions are still rejected, so a commit hash cannot become a recommended upgrade target.

• The offline advisory database stored GIT ranges, whose boundaries are commit hashes, as if they were versions, so a range could fail to exclude and a patched version could be reported as vulnerable.

• --no-cache did not bypass every cache. The npm advisory block and the advisory detail block read their caches regardless of the flag.

• Override hygiene said "copyies" for the plural and listed versions in lexicographic order.

Changed

• The two PR dependency-delta workflows are removed. They had been disabled since the GitHub App took over posting those comments.

Validation

• npm test
• npm run build

Contributors

• @​bennycode - --output <dir>, first contribution
• @​prx-my - override hygiene plural and version ordering, OA010 docs
• @​alex-powell - parent-update fix target shape
• @​MRX-72 - EPSS enrichment batching

v1.36.1 - The recommended fix version could itself be vulnerable

Fixed

• The recommended fix version could be a version that is still vulnerable. Two separate defects, either enough on its own. When several advisories affected the installed version, the lowest of their fixed versions was returned rather than the highest, so @hono/node-server@2.0.0 was told to upgrade to 2.0.5 when only 2.0.10 clears both advisories against it. Separately, the candidate was only checked against advisories affecting the version you already have, so an advisory introduced at or above the fix version was invisible: tmp@0.2.5 was told to upgrade to 0.2.6, which is the exact version another advisory introduces, while the same scan reported tmp@0.2.6 as vulnerable.

• The npm advisory source read fields npm does not send. It looked for ghsa_id, cve_ids and patched_versions; the bulk endpoint sends id, url, title, severity, vulnerable_versions, cwe and cvss. Every advisory therefore arrived under a private identifier and was counted a second time beside the same advisory from OSV, every advisory carried a range with no upper bound, and the request asked about one version per package while the answer was applied to all of them. postcss carries advisories capped at <=8.5.22, <8.5.10, <=8.5.11 and <=8.5.17, and all four were reported against 8.5.23, 8.5.25 and 8.5.26, versions the same scan was recommending as the fix.

• Caret ranges below 1.0.0 were treated as "same major". npm anchors the caret to the leftmost non-zero component, so ^0.25.0 means >=0.25.0 <0.26.0 and ^0.0.3 means >=0.0.3 <0.0.4. This also decides which versions an override is considered to admit, so it affected OA010.

• EPSS enrichment stopped at 100 CVEs. FIRST.org caps a response at 100 rows and the whole list was sent as one query, so a project past that lost scores, priority signals and the EPSS column on everything beyond the cap. Queries are now chunked, and one failing batch no longer discards the rest.

• The pull request delta comment matched on its marker alone and ignored authorship, so it could adopt and rewrite a comment written by something else.

... (truncated)

Changelog

Sourced from cve-lite-cli's changelog.

[1.37.0] - 2026-09-23

Upgrade note. 1.36.1 could report a finding that has a confirmed fix as having no safe upgrade at all, and describe the package as possibly unmaintained, in the same scan that named the fix. If you act on the fix plan, take this release.

Added

• --output <dir> sets the directory for the --json, --sarif and --sbom files. They previously always landed in the working directory under a timestamped name, so a CI job had to glob and rename before it could hand a path to the next step. Relative paths resolve against the working directory and the directory is created when missing; the default is unchanged. --output without one of those three flags is an error rather than a silent no-op, and a flag-like value is rejected. The GitHub Action gains a matching output input.

Fixed

• A finding carrying a confirmed fix version could be routed to the skipped list as having no safe upgrade, with the package described as possibly unmaintained, in the same scan that named the fix. The confirmation pass advanced one candidate counter and not the other, so for a single-version window the two compared equal and the plan read that as "every version is vulnerable". The counters now describe the same set, and the decision no longer rests on comparing them: a confirmed fix version wins.

• Our own semver range handling rejected most legal range syntax. Compound ranges (>=1.18.0 <2), unions, wildcards and hyphen ranges all read as invalid, which made override hygiene report a correct bounded override as though it were pinned to latest, and caused two other override rules to skip such overrides without evaluating them. Separately, a pre-release version had its tag stripped before comparison, so a vulnerable 1.2.3-beta.1 was not matched by an advisory covering <1.2.3. Range handling now delegates to semver.

