[dependabot]

Bumps the npm-minor group with 8 updates in the / directory:

Package	From	To
@tauri-apps/api	2.11.1	2.12.3
@tauri-apps/plugin-notification	2.4.0	2.6.0
@tauri-apps/plugin-updater	2.11.0	2.13.3
@tauri-apps/cli	2.11.4	2.12.2
@vitejs/plugin-react	6.1.1	6.1.2
jsdom	30.0.1	30.1.2
vite	8.2.2	8.3.4
vitest	5.0.0	5.0.4

Updates @tauri-apps/api from 2.11.1 to 2.12.3

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

Bug Fixes

• 0204f6f3a (#16244) Keep delivering Channel messages after the onmessage handler throws. The error is rethrown asynchronously so it is still reported as uncaught, instead of leaving every later message queued.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m911ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.3s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 239ms
📦 @tauri-apps/api@2.12.3 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=sigstore 200 81ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.3

@​tauri-apps/api v2.12.2

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.2]

... (truncated)

Commits

• 5b23c82 apply version updates (#16243)
• 05354a8 chore(deps): update swift-rs to 1.0.9
• c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
• eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
• 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
• 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
• fd319dd chore(deps): update base64 to 0.23
• 413cbdb Apply Version Updates From Current Changes (#16213)
• 587ae48 chore: disable CODEOWNERS file (#16236)
• a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-notification from 2.4.0 to 2.6.0

Release notes

Sourced from @​tauri-apps/plugin-notification's releases.

notification-js v2.6.0

[2.6.0]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

feat

• 46381516 (#3671) Report actions on desktop: a click on a notification (tap) or on one of the actions of its action type reaches onAction and the new Rust Notification::on_action, which also works on mobile. registerActionTypes, removeActive (Linux and the BSDs) and the listener commands no longer fail with "command not found" on desktop.

  The onAction callback is now typed with the new ActionPerformed interface, which is what every platform sends, instead of Options. Callbacks annotated with Options must be updated.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-notification@2.6.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 16.6kB dist-js/index.cjs
npm notice 26.1kB dist-js/index.d.ts
npm notice 16.2kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 663B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-notification
npm notice version: 2.6.0
npm notice filename: tauri-apps-plugin-notification-2.6.0.tgz
npm notice package size: 11.1 kB
npm notice unpacked size: 64.7 kB
npm notice shasum: 68f6090e06e17a92fd1803c7b40a01e4ee20cc7c
npm notice integrity: sha512-QvpsQ6L6uSGT/[...]J3c52S+1afsIw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189634908
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-notification@2.6.0

notification v2.6.0

... (truncated)

Commits

• See full diff in compare view

Updates @tauri-apps/plugin-updater from 2.11.0 to 2.13.3

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.13.3

[2.13.3]

• 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.13.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.7kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.6kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.13.3
npm notice filename: tauri-apps-plugin-updater-2.13.3.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 25.1 kB
npm notice shasum: fcd5b571631ca48f03eea01d6d1c0a0e776dc2f4
npm notice integrity: sha512-CtbA8CZ79WJry[...]/97ZjQ33dKUgg==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189642273
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.13.3

updater v2.13.3

[2.13.3]

• 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.11.4 to 2.12.2

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.12.2

[2.12.2]

Bug Fixes

• c48e1ca89 (#16246) On iOS, mark the Swift @_cdecl entry points that Rust links against as public (in the iOS API and in the plugin templates), so release builds made with Xcode 27 keep them global and link.

Dependencies

• Upgraded to tauri-cli@2.12.2
• fd319dd43 Update base64 to 0.23.

@​tauri-apps/cli v2.12.1

[2.12.1]

Enhancements

• 64bfdd909 (#16165 by @​Legend-Master) Ignore src-tauri in tauri plugin init example template

Dependencies

• Upgraded to tauri-cli@2.12.1

@​tauri-apps/cli v2.12.0

[2.12.0]

New Features

• f6c1eb253 (#15401) Added bundle.windows.bundleVCRuntime to copy the Visual C++ runtime DLLs into Windows MSI and NSIS installers. The bundler locates the runtime through VCTOOLS_REDIST_DIR or the bundled vswhere.exe.

• f76b1d3ae (#15644) The bundler now prints the size of each generated bundle next to its path in the Finished N bundles at: output (directories such as macOS .app bundles are measured recursively).

• af465eae1 (#15619) Add a --no-binary-patching flag to tauri build and tauri bundle. When set, the bundler skips patching the main executable with bundle type information (and the subsequent re-signing), leaving an already-signed binary untouched. Patching is only required when shipping multiple bundle types per platform that should each update with their own installer format.

• 0646cc162 (#15620) Add a --fit option to tauri icon to accept non-square source images. --fit cover center-crops the source to a square (clipping the longer side) and --fit contain pads the shorter side with transparency. Non-square sources without --fit keep erroring, now with a hint pointing to the flag.

