Skip to content

deps(deps): bump the minor-and-patch group with 9 updates - #93

Merged
cjlapao merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-0a5c94390b
Oct 7, 2026
Merged

deps(deps): bump the minor-and-patch group with 9 updates#93
cjlapao merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-0a5c94390b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 9 updates:

Package From To
@amplitude/analytics-browser 2.47.0 2.47.2
@types/node 26.6.2 26.6.4
@vitest/coverage-v8 5.0.1 5.0.3
ruflo 3.45.0 3.50.0
sass-embedded 1.105.0 1.105.1
vite 8.3.1 8.3.2
vitest 5.0.1 5.0.3
@rollup/rollup-linux-x64-gnu 4.63.5 4.63.6
tsx 4.22.1 4.23.15

Updates @amplitude/analytics-browser from 2.47.0 to 2.47.2

Release notes

Sourced from @​amplitude/analytics-browser's releases.

@​amplitude/analytics-browser@​2.47.2

2.47.2 (2026-09-29)

Note: Version bump only for package @​amplitude/analytics-browser

@​amplitude/analytics-browser@​2.47.1

2.47.1 (2026-09-25)

Note: Version bump only for package @​amplitude/analytics-browser

Commits
  • 21b55e2 chore(release): publish
  • a7ca1dd feat(analytics-react-native): support Rage Clicks (#2014)
  • 981efad fix(page-url-enrichment): stop double decodeURI (#2015)
  • c13c821 feat(session-replay): share DOM privacy policy across recorders (#1997)
  • 53badc1 chore(deps): bump brace-expansion from 1.1.11 to 1.1.12 in /packages/plugin-s...
  • 4ac9677 chore(release): publish
  • 61038cf chore: load background-capture 1.1.0 from CDN and forward device mode (#2011)
  • See full diff in compare view

Updates @types/node from 26.6.2 to 26.6.4

Commits

Updates @vitest/coverage-v8 from 5.0.1 to 5.0.3

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.3

   🐞 Bug Fixes

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

... (truncated)

Commits

Updates ruflo from 3.45.0 to 3.50.0

Release notes

Sourced from ruflo's releases.

v3.50.0: ruflo as a Claude Code mod

ruflo 3.50.0: ruflo as a Claude Code mod

Install with npx ruflo@latest; @claude-flow/cli, claude-flow and ruflo are all at 3.50.0.

Claude Code mods let a plugin hook the engine directly, as in-process TypeScript functions instead of shell commands. This release brings ruflo onto that API. It is opt-in: the classic hooks stay the default and the automatic fallback, and ruflo behaves exactly as before when function hooks are off.

What's new

  • ruflo mods install | uninstall | status | doctor | sync-policy and ruflo init --mods (ADR-404, #3608). Install writes only project-scoped files (.claude/settings.local.json, .claude-flow/mods/install.json).
  • The ruflo-mods plugin:
    • Routing: in-process prompt routing, byte-identical to the classic route hook. In-process it takes 0.045 ms median versus 18.2 ms for a spawned hook.
    • tool.check: fed by ruflo policy, and it only ever tightens a verdict.
    • Also: edit learning signals, the cost budget ladder, and a status bar.
    • $.ruflo noun: segment, lastRoute and snapshot, so other mods (ruOS among them) can add to ruflo's status bar instead of drawing their own.
    • Mod trust gate: for mods loaded mid-session, including ones Claude writes. It only observes by default; refuse-risky is opt-in, and the allow-list matches the install source, not a self-declared name.
  • The ruflo-swarm pane mod 0.3.0 (#3607): a live pane with one tile per agent, which light up as agents read and write. It also shows the topology, the task and claims board, cost and tokens, the router's pick and hive-mind votes, and has buttons that act through the ruflo CLI. Claude Code subagents appear as tiles.
  • ruflo-ruos (ADR-405, #3605): run swarm agents on your own ruOS cloud desktops.
    • Transport: only the tenant-authenticated fleet MCP and the ruOS jobs API (ADR-105). The unauthenticated desktop executor port is never used.
    • Live run: a live run on a real desktop passed, and the desktop was stopped and verified afterwards.
  • ruflo-plugin-creator 0.3.0: a create-mod skill and template for scaffolding governed mods.

Requirements and caveats

  • Requires Claude Code 2.1.287 or newer, where mods are on by default. Versions 2.1.277–2.1.286 need CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1.
  • Anthropic's rollout switch must also be on for your account. ruflo mods doctor reports its state, and it flipped during development.
  • The mods API is early access and may change.

