chore(deps): bump the development-dependencies group across 1 directory with 25 updates

[dependabot]

Bumps the development-dependencies group with 25 updates in the / directory:

Package	From	To
fallow	3.0.0	3.27.0
typescript	6.0.3	7.0.2
@testing-library/react	16.3.2	16.3.3
jsdom	29.1.1	30.1.0
hono	4.12.27	4.13.8
@hono/node-server	2.0.8	2.1.1
@types/supertest	7.2.0	7.2.1
tsx	4.23.0	4.23.13
@playwright/test	1.61.1	1.63.0
@vitejs/plugin-react	6.0.3	6.1.1
concurrently	10.0.3	10.0.5
vite	8.1.3	8.3.0
@astrojs/starlight	0.41.3	0.42.1
astro	7.0.6	7.3.3
starlight-package-managers	0.12.0	0.13.0
starlight-llms-txt	0.11.0	0.12.0
@stryker-mutator/core	9.6.1	10.0.0
@stryker-mutator/vitest-runner	9.6.1	10.0.0
@typescript-eslint/eslint-plugin	8.62.1	8.70.0
@typescript-eslint/parser	8.62.1	8.70.0
@vitest/coverage-v8	4.1.9	5.0.1
esbuild	0.28.1	0.28.2
eslint	10.6.0	10.10.0
fast-check	4.8.0	4.10.1
vitest	4.1.9	5.0.1

Updates fallow from 3.0.0 to 3.27.0

Release notes

Sourced from fallow's releases.

v3.27.0: every CI gate reaches the job, baseline staleness in CI, MCP verdicts

Every gate fallow documents now reaches CI. This release closes a defect class rather than a single bug: verdicts the CLI expressed only on stderr or through its exit code were invisible to the GitHub Action, the GitLab template and the MCP server, because all three run with --quiet --format json and drop the exit code whenever stdout parses as JSON.

CI gates that actually fail the job

• fail-on-regression, threshold, min-severity and the security gate were documented as gates and were silently inert in both integrations. A run that arms a gate now publishes gate_outcomes in its JSON envelope, and the action and the template read the verdict from there. A gate fails the build when its status is fail and enforced is true, and only when the input that owns it asked for it; a flag passed through args: warns and never overrides fail-on-issues: false.
• Every failing gate reports before the step exits: all reasons are printed, outputs and artifacts are written, and the step exits once. The security gate keeps its documented exit 8.
• min-score is a first-class action input and GitLab variable. It runs health with --complexity so annotations, SARIF and the pull-request comment stay populated, and the count gate stands down for that run because the CLI's own findings rule does.
• The duplication threshold reaches the bare command on GitHub, and in combined mode the envelope says the threshold is not enforced instead of pretending it is.
• A run that analyzed no source file says so. It warns and passes by default; fail-on-empty-analysis: true (FALLOW_FAIL_ON_EMPTY_ANALYSIS on GitLab) turns it into a failure. Diagnostics that mean the run measured less than the project land as one aggregated warning.
• Gate outcomes are exposed as step outputs on GitHub and as a dotenv report on GitLab.

Baseline staleness reaches CI

3.26.0 shipped the advisory that a dead-code baseline has gone stale and --fail-on-stale-baseline to turn that into a failing build, but both lived on stderr only, so the documented CI path never saw them. dead-code, the combined run, dupes and health now publish one baseline_staleness object with the counts, the advisory verdict and gate_trips. The action and the template surface it as a warning and in the job summary; on a pull request, where the primary run is scoped to changed files, the integration re-reads the baseline once over the whole project so the advisory reaches pull-request-only repositories too. The new fail-on-stale-baseline input and FALLOW_FAIL_ON_STALE_BASELINE variable decide whether that verdict fails the job. Thanks @​cloud-walker for the report in #2673, which documented exactly where the 3.26.0 fix stopped short.

MCP tool results state the verdict

MCP tool results now carry the baseline advisory, every failing or warning gate with its numbers, and the degraded-analysis summary as plain sentences in the envelope's warnings array, on the subprocess, Code Mode and typed routes. Result bodies stay JSON, no member moves, and a clean run is byte-identical to CLI stdout.