• f6c1eb253 (#15401) Added build.windows.staticVCRuntime to control MSVC static runtime linking. The STATIC_VCRUNTIME environment variable is now deprecated and emits a migration warning when used.

• f45ec0dcf Record the app version in the trusted comment of updater signatures, so a signed artifact is bound to the version it was released as.

  An update endpoint response is not signed, and the signature only covers the downloaded artifact, so the announced version on its own does not prove which release the url and signature point at. minisign covers the trusted comment with its global signature, which lets the updater plugin compare the two and reject a response that pairs a version number with a different release. Enable requireSignedVersion in the updater plugin configuration to enforce this.

  tauri build fills the version in automatically, and tauri plugin add updater now enables requireSignedVersion for the project it is adding the plugin to. tauri signer sign gains an --app-version flag for signing updater artifacts by hand, and warns when it is omitted.

Enhancements

• e19121427 (#15993) Don't always rewrite Cargo.toml file from CRLF line endings to LF

• aebf38c84 (#15694) Migrate the Android Gradle scripts from the deprecated kotlinOptions DSL to compilerOptions, which is accepted by both Kotlin Gradle Plugin 1.9.x and 2.x. This lets projects move to Kotlin 2.x without hitting the hard error that 2.3+ raises on the old DSL.

  This increased the minimum supported Gradle version to 8.13, if your gradle is on an earlier version, delete src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties and re-run tauri android init to update it.

• d89d8fa62 (#15780) Warn during Android commands (init/dev/build) when the active Java version is too new for the Gradle version the project uses (e.g. Java 27 against the Gradle 9.6.1 the template ships, or Java 25 against a project still on Gradle 8.14), instead of letting the build fail later with a cryptic error. The warning points to the Gradle/Java compatibility matrix and suggests a supported JDK.

• c3d21bd60 (#15730) Use Theme.Material3.DayNight.NoActionBar instead of Theme.MaterialComponents.DayNight.NoActionBar when running tauri android init

• f654f470c (#15862) Update template to use targetSdk = 37

• cdaf7eab6 (#15765) Clarify that the tauri init frontend commands run before tauri dev and tauri build, and can be left empty when they are not needed.

• d0f38df06 (#15997) When stdin is not a terminal, tauri init now automatically skips prompts, avoiding IO errors in CI and scripts. This eliminates the need to pass --ci explicitly in non-interactive environments.

... (truncated)

Commits

• 5b23c82 apply version updates (#16243)
• 05354a8 chore(deps): update swift-rs to 1.0.9
• c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
• eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
• 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
• 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
• fd319dd chore(deps): update base64 to 0.23
• 413cbdb Apply Version Updates From Current Changes (#16213)
• 587ae48 chore: disable CODEOWNERS file (#16236)
• a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.1.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Commits

• ac47648 release: plugin-react@6.1.2 (#1491)
• 98277e7 fix(deps): update all non-major dependencies (#1486)
• 12eddea fix(hmr): better handle compound components (#1484)
• 3cfb1d1 fix(plugin-react): fix compiler.logDiagnostics (#1483)
• 6de9915 fix(plugin-react): disable refresh for non-jsx with compiler enabled (#1485)
• ee97d2f fix(deps): update all non-major dependencies (#1445)
• b0a014d chore: use Babel 8 for babel compiler playgrounds (#1460)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• See full diff in compare view

Updates jsdom from 30.0.1 to 30.1.2

Release notes

Sourced from jsdom's releases.

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

v30.1.1

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)

... (truncated)

Commits

• a23bfb7 30.1.2
• 64a75d2 Update dependencies and dev dependencies
• 7bf9653 Invalidate styles after CSSOM and control state changes
• fe9009c Update focused area handling
• a8d28b3 Release windows retained by stylesheet parsing
• 05a2c01 Deduplicate generated CSS property metadata
• 1efa190 Reduce generated CSS property data
• a372e12 Avoid Document named-property rebuilds after irrelevant tree mutations
• b2cd235 Update css-color
• 0542d2b Release idle MutationObserver bookkeeping
• Additional commits viewable in compare view

Updates vite from 8.2.2 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Commits

• b6c20f6 release: v8.3.4 (#23702)
• b28db28 fix(server): match static aliases on path boundaries (#23643)
• bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
• fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
• 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
• 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
• facc2fb fix: remove input option unescaping for now (#23694)
• 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
• cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
• fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
• Additional commits viewable in compare view

Updates vitest from 5.0.0 to 5.0.4

Release notes

Sourced from vitest's releases.

v5.0.4

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in vitest-dev/vitest#11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in vitest-dev/vitest#11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in vitest-dev/vitest#11424

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.