• Advisory fix versions written with fewer than three components were discarded, and a finding whose every candidate was discarded reported "no fix available", which is indistinguishable from an advisory that genuinely has none. fixed: "1.22" now resolves to 1.22.0. Values that are not versions are still rejected, so a commit hash cannot become a recommended upgrade target.

• The offline advisory database stored GIT ranges, whose boundaries are commit hashes, as if they were versions. A version compared against a hash produced an ordering rather than a rejection, so the range failed to exclude and a patched version could be reported as vulnerable. Only ranges whose boundaries are versions are stored now.

• --no-cache did not bypass every cache. It was honoured for OSV queries and the registry publish-date lookups, but the npm advisory block and the advisory detail block read their caches regardless, so a run meant to be independent of cache state was not. All three cache reads now honour the flag.

• Override hygiene said "copyies" for the plural and listed versions in lexicographic

... (truncated)

Commits

• e444d84 release: v1.37.0 (#1227)
• 740bfdc fix(overrides): correct OA008 pluralization and order copies by version (#117...
• bb5f63a feat(output): add --output <dir> for SARIF, JSON and SBOM files (#1215)
• 47e63ee chore(ci): delete the two disabled PR delta workflows (#1225)
• 4ee9976 fix(scanner): honour --no-cache in every cache read (#1221)
• 73723b1 fix(offline-db): drop GIT ranges instead of storing commit hashes as versions...
• 8d667da fix(scanner): read advisory fix versions that omit components (#1219)
• 5d2afc0 fix(remediation): stop reporting a confirmed fix as no safe upgrade (#1218)
• bdb52aa fix(version): delegate semver range handling to semver (#1217)
• 725782e fix(remediation): stop parent-update rendering a child's version as the paren...
• Additional commits viewable in compare view

Updates prettier from 3.6.2 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

... (truncated)

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
</tr></table> 

... (truncated)

Commits

• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier since your current version.

Updates prettier-plugin-tailwindcss from 0.7.1 to 0.8.1

Release notes

Sourced from prettier-plugin-tailwindcss's releases.

v0.8.1

Fixed

• Don't remove escape sequences when sorting classes in JavaScript string literals, which could produce invalid code in Vue attribute expressions (#461)
• Restore class sorting in Svelte markup and dynamic class={...} expressions when using prettier-plugin-svelte v4 (#462)

v0.8.0

Changed

• Require at least Prettier 3.7.x (#420)

Added

• Export public sorting APIs to /sorter (#438)

Fixed

• Remove top-level await (#420)
• Improve load-time performance (#420)
• Improve config resolution caching with directory-based cache (#432)
• Load compatible plugins on demand and tighten plugin detection (#437)
• Load v3/v4 modules only when needed (#439)
• Remove recast/ast-types deps and optimize dynamic JS attribute handling (#440)
• Remove unused deps (#441)
• Use the plugin that has already been imported rather than dynamically importing it again (#442)
• Skip visiting non-node children (#443)
• Optimize whitespace-only class detection (#429)
• Fix v3 config loading with Jiti re-exports (#448)
• Collapse whitespace in template literals with adjacent quasis (#427)
• Improve canCollapseWhitespaceIn handling for "tailwindPreserveWhitespace": true (#428)

v0.7.4

Same as v0.7.2, since v0.7.3 contained breaking changes.

v0.7.3

Changed

• Remove top-level await (#420)
• Improve load-time performance (#420)

Fixed

• Collapse whitespace in template literals with adjacent quasis (#427)

v0.7.2

Fixed

• Load compatible plugins sequentially to work around race conditions in Node.js (#412)
• Fix compatibility with prettier-plugin-svelte when using Prettier v3.7+ (#418)

Changelog

Sourced from prettier-plugin-tailwindcss's changelog.

[0.8.1] - 2026-07-15

Fixed

• Don't remove escape sequences when sorting classes in JavaScript string literals, which could produce invalid code in Vue attribute expressions (#461)
• Restore class sorting in Svelte markup and dynamic class={...} expressions when using prettier-plugin-svelte v4 (#462)

[0.8.0] - 2026-04-27

Changed

• Require at least Prettier 3.7.x (#420)

Added

• Export public sorting APIs to /sorter (#438)

