Skip to content

chore(deps): update npm packages - #621

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages
Open

chore(deps): update npm packages#621
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages

Conversation

@renovate

@renovate renovate Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@anthropic-ai/sandbox-runtime 0.0.67 → 0.0.70 age adoption passing confidence
@openai/codex (source) 0.146.0 → 0.146.1 age adoption passing confidence
deno (source) 2.9.4 → 2.9.5 age adoption passing confidence
vite (source) 0.2.6 → 0.2.8 age adoption passing confidence
vite-task-tools>vite (source) 8.2.0 → 8.2.1 age adoption passing confidence

Release Notes

anthropic-experimental/sandbox-runtime (@​anthropic-ai/sandbox-runtime)

v0.0.70

Compare Source

What's Changed

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.69...v0.0.70

v0.0.69

Compare Source

What's Changed

New Contributors

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.68...v0.0.69

v0.0.68

Compare Source

What's Changed

New Contributors

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.67...v0.0.68

denoland/deno (deno)

v2.9.5

Compare Source

  • feat(add): --unscoped flag to alias packages by their unscoped name (#​36319)
  • feat(task): add --members flag to run tasks in workspace members only (#​35748)
  • feat: add Blob/Body textStream() (#​35616)
  • feat: add experimental QuickJS backend (#​36194)
  • fix(bundle): avoid esbuild protocol deadlock (#​36427)
  • fix(bundle): respect runtime file permissions (#​36107)
  • fix(cjs): use loader sources for recursive analysis (#​36111)
  • fix(cli): escape control characters in external metadata (#​36198)
  • fix(core): don't resolve internal module imports with the user's import map
    (#​36303)
  • fix(crypto): add "raw-secret" to KeyFormat type (#​35708)
  • fix(desktop): handle colored HMR URLs and page loads (#​36316)
  • fix(desktop): retain update signature verification op (#​36152)
  • fix(ext/crypto): allow deriveBits with length 0 (#​36283)
  • fix(ext/napi): polyfill uv_handle_size and uv_strerror (#​36308)
  • fix(ext/net): release completed QUIC stream resources (#​36247)
  • fix(ext/net): require --allow-sys for node:dns.getServers() (#​35941)
  • fix(ext/node): Node compat for web streams (#​36285)
  • fix(ext/node): apply backpressure in Readable.toWeb() (#​36321)
  • fix(ext/node): defer TLS write completion callback to avoid reentrancy panic
    (#​35867)
  • fix(ext/node): don't fire http2 settings callback after session destroy
    (#​36230)
  • fix(ext/node): gate constrained memory cgroup reads (#​36218)
  • fix(ext/node): handle pre-quoted shell arguments (#​36371)
  • fix(ext/node): implement node:test tags (#​36292)
  • fix(ext/node): implement util.diff (#​36289)
  • fix(ext/node): implement v8.promiseHooks API (#​36281)
  • fix(ext/node): sort fs.readdir entries to match Node.js (#​36341)
  • fix(ext/node): stop http2 file reads after stream close (#​36300)
  • fix(ext/node): store blocklist ranges compactly (#​36212)
  • fix(ext/node): support the fs flush option for writes (#​36290)
  • fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify (#​36326)
  • fix(ext/node_crypto): use named group exponent sizes (#​36347)
  • fix(ext/web): attach Node error codes to WHATWG API validation errors (#​36288)
  • fix(ext/websocket): disable HTTP/2 server push on wss upgrade path (#​36327)
  • fix(fetch): scope redirect-sensitive headers by origin (#​36361)
  • fix(ffi): reject resizable buffers in nonblocking calls (#​36259)
  • fix(fmt): accept xml and svg extensions for stdin (#​36149)
  • fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 (#​36397)
  • fix(http): preserve stripped headers across redirects (#​36360)
  • fix(inspector): validate request host headers (#​36348)
  • fix(net): cancel pending writes on stream close (#​36369)
  • fix(net): clean up concurrently dropped load-balanced listeners (#​36246)
  • fix(net): handle malformed DNS record text (#​36374)
  • fix(node): clean up Web Stream finished listeners (#​36227)
  • fix(node): retain consumed HTTP stream wrapper (#​36254)
  • fix(npm): ignore invalid package bin targets (#​36354)
  • fix(npm): tolerate malformed scripts field in packuments (#​36324)
  • fix(npmrc): match auth configs by authority and path (#​36359)
  • fix(outdated): don't report JSR pre-release versions as latest (#​36325)
  • fix(publish): report when the registry rejects a provenance attestation
    (#​36404)
  • fix(resolver): don't treat deno eval modules as npm package files (#​36304)
  • fix(runtime): map notify's Windows missing-path error to NotFound (#​35864)
  • fix(sync-types): add reason to too_many_arguments allows (lint)
  • fix(telemetry): handle reentrant attribute conversion (#​36256)
  • fix(webgpu): own mapped range backing stores (#​36257)
  • fix(webstorage): preserve Storage constructor name (#​35944)
  • fix: capitalize IP in help text (#​36170)
  • fix: upgrade deno_task_shell to 0.33.3 (#​36406)
  • fix: wire no-legacy-abort unstable flag from deno.json config (#​36312)
  • perf(core): run the common-path tick drain in Rust (#​36157)
  • perf(ext/node): bypass dns lookup on literal IPs in udp send (#​35909)
  • perf(ext/web): implement base64url encode/decode as simdutf ops (#​36398)
  • perf(fs): open files on the blocking pool in async readFile/writeFile (#​36160)
  • perf: order startup functions in release builds (#​36219)
  • perf: reduce eager module evaluation at startup (#​36331)
  • perf: remove Linux unwind tables from release artifacts (#​36265)
voidzero-dev/vite-plus (vite)

