chore(deps): update npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
deno (source)	2.9.3 → 2.9.4
vite (source)	0.2.4 → 0.2.6

---

Release Notes

denoland/deno (deno)

v2.9.4

Compare Source

2.9.4 / 2026.07.23

• feat(desktop): enable --hmr for React Router (#​35900)
• feat(ext/node): add a byteLength/length parameter to
  Buffer.indexOf/lastIndexOf/includes (#​35872)
• feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv (#​36016)
• feat: upgrade V8 to 150.2.0 (#​36098)
• fix(add): support --minimum-dependency-age flag in deno add/remove (#​36099)
• fix(cache): store Web Cache under origin data (#​36145)
• fix(canvas): require FFI permission for native window handles (#​36080)
• fix(clean): reject symlinked node_modules cleanup roots (#​36190)
• fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage
  (#​36242)
• fix(core): allow dynamic imports during cached module evaluation (#​36258)
• fix(core): bound error graph conversion (#​36070)
• fix(core): enforce JSON requests in FsModuleLoader (#​36137)
• fix(core): handle malformed error constructors (#​36071)
• fix(core): stop rejected dynamic imports before loading (#​36136)
• fix(desktop): make BrowserWindow bindings typeable (#​35907)
• fix(desktop): preserve binding wrappers after lazy op upgrade (#​36065)
• fix(desktop): strip runtime extension from app name (#​36060)
• fix(ext/napi): cancel async sends after close (#​36077)
• fix(ext/napi): scope callback info per invocation (#​36076)
• fix(ext/node): apply backpressure to http2 stream writes (#​36044)
• fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit
  (#​36113)
• fix(ext/node): implement worker_threads.locks via Web Locks (#​35963)
• fix(ext/node): node:sqlite backup() and deserialize() argument validation
  (#​36127)
• fix(ext/node): retry DNS query when its per-attempt timeout fires (#​35955)
• fix(ext/node): stop http2 file reads on stream close (#​36061)
• fix(ext/web): handle failed webtransport datagram setup (#​36067)
• fix(ext/webidl): implement async_sequence for ReadableStream.from (#​35976)
• fix(fetch): bound multipart part headers (#​36096)
• fix(fmt): keep embedded CSS custom property indentation stable (#​35949)
• fix(fs): require sys permission for umask (#​36222)
• fix(http): preserve trust proxy environment setting (#​36073)
• fix(init): validate temporary node_modules parent (#​36142)
• fix(jupyter): report codemirror_mode as a string (#​36241)
• fix(loader): reject non-JSON modules for JSON imports (#​36135)
• fix(napi): synchronize external string finalizers (#​36078)
• fix(net): clean up cancellation resources on early errors (#​36229)
• fix(net): limit WebTransport handshake frame buffering (#​36068)
• fix(node_http2): clean up destroyed sessions (#​36043)
• fix(node_resolver): handle CJS filesystem path edge cases (#​36112)
• fix(node_stream): handle Web Stream adapter errors (#​36193)
• fix(npm): avoid following lock poll symlinks (#​36192)
• fix(npm): download tarballs from the configured registry instead of
  registry.npmjs.org (#​36187)
• fix(npm): reject symlinked package materialization dirs (#​36191)
• fix(outdated): keep type-only dependencies in the lockfile (#​36140)
• fix(pack): support file paths longer than the tar name field (#​36105)
• fix(permissions): escape bidi controls in prompts (#​36195)
• fix(process): avoid collisions in Windows stdio pipe names (#​36081)
• fix(publish): constrain generated source rewrites (#​36109)
• fix(release): insert into versions.json in semver order (#​36097)
• fix(rt): isolate extracted native addons (#​36144)
• fix(runtime): bridge console to the inspector regardless of --inspect flag
  (#​35795)
• fix(runtime): give worker isolate threads the stack size we report (#​36114)
• fix(test): escape control characters in test names (#​36196)
• fix(tests): make npm test registry tolerate a bad advisories request body
  (#​36138)
• fix(tls): resolve sni requests concurrently (#​36062)
• fix(update): don't downgrade lockfile when npm cache is stale (#​35904)
• fix(webtransport): avoid url parse panic (#​36066)
• fix(webtransport): validate certificate dates (#​36069)
• fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge
  (#​36025)
• fix: discover config file for jsr: entrypoints (#​35838)
• fix: handle UTF-16 diagnostic columns (#​36028)
• perf(core): avoid duplicating lazy ESM snapshot sources (#​36262)
• perf(snapshot): mangle internal source identifiers (#​36263)
• perf: compress bundled AppImage runtimes (#​36261)
• perf: use FxHash for hot internal hash maps (#​36100)

