chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-22 — run · 10 updated

package	from	to
@anthropic-ai/claude-code	2.1.268	2.1.272
@socketregistry/packageurl-js	1.5.2	1.5.3
@socketregistry/packageurl-js-stable	npm:@socketregistry/packageurl-js@1.5.2	npm:@socketregistry/packageurl-js@1.5.3
all-the-package-names	2.0.2559	2.0.2564
brace-expansion	5.0.9	5.0.12
magic-string	1.3.1	1.4.1
rolldown-plugin-dts	0.28.4	0.28.5
typebox	1.3.30	1.3.31
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-21 — run · 6 updated

package	from	to
@anthropic-ai/claude-code	2.1.268	2.1.270
all-the-package-names	2.0.2559	2.0.2563
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-20 — run · 6 updated

package	from	to
@anthropic-ai/claude-code	2.1.268	2.1.270
all-the-package-names	2.0.2559	2.0.2562
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 6 updated

package	from	to
@anthropic-ai/claude-code	2.1.268	2.1.269
all-the-package-names	2.0.2559	2.0.2561
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 4 updated

package	from	to
all-the-package-names	2.0.2559	2.0.2560
fast-check	4.9.0	4.10.0
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0

commits

• chore(deps): apply weekly update fixes

---

Note

Medium Risk
Vite and magic-string feed vitest, coverage, and Rolldown builds; a minor Vite bump can surface bundler or test-runner regressions even though no product code changed.

Overview
This rolling dependency refresh bumps the fleet toolchain and test pins without changing application source.

Node is pinned to 26.8.2 in .node-version. Catalog / lockfile updates include vite 8.2.2 → 8.3.0 (with transitive vitest, @vitiate/*, and coverage tooling resolving the new Vite), fast-check 4.9.0 → 4.10.0, rolldown-plugin-dts 0.28.4 → 0.28.5, and magic-string 1.2.3 → 1.3.1 via catalog and overrides. The root devDependency all-the-package-names moves 2.0.2559 → 2.0.2560. pnpm-lock.yaml is regenerated accordingly (including pnpm 12.4.2 → 12.4.1 in the lockfile’s package-manager metadata).

^{Reviewed by Cursor Bugbot for commit 4421041. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	all-the-package-names@​2.0.2559 ⏵ 2.0.2564	-3
	yaml@​2.9.0 ⏵ 2.9.1	+1
	@​socketregistry/​packageurl-js@​1.5.2 ⏵ 1.5.3				+3
	typebox@​1.3.30 ⏵ 1.3.31			+1
	magic-string@​1.2.3 ⏵ 1.4.1			+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	all-the-package-names@​2.0.2559 ⏵ 2.0.2564
	yaml@​2.9.0 ⏵ 2.9.1	+1			+6
	@​socketregistry/​packageurl-js@​1.5.2 ⏵ 1.5.3
	magic-string@​1.2.3 ⏵ 1.4.1			+1
	typebox@​1.3.30 ⏵ 1.3.31	+1		+1

View full report