[dependabot]

Bumps the development-dependencies group with 21 updates in the / directory:

Package	From	To
fallow	3.0.0	3.20.0
typescript	6.0.3	7.0.2
@testing-library/react	16.3.2	16.3.3
jsdom	29.1.1	30.0.1
hono	4.12.27	4.13.5
@hono/node-server	2.0.8	2.1.1
@types/supertest	7.2.0	7.2.1
tsx	4.23.0	4.23.12
@playwright/test	1.61.1	1.62.1
@vitejs/plugin-react	6.0.3	6.1.1
concurrently	10.0.3	10.0.5
vite	8.1.3	8.2.2
@astrojs/starlight	0.41.3	0.41.9
astro	7.0.6	7.2.9
@stryker-mutator/core	9.6.1	10.0.0
@stryker-mutator/vitest-runner	9.6.1	10.0.0
@typescript-eslint/eslint-plugin	8.62.1	8.68.0
@typescript-eslint/parser	8.62.1	8.68.0
@vitest/coverage-v8	4.1.9	4.1.11
eslint	10.6.0	10.9.1
fast-check	4.8.0	4.9.0

Updates fallow from 3.0.0 to 3.20.0

Release notes

Sourced from fallow's releases.

v3.20.0: Yarn PnP resolution, monorepo tsconfig scope, review schema 8

Highlights

Yarn Plug'n'Play projects resolve like any other project. A PnP install has no populated node_modules, so every bare import used to miss and fall through to the much slower path, which on a large monorepo meant minutes of import resolution instead of seconds. fallow now detects .pnp.cjs at the analyzed root or one of its ancestors and resolves bare specifiers through the manifest, anchored to the directory that holds it, so a run started from another directory and an editor session resolve the same way. Manifests that are not inlined (pnpEnableInlining: false) are unsupported and stay on the old path. Thanks to @​PatrickShaw for the report and the implementation.

Project-reference monorepos resolve correctly and much faster. A tsconfig.json reached through references that declares neither include nor files now applies only to files under its own directory, matching the compiler's **/* default project scope. It previously claimed every file in the repository, so its paths aliases leaked into sibling packages and every referenced project was walked for every import. Alongside that, the per-run tsconfig and canonicalize caches no longer serialize every lookup behind a single lock or deep-copy the parsed document on each hit. Together these turn the resolution phase on a large project-reference monorepo from minutes into seconds. Thanks again to @​PatrickShaw.

The review brief carries author actions, test adjacency, and independent slices. Review-brief schema 7 moves to 8, all additive. A judgment returned through --walkthrough-file may set action to block, address, consider, or fyi, validated on reentry and echoed on the accepted judgment, so the author reading a note knows what is required and what is optional. Each direction unit reports whether a test imports it directly and whether that test moved with the change. The partition reports independent slices: connected components of the inter-unit graph, so a change that splits along a graph-proven seam says so. The dependency decision arm now fires, batching added entries and major bumps per manifest and weighting them by their in-repo importers.

Behavior changes worth reading before you upgrade

• A strict run can now exit 1 where it exited 0. When a config contains any per-path overrides entry, the exit code is decided by per-file severity resolution. That path never consulted import-direction boundary violations, and it started from unpromoted base rules, so --fail-on-issues and --ci could pass an error-severity boundary-violation and every warn-severity finding. Both are fixed, so a pipeline with overrides that passed before can now fail without any config or code change. The findings themselves are unchanged; only the exit code is. To keep the previous outcome, set the rule to off rather than warn, or drop the strict flag for that job. Thanks to @​DeLuke84 for a precise repro.
• The referenced-tsconfig scope fix can surface new findings. An import that only resolved through the old repository-wide leak is now an unresolved-import finding, which is error severity by default, and a file reachable only through such an import may be reported as unused. If a subdirectory config intentionally holds shared paths, give it an explicit include, or move those aliases to a config whose directory contains the importing files.
• Function counts change for files with bodyless declarations. Overload signatures, abstract members, and declare function no longer count as functions, so file scores move on those files without any code change, and a file whose declarations are all bodyless leaves the file-score table. Metrics averaged over the function population shift accordingly.

Coverage and health

• Coverage matching finds functions by their body location. Each coverage-map function entry now contributes up to three candidate positions, so a function whose only structural match was its body location scores against real coverage instead of a static estimate. Because an expression-bodied arrow's recorded body is the next arrow in a curried chain, a body-start candidate yields to a declaration at the same position, which keeps every arrow of a middleware chain, a higher-order component, or a curried class property matchable. Regression baselines are unaffected; re-save health baselines if you run with --coverage, because a newly matched function can cross the CRAP ceiling. Thanks to @​PrinceD96 for the report and the contribution.