voidzero-dev/vite-plus (vite)

v0.2.6: vite-plus v0.2.6: Stable type-aware linting and more reliable task caching

Compare Source

This release moves Vite+'s type-aware linting to the stable tsgolint 7 engine, updates the bundled build and formatting tools, strengthens vp run caching and workspace discovery, and removes the redundant vp build startup banner.

Highlights

• Move bundled type-aware linting to stable tsgolint 7, and update Vite 8.1.4 -> 8.1.5, Rolldown 1.1.5 -> 1.2.0, tsdown 0.22.7 -> 0.22.13, Oxlint 1.73.0 -> 1.75.0, oxlint-tsgolint 0.24.0 -> 7.0.2001, and Oxfmt 0.58.0 -> 0.60.0 (#​2214), by @​voidzero-guard[bot]
• Improve vp run reliability by caching much larger automatically tracked input sets, discovering npm workspaces whose patterns start with ./, and providing more accurate error messages (vite-task#554, vite-task#547, vite-task#552, #​2215), by @​wan9chi and @​liangmiQwQ
• Remove the redundant Vite startup banner from vp build output and fail fast when upstream Vite changes invalidate Vite+ branding patches (#​2200, #​2205), by @​liangmiQwQ

Refactor

• Deduplicate package-manager version gates in migration catalog handling (#​2216), by @​jong-kyung
• Unify static and generated CLI help under one document model and renderer (#​2211), by @​jong-kyung
• Reuse shared subprocess exit-status handling across global CLI command paths (#​2196), by @​jong-kyung

Docs

• Fix broken documentation anchors and add Migration Rules to the Migrate sidebar (#​2203), by @​charpeni

Chore

• Stabilize vp create build-approval snapshots by removing package-age timing from those fixtures (#​2224), by @​wan9chi
• Remove the temporary release workflow dispatch used for the previous release (#​2193), by @​wan9chi
• Share package-manager fixtures across CLI tests (#​2197), by @​jong-kyung
• Remove stale raw Oxlint and Oxfmt development dependencies that bypassed repository editor configuration (#​2187), by @​liangmiQwQ

Bundled Versions

Tool	Version	Source
vite	8.1.5	5e7fe12
rolldown	1.2.0	03e1e34
tsdown	0.22.13	npm
vitest	4.1.10	npm
oxlint	1.75.0	npm
oxlint-tsgolint	7.0.2001	npm
oxfmt	0.60.0	npm

Upgrade

vp upgrade

New Contributors

Welcome @​charpeni.

Full Changelog: voidzero-dev/vite-plus@v0.2.5...v0.2.6

Published Packages

• @voidzero-dev/vite-plus-core@0.2.6
• vite-plus@0.2.6

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: cd064c6

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.6 vp build

Run any vp command without installing it; see the Docker guide for more.

v0.2.5: vite-plus v0.2.5: Cleaner environments and more reliable workflows

Compare Source

This release adds cleanup and package version commands, supports TypeScript 7 declaration generation, reduces the standalone binary size, and hardens task tracking, CLI output, package-manager routing, Docker workflows, and project scaffolding.