Fixed

• Remove top-level await (#420)
• Improve load-time performance (#420)
• Improve config resolution caching with directory-based cache (#432)
• Load compatible plugins on demand and tighten plugin detection (#437)
• Load v3/v4 modules only when needed (#439)
• Remove recast/ast-types deps and optimize dynamic JS attribute handling (#440)
• Remove unused deps (#441)
• Use the plugin that has already been imported rather than dynamically importing it again (#442)
• Skip visiting non-node children (#443)
• Optimize whitespace-only class detection (#429)
• Fix v3 config loading with Jiti re-exports (#448)
• Collapse whitespace in template literals with adjacent quasis (#427)
• Improve canCollapseWhitespaceIn handling for "tailwindPreserveWhitespace": true (#428)

[0.7.2] - 2025-12-01

Fixed

• Load compatible plugins sequentially to work around race conditions in Node.js (#412)
• Fix compatibility with prettier-plugin-svelte when using Prettier v3.7+ (#418)

Commits

• fad3e07 0.8.1
• fc3a063 sync changelog
• 2b6f3c2 fix: Preserve escape sequences when sorting JS string literals (#461)
• 410eb88 Fix Svelte class sorting with prettier-plugin-svelte v4 (#462)
• f77532e 0.8.0
• 4815377 Update the changelog for recent PRs (#449)
• 0a7ddcb Fix insiders tags sometimes published to latest channel (#453)
• 8066e85 release on published event
• 3b0ed57 move --silent flag before the script
• f7d2598 0.7.3
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier-plugin-tailwindcss since your current version.

Updates @types/node from 24.10.1 to 24.19.0

Commits

• See full diff in compare view

Updates jscodeshift from 17.3.0 to 17.4.0

Changelog

Sourced from jscodeshift's changelog.

17.4.0

Minor Changes

• 0ced828: Add iterator implementation to Collections

  ES6 iterators support the new for..of syntax. Since a Collection wraps an Array, we can lean on ECMAScript's new iterator delegation.

Patch Changes

• bc1de49: Fix --ignore-pattern not matching files when the source path is relative and starts with ../ (or ./)

  Ignore patterns such as **/node_modules/** were silently skipped for files enumerated from a relative source path like ../app/src, because picomatch's ** wildcard does not match across a leading ..//./ traversal segment. The path is now also matched with any leading traversal prefix stripped, so ignore behavior is consistent for relative and absolute source paths.

Commits

• See full diff in compare view

Updates tsdown from 0.16.6 to 0.23.0

Release notes

Sourced from tsdown's releases.

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in rolldown/tsdown#1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)

... (truncated)

Commits

• ced9a2c chore: release v0.23.0
• f5f9ea9 docs: add Ember support guide (#1043)
• 8ac89dc chore: upgrade Vitest to v5
• 96a4098 feat: expose programmatic watch controls (#1062)
• 61718d7 chore: upgrade deps
• d04119c chore: upgrade deps
• 55f89c5 chore(deps): update pnpm to v12.1.0 (#1060)
• 946224d fix: ignore optional dependencies in type definitions
• 62f01cd chore: release v0.23.0-rc.1
• bf53f43 fix(cli): camel-case nested flag keys
• Additional commits viewable in compare view

Updates vite-plugin-node-polyfills from 0.24.0 to 0.28.0

Release notes

Sourced from vite-plugin-node-polyfills's releases.

v0.28.0

• Normalize trailing slashes (fix for Vite 8)
• Run unit tests against Vite 8 & Vitest 4 in CI
• Update @playwright/test

v0.27.0

• Use inject plugin instead of esbuild.banner (thanks to @​sapphi-red)

v0.26.0

• Add support for Vite v8 (thanks to @​sapphi-red)

v0.25.0

• Update node-stdlib-browser dependency (thanks to @​miguel-nascimento)
• Add support for Vite 8 beta (thanks to @​sapphi-red)

Commits

• eebf1cf Release v0.28.0
• b1609a7 Normalize trailing slashes (#156)
• 3c24819 Properly resolve polyfills in Vite 8
• fc03122 Move global shim banners into utils
• 36c618a Disable GH token permissions in CI
• 6db3db0 Run unit tests against Vite 8 and Vitest 4 in CI
• 015aafa Add GitHub Action for overriding dependency versions
• 84a2a5f Update @playwright/test
• a31869f Move util-like types into utils
• 780986c Release v0.27.0
• Additional commits viewable in compare view

Updates vitest from 4.1.8 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ff57423a-6cf8-4e7f-9e77-635aca30a8a4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}