fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@babel/parser (source)	^7.29.7 → ^7.29.8			devDependencies	patch
@babel/plugin-transform-modules-systemjs (source)	^7.29.7 → ^7.29.8			dependencies	patch
@shikijs/vitepress-twoslash (source)	^4.3.1 → ^4.4.1			devDependencies	minor
@types/react (source)	^19.2.17 → ^19.2.18			devDependencies	patch
@types/react-dom (source)	^19.2.3 → ^19.2.4			devDependencies	patch
@vitejs/devtools (source)	^0.4.8 → ^0.4.10			devDependencies	patch
@vitejs/plugin-react (source)	^6.0.4 → ^6.0.5			devDependencies	patch
acorn	^8.17.0 → ^8.18.0			devDependencies	minor
baseline-browser-mapping	^2.11.3 → ^2.11.10			devDependencies	patch	2.11.11
github/codeql-action	v4.37.3 → v4.37.4			action	patch
globals	17.7.0 → 17.8.0				minor	17.9.0
globals	^17.7.0 → ^17.8.0			devDependencies	minor	17.9.0
less (source)	^4.8.0 → ^4.8.1			devDependencies	patch
lint-staged	^17.2.0 → ^17.3.0			devDependencies	minor
markdown-it-image-size	^15.0.1 → ^15.1.0			devDependencies	minor
miniflare (source)	^4.20260722.0 → ^4.20260730.0			devDependencies	minor
oxfmt (source)	^0.60.0 → ^0.61.0			devDependencies	minor
oxlint (source)	^1.75.0 → ^1.76.0			devDependencies	minor
playwright-chromium (source)	^1.62.0 → ^1.62.1			devDependencies	patch
postcss (source)	^8.5.23 → ^8.5.25			dependencies	patch
preact (source)	^10.29.7 → ^10.29.8			dependencies	patch
semgrep/semgrep	1.171.0 → 1.172.0			container	minor
svelte-check	^4.7.3 → ^4.7.4			devDependencies	patch
vite-plugin-solid	^2.11.13 → ^2.11.14			devDependencies	patch
vitepress (source)	^2.0.0-alpha.18 → ^2.0.0-alpha.19			devDependencies	patch
vitepress-plugin-group-icons	^1.7.5 → ^1.7.6			devDependencies	patch
vitepress-plugin-llms	^1.13.3 → ^1.13.4			devDependencies	patch
vue-tsc (source)	^3.3.8 → ^3.3.9			devDependencies	patch
zizmorcore/zizmor-action	v0.6.1 → v0.6.2			action	patch

---

Release Notes

babel/babel (@​babel/parser)

v7.29.8

Compare Source

babel/babel (@​babel/plugin-transform-modules-systemjs)

v7.29.8

Compare Source

shikijs/shiki (@​shikijs/vitepress-twoslash)

v4.4.1

Compare Source

   🚀 Features

• Update deps  -  by @​antfu (e07fd)

    View changes on GitHub

v4.4.0

Compare Source

   🚀 Features

• Update grammars and themes  -  by @​antfu (dec2a)

   🐞 Bug Fixes

• core: Guess yaml from frontmatter segments  -  by @​antfubot in #​1299 (1b8b6)

    View changes on GitHub

vitejs/devtools (@​vitejs/devtools)

v0.4.10

Compare Source

   🚀 Features

• core: Type the remaining json-render catalog components' props  -  by @​dvcolomban in #​493 (341bc)
• oxc: Oxlint config inspector  -  by @​yuyinws in #​485 (04abd)
• playground: Mount official @​devframes/plugin-* dashboards  -  by @​antfubot, opencode and @​antfu in #​483 (06668)

   🐞 Bug Fixes

• core:
  • Render single overflow dock entry inline instead of behind overflow button  -  by @​antfubot in #​486 (b5b1d)
  • Add vite server fallback for embedded connections  -  by @​webfansplz in #​494 (969d4)
• ui:
  • Remove custom web fonts usage to reduce package size  -  by @​antfu (10f99)

    View changes on GitHub

v0.4.9

Compare Source

   🚀 Features

• core:
  • Allow configuring extra allowed origins for the DevTools WS transport  -  by @​dvcolomban in #​471 (f9087)
  • Opt-in variant/interactive on json-render Card & Stack, fix dock scrollbar in dark mode  -  by @​dvcolomban in #​477 (c279e)

   🐞 Bug Fixes

• core:
  • Scroll selected command palette item into view inside shad…  -  by @​SaKaNa-Y in #​474 (9ab86)
  • Hide stale panes when switching docks in popup mode  -  by @​SaKaNa-Y in #​475 (073ff)
  • Land a subTabs anchor on its live member tab, not the hidden anchor  -  by @​antfubot in #​473 (5d668)
  • Align grouped iframe address bar with sidebar  -  by @​webfansplz in #​482 (95c9f)
  • Prevent popup dock icons from being dimmed  -  by @​SaKaNa-Y in #​481 (4dfbe)
  • Command palette dark-on-dark text + glass-panel mismatch  -  by @​dvcolomban in #​478 (8becc)
• oxc:
  • Tolerate stdout notices ahead of oxlint's JSON payload  -  by @​dvcolomban in #​476 (c9504)
• ui:
  • Prevent dark mode from mutating host document  -  by @​SaKaNa-Y in #​480 (2ee70)

    View changes on GitHub

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.5

Compare Source

Fixed the react compiler preset filter to be linear (#​1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#​1349). The filter was changed to be linear to avoid that.

acornjs/acorn (acorn)

v8.18.0

Compare Source

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.11.10

Compare Source

v2.11.9

Compare Source

v2.11.8

Compare Source

v2.11.7

Compare Source

v2.11.6

Compare Source

v2.11.5

Compare Source

v2.11.4

Compare Source

github/codeql-action (github/codeql-action)

v4.37.4

Compare Source

sindresorhus/globals (globals)

v17.8.0

Compare Source

• Update globals (2026-07-01) (#​347) 7394811

---

less/less.js (less)

v4.8.1

Compare Source

Changes

• #​4483 fix(release): sync release version from PR title (@​matthew-dean)
• #​4479 fix: leave math functions for the browser when an argument is a runtime CSS var() (@​Lfan-ke)
• #​4477 fix: forwarding an unset variadic no longer overrides callee defaults (@​Lfan-ke)
• #​4474 chore: release v4.8.0 — deprecate legacy identifier forms and dynamic @​charset (@​app/github-actions)

lint-staged/lint-staged (lint-staged)

v17.3.0

Compare Source

Minor Changes

• #​1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @​type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #​1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

boyum/markdown-it-image-size (markdown-it-image-size)

v15.1.0: Release 15.1.0

Compare Source

Features

• custom cache dir (#​760) (bf8a3ef)

Bug Fixes

• npm audit (f5d519b)
• resolve generator paths on Windows (#​977) (09f15e5)

Tests

• use latest version of plugin-img-size (#​898) (84563ab)

Continuous Integration

• run CI in Node 24 (#​784) (35d8684)
• track bundle changes with codecov (947735d)

cloudflare/workers-sdk (miniflare)

v4.20260730.0

Compare Source

Minor Changes

• #​14685 01d7020 Thanks @​edmundhung! - Add JSON output to /cdn-cgi/handler/email

  The /cdn-cgi/handler/email endpoint now accepts ?format=json to return the email handler result as JSON, including its outcome, rejection reason, forwarded messages, and replies. Requests without format=json still return the existing text outcome for backward compatibility.

Patch Changes

• #​14929 48f0c6c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260722.1	^5.20260730.1
  workerd	1.20260722.1	1.20260730.1

• #​14810 d7f38c3 Thanks @​allocsys! - Fix the local Images binding transform (env.IMAGES.input(...).transform(...)) ignoring the fit, gravity, and background options. Previously, local dev always letterboxed transformed images with black bars regardless of the options passed in. Local dev now respects fit, gravity, and background, matching production Images binding behavior.

• #​14850 5c25cfe Thanks @​exKAZUu! - Disable the keep-alive timeout on the loopback server

  The loopback server (which serves custom service bindings, @cloudflare/vite-plugin's module transport, and other workerd → Node callbacks) used Node's default server.keepAliveTimeout of 5 seconds. workerd pools and reuses connections to the loopback server, so Node closing an idle pooled socket raced with workerd sending the next request on it, making that request fail with Network connection lost. The failure is probabilistic and load-dependent; under @cloudflare/vite-plugin with a large SSR module graph and a cold optimizer cache (thousands of fetchModule calls with multi-second idle gaps between bursts), it broke most dev sessions. Disable the idle keep-alive timeout on the loopback server, mirroring the undici pools used for dispatch in the opposite direction.

• #​14914 1f61001 Thanks @​nickpatt! - Capture Workflows invocations in local observability

  When local observability is enabled, the Workflows engine service is now attached to the trace collector (like every user worker), so workflow runs show up in the Local Explorer's Observability view attributed to the workflow. Previously the engine ran outside the per-user-worker tail wiring, so workflow invocations left no traces, spans, or logs in the local store.

v4.20260722.1

Compare Source

Minor Changes

• #​14702 e426cb9 Thanks @​Sipixer! - Support passing V8 flags to workerd via the MINIFLARE_WORKERD_V8_FLAGS environment variable

  The generated workerd config already supports v8Flags, but Miniflare never populated it, so the runtime always ran with V8's default heap limit (~1.4 GB). Large dev applications (e.g. big SSR module graphs under @cloudflare/vite-plugin, where each server-file edit grows the runner isolate's heap) can reach that limit, at which point workerd aborts with V8 fatal error; location = Reached heap limit and every subsequent dispatchFetch() fails with fetch failed until the dev server is manually restarted.

  Setting e.g. MINIFLARE_WORKERD_V8_FLAGS="--max-old-space-size=4096" raises the limit and keeps long dev sessions alive. The variable follows the same space-separated format as MINIFLARE_WORKERD_AUTOGATES.

• #​14280 465c0fb Thanks @​tahmid-23! - Add a local S3-compatible API for R2 buckets at /cdn-cgi/local/r2/s3/<bucket-id>, where <bucket-id> is the ID the bucket is configured with in the r2Buckets option

  Buckets configured with s3Credentials: { accessKeyId, secretAccessKey } in r2Buckets are served over an S3-compatible HTTP API, authenticated with AWS Signature Version 4 (both Authorization header and presigned URL query authentication). Supported operations: GetObject, HeadObject, PutObject, CopyObject, DeleteObject, DeleteObjects, ListObjects, ListObjectsV2, HeadBucket, ListBuckets, CreateMultipartUpload, UploadPart, UploadPartCopy, CompleteMultipartUpload, and AbortMultipartUpload. Status codes, error responses, and unsupported-header screening mirror R2's S3 endpoint, including its static responses for bucket-configuration reads and its named errors for unimplemented operations.

• #​14712 6e0bf6e Thanks @​mack-erel! - Support connect() on remote VPC Network and VPC Service bindings in local development

  Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

  This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

Patch Changes

• #​14784 1035f74 Thanks @​ATKasem! - Fix getWithMetadata dropping metadata for falsy KV values

  KVNamespace.getWithMetadata returned null metadata whenever the stored value was falsy — an empty string or "0" — because the metadata branch was guarded by a truthiness check on the value. The guard now checks for null explicitly, so metadata is preserved for empty-string and "0" values while genuinely missing keys still return null.

• #​14864 3a22ae5 Thanks @​Hashim1999164! - Hide the workerd console window on Windows when the parent process has no console. Spawning workerd without windowsHide: true caused Windows Terminal to open a visible, focus-stealing window for background or detached parents (for example Astro's astro dev --background).

oxc-project/oxc (oxfmt)

v0.61.0

Compare Source

oxc-project/oxc (oxlint)

v1.76.0

Compare Source

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#​24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#​24724) (Bartok)
• 016cf2a linter/oxc: Add bad-match-all-arg rule (#​24900) (camc314)
• cdc941e linter/n: Implement exports-style rule (#​24087) (Mikhail Baev)
• 1ad6f6c linter/eslint: Implement id-denylist rule (#​24632) (Mikhail Baev)

📚 Documentation

• 3ff2e0e linter: Clarify config extends types (#​24936) (Boshen)

microsoft/playwright (playwright-chromium)

v1.62.1

Compare Source

postcss/postcss (postcss)

v8.5.25

Compare Source

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

v8.5.24

Compare Source

• Preserve the BOM after the processing (by @​hdimer).

preactjs/preact (preact)

v10.29.8

Compare Source

Performance

• Batch updates in flushSync (#​5173, thanks @​JoviDeCroock)
• Avoid traversing retained subtrees (#​5182, thanks @​JoviDeCroock)

sveltejs/language-tools (svelte-check)

v4.7.4

Compare Source

Patch Changes

• fix: support TypeScript 7 Stable under npm alias (#​3073)

solidjs/vite-plugin-solid (vite-plugin-solid)

v2.11.14

Compare Source

Patch Changes

• a9a68cb: Allow @testing-library/jest-dom v7 in the optional peer dependency range. v7 keeps the @testing-library/jest-dom/vitest subpath the plugin auto-injects into test.setupFiles, so no code change is needed, only the range widening that unblocks npm's peer resolution.

vuejs/vitepress (vitepress)

v2.0.0-alpha.19

Compare Source

Bug Fixes

• build: apply rewrites when computing createContentLoader urls (9e2148d)
• build: clear markdown cache with rewritten path on include change (5eac447), closes #​5035
• build: compose markdown preConfig hook when extending configs (c39a85a), closes #​5205
• build: don't apply docsearch css transform to pages matching its filter (fa0e48c)
• build: don't rely on checkout directory name when externalizing types (e6ba9d8)
• build: report links to pre-rewrite paths of rewritten pages as dead (3cf3f37)
• build: resolve additional configs by source path (5e4a9e7)
• build: resolve rewrites against externally injected pages too (769c10e)
• build: respect cleanUrls in content loader render (027f046), closes #​4331 #​5299
• build: track include importers by module id (c961655)
• build: prevent duplicate IDs in MiniSearch (#​5303) (505278c)
• build: remove stackTraceLimit Infinity for DEBUG (#​5318) (865d04b)
• build: retry file reads when out of file descriptors (da71173)
• cli: avoid onAfterConfigResolve (3fbaf9c)
• client: make the route the single source of truth for the URL hash (dcb7a75)
• markdown: preserve user-defined attributes (3f4530b), closes #​5123
• markdown: remove extra whitespace from container markup (b6d9cb8)
• markdown: skip circular includes (3372516)
• markdown: remove deprecated cjkFriendly option (27762ea)
• markdown: rename image option lazyLoading to lazyLoad (078786a)
• search: index changed files with srcDir-relative paths in dev (6b64f35), closes #​3374
• search: only index pages on dev updates (559fb24)
• search: serve a fresh search index after dev updates (1534a67)
• search: skip pages that fail to render instead of crashing dev server (3ffefa2)
• theme: use ul and li for lists (#​5326) (3f99872)
• theme: align docsearch breakpoints with the default theme (90c28d4), closes #​5213
• theme: align local search breakpoint (#​5217) (a425113)
• theme: correct anchor scroll margins across viewports (dabc5e9)
• theme: ensure outline marker follows click (#​3879) (31287c0)
• theme: external link icon not showing in navbar links (225c94a), closes #​5306
• theme: pass target and rel to prev/next page links (#​5297) (6b5e770)
• theme: preserve url params when switching languages (#​5312) (9ee401d)
• theme: prevent TypeError when navigating to page without outline (#​5329) (9376c58)
• theme: remove font-synthesis style (#​5309) (c34769c)
• theme: safari not showing external link icon properly (7118402)
• theme: rebuild the base styles on tailwind's preflight (f1ee913)
• theme: route cjk punctuation to matching system fonts (91b06b6)
• theme: remove deprecated disableDetailedView local search option (cec4998)
• theme: remove deprecated lastUpdatedText option (18d1b47)
• theme: remove deprecated outlineTitle option (95c0420)
• types: declare Badge as a global component (ca8ba5b)
• types: import EnhanceAppContext from package entry in theme.d.ts (8ff1f3e), closes #​5156

Features

• add web-types.json for JetBrains IDE support (1d448c9), closes #​5157
• auto-add width/height to local images to avoid layout shift (#​5311) (3868b64)
• client: declare $frontmatter and $params as ComponentCustomProperties (0535009)
• client: declare Content and ClientOnly components as GlobalComponents (#​5156) (6629577), closes #​5154
• cli: show vite version in startup log (#​5328) (4666fc2)
• enable metaChunk by default (#​5325) (8e42f31)
• init: use async fs in scaffolding (38b59f9)
• markdown: accept booleans for plugin options (c2be0bf)
• markdown: add region marker engine (b303dd3)
• markdown: allow disabling table tabindex attribute (bffe1e1)
• markdown: support disabling built-in markdown plugins (b8d9c8f), closes #​4484 #​4556
• markdown: support footnotes (430a890)
• markdown: support GitHub-style task lists (97f8781), closes #​413 #​1923 #​3648 #​5110
• markdown: support per-locale markdown strings (faaa4a1), closes #​4431
• markdown: support registering custom containers (962f00e), closes #​3591 #​3603 #​4228
• markdown: support title-less containers (4c7a030), closes #​4928 #​4932 #​4929
• markdown: rebase relative urls in included files (6a337ef)
• markdown: group code copy button strings into one option (2fa0ded), closes #​4431
• markdown: replace markdown-it-attrs with @​mdit/plugin-attrs (18380b0)
• markdown: replace markdown-it-emoji with @​mdit/plugin-emoji (018887f)
• markdown: replace markdown-it-anchor with @​mdit/plugin-anchor (7550517)
• markdown: support attrs: false for disabling attrs plugin (e235dbe)
• markdown: support note, important, caution markdown containers (#​5161) (3b560a0), closes #​4427 #​3928
• theme: allow internal social links (51ff681), closes #​5305
• theme: cover all Inter glyphs, generate font subsets from a script (705c1be)
• update option stability annotations (ab1896f)

Performance Improvements

• build: reuse lastUpdated from markdown rendering in sitemap generation (fdd68e3)
• md: bypass gray-matter's unbounded cache (4f8703d)
• md: limit the compile cache's memory usage (2fb6bda)
• use hook filters in vite plugins ([fa24c6d](h

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.