[dependabot]

Bumps the npm-dependencies group with 35 updates in the / directory:

Package	From	To
@types/node	25.9.5	26.6.5
tsdown	0.22.14	0.23.1
typescript	6.0.3	7.0.2
vitest	4.1.11	5.0.5
@angular-devkit/architect	0.2201.5	0.2202.3
@angular-devkit/core	22.1.5	22.2.3
astro	7.2.4	7.4.0
cac	7.0.0	7.1.0
ink	7.1.1	8.0.0
react	19.2.8	19.3.1
@types/react	19.2.18	19.3.0
@types/react	19.2.18	19.3.0
execa	9.6.1	10.1.1
@clack/prompts	1.7.0	1.8.1
handlebars	4.7.9	4.7.10
tsx	4.23.12	4.23.15
elysia	1.4.29	1.4.30
express	5.2.1	5.3.0
supertest	7.2.2	7.3.1
@fastify/static	9.3.0	10.1.6
fastify-plugin	5.1.0	6.0.1
fastify	5.12.1	5.12.7
@hono/node-server	2.1.1	2.1.5
hono	4.13.3	4.13.13
@nestjs/common	11.2.1	12.1.3
@nestjs/core	11.2.1	12.1.3
@nestjs/platform-express	11.2.1	12.1.3
@nestjs/serve-static	5.0.5	12.0.0
oxc-transform	0.146.0	0.154.0
rolldown	1.2.5	1.2.14
@rollup/plugin-node-resolve	15.3.1	16.0.3
rollup	4.62.5	4.64.7
@swc/core	1.16.1	1.16.18
webpack	5.109.2	5.111.1
verdaccio	6.10.0	6.10.5
playwright	1.62.1	1.64.1

Updates @types/node from 25.9.5 to 26.6.5

Commits

• See full diff in compare view

Updates tsdown from 0.22.14 to 0.23.1

Release notes

Sourced from tsdown's releases.

v0.23.1

   🐞 Bug Fixes

• Preserve false tsconfig option  -  by @​Masutayunikon in rolldown/tsdown#1065 (407f8)
• entry: Honor custom root for object entry  -  by @​giaBaoJS in rolldown/tsdown#1072 (17452)
• pkg: Pack tarball inside npm publish --dry-run  -  by @​giaBaoJS in rolldown/tsdown#1076 (83f0c)

    View changes on GitHub

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)

... (truncated)

Commits

• 6493257 chore: release v0.23.1
• ba6acb9 chore: upgrade deps
• 6cbfec7 chore(deps): update dependency unplugin-vue to v8 (#1090)
• eb40c95 chore: declare package side effects
• f9c95d0 chore: align pnpm workspace settings
• e64bde4 chore: configure pnpm via devEngines
• 83f0c57 fix(pkg): pack tarball inside npm publish --dry-run (#1076)
• 1745223 fix(entry): honor custom root for object entry (#1072)
• 9655dcb chore: upgrade deps
• 30da631 docs: correct default value of minify
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vitest from 4.1.11 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in vitest-dev/vitest#11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in vitest-dev/vitest#11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in vitest-dev/vitest#11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in vitest-dev/vitest#11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in vitest-dev/vitest#11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in vitest-dev/vitest#11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in vitest-dev/vitest#11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in vitest-dev/vitest#11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in vitest-dev/vitest#11417 (56b31)
• Fix module graph builtin externals after #11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in vitest-dev/vitest#11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in vitest-dev/vitest#11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in vitest-dev/vitest#11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in vitest-dev/vitest#11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in vitest-dev/vitest#11323 (6f990)
• browser:

... (truncated)

Commits

• 7a825db chore: release v5.0.5 (#11609)
• 6621a72 fix: abort all running tests on cancel (#11606)
• e9c3d72 fix: release mocks of finished test files (#11607)
• 8dd67c2 fix(browser): run global setup once with instances (#11596)
• 6c5a447 fix: run hook cleanups when a later hook fails (#11605)
• 9697b38 fix: keep the import frame in native loader errors (#11599)
• 6498b66 fix(browser): wait 30s for the browser to close (#11601)
• f161e6d fix(browser): drop late connections of closed sessions (#11600)
• fe86a64 fix: skip builtin loading in async leak detector (#11598)
• 6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
• Additional commits viewable in compare view

Updates @angular-devkit/architect from 0.2201.5 to 0.2202.3

Commits

• See full diff in compare view

Updates @angular-devkit/core from 22.1.5 to 22.2.3

Release notes

Sourced from @​angular-devkit/core's releases.

