[dependabot]

Bumps the production-minor-patch group with 10 updates in the / directory:

Package	From	To
posthog-node	5.55.2	5.57.0
jose	6.2.12	6.2.13
@rollup/rollup-linux-x64-gnu	4.64.5	4.65.0
arktype	2.2.8	2.2.9
@anthropic-ai/claude-agent-sdk	0.3.296	0.3.309
@anthropic-ai/sdk	0.133.0	0.137.0
@clerk/nextjs	7.9.14	7.9.19
@vitest/coverage-v8	4.1.11	4.1.12
vitest	4.1.11	4.1.12
vite	8.3.4	8.3.5

Updates posthog-node from 5.55.2 to 5.57.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.57.0

5.57.0

Minor Changes

• #5234 1991b99 Thanks @​gustavohstrassburger! - feat: report flags local evaluation could not resolve on evaluateFlags() snapshots via unresolvedFlags, tag reads of them with local_evaluation_inconclusive, and warn once about flags whose definition local evaluation does not support

  Behavior changes:

  • A condition with a filter local evaluation cannot check and a filter that does not match now resolves locally as no match, instead of falling back to a server request or staying unresolved.
  • $feature_flag_called events from snapshot reads report local_evaluation_inconclusive instead of flag_missing for these flags.
  • The load-time warning now also logs with strictLocalEvaluation: true. (2026-10-22)

Patch Changes

• Updated dependencies [1991b99]:
  • @​posthog/core@​1.60.0

posthog-node@5.56.4

5.56.4

Patch Changes

• #5350 17260e5 Thanks @​marandaneto! - Fall back from local flag evaluation when a required property value is undefined. (2026-10-21)
• Updated dependencies [17260e5]:
  • @​posthog/core@​1.59.3

posthog-node@5.56.3

5.56.3

Patch Changes

• #5307 189da75 Thanks @​quotentiroler! - Local flag evaluation now matches a null property with string operators like the flags service, so negated operators such as not_icontains match instead of failing. (2026-10-21)
• Updated dependencies [189da75]:
  • @​posthog/core@​1.59.2

Changelog

Sourced from posthog-node's changelog.

5.57.0

Minor Changes

• #5234 1991b99 Thanks @​gustavohstrassburger! - feat: report flags local evaluation could not resolve on evaluateFlags() snapshots via unresolvedFlags, tag reads of them with local_evaluation_inconclusive, and warn once about flags whose definition local evaluation does not support

  Behavior changes:

  • A condition with a filter local evaluation cannot check and a filter that does not match now resolves locally as no match, instead of falling back to a server request or staying unresolved.
  • $feature_flag_called events from snapshot reads report local_evaluation_inconclusive instead of flag_missing for these flags.
  • The load-time warning now also logs with strictLocalEvaluation: true. (2026-10-22)

Patch Changes

• Updated dependencies [1991b99]:
  • @​posthog/core@​1.60.0

5.56.4

Patch Changes

• #5350 17260e5 Thanks @​marandaneto! - Fall back from local flag evaluation when a required property value is undefined. (2026-10-21)
• Updated dependencies [17260e5]:
  • @​posthog/core@​1.59.3

5.56.3

Patch Changes

• #5307 189da75 Thanks @​quotentiroler! - Local flag evaluation now matches a null property with string operators like the flags service, so negated operators such as not_icontains match instead of failing. (2026-10-21)
• Updated dependencies [189da75]:
  • @​posthog/core@​1.59.2

5.56.2

Patch Changes

• #5263 cd31356 Thanks @​dustinbyrne! - Allow local feature flag evaluation from a shared definition cache without a secret or personal API key. (2026-10-16)

5.56.1

Patch Changes

• #5289 e6598be Thanks @​pauldambra! - Link captured exceptions to active OpenTelemetry traces when the API is available. (2026-10-14)

5.56.0

... (truncated)