Envelope additions, no schema version moved

• gate_outcomes: an optional object keyed by gate name with status, enforced, and observed, threshold and threshold_label where a comparison happened. Absent when no gate was armed; the key set is open on the wire.
• baseline_staleness on dead-code, combined, dupes and health envelopes, grouped output included.
• workspace_diagnostics[].degrades_analysis and a no-source-files-analyzed diagnostic.
• fallow report --from renders a neutral "Gate outcomes" line on the GitHub summary, annotations, pull-request comment, review targets and the GitLab merge-request note; the check-run conclusion and the exit code are unchanged.
• TypeScript consumers of npm/fallow/types: HealthBaselineStaleness is now the shared BaselineStaleness; the old name ships as a deprecated alias so existing imports keep compiling.

Behaviour changes to check before upgrading

• A repository with a security gate configured and fail-on-issues: false now fails on a tripped gate. Not configuring the gate is the opt-out.
• The action's inline Check threshold step is gone; its logic lives in the analyze step, and the gates-failed output carries which gates decided the verdict.
• --fail-on-stale-baseline now moves exactly one wire member, gate_outcomes["stale-baseline"].enforced; the baseline_staleness object itself stays flag-independent.
• On a fallow older than 3.27.0 both integrations fall back to the fields those releases already published and fail open with one warning for the gates that had none.

Full Changelog: fallow-rs/fallow@v3.26.0...v3.27.0

v3.26.0: stale-baseline gate, built-in exclusion diagnostics, rule overrides everywhere

Features

• --fail-on-stale-baseline turns a rotting baseline into a failing build. The new global flag exits 1 when a loaded --baseline has any entry that matched nothing this run, on dead-code / check, the bare run, dupes and health, in every output format. A run that cannot judge the baseline (a narrowed scope, health --report-only, audit, decision-surface) stands down and says so on stderr. JSON output is unchanged. (#2637)
• dead-code --baseline warns when the saved baseline has gone stale, in the same wording health --baseline has used since 3.12.0: when a quarter or more of the entries match no current issue, the run says so and points at the re-save command. Exit codes are untouched. Thanks @​cloud-walker for the report. (#2627)
• A run can say which built-in ignore pattern removed source files. The walk attributes every excluded candidate to the pattern that removed it and records one excluded-by-default-ignore entry per pattern in workspace_diagnostics[] with the glob, an exact file count, the matched-directory count and a project-relative anchor. --explain-skipped prints the breakdown on check, dead-code, audit and the default run; without the flag, only a run that discovered no source files at all prints a two-fact warning pointing at the flag. (#2638)
• Oxfmt is a built-in plugin. oxfmt.config.ts and its siblings are marked always-used and static imports from those configs are credited. Thanks @​uzosrc for the request. (#2614)
• Expo Router's SuspenseFallback, getNavOptions and generateMetadata route exports are recognized. Thanks @​tilgovi for the SuspenseFallback patch (#2618).

Changed

• The built-in build exclusion now matches at any depth (**/build/**), consistent with the dist and coverage defaults, so nested build output in monorepos no longer produces unused-file, unused-export, duplication and health findings. Five consequences are stated plainly in the changelog together with the remedy for each, including that hand-written source in a nested build/ directory is now skipped. Thanks @​michalius for the report. (#2622)
• Unused- and unlisted-dependency checks are faster on large workspace monorepos: each file's owning workspace is resolved once per analysis. On a repository with about 18,000 files and 800 workspaces the check went from roughly 30 seconds to 6 seconds. Thanks @​Freakazo for the patch (#2624).

... (truncated)

Commits

• See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates jsdom from 29.1.1 to 30.1.0

Release notes

Sourced from jsdom's releases.

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
• Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
• Fixed :focus matching in shadow trees. (@​asamuzaK)
• Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
• Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
• Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
• Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
• Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
• Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
• Fixed successful cached resource loads being treated as aborted.
• Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
• Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
• Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
• Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
• Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
• Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
• Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
• Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
• Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
• Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
• Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
• Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
• Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
• Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
• Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
• Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
• Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
• Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
• Fixed storage events being sent to windows created after the storage change, and ensured surviving recipients still receive events when the source document is destroyed.
• Fixed attribute lookups after namespace prefix changes, and namespaced attributes incorrectly affecting ID lookups and element behavior. (@​scttcper)
• Fixed input.list in detached element trees. (@​scttcper)
• Fixed attr.ownerDocument after setting an attribute node on an element in another document or adopting its element. (@​Kjubikstronk)