22.2.3

@​schematics/angular

Commit	Description
	keep the workspace build version in the use-application-builder migration

@​angular/cli

Commit	Description
	accept multi-digit array indices in ng config
	keep ng version working when the package manager is not installed
	resolve package name in npm workspace members

@​angular-devkit/schematics

Commit	Description
	avoid stack overflow when chaining many rules

@​angular/build

Commit	Description
	add CSP nonce to stylesheet and modulepreload link elements
	always use AOT when extracting i18n messages
	coalesce external watcher directories to avoid macOS FSEvents limit
	disable Vitest fsModuleCache in unit-test builder
	ensure Sass importers return global Promise instances
	keep Vite server file watcher disabled in Vitest watch mode
	sort discovered unit-test files for deterministic builds
	use module.registerHooks() for in-memory ESM loader
	avoid invalidating Angular diagnostic cache on stylesheet change
	resolve asset patterns concurrently with bounded concurrency

@​angular/ssr

Commit	Description
	preserve preload metadata for nested empty-path routes
	preserve query parameters on relative route redirects
	resolve relative redirects against the parent route

22.2.2

@​angular-devkit/build-angular

Commit	Description
	preserve Host header when proxying in ssr-dev-server

@​angular/build

Commit	Description
	keep the order of glob entries in the proxy configuration
	support a string context in array-form proxy configurations

22.2.1

@​angular-devkit/schematics-cli

Commit	Description

... (truncated)

Changelog

Sourced from @​angular-devkit/core's changelog.

22.2.3 (2026-10-15)

@​angular/cli

Commit	Type	Description
3158e865f	fix	accept multi-digit array indices in ng config
bcff0e76a	fix	keep ng version working when the package manager is not installed
5570c91d2	fix	resolve package name in npm workspace members

@​schematics/angular

Commit	Type	Description
881865f36	fix	keep the workspace build version in the use-application-builder migration

@​angular-devkit/schematics

Commit	Type	Description
cf1f3b9d4	fix	avoid stack overflow when chaining many rules

@​angular/build

Commit	Type	Description
1d477d6bc	fix	add CSP nonce to stylesheet and modulepreload link elements
fbe208f83	fix	always use AOT when extracting i18n messages
c1c4216a6	fix	coalesce external watcher directories to avoid macOS FSEvents limit
792990bc2	fix	disable Vitest fsModuleCache in unit-test builder
82439399c	fix	ensure Sass importers return global Promise instances
a818de415	fix	keep Vite server file watcher disabled in Vitest watch mode
91bad469e	fix	sort discovered unit-test files for deterministic builds
e84db4af7	fix	use module.registerHooks() for in-memory ESM loader
a428021b7	perf	avoid invalidating Angular diagnostic cache on stylesheet change
b0ac394a0	perf	resolve asset patterns concurrently with bounded concurrency

@​angular/ssr

Commit	Type	Description
bd09b98fc	fix	preserve preload metadata for nested empty-path routes
a92546892	fix	preserve query parameters on relative route redirects
a2b86cc94	fix	resolve relative redirects against the parent route

21.2.27 (2026-10-14)

... (truncated)

Commits

• afa3814 release: cut the v22.2.3 release
• cc05ecf build: update pnpm to v12.11.2
• c1c4216 fix(@​angular/build): coalesce external watcher directories to avoid macOS FSE...
• 116cb93 build: update cross-repo angular dependencies
• e84db4a fix(@​angular/build): use module.registerHooks() for in-memory ESM loader
• cf1f3b9 fix(@​angular-devkit/schematics): avoid stack overflow when chaining many rules
• 91bad46 fix(@​angular/build): sort discovered unit-test files for deterministic builds
• bd09b98 fix(@​angular/ssr): preserve preload metadata for nested empty-path routes
• 9313776 build: lock file maintenance
• c0b6659 build: update dependency zod to v4.6.6
• Additional commits viewable in compare view

Updates astro from 7.2.4 to 7.4.0

Release notes

Sourced from astro's releases.

astro@7.4.0

Minor Changes

• #17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

  When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

  astro build --timings

  This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a new optional getFontProperties() callback to font providers

  Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

  All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

  import type { FontProvider } from 'astro';
  const provider: FontProvider = {
  name: 'my-provider',
  resolveFont: ({ familyName }) => {
  // ...
  },
  getFontProperties: ({ familyName }) => ({
  weights: ['400', '700'],
  styles: ['normal', 'italic'],
  subsets: ['latin'],
  formats: ['woff2'],
  }),
  };

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a fetch() function to the font provider init() context

  This function requests a provider API, retrying transient failures and more. It lets providers that wrap a 3rd-party unifont provider pass the context to it directly:

  import type { FontProvider } from 'astro';
  import type { InitializedProvider } from 'unifont';
  import { acmeProvider } from '@acme/unifont-provider';
  export function acmeFontProvider(): FontProvider {
  const provider = acmeProvider();
  let initializedProvider: InitializedProvider | undefined;
  return {
  name: provider._name,

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.0

Minor Changes

• #17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

  When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

  astro build --timings

  This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a new optional getFontProperties() callback to font providers

  Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

  All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

  import type { FontProvider } from 'astro';
  const provider: FontProvider = {
  name: 'my-provider',
  resolveFont: ({ familyName }) => {
  // ...
  },
  getFontProperties: ({ familyName }) => ({
  weights: ['400', '700'],
  styles: ['normal', 'italic'],
  subsets: ['latin'],
  formats: ['woff2'],
  }),
  };

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a fetch() function to the font provider init() context

  This function requests a provider API, retrying transient failures and more. It lets providers that wrap a 3rd-party unifont provider pass the context to it directly:

  import type { FontProvider } from 'astro';
  import type { InitializedProvider } from 'unifont';
  import { acmeProvider } from '@acme/unifont-provider';
  export function acmeFontProvider(): FontProvider {
  const provider = acmeProvider();
  let initializedProvider: InitializedProvider | undefined;
  return {

... (truncated)

Commits

• c2c43a9 [ci] release (#18354)
• f698e18 fix(astro): ignore image.service overrides with only undefined values (#18383)
• 83f5f4d Update dependency vite to ^8.3.4 (#18393)
• 858938a Update astro (#18390)
• 1f04637 feat: use tinyps for process finding (#18368)
• c96d07e Update dependency preact to v11 (#18389)
• f8cf143 Update dependency rolldown to ^1.2.13 (#18388)
• 5c48d3b Update dependency devalue to v6 (#18385)
• 71e2b24 feat: treat Vite's resolved outDir values as the source of truth for build ou...
• a937b0d feat(fonts): warn on invalid properties (#17830)
• Additional commits viewable in compare view

Updates cac from 7.0.0 to 7.1.0

Release notes

Sourced from cac's releases.

v7.1.0

   🐞 Bug Fixes

• Read process.argv lazily  -  by @​Bryandero98 and @​sxzz in cacjs/cac#179 (c0ccb)
• parse: Leave an omitted array option absent  -  by @​MFA-G in cacjs/cac#177 (26938)

    View changes on GitHub

v7.0.1

   🐞 Bug Fixes

• Prevent prototype pollution via dotted option names  -  by @​sxzz (604d4)

