[dependabot]

Bumps the development-dependencies group with 20 updates in the / directory:

Package	From	To
fallow	3.0.0	3.17.0
typescript	6.0.3	7.0.2
jsdom	29.1.1	30.0.1
hono	4.12.27	4.13.3
@hono/node-server	2.0.8	2.1.1
@types/supertest	7.2.0	7.2.1
tsx	4.23.0	4.23.12
@playwright/test	1.61.1	1.62.1
@vitejs/plugin-react	6.0.3	6.1.0
concurrently	10.0.3	10.0.5
vite	8.1.3	8.2.2
@astrojs/starlight	0.41.3	0.41.7
astro	7.0.6	7.2.4
@stryker-mutator/core	9.6.1	10.0.0
@stryker-mutator/vitest-runner	9.6.1	10.0.0
@typescript-eslint/eslint-plugin	8.62.1	8.67.0
@typescript-eslint/parser	8.62.1	8.67.0
@vitest/coverage-v8	4.1.9	4.1.11
eslint	10.6.0	10.8.1
fast-check	4.8.0	4.9.0

Updates fallow from 3.0.0 to 3.17.0

Release notes

Sourced from fallow's releases.

v3.17.0: Type-aware CI output and Windows reliability

Type-aware analysis is easier to use in CI, more accurate around ambiguous exports, and more reliable across platforms.

Highlights

• Type-aware results render directly in CI: check and audit now support pr-comment-github, pr-comment-gitlab, review-github, and review-gitlab. fallow report --from <results.json> supports the same formats while preserving audit conclusions, semantic completeness, diff positions, ownership groups, and repository path prefixes. Required incomplete analysis fails closed. Thanks @​Jerc92 for #2272.
• Type-aware analysis starts reliably from npm and VS Code on Windows: the npm launcher uses Node for the companion, the VSIX includes every supported native semantic backend, and native child processes stay hidden without weakening process-tree cleanup. Thanks @​VariableVince for reporting #2284.

Accuracy and reliability

• Ambiguous export * collisions no longer blame contributing source files: Fallow suppresses ambiguity-attributable unused declaration, unused member, unrendered component, and unprovided injection findings. fallow trace exposes the additive star_export_ambiguity field with the contributing origins and namespaces. #2268, #2283
• External generic constraints stay bounded: type-aware public-signature scans avoid expanding complete external structural graphs while preserving project-local constraint edges. Unsupported Svelte virtual-module exports now fail closed with the stable svelte-virtual-module-exports reason instead of claiming complete evidence. Thanks @​cmoyates for the detailed reports behind #2271.
• Action binary verification has a hard deadline: the bundled Action supervises verification from a file, preserves normal exit statuses, and returns status 124 with one focused workflow error on timeout. Thanks @​Jonathangadeaharder for reporting #2273.

Performance

• Duplicate spread calculation, local type extraction, named-export indexing, and JSON root serialization now avoid unnecessary sorting, allocation, and copying. #2266, #2267, #2281, #2282

Compatibility

• Strict machine-readable consumers should update for type-aware wire protocol 7 and semantic schema 3. Every versioned JSON root that can embed this contract has a corresponding schema-version bump. Unversioned trace and inspect roots remain unchanged. Regenerate validators from the current output schema.

Full Changelog: fallow-rs/fallow@v3.16.0...v3.17.0

v3.16.0: honest template scoring, prunable audit cache, visible demotion

Health scoring gets more honest and more configurable in this release: template-family units drop the CRAP dimension they could never earn coverage for, Svelte {#snippet} blocks are scored as their own units, and thresholdOverrides finally reach file scores and refactoring targets. The audit cache becomes observable and prunable, new-only duplication demotion is no longer invisible, and a batch of correctness fixes lands across the type-aware sidecar, manual-mock detection, and the resolver.

