chore(deps): update npm packages by renovate[bot] · Pull Request #621 · voidzero-dev/vite-task

renovate · 2026-08-09T16:28:01Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@anthropic-ai/sandbox-runtime	`0.0.67` → `0.0.73`
@openai/codex (source)	`0.146.0` → `0.149.0`
@vitest/browser-playwright (source)	`4.1.10` → `4.1.11`
bun (source)	`1.3.14` → `1.4.0`
deno (source)	`2.9.4` → `2.9.5`
typescript (source)	`7.1.0-dev.20260812.1` → `7.1.0-dev.20260819.1`
vite-task-tools>vite (source)	`8.2.0` → `8.2.2`

Release Notes

anthropic-experimental/sandbox-runtime (@anthropic-ai/sandbox-runtime)

`v0.0.73`

Compare Source

What's Changed

refactor(windows): per-user session DB, machine-wide install store by @ig-ant in #467
Release v0.0.73 by @ig-ant in #472

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.72...v0.0.73

`v0.0.72`

Compare Source

What's Changed

fix(windows): preserve SE_DACL_PROTECTED across acl grant/revoke by @ig-ant in #459
feat(windows): install-time write-deny stamps on world-writable system dirs by @ig-ant in #460
fix(proxy): close CONNECT clients that abandon a slow permission decision by @ig-ant in #461
ci: harden smoke-kill's Start-Tree wait against slow runners by @ig-ant in #464
test: keep ssh ProxyCommand helper alive until ssh closes it by @ant-kurt in #466
fix(macos): keep glob denyRead entries denied inside allowRead regions by @ant-kurt in #465
fix(proxy): route and dial the canonical host, not the client's spelling by @MarshallOfSound in #470
Release v0.0.72 by @MarshallOfSound in #471

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.71...v0.0.72

`v0.0.71`

Compare Source

What's Changed

feat: per-exec commandLabel for violation attribution; sanitize decoded proxy command by @shawnm-anthropic in #443
fix: strip trailing slashes from non-glob spellings at the normalizePathForSandbox chokepoint by @ronleizrowice-ant in #444
feat: commandId + commandText for attribution; sanitize violation lines at ingestion by @shawnm-anthropic in #445
Compact the generated macOS sandbox profile (~6-10x smaller) by @dylan-conway in #448
fix(network): bracket-aware IPv6 literals in allowed/denied domain entries by @shawnm-anthropic in #449
feat(socks): legible refusals for unauthenticatable clients; in-band SSH deny reasons by @shawnm-anthropic in #454
Release v0.0.71 by @shawnm-anthropic in #455

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.70...v0.0.71

`v0.0.70`

Compare Source

What's Changed

fix(seccomp): start the sandbox when the helper binary is execute-only by @ant-kurt in #438
fix(proxy): honor ignoreViolations and redact query strings on proxy deny lines by @shawnm-anthropic in #441
Bump 0.0.70 by @shawnm-anthropic in #442

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.69...v0.0.70

`v0.0.69`

Compare Source

What's Changed

fix(linux): skip creation stubs for absent deny paths under a read-only denied directory by @ronleizrowice-ant in #435
feat(network): per-entry deniedDomainReasons for model-facing deny reasons by @shawnm-anthropic in #437
Bump 0.0.69 by @shawnm-anthropic in #440

New Contributors

@ronleizrowice-ant made their first contribution in #435

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.68...v0.0.69

`v0.0.68`

Compare Source

What's Changed

feat(network): optional ":port" suffix on allowed/denied domains by @MarshallOfSound in #426
proxy: survive client aborts and keep abort semantics end-to-end by @sa3eed3ed in #423
feat(proxy): record proxy denials in SandboxViolationStore by @shawnm-anthropic in #436
Bump 0.0.68 by @MarshallOfSound in #439

New Contributors

@sa3eed3ed made their first contribution in #423

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.67...v0.0.68

openai/codex (@openai/codex)

`v0.147.0`

`v0.146.1`

vitest-dev/vitest (@vitest/browser-playwright)

`v4.1.11`

Compare Source

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in #10992 (5146d)
browser:
- Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in #10955 (10b2c)
- Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in #10951 (9851d)
mocker:
- Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in #10974 (fe5a1)

View changes on GitHub

oven-sh/bun (bun)

`v1.4.0`: Bun v1.4

Compare Source

To install Bun v1.4

curl -fsSL https://bun.com/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.0:

bun upgrade

Read the blog post:

Thank you

Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3.

denoland/deno (deno)

`v2.9.5`

Compare Source

feat(add): --unscoped flag to alias packages by their unscoped name (#36319)
feat(task): add --members flag to run tasks in workspace members only (#35748)
feat: add Blob/Body textStream() (#35616)
feat: add experimental QuickJS backend (#36194)
fix(bundle): avoid esbuild protocol deadlock (#36427)
fix(bundle): respect runtime file permissions (#36107)
fix(cjs): use loader sources for recursive analysis (#36111)
fix(cli): escape control characters in external metadata (#36198)
fix(core): don't resolve internal module imports with the user's import map
(#36303)
fix(crypto): add "raw-secret" to KeyFormat type (#35708)
fix(desktop): handle colored HMR URLs and page loads (#36316)
fix(desktop): retain update signature verification op (#36152)
fix(ext/crypto): allow deriveBits with length 0 (#36283)
fix(ext/napi): polyfill uv_handle_size and uv_strerror (#36308)
fix(ext/net): release completed QUIC stream resources (#36247)
fix(ext/net): require --allow-sys for node:dns.getServers() (#35941)
fix(ext/node): Node compat for web streams (#36285)
fix(ext/node): apply backpressure in Readable.toWeb() (#36321)
fix(ext/node): defer TLS write completion callback to avoid reentrancy panic
(#35867)
fix(ext/node): don't fire http2 settings callback after session destroy
(#36230)
fix(ext/node): gate constrained memory cgroup reads (#36218)
fix(ext/node): handle pre-quoted shell arguments (#36371)
fix(ext/node): implement node:test tags (#36292)
fix(ext/node): implement util.diff (#36289)
fix(ext/node): implement v8.promiseHooks API (#36281)
fix(ext/node): sort fs.readdir entries to match Node.js (#36341)
fix(ext/node): stop http2 file reads after stream close (#36300)
fix(ext/node): store blocklist ranges compactly (#36212)
fix(ext/node): support the fs flush option for writes (#36290)
fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify (#36326)
fix(ext/node_crypto): use named group exponent sizes (#36347)
fix(ext/web): attach Node error codes to WHATWG API validation errors (#36288)
fix(ext/websocket): disable HTTP/2 server push on wss upgrade path (#36327)
fix(fetch): scope redirect-sensitive headers by origin (#36361)
fix(ffi): reject resizable buffers in nonblocking calls (#36259)
fix(fmt): accept xml and svg extensions for stdin (#36149)
fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 (#36397)
fix(http): preserve stripped headers across redirects (#36360)
fix(inspector): validate request host headers (#36348)
fix(net): cancel pending writes on stream close (#36369)
fix(net): clean up concurrently dropped load-balanced listeners (#36246)
fix(net): handle malformed DNS record text (#36374)
fix(node): clean up Web Stream finished listeners (#36227)
fix(node): retain consumed HTTP stream wrapper (#36254)
fix(npm): ignore invalid package bin targets (#36354)
fix(npm): tolerate malformed scripts field in packuments (#36324)
fix(npmrc): match auth configs by authority and path (#36359)
fix(outdated): don't report JSR pre-release versions as latest (#36325)
fix(publish): report when the registry rejects a provenance attestation
(#36404)
fix(resolver): don't treat deno eval modules as npm package files (#36304)
fix(runtime): map notify's Windows missing-path error to NotFound (#35864)
fix(sync-types): add reason to too_many_arguments allows (lint)
fix(telemetry): handle reentrant attribute conversion (#36256)
fix(webgpu): own mapped range backing stores (#36257)
fix(webstorage): preserve Storage constructor name (#35944)
fix: capitalize IP in help text (#36170)
fix: upgrade deno_task_shell to 0.33.3 (#36406)
fix: wire no-legacy-abort unstable flag from deno.json config (#36312)
perf(core): run the common-path tick drain in Rust (#36157)
perf(ext/node): bypass dns lookup on literal IPs in udp send (#35909)
perf(ext/web): implement base64url encode/decode as simdutf ops (#36398)
perf(fs): open files on the blocking pool in async readFile/writeFile (#36160)
perf: order startup functions in release builds (#36219)
perf: reduce eager module evaluation at startup (#36331)
perf: remove Linux unwind tables from release artifacts (#36265)

microsoft/TypeScript (typescript)

vitejs/vite (vite-task-tools>vite)

`v8.2.2`

Compare Source

Features

deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

bundled-dev: handle lazy request error (#23291) (3ba026d)
bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
css: don't pass empty targets to lightningcss (#23295) (2804636)
define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
deps: update all non-major dependencies (#23217) (ba958bd)
deps: update rolldown-related dependencies (#23218) (83ecb2c)
module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
optimizer: close custom extension analysis bundles (#23207) (8fb7675)
reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

define: close rolldown bundler after generate (#23231) (b4d66fe)
module-runner: add TLA circular import case (#23299) (4a261f2)
module-runner: simplify server-hmr tests (#23300) (599b44b)
ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

`v8.2.1`

Compare Source

Bug Fixes

build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
deps: update all non-major dependencies (#23136) (14454fd)
deps: update rolldown-related dependencies (#23070) (7ac6f7f)
don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

css: look up pure CSS chunks through a Set (#23114) (1331b0b)

Documentation

build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

bundled-dev: enable sourcemap playgrounds (#23080) (c2155fe)
reduce logs (#23138) (7673c02)

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 10am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-08-09T16:28:20Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/deno@2.9.5
	npm/bun@1.4.0
	npm/vite@8.2.2
	npm/@vitest/browser-playwright@4.1.11
	npm/typescript@7.1.0-dev.20260819.1
	npm/@anthropic-ai/sandbox-runtime@0.0.73
	npm/@openai/codex@0.149.0

View full report

github-actions · 2026-08-09T16:33:26Z

fspy benchmark

linux

dynamic/launch             change  +0.09%  [ -8.61% ..  +8.78%]  overhead  +302.29%
dynamic/access             change  +0.12%  [ -1.68% ..  +1.05%]  overhead    +8.21%
dynamic/access-relative    change  +0.10%  [ -0.78% ..  +1.06%]  overhead   +47.66%
dynamic/access-contended   change  -0.13%  [ -6.45% ..  +2.31%]  overhead   +11.37%
static/launch              change  +0.31%  [ -6.65% ..  +7.36%]  overhead  +730.41%
static/access              change  +0.19%  [ -1.26% ..  +1.72%]  overhead  +819.68%
static/access-relative     change  -0.15%  [ -1.32% ..  +0.93%]  overhead +1317.94%
static/access-contended    change  +0.43%  [ -0.54% ..  +1.65%]  overhead +3436.54%

macos

dynamic/launch             change  +0.79%  [ -4.91% ..  +5.16%]  overhead  +238.34%
dynamic/access             change  +0.68%  [ -3.88% ..  +5.42%]  overhead    +7.03%
dynamic/access-relative    change  +0.92%  [ -6.84% .. +36.34%]  overhead  +237.78%
dynamic/access-contended   change  +1.79%  [-12.46% .. +608.14%]  overhead    +9.18%

windows

dynamic/launch             change  -0.29%  [ -2.09% ..  +1.69%]  overhead   +25.80%
dynamic/access             change  -0.19%  [ -0.93% ..  +0.75%]  overhead    +0.95%
dynamic/access-relative    change  +0.00%  [ -0.75% ..  +0.93%]  overhead    +1.12%
dynamic/access-contended   change  +0.00%  [ -1.94% ..  +1.09%]  overhead    +1.09%

renovate Bot force-pushed the renovate/npm-packages branch 3 times, most recently from 633785c to a320414 Compare August 16, 2026 16:42

renovate Bot force-pushed the renovate/npm-packages branch 2 times, most recently from 21ba143 to 6c1f382 Compare August 23, 2026 16:33

chore(deps): update npm packages

3b4cec0

renovate Bot force-pushed the renovate/npm-packages branch from 6c1f382 to 3b4cec0 Compare August 23, 2026 21:49

Navigation Menu

Uh oh!

chore(deps): update npm packages - #621

chore(deps): update npm packages#621
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages

renovate Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

🐞 Bug Fixes

v1.4.0: Bun v1.4

Thank you

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Build System

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Configuration

Uh oh!

socket-security Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

fspy benchmark

linux

macos

windows

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 9, 2026 •

edited

Loading

`v1.4.0`: Bun v1.4

socket-security Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading