[dependabot]

Bumps the all-minor-and-patch group with 64 updates in the / directory:

Package	From	To
knip	6.39.0	6.41.0
turbo	2.11.7	2.11.9
posthog-node	5.55.0	5.56.2
@types/node	26.6.4	26.6.5
rolldown	1.2.12	1.2.14
vitest	5.0.3	5.0.5
@base-ui/react	1.8.0	1.9.0
@fontsource/inter	5.2.8	5.3.0
@modelcontextprotocol/sdk	1.32.0	1.32.1
@scalar/api-reference-react	0.9.77	0.9.81
@tabler/icons-react	3.48.0	3.49.0
@takumi-rs/core	2.14.0	2.16.3
@tanstack/react-query	5.104.1	5.104.3
@tanstack/react-query-devtools	5.104.1	5.104.3
@tanstack/react-router	1.170.41	1.170.45
@tanstack/react-start	1.168.60	1.169.3
@tanstack/react-virtual	3.14.13	3.14.21
auth0	7.3.0	7.5.0
drizzle-orm	0.45.3	0.45.4
html2canvas-pro	2.5.1	2.5.2
lucide-react	1.51.0	1.58.0
pg-boss	12.36.0	12.38.0
posthog-js	1.435.8	1.438.12
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
uuid	14.0.2	14.0.3
zod	4.6.5	4.6.7
@storybook/addon-vitest	10.6.1	10.6.2
@storybook/react	10.6.1	10.6.2
@storybook/react-vite	10.6.1	10.6.2
@vitejs/plugin-react	6.1.1	6.1.2
@vitest/browser-playwright	5.0.3	5.0.5
@vitest/coverage-v8	5.0.3	5.0.5
playwright	1.63.0	1.64.1
storybook	10.6.1	10.6.2
vite	8.3.2	8.3.4
@sentry/node	11.4.0	11.8.0
@mux/mux-player-react	3.13.4	3.14.0
fumadocs-core	16.16.0	16.17.5
fumadocs-mdx	15.4.6	15.4.7
fumadocs-openapi	12.2.0	12.5.2
fumadocs-ui	16.16.0	16.17.5
@vercel/blob	2.8.0	2.8.2
tar-stream	3.2.0	3.2.2
@redocly/cli	2.57.0	2.64.1
@better-auth/stripe	1.7.7	1.7.10
better-auth	1.7.7	1.7.10
resend	6.32.0	6.34.1
@ai-sdk/anthropic	4.0.71	4.0.82
@ai-sdk/openai	4.0.83	4.0.96
@anthropic-ai/sdk	0.131.0	0.135.0
@better-auth/api-key	1.7.7	1.7.10
@better-auth/cimd	1.7.7	1.7.10
@better-auth/core	1.7.7	1.7.10
@better-auth/mcp	1.7.7	1.7.10
@better-auth/oauth-provider	1.7.7	1.7.10
@better-auth/sso	1.7.7	1.7.10
ai	7.0.127	7.0.143
dataforseo-client	2.1.8	2.1.9
auth	1.7.7	1.7.10
@takumi-rs/helpers	2.14.0	2.16.3
react-hook-form	7.89.0	7.90.0
@playwright/test	1.63.0	1.64.1
@usebruno/cli	4.2.0	4.2.1

Updates knip from 6.39.0 to 6.41.0

Release notes

Sourced from knip's releases.