Features

• fallow audit-cache prune: the audit cache garbage collector now explains what it does, and a new audit-cache prune subcommand removes stale entries on demand. --dry-run previews the policy without touching disk, --max-age-days overrides the age ceiling (flag, then FALLOW_AUDIT_CACHE_MAX_AGE_DAYS, then audit.cacheMaxAgeDays, then the 30-day default), and the JSON maintenance envelope reports per-entry dispositions with reclaimed_bytes counting only bytes actually removed from disk. Legacy git registrations that are only deregistered report under deregistered and are never counted as reclaimed. RUST_LOG=fallow=debug surfaces per-entry GC decisions during normal audit runs. (#2221)
• Observable duplication demotion: when --gate new-only demotes an introduced clone group to inherited, the decision is now visible. Demoted entries carry demotion_reason (currently no-added-lines), audit-family JSON always includes attribution.duplication_demoted, and --explain prints the demotion decision with the diff source it used. (#2220)
• Svelte {#snippet} blocks are their own complexity units: top-level snippets score as <snippet:NAME> units with nesting rebased to zero, so extracting markup into a snippet moves the score. Snippet units are exact-match keys for health.thresholdOverrides[].functions. (#2227)
• Broader declarative plugin manifests: typed manifest field paths with bounded [*] object-array traversal and exact exists predicates, strict JSON rules that reject JSONC input, and deterministic plugin-check limit diagnostics. Thanks @​M-Hassan-Raza. (#2165)

Health scoring changes

• Template-family units no longer participate in the CRAP dimension: a template carries no direct test coverage, so \<template> and <snippet:NAME> findings gate on the cyclomatic and cognitive dimensions only and never report crap, coverage_pct, or coverage_tier. A maxCrap override scoped to a template unit reports a matched row explaining the entry can be removed. (#2235)
• thresholdOverrides and maxCrap reach file scores and refactoring targets: file scoring and the add_test_coverage target rule now compare CRAP against the effective per-function ceiling instead of a fixed 30. Rows whose breaches were let through by configuration carry crap_exempted and crap_effective_threshold. (#2228)

Bug fixes

• Windows: --gate new-only no longer fails on pre-existing findings: the base-snapshot focus set is built from git rev-parse --show-toplevel, whose spelling can differ from the canonicalized project root (8.3 path components, drive-letter case), so no path mapped into the base worktree and the base dead-code results were filtered away entirely. Every inherited finding then looked introduced and failed the gate. Path matching now compares simplified and canonicalized forms, and a base run whose focus set cannot be expressed leaves its results unfiltered.
• jest/vitest __mocks__ parity: vitest root-level __mocks__ manual mocks for node modules are no longer reported as unused files, and literal X/__mocks__ imports and the /__mocks__ virtual package suffix now follow each framework's actual semantics. (#2225, #2226)
• Type-aware sidecar and root typescript stay in lockstep: the root lockfile pins the same typescript the sidecar needs, and a new preflight exits with a message naming the resolved version, its path, and the install command when the resolvable install is missing or too old, instead of a bare module-resolution error. (#2236)
• No wasted sidecar work when private-type-leaks is off: the type-aware layer only requests the api-surface capability when the check is active, pinned by an end-to-end config test in both directions. (#2218, #2219)
• MCP audit tool description matches the payload: the description now documents the nested complexity block that audit JSON actually carries. (#2217)
• Effective barrel exports resolve through one binding model: explicit-over-star precedence, ambiguous star origins vs convergent diamonds, separate type and value namespaces, and canonical binding identity now hold through usage propagation, public exports, duplicate analysis, trace provenance, caches, and the type-aware sidecar. Thanks @​M-Hassan-Raza. (#2210)
• Package tooling stays out of production reachability: build and tooling scripts no longer make devDependencies look like production dependencies. Thanks @​Jerc92. (#2211)
• Partial GitLab review posts now warn: inline-review jobs surface a warning when posting only partially succeeds instead of reporting clean success. Thanks @​Jerc92. (#2209)
• Scoped-package manual mocks: factory-less jest.mock/vi.mock of a scoped package no longer fabricates an unused-file candidate. (#2213)

... (truncated)

Commits

• See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates jsdom from 29.1.1 to 30.0.1

Release notes

Sourced from jsdom's releases.

v30.0.1

• Fixed getComputedStyle() with calc() and other functions throwing an exception, which regressed in v30.0.0. (@​asamuzaK)
• Sped up up range operations on large documents (@​leonidaz)

v30.0.0

Breaking changes:

• Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0.