Commits

• 6897dc8 chore: update versions and lockfile [version bump]
• 1991b99 feat(node): report unresolved local flags on evaluateFlags snapshots (#5234)
• a856dd2 chore: update versions and lockfile [version bump]
• 17260e5 fix(flags): defer undefined property values to remote evaluation (#5350)
• 43fdd6b chore: update versions and lockfile [version bump]
• 189da75 fix(flags): match null properties for string operators like the flags service...
• 89b4e09 test(node): await enrichment before asserting flag event delivery (#5324)
• 3ddaa65 chore: update versions and lockfile [version bump]
• cd31356 fix(flags): load shared definitions without a secret key (#5263)
• 9a196f9 chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates jose from 6.2.12 to 6.2.13

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

Commits

• 316b7f2 chore(release): 6.2.13
• 8106395 chore: bump packages
• 724ba24 refactor: preserve underlying error causes
• b112a5e chore: bump packages
• 2a3a525 chore(deps-dev): bump workerd in /tap/workerd
• 8f540d8 chore(deps): bump the actions group with 3 updates
• 8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
• 55c959f ci: use gh run rerun for retries
• 5b00c64 ci: address zizmor findings and bump shared workflows
• 1761d7f chore: bump packages
• Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.64.5 to 4.65.0

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.65.0

4.65.0

2026-10-22

Features

• Support synthetic named exports in namespaces when preserving modules (#6589)

Bug Fixes

• Fix a situation where unaligned sourcemaps resulted in a wrong segment (#6591)
• Forward startup errors on native module load when starting rollup (#6592)

Pull Requests

• #6589: Merge synthetic named exports into static namespaces when preserving modules (@​b84330808, @​lukastaegert)
• #6590: Stabilize flaky watch test "treats filenames literally, not as globs" (@​lukastaegert)
• #6591: Use the last sourcemap segment for log locations after its start (@​Dev-next-gen)
• #6592: Preserve native module load errors (@​shuaiyafei, @​lukastaegert)
• #6593: Close bundles in the Gulp examples (@​shuaiyafei, @​lukastaegert)
• #6594: Improve review instructions and resolve audit (@​lukastaegert)

v4.64.12

4.64.12

2026-10-20

Bug Fixes

• Allow generating logs from transform hooks at position 0 (#6587)
• Properly handle global or sticky regular expressions for file names (#6588)

Pull Requests

• #6587: Fix transform diagnostics at position zero (@​shuaiyafei)
• #6588: Match stateful external regular expressions consistently (@​shuaiyafei)

v4.64.10

4.64.10

2026-10-18

Bug Fixes

• Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
• Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.65.0

2026-10-22

Features

• Support synthetic named exports in namespaces when preserving modules (#6589)

Bug Fixes

• Fix a situation where unaligned sourcemaps resulted in a wrong segment (#6591)
• Forward startup errors on native module load when starting rollup (#6592)

Pull Requests

• #6589: Merge synthetic named exports into static namespaces when preserving modules (@​b84330808, @​lukastaegert)
• #6590: Stabilize flaky watch test "treats filenames literally, not as globs" (@​lukastaegert)
• #6591: Use the last sourcemap segment for log locations after its start (@​Dev-next-gen)
• #6592: Preserve native module load errors (@​shuaiyafei, @​lukastaegert)
• #6593: Close bundles in the Gulp examples (@​shuaiyafei, @​lukastaegert)
• #6594: Improve review instructions and resolve audit (@​lukastaegert)

4.64.12

2026-10-20

Bug Fixes

• Allow generating logs from transform hooks at position 0 (#6587)
• Properly handle global or sticky regular expressions for file names (#6588)

Pull Requests

• #6587: Fix transform diagnostics at position zero (@​shuaiyafei)
• #6588: Match stateful external regular expressions consistently (@​shuaiyafei)

4.64.10

2026-10-18

Bug Fixes

• Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
• Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

• #6583: Track manual chunk dependencies when merging small chunks (@​ybai08, @​lukastaegert)
• #6584: Use decoded values for JSX string attributes (@​luantaraschi)

... (truncated)

Commits

• 9aac09a 4.65.0
• 56200ea Preserve native module load errors (#6592)
• 61ce2a7 Close bundles in the Gulp examples (#6593)
• fba8c01 Merge synthetic named exports into static namespaces when preserving modules ...
• 0cae2c7 Improve review instructions and resolve audit (#6594)
• 05c6ba2 Use the last sourcemap segment for log locations after its start (#6591)
• e70c19b Stabilize flaky watch test "treats filenames literally, not as globs" (#6590)
• 78d43df 4.64.12
• 375a2d0 Match stateful external regular expressions consistently (#6588)
• 3a9f4af Fix transform diagnostics at position zero (#6587)
• Additional commits viewable in compare view

Updates arktype from 2.2.8 to 2.2.9

Changelog

Sourced from arktype's changelog.