Notes for integrators

• The graph cache version moves twice in this release, so the first run after upgrading rebuilds import resolution instead of replaying results that predate the two resolution fixes.
• docs/backwards-compatibility.md records the exit-code and tsconfig-scope changes under "Notable behavior changes within v3".

Full Changelog: fallow-rs/fallow@v3.19.0...v3.20.0

v3.19.0: one-pass agent install, MCP resources, similar-code discovery

Highlights

One command to wire your coding agents. npx fallow agent install detects Claude Code, Codex, and Cursor from the project, your home directory, and the session, then writes what each one reads: an AGENTS.md task map (plus an @AGENTS.md import in CLAUDE.md), the fallow skill, the MCP server registration, and the commit/push gate. Every write carries a marker, re-running is byte-stable, --dry-run shows the plan, and fallow agent status / fallow agent uninstall cover the same surfaces. Nothing is fabricated when no harness is detected, hand-written MCP entries are never replaced or removed without --force, and --force on an unparsable config file saves the old bytes next to it first. fallow setup-hooks is deprecated in favor of this command (it keeps working through the 3.x line with a warning).

MCP reference material as resources. fallow-mcp now serves fallow://tools, fallow://issue-types, fallow://explain plus the fallow://explain/{issue_type} template, fallow://task-matrix, and the config, plugin, and rule-pack JSON Schemas as read-only, cacheable resources. Payloads are plain documents (the schema resources are byte-identical to fallow config-schema and friends), the server version travels in each content item's _meta, and fallow schema gains a matching mcp_resources block. Fallow is also listed in the official MCP Registry.

Opt-in semantic similar-code discovery. fallow similar-code finds functions that may share intent despite different syntax, through a pinned and verified local model. It is advisory by design: explicit local setup, model provenance, a persistent vector cache, source-grounded candidate inspection, a fail-closed external verdict join, read-only MCP tools, and a Node API, with no participation in bare analysis, audit gates, SARIF, editor diagnostics, or auto-fix.

Detection and plugins

• StyleX theme styling. defineVars, unstable_defineVarsNested, createTheme, and unstable_createThemeNested are modeled with the framework's real token shape and theme-application semantics, including same-file reads, partial overrides, empty reset themes, and namespace or default aliases.
• size-limit is recognized. A new built-in plugin credits every declared @size-limit/* and size-limit-* package, treats size-limit as tooling, and keeps every config form it searches reachable, including a config inside a workspace package when the tool is hoisted to the monorepo root. Thanks to @​robinvdvleuten for the contribution in #2413.

Fixes

• React Native and Expo platform families are no longer reported as duplicate exports. With the react-native or expo plugin active, dead-code folds each Metro family (UserMenu.tsx, UserMenu.ios.tsx, UserMenu.web.tsx, ...) into one representative before duplicate detection; a genuine duplicate in an unrelated file is still reported. Thanks to @​issacfriedman for the report in #2407.
• fallow impact statusline names a newer Impact store. An older binary reading a store written by a newer fallow now prints data from newer fallow · upgrade this fallow instead of the generic data unavailable line.

Deprecated

• fallow setup-hooks: use fallow agent install (every harness in one pass) or fallow hooks install --target agent (the gate alone). The command keeps working throughout fallow 3 with a one-line warning and is removed in the next major.

Full Changelog: fallow-rs/fallow@v3.18.0...v3.19.0

... (truncated)

Commits

• 446e3f0 docs(changelog): move the review schema 8 entries to Unreleased
• 8d53657 fix(check): fail strict runs on findings the override path let through (#2447)
• d877424 feat(graph): resolve Yarn Plug'n'Play projects through the PnP manifest (#2435)
• b0585d4 fix(graph): scope a referenced tsconfig without include to its own directory ...
• 8c3c5b7 perf(graph): cut tsconfig cache lock contention on large monorepos (#2437)
• 6afdf4f chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#2430)
• 9406571 chore(napi): sync transitive similar-code platform pins to v3.19.0
• d97f540 chore(napi): sync companion optional dependencies to v3.19.0
• bcf333d feat(review): author actions, test adjacency, slices, and dependency decision...
• bf98a42 chore(docker): pin Dockerfile to v3.19.0
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates jsdom from 29.1.1 to 30.0.1

Release notes

Sourced from jsdom's releases.

v30.0.1

• Fixed getComputedStyle() with calc() and other functions throwing an exception, which regressed in v30.0.0. (@​asamuzaK)
• Sped up up range operations on large documents (@​leonidaz)

v30.0.0

Breaking changes:

• Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0.