Other changes:

• Added CSS.escape() and CSS.supports() functions. (@​asamuzaK)
• Added 'background-position-x' and 'background-position-y' CSS properties. (@​olagokemills)
• Fixed getComputedStyle() to convert length values into pixels. (@​asamuzaK)
• Fixed CSS function serialization, e.g., in the return value of getPropertyValue(). (@​asamuzaK)
• Fixed the type of error thrown by document.evaluate() (@​dokson)

Commits

• 6584485 30.0.1
• 0c51df6 Update dependencies and dev dependencies
• 32adb34 Bump @​asamuzakjp/dom-selector
• 70f014a Speed up range operations on large documents
• 250d7ee Partially fix getComputedStyle with calc()
• 20a01fc 30.0.0
• 8c8e583 Precompute WPT expectation matches
• f32245c Bump Node.js floor and dependencies
• 03ef23b Add background-position longhands
• ded056f Test CSS.escape() with numeric IDs
• Additional commits viewable in compare view

Updates hono from 4.12.27 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
• fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
• feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
• fix(client): serialize multiple cookies correctly in honojs/hono#5202
• fix(etag): stabilize digest across stream chunks in honojs/hono#5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
• perf(cors): pre-join static array header options during initialization in honojs/hono#5210
• fix(client): send falsy JSON bodies in honojs/hono#5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

• fix(trie-router): count every slash a pattern consumes by @​Jaybhade in honojs/hono#5189
• fix(utils/stream): re-acquire writer lock when pipe() throws by @​Sriharsha-dev369 in honojs/hono#4988
• fix(etag): skip unsafe methods or error responses on non-* case by @​na-trium-144 in honojs/hono#5196

New Contributors

• @​Jaybhade made their first contribution in honojs/hono#5189
• @​Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

... (truncated)

Commits

• 0293343 4.13.3
• 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
• c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
• eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
• a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
• 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
• ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
• 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
• 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
• 7195c24 fix(etag): copy pending stream bytes (#5239)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.0.8 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

• test: replace supertest by @​BlankParticle in honojs/node-server#379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in honojs/node-server#377
• perf(request): fast-path QUERY methods by @​usualoma in honojs/node-server#376
• perf(request): fast-path PATCH method by @​yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• a813b6c 2.0.12
• caf48ba fix(response): copy headers when init is a foreign Response (#382)
• 3b1dd68 test: replace supertest (#379)
• 834e54f 2.0.11
• ba72bcd perf(request): fast-path PATCH method (#380)
• Additional commits viewable in compare view

Updates @types/supertest from 7.2.0 to 7.2.1

Commits

• See full diff in compare view

Updates tsx from 4.23.0 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Updates @playwright/test from 1.61.1 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.0.3 to 6.1.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Commits

• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• 555cdbc fix(react): make the react compiler preset filter linear (#1353)
• a00a9f8 fix(deps): update all non-major dependencies (#1327)
• f4b5498 release: plugin-react@6.0.4
• 7a40659 fix(react): $RefreshSig$ is not defined with NODE_ENV=production vite dev ...
• 98b32d4 fix(deps): update react 19.2.8 (#1298)
• 8ae5449 fix: babel-plugin-react-compiler cannot be imported when used in a framework ...
• Additional commits viewable in compare view

Updates concurrently from 10.0.3 to 10.0.5

Release notes

Sourced from concurrently's releases.

v10.0.5

What's Changed

• fix: correctly output non-ASCII text on Windows by @​DanielC000 in open-cli-tools/concurrently#604
• fix: expand wildcards from package.json5 when package.json is missing by @​DSeaStar in open-cli-tools/concurrently#608

New Contributors

• @​DanielC000 made their first contribution in open-cli-tools/concurrently#604
• @​DSeaStar made their first contribution in open-cli-tools/concurrently#608

Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5

v10.0.4

What's Changed

• deps: upgrade shell-quote to 1.9.0 by @​Mayvis in open-cli-tools/concurrently#599
• fix: avoid kill timeout exit delays by @​rajanpanth in open-cli-tools/concurrently#601

New Contributors

• @​Mayvis made their first contribution in open-cli-tools/concurrently#599
• @​rajanpanth made their first contribution in open-cli-tools/concurrently#601

Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4

Commits

• 1b8cbeb 10.0.5
• 544dba0 docs: make linter happy
• 667b701 deps: update several dev deps
• f67c57c vscode: use installed TS version
• dbb5617 fix: expand wildcards from package.json5 when package.json is missing (#608)
• 9f90a1a fix: correctly output non-ASCII text on Windows (#604)
• 94415cc ci: fix publishing to latest/backport
• 2524b65 10.0.4
• 1080199 fix: avoid kill timeout exit delays (#601)
• e668211 ci: publish to latest only on npm
• Additional commits viewable in compare view

Updates vite from 8.1.3 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA ...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.