2.2.9

Keep tuple elements around defaults in .in and .out

Combining a tuple's defaultable elements with its other elements dropped some of them, depending on key order:

const T = type(["string", "number = 5", "boolean?"])
// was: [string, boolean?]
// now: [string, number?, boolean?]
T.in.expression
// was: number[]
// now: [number, string, ...number[]]
type(["number", "string = 'foo'", "...", "number[]"]).out.expression

A bound that narrows two existing length constraints at once also no longer throws "multiple distinct intersection results":

// was: throws
// now: string == 2
type("1 <= string <= 2").and("string >= 2")

Thanks to @​ybai08 (#1696).

Reject NaN in unions discriminated by typeof

number rejects NaN, but compiled unions like number | null dropped that check when they discriminated by typeof, so NaN was only rejected with jitless (#1702).

const T = type("number | null")
// was: NaN
// now: ArkErrors: must be a number (was NaN)
T(NaN)

Thanks to @​thecotne.

Don't treat Object.prototype keys as declared

Inherited names like toString or constructor, and an own __proto__ key like the one JSON.parse creates, were treated as declared keys, so "+": "delete" kept them and "+": "reject" accepted them (#1701).

const T = type({ a: "string", "+": "reject" })
// was: { a: "x", constructor: 1 }
</tr></table>

... (truncated)

Commits

• cfded1a release: arktype 2.2.9 + dependents (#1704)
• 092075a fix(schema): keep tuple elements around defaults in .in and .out (#1696)
• fc06904 fix(schema): only emit referenced $defs in toJsonSchema (#1689)
• cd11e1f fix(schema): don't treat Object.prototype keys as declared for undeclared key...
• c82c596 fix(schema): keep the NaN check when a union discriminates on typeof (#1702)
• 5aad144 fix(schema): convert what JSON Schema can't represent in ~standard.jsonSchema...
• 9d60ec7 docs: simpler landing examples, Markdown docs for agents, and an ArkType skil...
• See full diff in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.296 to 0.3.309

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.309

What's changed

• Fixed host-supplied managedSettings dropping disableAllHooks, disableSkillShellExecution and empty allowedHttpHookUrls / httpHookAllowedEnvVars lists
• Changed extractFromBunfs() to extract the embedded CLI into its own per-user temp directory (claude-agent-sdk-<uid>, or claude-agent-sdk on Windows) instead of Claude Code's temp root
• Changed extractFromBunfs() to reuse an already-extracted file only when its bytes match the embedded binary, replacing it otherwise
• Updated to parity with Claude Code v2.1.309

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.309
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.309
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.309
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.309

v0.3.308

What's changed

• Updated to parity with Claude Code v2.1.308

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.308
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.308
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.308
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.308

v0.3.307

What's changed

• Added wakeup_source to the command_lifecycle started frame of a scheduled wakeup or task, and scheduled_for for a wakeup (capability lifecycle_wakeup_source_v1), so a host can tell which one fired
• Added supportedDialogKinds to browser SDK query(), sent on initialize; a non-empty list requires onUserDialog
• Updated to parity with Claude Code v2.1.307

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.307
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.307
</tr></table> 

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.309

• Fixed host-supplied managedSettings dropping disableAllHooks, disableSkillShellExecution and empty allowedHttpHookUrls / httpHookAllowedEnvVars lists
• Changed extractFromBunfs() to extract the embedded CLI into its own per-user temp directory (claude-agent-sdk-<uid>, or claude-agent-sdk on Windows) instead of Claude Code's temp root
• Changed extractFromBunfs() to reuse an already-extracted file only when its bytes match the embedded binary, replacing it otherwise
• Updated to parity with Claude Code v2.1.309