... (truncated)

Commits

• 556b11f 30.1.0
• 9547fbf Tie queued tasks to document lifetime
• 3be65d9 Disable unused HTML reports in the WPT runner
• d555e61 Replace SymbolTree with a DOM-specific tree
• f28983d Clone CDATA and processing instructions without revalidation
• 33e4fa7 Invalidate computed styles after CSS imports load
• ec6fd5b Select storage event recipients at mutation time
• bcc037a Honor script type and legacy event attributes
• faa5c4f Preserve currentScript across nested scripts
• 8d7a37f Avoid quadratic HTML collection iteration
• Additional commits viewable in compare view

Updates hono from 4.12.27 to 4.13.8

Release notes

Sourced from hono's releases.

v4.13.8

What's Changed

• docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343
• perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340
• fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351
• fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311
• fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349
• fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357
• fix(request): keep the request media type when reusing a cached body in honojs/hono#5366
• docs(combine): fix except() JSDoc param and add missing @​returns in honojs/hono#5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

... (truncated)

Commits

• 098e119 4.13.8
• e8c8c21 perf(jsx/dom): optimize matching-head child lookup during reconciliation (#5329)
• 8755b17 docs(combine): fix except() JSDoc param and add missing @​returns (#5346)
• edd138e fix(request): keep the request media type when reusing a cached body (#5366)
• 9b4e9c2 fix(accept): clamp a negative q to 0, not 1 (#5357)
• 65cff90 fix(accept): treat the q parameter name as case-insensitive (#5349)
• f147de5 fix(accepts, language): skip accept entries with quality 0 when matching (#5311)
• 90e1b94 fix(aws-lambda): respect backpressure when streaming the response body (#5351)
• 7792f5d perf(jsx/dom): reduce lookup work for large keyed updates (#5340)
• e7b38ee docs: fix typos in code comments and link third-party middleware section (#5343)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.0.8 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

• test: replace supertest by @​BlankParticle in honojs/node-server#379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in honojs/node-server#377
• perf(request): fast-path QUERY methods by @​usualoma in honojs/node-server#376
• perf(request): fast-path PATCH method by @​yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• a813b6c 2.0.12
• caf48ba fix(response): copy headers when init is a foreign Response (#382)
• 3b1dd68 test: replace supertest (#379)
• 834e54f 2.0.11
• ba72bcd perf(request): fast-path PATCH method (#380)
• Additional commits viewable in compare view

Updates @types/supertest from 7.2.0 to 7.2.1

Commits

• See full diff in compare view

Updates tsx from 4.23.0 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

... (truncated)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• Additional commits viewable in compare view

Updates @playwright/test from 1.61.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.0.3 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• Additional commits viewable in compare view

Updates concurrently from 10.0.3 to 10.0.5

Release notes

Sourced from concurrently's releases.

v10.0.5

What's Changed

• fix: correctly output non-ASCII text on Windows by @​DanielC000 in open-cli-tools/concurrently#604
• fix: expand wildcards from package.json5 when package.json is missing by @​DSeaStar in open-cli-tools/concurrently#608

New Contributors

• @​DanielC000 made their first contribution in open-cli-tools/concurrently#604
• @​DSeaStar made their first contribution in open-cli-tools/concurrently#608

Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5

v10.0.4

What's Changed

• deps: upgrade shell-quote to 1.9.0 by @​Mayvis in open-cli-tools/concurrently#599
• fix: avoid kill timeout exit delays by @​rajanpanth in open-cli-tools/concurrently#601

New Contributors

• @​Mayvis made their first contribution in open-cli-tools/concurrently#599
• @​rajanpanth made their first contribution in open-cli-tools/concurrently#601

Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4

Commits

• 1b8cbeb 10.0.5
• 544dba0 docs: make linter happy
• 667b701 deps: update several dev deps
• f67c57c vscode: use installed TS version
• dbb5617 fix: expand wildcards from package.json5 when package.json is missing (#608)
• 9f90a1a fix: correctly output non-ASCII text on Windows (#604)
• 94415cc ci: fix publishing to latest/backport

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 5ca606ab-b748-40e3-ba5d-5132fdb7c908

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}