v0.2.8: vite-plus v0.2.8: monorepo target resolution, breaking VP_* environment variable renames, and install fixes

Compare Source

Bare vp dev/build/preview/pack at a monorepo root now resolve a target package instead of silently running against the root, and three Vite+-specific environment variables move to the VP_* prefix without compatibility aliases. Two failures that broke Vite+ before it could run are also fixed: the crash on container images that ship no CA certificates, and the missing Rolldown binding under pnpm's global virtual store.

Breaking Changes

  • Rename three Vite+-specific environment variables to the VP_* prefix, with no compatibility aliases, so the old names stop working (#​2312), by @​jong-kyung:

    Old New
    VITE_LOG VP_LOG
    VITE_GLOBAL_CLI_JS_SCRIPTS_DIR VP_GLOBAL_CLI_JS_SCRIPTS_DIR
    VITE_UPDATE_TASK_TYPES VP_UPDATE_TASK_TYPES

    Update any shell profile, CI job, or Dockerfile that sets the old names.

Highlights
  • Resolve a target package for vp dev, build, preview, and pack at a monorepo root: interactive shells get a fuzzy package picker, non-interactive runs list the candidates and exit 1 instead of building the root, and a new global -C <dir> flag or a defaultPackage setting (a single directory, or an object mapping each of the four commands to its own directory) skips the prompt (#​2031, #​2305), by @​fengmk2
  • Stop aborting with exit 134 on container images that ship no CA certificates (Debian slim, distroless): the shared HTTP client now retries once with the bundled Mozilla root list, like Node's own bundled roots, and reports a real error instead of panicking when it still cannot be built (#​2273, #​2295), by @​jbmusso and @​fengmk2
  • Resolve the bundled Rolldown binding through platform packages instead of an undeclared require back into vite-plus, fixing Cannot find module 'vite-plus/binding' under pnpm enable-global-virtual-store and in standalone @voidzero-dev/vite-plus-core installs (#​2313), by @​fengmk2
  • Add vp pm ci for reproducible frozen-lockfile installs, and vp pm patch / vp pm patch-commit for editing dependencies in place on pnpm, bun, and Yarn Berry (npm and Yarn Classic warn and exit successfully) (#​2082, #​2308), by @​forehalo and @​jong-kyung
Features
  • Upgrade the bundled toolchain: vite 8.1.5 -> 8.2.0, rolldown 1.2.0 -> 1.2.2, oxlint 1.75.0 -> 1.76.0, oxfmt 0.60.0 -> 0.61.0, and Vite DevTools 0.4.5 -> 0.4.10 (#​2302, #​2311), by @​voidzero-guard[bot]. The new oxfmt and oxlint can flag code that passed before, so run vp fmt after upgrading if your CI runs vp check.
  • Read the Node.js version from .nvmrc when no other version source is present (#​2244), by @​BlankParticle
  • Support pnpm v12, which ships as a native binary: Vite+ now downloads the platform-specific @pnpm/exe.* package and generates native shims, so pnpm and pnpx work instead of failing to exec (#​2289), by @​jong-kyung
  • Verify the downloaded bun platform tarball against the registry dist.integrity hash (#​2310), by @​jong-kyung
Fixes & Enhancements