0.3.308

• Updated to parity with Claude Code v2.1.308

0.3.307

• Added wakeup_source to the command_lifecycle started frame of a scheduled wakeup or task, and scheduled_for for a wakeup (capability lifecycle_wakeup_source_v1), so a host can tell which one fired
• Added supportedDialogKinds to browser SDK query(), sent on initialize; a non-empty list requires onUserDialog
• Updated to parity with Claude Code v2.1.307

0.3.306

• Updated to parity with Claude Code v2.1.306

0.3.305

• Added recommendations and fix to the get_usage response's behavior windows
• Fixed servers set with setMcpServers being replaced later in the session by a same-named server from the user's own settings
• Fixed startup() with initializeTimeoutMs: null counting time spent in SessionStart or Setup hooks against its 60-second limit; null now works like leaving the option out
• Changed the startup() and prewarm() timeout error for a start with no open SessionStart or Setup hook: it lists possible causes and no longer says to check authentication and network
• Updated to parity with Claude Code v2.1.305

0.3.304

• Added suspendSseStream(query) and resumeSseStream(query) to the browser SDK: close a query's event stream and reopen it later without ending the query
• Added stable row ids to getContextUsage(), and, when the CLI answers on its own stdio, plugin ids, agent and skill file paths, and per-server MCP instruction token shares
• Fixed startup() timing out while a SessionStart or Setup command hook was running when no initializeTimeoutMs is passed: up to 10 minutes of that time no longer counts toward the 60-second limit, and the timeout error now says what the process reported
• Fixed startup() keeping every hook_progress message of a running SessionStart or Setup hook in memory until it resolved; it now keeps only the newest one for each hook
• Updated to parity with Claude Code v2.1.304

0.3.303

• Updated to parity with Claude Code v2.1.303

0.3.302

• Fixed structured output results delivering a response's output as structured_output when the API refused that response; the result is now an error with no payload
• Changed an omitted permissionMode to start in default mode on third-party providers, with telemetry off or on a fresh install; pass permissionMode: 'auto' to keep auto mode
• Changed fork subagents (subagent_type: "fork") to be on by default in SDK sessions, as in the terminal; run_in_background is still offered, and CLAUDE_CODE_FORK_SUBAGENT=0 turns them off
• Updated to parity with Claude Code v2.1.302

0.3.301

... (truncated)

Commits

• 82e441e chore: Update CHANGELOG.md
• c17fea5 chore: Update CHANGELOG.md
• b4d3ea3 chore: Update CHANGELOG.md
• 9c59e06 chore: Update CHANGELOG.md
• b43f033 chore: Update CHANGELOG.md
• b8060fa chore: Update CHANGELOG.md
• 53464f2 chore: Update CHANGELOG.md
• 9cf9f23 chore: Update CHANGELOG.md
• b0fc766 chore: Update CHANGELOG.md
• fbc5294 chore: Update CHANGELOG.md
• Additional commits viewable in compare view

Updates @anthropic-ai/sdk from 0.133.0 to 0.137.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.137.0

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner
• tests: make credential tests independent of the caller's environment

sdk-v0.136.0

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• tools: accept every tool definition field in the tool helpers

Bug Fixes

• client: treat x-amz-security-token as a sensitive header
• tools: keep $ sequences literal in memory tool str_replace

Chores

• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions
• internal: bump playwright-core in the browser ecosystem tests
• tests: cover OpenTelemetry failures, propagation and environment variables

sdk-v0.135.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.137.0 (2026-10-20)

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner
• tests: make credential tests independent of the caller's environment

0.136.0 (2026-10-20)

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• tools: accept every tool definition field in the tool helpers

Bug Fixes

• client: treat x-amz-security-token as a sensitive header
• tools: keep $ sequences literal in memory tool str_replace

Chores

• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions
• internal: bump playwright-core in the browser ecosystem tests
• tests: cover OpenTelemetry failures, propagation and environment variables

0.135.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

... (truncated)

