chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-23 — run · 12 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.273
@types/node	26.5.1	26.6.1
@vitest/coverage-v8	5.0.0	5.0.1
@vitest/ui	5.0.0	5.0.1
fast-check	4.10.0	4.10.1
magic-string	1.3.1	1.4.1
rolldown-plugin-dts	0.28.4	0.28.6
typebox	1.3.30	1.3.32
untracked	1.6.5	1.6.7
vite	8.2.2	8.3.0
vitest	5.0.0	5.0.1
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-22 — run · 10 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.272
@socketregistry/packageurl-js	1.5.2	1.5.3
@socketregistry/packageurl-js-stable	npm:@socketregistry/packageurl-js@1.5.2	npm:@socketregistry/packageurl-js@1.5.3
brace-expansion	5.0.9	5.0.12
magic-string	1.3.1	1.4.1
rolldown-plugin-dts	0.28.4	0.28.5
typebox	1.3.30	1.3.31
untracked	1.6.5	1.6.7
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-21 — run · 11 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
npm-run-all2	9.0.2	9.0.3
rolldown-plugin-dts	0.28.4	0.28.5
untracked	1.6.5	1.6.7
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-20 — run · 11 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
npm-run-all2	9.0.2	9.0.3
rolldown-plugin-dts	0.28.4	0.28.5
untracked	1.6.5	1.6.7
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 11 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.269
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
npm-run-all2	9.0.2	9.0.3
rolldown-plugin-dts	0.28.4	0.28.5
untracked	1.6.5	1.6.7
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 10 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.268
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
npm-run-all2	9.0.2	9.0.3
rolldown-plugin-dts	0.28.4	0.28.5
untracked	1.6.5	1.6.7
vite	8.2.2	8.3.0

commits

• chore(deps): apply weekly update fixes

---

Note

Medium Risk
Updates verified external binaries (SFW) and a wide dev/CI dependency surface including Vite and security-pinned transitives; typical for a fleet rolling update but worth validating install and CI.

Overview
This rolling dependency refresh bumps the pnpm catalog, overrides, and lockfile together with a small Node pin and external binary updates.

Toolchain & binaries: .node-version moves to 26.8.2. In external-tools.json, Socket Firewall (sfw-free / sfw-enterprise) is updated to 1.15.2 with new per-platform sha512 integrity values and a dated soakBypass (published 2026-09-15, removable 2026-09-22). zizmor goes 1.30.0 → 1.30.1 with refreshed hashes. Several tool descriptions switch to normalized em dashes (encoding-only).

npm/pnpm deps: pnpm-workspace.yaml catalog bumps include vite 8.3.0, @anthropic-ai/claude-code, ecc-agentshield 1.6.0, magic-string, compromise, fast-check, untracked, npm-run-all2, rolldown-plugin-dts, and @mdn/browser-compat-data, with matching override pins (e.g. hono, qs, sharp, ip-address). pnpm-lock.yaml reflects the resolved tree (including the catalog-driven transitive updates).

^{Reviewed by Cursor Bugbot for commit b7bbe98. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	untracked@​1.6.5 ⏵ 1.6.7				+1
	@​vitest/​ui@​5.0.0 ⏵ 5.0.1				-1
	@​vitest/​coverage-v8@​5.0.0 ⏵ 5.0.1
	vitest@​5.0.0 ⏵ 5.0.1	+1		+1	-1
	@​types/​node@​26.6.1
	yaml@​2.9.0 ⏵ 2.9.1	+1
	fast-check@​4.10.0 ⏵ 4.10.1			+1	+2
	magic-string@​1.2.3 ⏵ 1.4.1			+1
	typebox@​1.3.30 ⏵ 1.3.32			+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​ui@​5.0.0 ⏵ 5.0.1				-1
	untracked@​1.6.5 ⏵ 1.6.7	-2			-5
	@​vitest/​coverage-v8@​5.0.0 ⏵ 5.0.1				-1
	vitest@​5.0.0 ⏵ 5.0.1	+1		+1
	@​types/​node@​26.6.1
	yaml@​2.9.0 ⏵ 2.9.1	+1			+6
	fast-check@​4.10.0 ⏵ 4.10.1			+1	+2
	magic-string@​1.2.3 ⏵ 1.4.1			+1
	typebox@​1.3.30 ⏵ 1.3.32			+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b7bbe98. Configure here.}

[cursor]

Lockfile downgrades pnpm package manager

Medium Severity

packageManagerDependencies re-resolves pnpm from 12.4.2 to 12.4.1. That drops the 12.4.2 POSIX bin-shim takeover fix and moves backward under resolutionMode: highest and trustPolicy: no-downgrade. The weekly-update table does not list this change, and both releases are still inside the 7-day soak, so this is not a soak promotion.

Additional Locations (1)

• pnpm-lock.yaml#L91-L93

 

^{Reviewed by Cursor Bugbot for commit b7bbe98. Configure here.}