Verified

  • Registry: latest, alpha and v3alpha are 3.50.0 for all three packages.
  • Fresh install: npm i ruflo@3.50.0 gives ruflo v3.50.0; mods install, status and doctor work and write only inside the project.
  • Plugin tests: engine-kit tests pass on 2.1.287 (ruflo-mods 16/16, ruflo-swarm 38/38, ruflo-ruos 3/3), and claude plugin validate passes for all three.
  • Release integrity: the witness passes 117/117 on linux, macos and windows, and the signed helper manifest verifies.

Coordinated with the ruOS lane: @cognitum/ruos 0.3.0 ships the ruOS mod and the jobs API clients.

Gist: https://gist.github.com/ruvnet/aede145f8e730eb434e14decbb3f10a1

v3.49.0: eleven reported issues fixed (Martin Vladimirov), Nick Ruest and drakeo338 contributions

ruflo 3.49.0

Install: npx ruflo@latest (also @claude-flow/cli@3.49.0, claude-flow@3.49.0). @claude-flow/security@3.0.1 is bundled and published standalone.

This release fixes eleven issues reported by Martin Vladimirov (@​martinvlad). Each report included measurements and a reproduction, and that is what made fixing them quick. It also includes two PRs from Nick Ruest (@​nicholas-ruest) and one from @​drakeo338.

Fixes

  • #3555: helpers load in "type":"module" projects. router, session and memory now ship as .cjs, so ESM projects no longer get "Router not available" (#3583).
  • #3565: post-install helper tampering is detected and healed. An integrity re-check runs even when the version stamp matches, contributed by Nick Ruest (#3576). doctor now reports it as well (#3583).
  • #3567: hooks_route no longer reports high confidence on no match. It used to report 70% when nothing matched; it now returns 30% with matched:false / no-match-default. Whitespace-only tasks are rejected (#3581).
  • #3568: policy ledger truncation is now detectable. The ledger records its head anchor and length; this change is in @claude-flow/security 3.0.1 (#3579).
  • #3557: plugin install trust policy. Install scripts are gated (#3580).
  • #3556: ai-team discovery uses a CORS allowlist. 0.1.6 is live on team.ruv.io (#3577).

... (truncated)

Commits
  • 519709a release 3.50.0: bump train to 3.50.0
  • 35cf4a4 release 3.49.0: bump train to 3.49.0, @​claude-flow/security to 3.0.1
  • 9ce7102 docs(readme): remove flo.ruv.io and goal.ruv.io
  • 2764e49 release 3.48.0: stable internal leaves + guarded federation registration (3.4...
  • e69bc34 feat(federation): add guarded public registration and release 3.47.0
  • 32c4570 chore(release): 3.46.1
  • fe022cc chore(release): 3.46.0
  • See full diff in compare view

Updates sass-embedded from 1.105.0 to 1.105.1

Changelog

Sourced from sass-embedded's changelog.

1.105.1

  • Improve error messages for @extends across different media queries.
Commits

Updates vite from 8.3.1 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

  • build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
  • bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
  • bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
  • deps: update all non-major dependencies (#23601) (9944fa6)
  • deps: update rolldown-related dependencies (#23602) (88c1741)
  • html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
  • limit size of object and array printing via forwardConsole (#23565) (e64a587)
  • merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
  • optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
  • optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
  • pass queries to renderBuiltUrl (#23586) (744269e)
  • server: handle file watcher errors without crashing (#23503) (6894f5c)
  • server: release previous environments after initialization (#23499) (5a3a010)
  • ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
  • worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

  • avoid encoding intermediate source maps (#23461) (89574f6)
  • build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
  • only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

  • fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

Code Refactoring

Tests

  • bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)
Changelog

Sourced from vite's changelog.

8.3.2 (2026-10-01)

Bug Fixes

  • build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
  • bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
  • bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
  • deps: update all non-major dependencies (#23601) (9944fa6)
  • deps: update rolldown-related dependencies (#23602) (88c1741)
  • html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
  • limit size of object and array printing via forwardConsole (#23565) (e64a587)
  • merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
  • optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
  • optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
  • pass queries to renderBuiltUrl (#23586) (744269e)
  • server: handle file watcher errors without crashing (#23503) (6894f5c)
  • server: release previous environments after initialization (#23499) (5a3a010)
  • ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
  • worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

  • avoid encoding intermediate source maps (#23461) (89574f6)
  • build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
  • only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

  • fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

Code Refactoring

Tests

  • bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)
Commits
  • 1003321 release: v8.3.2 (#23623)
  • 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
  • 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
  • 89574f6 perf: avoid encoding intermediate source maps (#23461)
  • 5a3a010 fix(server): release previous environments after initialization (#23499)
  • 1929b4c docs: fix dead og-image PNG links in vite6/vite7 changelog entries (#23594)
  • 6894f5c fix(server): handle file watcher errors without crashing (#23503)
  • cf5c028 perf(build): avoid quadratic link scan in the preload helper (#23510)
  • bba3bb8 fix: merge build.rolldownOptions.output.minify correctly (#23536)
  • 5e4b9ca fix(optimize-deps): avoid "unsupported" warnings for browser:false mappings (...
  • Additional commits viewable in compare view

Updates vitest from 5.0.1 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

... (truncated)

Commits

Updates @rollup/rollup-linux-x64-gnu from 4.63.5 to 4.63.6

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.63.6

4.63.6

2026-10-01

Bug Fixes

  • Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.63.6

2026-10-01

Bug Fixes

  • Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

Commits

Updates tsx from 4.22.1 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

  • exclude bare builtins from namespace inheritance (38e1588)
  • expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
  • make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

  • restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

... (truncated)

Commits
  • ca66105 test: fix drive-less file URLs in ESM resolver fixtures
  • 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
  • 38e1588 fix: exclude bare builtins from namespace inheritance
  • 562c434 fix: make namespaced register() overloads portable for declaration emit
  • edfb1f0 build: upgrade pkgroll and externalize CJS loader reference...

    Description has been truncated

@dependabot
deps(deps): bump the minor-and-patch group with 9 updates
9e59edd 
Bumps the minor-and-patch group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@amplitude/analytics-browser](https://github.com/amplitude/Amplitude-TypeScript) | `2.47.0` | `2.47.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.4` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.1` | `5.0.3` |
| [ruflo](https://github.com/ruvnet/claude-flow/tree/HEAD/ruflo) | `3.45.0` | `3.50.0` |
| [sass-embedded](https://github.com/sass/embedded-host-node) | `1.105.0` | `1.105.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.1` | `8.3.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` |
| [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.63.5` | `4.63.6` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.1` | `4.23.15` |


Updates `@amplitude/analytics-browser` from 2.47.0 to 2.47.2
- [Release notes](https://github.com/amplitude/Amplitude-TypeScript/releases)
- [Commits](https://github.com/amplitude/Amplitude-TypeScript/compare/@amplitude/analytics-browser@2.47.0...@amplitude/analytics-browser@2.47.2)

Updates `@types/node` from 26.6.2 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 5.0.1 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/coverage-v8)

Updates `ruflo` from 3.45.0 to 3.50.0
- [Release notes](https://github.com/ruvnet/claude-flow/releases)
- [Changelog](https://github.com/ruvnet/ruflo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ruvnet/claude-flow/commits/v3.50.0/ruflo)

Updates `sass-embedded` from 1.105.0 to 1.105.1
- [Changelog](https://github.com/sass/embedded-host-node/blob/main/CHANGELOG.md)
- [Commits](sass/embedded-host-node@1.105.0...1.105.1)

Updates `vite` from 8.3.1 to 8.3.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.2/packages/vite)

Updates `vitest` from 5.0.1 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest)

Updates `@rollup/rollup-linux-x64-gnu` from 4.63.5 to 4.63.6
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.63.5...v4.63.6)

Updates `tsx` from 4.22.1 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.1...v4.23.15)

---
updated-dependencies:
- dependency-name: "@amplitude/analytics-browser"
  dependency-version: 2.47.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ruflo
  dependency-version: 3.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sass-embedded
  dependency-version: 1.105.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@rollup/rollup-linux-x64-gnu"
  dependency-version: 4.63.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions github-actions Bot added the triage Waiting triage label Oct 5, 2026
@cjlapao
cjlapao merged commit 0ab71f7 into main Oct 7, 2026
9 checks passed
@cjlapao
cjlapao deleted the dependabot/npm_and_yarn/minor-and-patch-0a5c94390b branch October 7, 2026 06:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cjlapao cjlapao cjlapao approved these changes
@alevlasu alevlasu Awaiting requested review from alevlasu alevlasu is a code owner
@sai-kumar-peddireddy sai-kumar-peddireddy Awaiting requested review from sai-kumar-peddireddy

Assignees

No one assigned

Labels

dependencies npm triage Waiting triage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cjlapao