Commits

• 9c65624 release: 0.137.0
• 04151db Merge pull request #970 from anthropics/synced/published
• 5aae8ce feat(api): add org webhook endpoints and user profile enforcement events
• 261ead0 codegen metadata
• 20d7c14 codegen metadata
• a7736e6 chore(ci): run the changelog check on a standard runner
• 48ecaa4 Merge branch 'main'
• accbdd8 release: packages/aws-sdk 0.9.0, packages/bedrock-sdk 0.36.0, packages/vertex...
• b00aefc Merge pull request #968 from anthropics/synced/published
• 521ffc1 Merge branch 'main'
• Additional commits viewable in compare view

Updates @clerk/nextjs from 7.9.14 to 7.9.19

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.9.19

Patch Changes

• Updated dependencies [49c8afd]:
  • @​clerk/backend@​3.26.1

@​clerk/nextjs@​7.9.18

Patch Changes

• Fix the return type of auth.protect() when a predicate is passed together with the token option. The result is now typed from the accepted token types, so auth.protect(() => true, { token: 'api_key' }) resolves to the API key auth object instead of a session auth object. (#10211) by @​wobsoriano

• Updated dependencies [85dec02, b799bad, e5cfdff]:

  • @​clerk/backend@​3.26.0
  • @​clerk/shared@​4.41.0
  • @​clerk/react@​6.18.0

Changelog

Sourced from @​clerk/nextjs's changelog.

7.9.19

Patch Changes

• Updated dependencies [49c8afd]:
  • @​clerk/backend@​3.26.1

7.9.18

Patch Changes

• Fix the return type of auth.protect() when a predicate is passed together with the token option. The result is now typed from the accepted token types, so auth.protect(() => true, { token: 'api_key' }) resolves to the API key auth object instead of a session auth object. (#10211) by @​wobsoriano

• Updated dependencies [85dec02, b799bad, e5cfdff]:

  • @​clerk/backend@​3.26.0
  • @​clerk/shared@​4.41.0
  • @​clerk/react@​6.18.0

7.9.17

Patch Changes

• Updated dependencies [57aeba8]:
  • @​clerk/backend@​3.25.0

7.9.16

Patch Changes

• Updated dependencies [9159465]:
  • @​clerk/backend@​3.24.0

7.9.15

Patch Changes

• Fix auth.protect() skipping authorization checks for machine tokens. The role, permission, feature, plan, and reverification params and the predicate callback are now evaluated for API key, OAuth token, and M2M token requests. Param-based checks respond with a 401 for those requests. (#10198) by @​wobsoriano

• Fix getAuth() and auth() returning OAuth and M2M tokens as signed-in user sessions. They now return a signed-out state for machine tokens. To authenticate OAuth or M2M tokens on a route, use auth({ acceptsToken }). (#10213) by @​wobsoriano

Commits

• 80b0813 ci(repo): Version packages (#10315)
• ec91b9b ci(repo): Version packages (#10283)
• 0eb5e97 fix(nextjs): infer auth.protect() predicate return type from the token option...
• 0c7e63b ci(repo): Version packages (#10274)
• 01da4b4 ci(repo): Version packages (#10234)
• 9079455 ci(repo): Version packages (#10210)
• dd522cf fix(nextjs): reject machine tokens where a session is expected (#10213)
• f5ba9b0 fix(nextjs): evaluate auth.protect() authorization params for machine tokens ...
• See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.11 to 4.1.12

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.12

   🐞 Bug Fixes

• mocker: Harden manual and redirect mocks [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#11580 (b8253)

    View changes on GitHub

Commits

• 4766ce1 chore: release v4.1.12 (#11610)
• See full diff in compare view

Updates vitest from 4.1.11 to 4.1.12

Release notes

Sourced from vitest's releases.

v4.1.12

   🐞 Bug Fixes

• mocker: Harden manual and redirect mocks [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#11580 (b8253)

    View changes on GitHub

Commits

• 4766ce1 chore: release v4.1.12 (#11610)
• 5bf2197 chore: delete wdio folder from v4 branch to avoid falsy release (#11581)
• See full diff in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served outp...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e0b5366

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 33aab1cb-38cd-4874-962b-a317cc3771cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}