Highlights

• Add vp env clean to remove unused managed Node.js runtimes and package-manager caches (#​2003), by @​liangmiQwQ
• Add vp pm version, forwarding native version commands to npm, pnpm, Yarn, and Bun (#​2127), by @​jong-kyung
• Add TypeScript 7 support to declaration generation and generated library projects with tsdown 0.22.7 (#​2104, #​2168), by @​wan9chi
• Improve automatic task input tracking for Bun on macOS, Linux containers with constrained /dev/shm, and Windows process images, reduce Windows backing-file allocation, and clarify task wait failures (vite-task#515, vite-task#518, vite-task#523, vite-task#524, vite-task#542, #​2126, #​2167), by @​wan9chi
• Prevent CLI diagnostics from truncating or panicking when inherited standard output or error is nonblocking (#​2172, #​2173), by @​wan9chi

Fixes & Enhancements

• Reduce standalone vp binary sizes by about 5% on Linux and macOS and 19% on Windows (#​2043), by @​fengmk2
• Keep the Docker image non-root by default while allowing passwordless sudo for Playwright browser dependencies and system packages (#​2088), by @​fengmk2
• Ignore .env and .env.* in generated projects while keeping .env.example trackable (#​2095), by @​forehalo
• Create vp-use.cmd after the Windows environment bin directory is ready and document its Command Prompt-only usage (#​2128), by @​liangmiQwQ
• Render user-facing process statuses and paths without Rust debug wrappers (#​2130), by @​liangmiQwQ
• Make vp dedupe fall back to yarn install with a warning on Yarn Classic (#​2139), by @​jong-kyung
• Ensure package-manager child processes, including Bun, can always find the managed Node.js runtime (#​2158), by @​BlankParticle

Docs

• Update the release-manager post-release guidance (#​2096), by @​wan9chi
• Add Windows to the Namespace sponsor credit (#​2108), by @​fengmk2
• Document installer and runtime environment variables, registry settings, TLS options, and precedence rules (#​2114), by @​yukinoshi
• Mark shell examples in CONTRIBUTING.md as Bash code blocks (#​2159), by @​BlankParticle

Chore

• Assign prepared release PRs to the workflow actor (#​2094), by @​wan9chi
• Complete the PTY snapshot migration and harden the runner, fixtures, release-version redaction, registry teardown, timeouts, and Linux parallelism (#​2071, #​2080, #​2084, #​2099, #​2102, #​2103, #​2107, #​2109, #​2115, #​2117, #​2118, #​2119, #​2120, #​2121, #​2131, #​2132, #​2134, #​2137, #​2138, #​2141, #​2143, #​2145, #​2182), by @​fengmk2 and @​wan9chi
• Expose Vite+ managed binaries consistently inside snapshot fixtures (#​2110), by @​liangmiQwQ
• Exclude PTY snapshot configuration from Vitest discovery and remove the legacy snapshot infrastructure (#​2135, #​2146), by @​jong-kyung
• Modernize Windows runners, registry bridge publishing, native size reporting, merge-base comparisons, and package-manager installation CI (#​2083, #​2100, #​2105, #​2106, #​2112, #​2133), by @​fengmk2
• Verify that created monorepo libraries emit declarations in CI (#​2171), by @​wan9chi

Bundled Versions

Tool	Version	Source
vite	8.1.4	a477454
rolldown	1.1.5	f09947a
tsdown	0.22.7	npm
vitest	4.1.10	npm
oxlint	1.73.0	npm
oxlint-tsgolint	0.24.0	npm
oxfmt	0.58.0	npm

Upgrade

vp upgrade

New Contributors

Welcome @​yukinoshi and @​BlankParticle.

Full Changelog: voidzero-dev/vite-plus@v0.2.4...v0.2.5

Published Packages

• @voidzero-dev/vite-plus-core@0.2.5
• vite-plus@0.2.5

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: 93dc59a

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.5 vp build

Run any vp command without installing it; see the Docker guide for more.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​deno@​2.9.4

View full report