  • Let vp config install the Git hook dispatcher without creating or modifying project hook scripts or staged-file configuration, so a custom .vite-hooks/pre-commit survives (#​2280), by @​TheAlexLichter
  • Nest immutable global package installs under packages/<package>/<uuid> instead of using # in the path, which Node treated as a URL fragment and which broke dynamic imports inside installed packages (#​2222), by @​liangmiQwQ
  • Keep the recorded version spec on global installs, so vp update -g follows a dist tag or range instead of silently resolving back to latest, vp outdated -g reports Wanted versus Latest, and vp update -g --latest explicitly moves packages back to latest (#​2249), by @​TheAlexLichter
  • Stop deleting a managed Node.js runtime that another process is concurrently installing (#​2248), by @​shulaoda
  • Preserve the real exit code when a spawned process is terminated by a signal on Unix (#​2154), by @​liangmiQwQ
  • Honor an explicit vp create --package-manager outside monorepos instead of inheriting the manager from a non-monorepo ancestor directory (#​2226), by @​jong-kyung
  • Scaffold the vite:library template into a directory that contains only .git, while still refusing to overwrite existing user files (#​2287), by @​RSS1102
  • Render help for delegated commands from the local CLI, so vp <command> --help matches the installed toolchain instead of drifting (#​2184), by @​liangmiQwQ
  • Resolve typeAware and typeCheck options inherited through Oxlint extends, so vp check --no-lint runs and classifies type checking correctly (#​2228), by @​jong-kyung
  • Report (no version) instead of unknown when globally installing a local package that has no version field (#​2232), by @​liangmiQwQ
Refactor
  • Rename the Git hooks environment variable to VP_GIT_HOOKS, keeping VITE_GIT_HOOKS working as a deprecated alias (#​2195), by @​dennybiasiolli
  • Consolidate the package manager infrastructure so typed command arguments are the source of truth for per-manager compatibility (#​2140), by @​forehalo
  • Generate the Zed language settings from a language list instead of 17 near-identical blocks (#​2294), by @​jong-kyung
  • Share the agent-file detect and write traversal helpers so both passes apply identical rules (#​2296), by @​jong-kyung
  • Drop redundant clippy allow attributes in the global CLI (#​2235), by @​shulaoda
Docs
Chore
Bundled Versions
Tool Version Source
vite 8.2.0 fa79f9a
rolldown 1.2.2 872b98a
tsdown 0.22.14 npm
vitest 4.1.10 npm
oxlint 1.76.0 npm
oxlint-tsgolint 7.0.2001 npm
oxfmt 0.61.0 npm
Upgrade
vp upgrade
New Contributors

@​jbmusso, @​Arcadi4, @​dennybiasiolli, @​RSS1102

Full Changelog: voidzero-dev/vite-plus@v0.2.7...v0.2.8

Published Packages
  • @voidzero-dev/vite-plus-core@0.2.8
  • vite-plus@0.2.8
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.8 vp build

Run any vp command without installing it; see the Docker guide for more.

v0.2.7: vite-plus v0.2.7: Clearer guidance for built-in commands and scripts

Compare Source

This release points users to vpr <name> when a Vite+ built-in command and package script share a name, adds concurrency control to vp pack, and smooths migrations and package-manager setup.