    View changes on GitHub

Commits

• 12a5e82 chore: release v7.1.0
• c0ccb94 fix: read process.argv lazily (#179)
• 284577b chore: fix lint
• e7c7f3a chore: remove Deno tests & docs
• 0613c12 chore: upgrade deps
• 26938a2 fix(parse): leave an omitted array option absent (#177)
• 66bb550 chore: release v7.0.1
• 604d408 fix: prevent prototype pollution via dotted option names
• eb5fe08 chore: declare package side effects
• 38268e6 chore: align pnpm workspace settings
• Additional commits viewable in compare view

Updates ink from 7.1.1 to 8.0.0

Release notes

Sourced from ink's releases.

v8.0.0

Breaking

• Require React 19.3+ 7829102
• minWidth and maxWidth on <Box> now only accept numbers (#1029) 7cd7fd9
  • Percentage strings were never documented as supported, and Yoga resolved them against the wrong ancestor
• stdin, stdout, and stderr are now typed as generic Node.js streams (#981) eb82d8f
  • This applies to the render() options and to useStdin(), useStdout(), and useStderr(). TTY-only properties like stdout.columns are no longer part of the types
• useInput no longer receives unrecognized terminal control sequences (#1014) c76893e
  • Mouse reports, focus in/out events, cursor position reports, and other terminal replies used to arrive in input with the ESC stripped, as if typed. They are now dropped

New

• Add contentOffsetX and contentOffsetY props to <Box> for building scrollable views (#765) 3ba5828
  • Combine with overflow="hidden". See the scroll example
• Add clientWidth and clientHeight to useBoxMetrics() and measureElement() (#988) 3ba5828
  • The element size excluding borders, which is the space its content can occupy
• Accept any Node.js stream for the stdin, stdout, and stderr options of render() (#981) eb82d8f
  • For example, PassThrough or other Readable/Writable streams. Raw mode is used only when stdin is a TTY with setRawMode()
• Skip unchanged line prefixes in incrementalRendering mode (#1036) 91eb50a
  • Only the changed part of a line is written, which reduces output and flicker
• Drop the ws dependency in favor of the native WebSocket for React DevTools (#976) 33567ed
• Recognize application keypad Enter as key.return b73ebf4

Fixes

Rendering

• Preserve scrollback when clearing the viewport (#994) fe1d123
• Preserve terminal history after clear() 494ebeb
• Restore the unchanged frame when rerendering after clear() fc358c2
• Redraw the frame when the terminal loses rows (#1025) f603aeb
• Keep content above the frame when rows shrink while the cursor is shown (#1031) c800284
• Keep the cursor on the last line when output has no trailing newline (#982) cdc18fa
• Restore the terminal cursor below the frame on exit 06385e9
• Preserve the cursor position when its component skips rendering 013feb2
• Fix incremental rendering of single-line updates, new blank rows, and changed rows (#1039) 9a501e4 507c0c9 509ea75
• Fix overflow clipping when both the shorthand and an explicit axis are set, and preserve <Transform> line indices when clipping 4f3c7aa
• Fix background color inheritance for <Static> and nested <Text> 753a5f8
• Fix fractional percentages being truncated in layout sizes, and restore layout defaults when style props are undefined 274b15a
• Preserve visibility across Suspense transitions fc685bc
• Call onRender after the frame is written 83d7de5

<Static>

• Stop replaying <Static> output on full-clear frames (#1005) d661543
• Replay <Static> output when resuming re-enters the alternate screen (#1012) 9235028
• Fix repeated padding, ignored margins, and output inside hidden ancestors 793fe59
• Keep <Static> output after abandoned concurrent renders 8678b76
• Reset captured <Static> output when its identity changes cfdd9e6

... (truncated)

Commits

• 26d2c3f 8.0.0
• 509ea75 Clear changed incremental rows before painting (#1039)
• 91eb50a Skip unchanged prefixes during incremental rendering (#1036)
• 935db23 Switch to node:test
• d08ff67 Align reconciler host config with updated type definitions (#1037)
• f603aeb Redraw the frame when the terminal loses rows (#1025)
• 7cd7fd9 Align minWidth and maxWidth types with supported values (#1033)
• 02...

  Description has been truncated