Other changes:

• Added CSS.escape() and CSS.supports() functions. (@​asamuzaK)
• Added 'background-position-x' and 'background-position-y' CSS properties. (@​olagokemills)
• Fixed getComputedStyle() to convert length values into pixels. (@​asamuzaK)
• Fixed CSS function serialization, e.g., in the return value of getPropertyValue(). (@​asamuzaK)
• Fixed the type of error thrown by document.evaluate() (@​dokson)

Commits

• 6584485 30.0.1
• 0c51df6 Update dependencies and dev dependencies
• 32adb34 Bump @​asamuzakjp/dom-selector
• 70f014a Speed up range operations on large documents
• 250d7ee Partially fix getComputedStyle with calc()
• 20a01fc 30.0.0
• 8c8e583 Precompute WPT expectation matches
• f32245c Bump Node.js floor and dependencies
• 03ef23b Add background-position longhands
• ded056f Test CSS.escape() with numeric IDs
• Additional commits viewable in compare view

Updates hono from 4.12.27 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
• fix(client): skip undefined header and cookie values in honojs/hono#5244
• fix(client): skip an undefined entry inside a query array in honojs/hono#5272
• fix(client): skip an undefined entry inside a form array in honojs/hono#5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
• fix(client): omit empty query delimiter in honojs/hono#5283
• fix(request): drop stale content length for cloned FormData in honojs/hono#5282
• fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
• fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
• fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• 3a67f7f Merge commit from fork
• 9c28d72 Merge commit from fork
• 017000d 4.13.4
• 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
• 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
• c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
• 612b59c fix(request): drop stale content length for cloned FormData (#5282)
• 73794bd fix(client): omit empty query delimiter (#5283)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.0.8 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

• test: replace supertest by @​BlankParticle in honojs/node-server#379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in honojs/node-server#377
• perf(request): fast-path QUERY methods by @​usualoma in honojs/node-server#376
• perf(request): fast-path PATCH method by @​yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• a813b6c 2.0.12
• caf48ba fix(response): copy headers when init is a foreign Response (#382)
• 3b1dd68 test: replace supertest (#379)
• 834e54f 2.0.11
• ba72bcd perf(request): fast-path PATCH method (#380)
• Additional commits viewable in compare view

Updates @types/supertest from 7.2.0 to 7.2.1

Commits

• See full diff in compare view

Updates tsx from 4.23.0 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Updates @playwright/test from 1.61.1 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.0.3 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• Additional commits viewable in compare view

Updates concurrently from 10.0.3 to 10.0.5

Release notes

Sourced from concurrently's releases.

v10.0.5

What's Changed

• fix: correctly output non-ASCII text on Windows by @​DanielC000 in open-cli-tools/concurrently#604
• fix: expand wildcards from package.json5 when package.json is missing by @​DSeaStar in open-cli-tools/concurrently#608

New Contributors

• @​DanielC000 made their first contribution in open-cli-tools/concurrently#604
• @​DSeaStar made their first contribution in open-cli-tools/concurrently#608

Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5

v10.0.4

What's Changed

• deps: upgrade shell-quote to 1.9.0 by @​Mayvis in open-cli-tools/concurrently#599
• fix: avoid kill timeout exit delays by @​rajanpanth in open-cli-tools/concurrently#601

New Contributors

• @​Mayvis made their first contribution in open-cli-tools/concurrently#599
• @​rajanpanth made their first contribution in open-cli-tools/concurrently#601

Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4

Commits

• 1b8cbeb 10.0.5
• 544dba0 docs: make linter happy
• 667b701 deps: update several dev deps
• f67c57c vscode: use installed TS version
• dbb5617 fix: expand wildcards from package.json5 when package.json is missing (#608)
• 9f90a1a fix: correctly output non-ASCII text on Windows (#604)
• 94415cc ci: fix publishing to latest/backport
• 2524b65 10.0.4
• 1080199 fix: avoid kill timeout exit delays (#601)
• e668211 ci: publish to latest only on npm
• Additional commits viewable in compare view

Updates vite from 8.1.3 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define:<...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.