[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/core (source)	8.0.7 → 8.0.9
npm-run-all2	9.0.3 → 9.0.4
vite (source)	8.3.4 → 8.3.5

---

Release Notes

babel/babel (@​babel/core)

v8.0.9

Compare Source

v8.0.9 (2026-10-23)

This release contains no changes. It is needed only to update the repo (which is based on @babel/core's last release) in Node.js's CITGM.

bcomnes/npm-run-all2 (npm-run-all2)

v9.0.4

Compare Source

Merged

• fix: honor explicit nodeRun options and clarify Node API docs #255
• Upgrade: Bump typescript from 6.0.3 to 7.0.2 #240
• fix: avoid retaining argument placeholder regex state #258
• fix: bump shell-quote to ^1.12.0- #​260 #261
• Upgrade: Bump neostandard from 0.13.0 to 0.14.1 #259
• docs: fix default argument placeholder syntax #254
• Group TypeScript Dependabot updates #263
• Upgrade: Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 #262
• Upgrade: Bump @​voxpelli/tsconfig from 16.2.1 to 17.0.0 #256
• Upgrade: Bump codecov/codecov-action from 7.0.0 to 7.1.1 #252
• Upgrade: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 #250
• Upgrade: Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 #248
• Upgrade: Bump installed-check from 10.0.1 to 11.0.0 #246
• Upgrade: Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 #245

Commits

• Add Zed and Codex worktree setup 9f54ec7
• Rename agent instructions to AGENTS.md b06eac4

vitejs/vite (vite)

v8.3.5

Compare Source

Bug Fixes

• build: handle missing chunk import maps (#​23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#​23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#​23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#​23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#​23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#​23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#​23741) (11fe1e4)
• bundled-dev: normalize served output files (#​23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#​23839) (7471e8c)
• css: don't fail on a literal % in url() (#​23676) (50b382d)
• deps: update all non-major dependencies (#​23731) (cf80aa5)
• deps: update all non-major dependencies (#​23826) (77d8373)
• deps: update rolldown-related dependencies (#​23733) (43f0d05)
• deps: update rolldown-related dependencies (#​23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#​23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#​23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#​23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#​23761) (a7d5696)
• resolve: support subpath imports with multiple # (#​23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#​23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#​23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#​23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#​23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#​23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#​23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#​23828) (df7b40e)
• dev: separate import resolution from URL conversion (#​23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#​23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#​23815) (a162990)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 01:00 AM and 07:59 AM, only on Monday (* 1-7 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Bundle Report

Changes will decrease total bundle size by 1 bytes (-0.0%) ⬇️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
contribkit-esm	128.19kB	-1 bytes (-0.0%) ⬇️

Affected Assets, Files, and Routes:

view changes for bundle: contribkit-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
chunks/types-*.mjs	-1 bytes	76.17kB	-0.0%

Files in chunks/types-*.mjs:

• ./package.json → Total Size: 69 bytes

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (e599de5) to head (fa77e6f).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@      Coverage Diff      @@
##   master   #170   +/-   ##
=============================
=============================

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e599de5...fa77e6f. Read the comment docs.