Highlights
  • Point users to vpr <name> when a Vite+ built-in command and package.json script share a name (#​2259, #​2262, #​2265, vite-task#570), by @​wan9chi
  • Add --concurrency to vp pack to limit parallel Rolldown builds, and update tsdown 0.22.13 -> 0.22.14 and Vite DevTools 0.4.2 -> 0.4.5 (#​2233), by @​voidzero-guard[bot]
  • Add read-only Svelte rune globals to migrated Oxlint overrides, preventing false no-undef errors (#​2192), by @​naokihaba
  • Install package managers from npm tarballs with nonstandard top-level directories, fixing Yarn 1.22.19 installation (#​2264), by @​TheAlexLichter
Fixes & Enhancements
  • Prevent the Oxc language server from crashing when contributors open the Vite+ workspace in VS Code (#​2245), by @​jong-kyung
Docs
  • Document the full procedure for removing Vite+ commit hooks (#​2218), by @​TheAlexLichter
  • Document per-process and per-machine ways to disable Vite+ commit hooks without uninstalling them (#​2230), by @​TheAlexLichter
  • Clarify when to use built-in vp commands versus package scripts through vp run or vpr, including migration and agent guidance (#​2255), by @​wan9chi
  • Document GitLab CI/CD setup with the reusable setup-vp template (#​2258), by @​naokihaba
Chore
  • Run Semgrep security scans on pull requests and pushes to main (#​2223), by @​Boshen
  • Re-enable Vitest browser-mode CLI snapshot coverage on every supported platform (#​2275), by @​wan9chi
  • Stabilize Windows CLI snapshot tests for interrupted installs and browser port fallback (#​2282), by @​wan9chi
  • Replace deprecated shared JavaScript and TypeScript VS Code settings with their current js/ts.* names (#​2246), by @​jong-kyung
Bundled Versions
Tool Version Source
vite 8.1.5 5e7fe12
rolldown 1.2.0 03e1e34
tsdown 0.22.14 npm
vitest 4.1.10 npm
oxlint 1.75.0 npm
oxlint-tsgolint 7.0.2001 npm
oxfmt 0.60.0 npm
Upgrade
vp upgrade

Full Changelog: voidzero-dev/vite-plus@v0.2.6...v0.2.7

Published Packages
  • @voidzero-dev/vite-plus-core@0.2.7
  • vite-plus@0.2.7
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: c17e1c3

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.7 vp build

Run any vp command without installing it; see the Docker guide for more.

vitejs/vite (vite-task-tools>vite)

v8.2.1

Compare Source

Bug Fixes
Performance Improvements
Documentation
Miscellaneous Chores
Code Refactoring
Tests

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • "before 10am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​deno@​2.9.5901007197100
Addednpm/​@​openai/​codex@​0.146.17210093100100
Addednpm/​@​voidzero-dev/​vite-plus-core@​0.2.8801007799100
Addednpm/​vite@​8.2.1981008296100
Addednpm/​@​anthropic-ai/​sandbox-runtime@​0.0.7091100100100100

View full report

@github-actions

github-actions Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown

fspy benchmark

linux

dynamic/launch             change  +1.03%  [ -4.86% ..  +8.69%]  overhead   +62.41%
dynamic/access             change  +0.76%  [ -2.69% .. +33.01%]  overhead   +10.21%
dynamic/access-relative    change  +0.10%  [-11.02% .. +15.58%]  overhead   +48.11%
static/launch              change  +2.21%  [ -6.15% .. +11.35%]  overhead  +179.81%
static/access              change  -0.19%  [ -4.61% .. +15.02%]  overhead  +811.88%
static/access-relative     change  +0.47%  [ -5.87% ..  +4.71%]  overhead +1172.13%

macos

dynamic/launch             change  +0.41%  [ -4.62% ..  +5.78%]  overhead  +232.47%
dynamic/access             change  +0.33%  [-44.92% ..  +6.84%]  overhead    +4.93%
dynamic/access-relative    change  -0.10%  [ -6.04% ..  +4.86%]  overhead  +244.87%

windows

dynamic/launch             change  -0.00%  [ -2.18% ..  +2.51%]  overhead   +27.26%
dynamic/access             change  +0.00%  [ -0.74% ..  +1.13%]  overhead    +1.33%
dynamic/access-relative    change  +0.00%  [ -0.74% ..  +0.95%]  overhead    +1.34%

@renovate
renovate Bot force-pushed the renovate/npm-packages branch from 06f7af3 to fc1e4c9 Compare August 9, 2026 16:46
@renovate
renovate Bot force-pushed the renovate/npm-packages branch from fc1e4c9 to 633785c Compare August 9, 2026 21:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants