chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-21 — run · 5 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-20 — run · 5 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 5 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.269
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 4 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.268
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0

commits

• chore(deps): apply weekly update fixes

---

Note

Low Risk
Tooling and lockfile-only changes with semver-minor bumps; no application runtime or security-sensitive logic is modified.

Overview
This rolling dependency update bumps the fleet Node pin to 26.8.2 and refreshes the pnpm lockfile (including pinning the workspace pnpm binary to 12.4.1).

Catalog / direct bumps in pnpm-workspace.yaml: @anthropic-ai/claude-code (2.1.220 → 2.1.268), vite (8.2.2 → 8.3.0), fast-check (4.9.0 → 4.10.0), and rolldown-plugin-dts (0.28.4 → 0.28.5). The lockfile also picks up aligned override and transitive updates (e.g. magic-string 1.3.1, sharp 0.35.4, protobufjs 7.6.6, picomatch 4.0.7, content-type 2.1.0).

package.json devEngines now declares both npm and pnpm as allowed package managers (each with onFail: "error"), instead of only pnpm.

^{Reviewed by Cursor Bugbot for commit 7622c01. Configure here.}

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​fast-check@​4.9.0 ⏵ 4.10.0	+1
	npm/​yaml@​2.9.0 ⏵ 2.9.1	+1			+6
	npm/​magic-string@​1.2.3 ⏵ 1.3.1			+1	+1

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​yaml@​2.9.0 ⏵ 2.9.1	+1
	npm/​fast-check@​4.9.0 ⏵ 4.10.0	+1		+1	-2
	npm/​magic-string@​1.2.3 ⏵ 1.3.1			+1	+1

View full report