Release 6.41.0

• Add Flue plugin (#2124) (c52737d45ff008d6d96d4c2d4182048a2aa64602) - thanks @​LuisFigueroaG!
• Match all React Native config file extensions (#2125) (898fdffb37ae0bdb3d2653038eb10c2e01edf983) - thanks @​LuisFigueroaG!
• Consolidate fixture guidance and extend plugin guidelines (37a4ca04645f71f599e9b530676543f9893bd641)
• Add AI contribution policy (b15f0fbb090ea0427240880da2bec602c11cea50)
• Use files from tsconfig references with --use-tsconfig-files (#2126) (9618185eafb0c5cb365035f89e9d66718642338a) - thanks @​kaanisthatyou!
• Compile gitignore walk patterns once (resolve #2127) (09c80299779fa5abe133ee8f82051c25870007b8)
• Drop readdir order dependent case from gitignore walk test (ab3da8ff95a05a0fbfba6873b64559017d038aa7)
• fix: recognize binaries from absent optional dependencies (#2120) (d908556eaa98bf9637a2744d2de089bab31b8dbc) - thanks @​DreamLongYT!
• Apply a directory's .gitignore before walking its subdirectories (9560c07862d4c72dc956371b9a77e049d83ed4a9)
• Apply nested .gitignore files to workspace globs (23d35421dd67c405254f2f8bcbc09b18d224e338)
• Update gitignore matcher and walk notes (499f85f4544457dc7c51c4a7612fea69773ef3dd)
• Keep the cwd out of glob patterns and matchers (#2107) (1e82fb807c88cc46951f2028214569f9a2eb0061) - thanks @​kaanisthatyou!
• Support function configs in Rsbuild plugin (#2122) (38071db87e9023e5dd61173ce32f9020a1a5d7ff) - thanks @​bytedoe!
• Separate Expo Router plugin; remove expo-router entry points from Expo plugin (#2128) (ad541764ca7d3c062236661677d1d66d5275122f) - thanks @​jjjjonathan!
• Link Expo config discovery source and fold expo6 fixture into expo-router (2ddeca50956790b10580e835df50bc980cce961d)
• Update dependencies (c9f79148f7165314a7b3c801eff926d1d0d6b060)
• Migrate shell script parsing to unbash v5 (4942cca05303410120a007a5bb23b0c2da725da1)
• Handle updated Formatly result types (ca9e8315e003dae69646f7500fa98ab9ed403b92)
• Preserve TypeScript 5.0 compatibility in shell AST filters (957ac7bbd654f6d3d0c4dc4eab2f4aa133ff0b4b)
• Point timerify crashes to the Node.js version that fixes them (0c235de096fd3361eb918d1290241fa32a62f089)
• Copy importer identifier sets into the reverse index (2860d678a87dddb5ad56299119fb6e108ceffa12)
• Clear the resolver cache at the start of a run (10b5bb82ecd03c88b68ace58a7aea23d188cc5f1)

Release 6.40.0

• Resolve local and scope-only extends in commitlint plugin (#2079) (e667552d4e7122094565d3ad9ae407acfc0ac684) - thanks @​giaBaoJS!
• Clarify worktree guides and plugin review preparation (dd02baf020d23af1d47c44c1a726a61014b270bd)
• Document stale cache results and workarounds (#2078) (3573749a5d5bbee6305f207cc7d1b72c200c8c9b)
• Exclude test files from package entries in production mode (resolve #2082) (b86f45f9d38d4b83baad98e43983e08910e00c78) - thanks @​jonathanong!
• Resolve Serverless file variables in plugins and functions (resolve #2074) (99cac789694ea8d76cd38184d2d7c95f34315224) - thanks @​SwastikTripathi!
• Preserve locally referenced namespace members (resolve #2070) (f0f36df766cd74ad7ae03fbf8940bdeb792439be) - thanks @​MFA-G!
• fix: add the commitlint-plugin prefix to Commitlint plugin names (#2096) (3decd35ff0a4220c7cd2c9142dc69c89794b3927) - thanks @​devYRPauli!
• fix: match .mjs config files in the simple-git-hooks plugin (#2097) (79a87d92396c2444ae4ef3c780c0d2e18cd73e4c) - thanks @​devYRPauli!
• fix: match capacitor.config.js in the Capacitor plugin (#2098) (4a5ec96d818117a7f2eafa027e3b707bc97573a8) - thanks @​devYRPauli!
• fix(typescript): ArrayExpression (#2099) (#2100) (87fea9f201c2fd864eafa31bdad68910a8a177ba) - thanks @​DreamLongYT!
• Preserve development entry pattern groups (7c229f4e1918075d801ed3b046fa022b1d3bcc41)
• Resolve null package exports to the files they hide (resolve #2084, close #2085) (5bd46260feb60b957c2631bc72375ef192e441e0)
• Pin InvokeAI ecosystem test (4e0a3432eb35e3f628f6d3b7fcd14b942de343d0)
• fix(utils): add jsx extension to source mapping (#2087) (eaa353b5fc30c2f12cdf2c29e6dd68e0d0950062) - thanks @​DreamLongYT!
• fix(serverless-framework): handle explicit extensions in handler paths (#2091) (e9393965be7563640921e3f20c946fcb9132e1cb) - thanks @​DreamLongYT!
• Annotate published manifest return type (d95a8310a0d0dca8f23d8dd3f83e7b0a1909d038)
• Add Jasmine plugin (#2105) (9ed14911d5c5752aef36878ab3d515c35d1ac6bc) - thanks @​SulimanAbdulrazzaq!
• fix: resolve workspace exports with fallback arrays (#2088) (49c2aaeaba4544f25cc02c19d5da5152a8ef68c3) - thanks @​DreamLongYT!
• fix(postcss): ignore disabled plugins in object configs (#2092) (b84fdf8a8ee676ee45f4313009ebfe969d034a88) - thanks @​DreamLongYT!
• Resolve webServer commands in Playwright plugin (#2110) (1af96bce36b0d0d07791de100c7f2ea5672a478c) - thanks @​everton-dgn!
• Cache config file inputs per plugin (#2109) (01cb43267ca5dc03a2cbcba0a19fd891d4ed1f37) - thanks @​everton-dgn!
• fix: include custom compiler extensions in source path mapping (#2090) (dc3a47e2d810808314454b8f5c23070f136d15d3) - thanks @​DreamLongYT!
• Don't let a self-closing swallow the next (#2113) (989fdadde0a068d1d1c52e26a8327b99c5de0668) - thanks @​maniflopi!
• fix(oxlint): resolve lint from loaded Vite config (#2108) (6d44e532ed6320cdf4f4c3253b26e155c4d26ba7) - thanks @​everton-dgn!
• fix: resolve Jest module names without the jest-* prefix (#2095) (a5f4cfbff7f263a0ea8d5461a3f9216cbef38602) - thanks @​devYRPauli!

... (truncated)

Commits

• 13d7f21 Release knip@6.41.0
• 10b5bb8 Clear the resolver cache at the start of a run
• 2860d67 Copy importer identifier sets into the reverse index
• 0c235de Point timerify crashes to the Node.js version that fixes them
• 957ac7b Preserve TypeScript 5.0 compatibility in shell AST filters
• ca9e831 Handle updated Formatly result types
• 4942cca Migrate shell script parsing to unbash v5
• c9f7914 Update dependencies
• 2ddeca5 Link Expo config discovery source and fold expo6 fixture into expo-router
• ad54176 Separate Expo Router plugin; remove expo-router entry points from Expo plugin...
• Additional commits viewable in compare view

Updates turbo from 2.11.7 to 2.11.9

Release notes

Sourced from turbo's releases.

Turborepo v2.11.9

What's Changed

Changelog

• chore: Release Turborepo 2.11.8 by @​github-actions[bot] in vercel/turborepo#14789
• perf: Prefetch Cargo metadata during lazy graph construction by @​anthonyshew in vercel/turborepo#14497
• perf: Compute Berry lockfile closures once across workspaces by @​anthonyshew in vercel/turborepo#14499
• perf: Check cache hit outputs in place instead of on the blocking pool by @​anthonyshew in vercel/turborepo#14524
• perf: Speed up Berry lockfile loading by @​anthonyshew in vercel/turborepo#14500
• perf: Parse bun.lock without building a JSON syntax tree by @​anthonyshew in vercel/turborepo#14502
• perf: Skip the dry run cache batch window when there is no remote cache by @​anthonyshew in vercel/turborepo#14505
• perf: Emit lockfile closures pre-sorted and cheapen closure interning by @​anthonyshew in vercel/turborepo#14525
• perf: Reuse configuration derived from turbo.json between the shim and the CLI by @​anthonyshew in vercel/turborepo#14521
• feat: Report locked tools-only setup plans by @​anthonyshew in vercel/turborepo#14483
• perf: Compute Bun lockfile closures once across workspaces by @​anthonyshew in vercel/turborepo#14501
• perf: Reuse open parent directories when restoring cache archives by @​anthonyshew in vercel/turborepo#14506
• perf: Skip dropping the run right before turbo run exits by @​anthonyshew in vercel/turborepo#14507
• perf: Match literal input exclusions without compiling globs by @​anthonyshew in vercel/turborepo#14510
• perf: Copy pruned package files in parallel by @​anthonyshew in vercel/turborepo#14512
• feat: Report proposed first-lock and refresh setup plans by @​anthonyshew in vercel/turborepo#14571
• perf: Compress large cache archives with multithreaded zstd by @​anthonyshew in vercel/turborepo#14698
• perf: Read tracked file stats from directory listings on Windows by @​anthonyshew in vercel/turborepo#14633
• perf: Diff changed lockfile resolutions with a merge instead of ordered sets by @​anthonyshew in vercel/turborepo#14630
• perf: Write dry run text output through one buffered stdout handle by @​anthonyshew in vercel/turborepo#14625
• perf: Parse pnpm-workspace.yaml once per command by @​anthonyshew in vercel/turborepo#14620
• perf: Write each file trace error to stderr in a single call by @​anthonyshew in vercel/turborepo#14618
• perf: Reuse glob validation results when re-validating turbo.json in the language server by @​anthonyshew in vercel/turborepo#14615
• perf: Keep git subprocesses off the critical path of dry runs by @​anthonyshew in vercel/turborepo#14610
• perf: Classify watch file changes when they arrive instead of on a 100ms poll by @​anthonyshew in vercel/turborepo#14600
• perf: Buffer TUI raw-output spool writes by @​anthonyshew in vercel/turborepo#14597
• perf: Add the turbo query version key without re-parsing the response by @​anthonyshew in vercel/turborepo#14592
• perf: Replay cached task logs in whole-line chunks by @​anthonyshew in vercel/turborepo#14590
• perf: Write each boundaries diagnostic to stderr in a single call by @​anthonyshew in vercel/turborepo#14587
• perf: Walk leading-globstar input trees in parallel without wax by @​anthonyshew in vercel/turborepo#14511
• perf: Reuse open parent directories when writing cache archives by @​anthonyshew in vercel/turborepo#14513
• perf: Index Bun lockfile subgraph lookups instead of rescanning all packages by @​anthonyshew in vercel/turborepo#14514
• perf: Render the pruned lockfile while package files are copied by @​anthonyshew in vercel/turborepo#14515
• feat: Resolve exact native npm lock cohorts by @​anthonyshew in vercel/turborepo#14484
• perf: Batch prefixed task output into one write per chunk by @​anthonyshew in vercel/turborepo#14588
• perf: Share one allocation per external package identity by @​anthonyshew in vercel/turborepo#14528
• perf: Remove quadratic package-name scan from microfrontends discovery by @​anthonyshew in vercel/turborepo#14527
• perf: Render file trace errors on several threads by @​anthonyshew in vercel/turborepo#14623
• perf: Check boundaries packages in parallel again by @​anthonyshew in vercel/turborepo#14598
• perf: Read PTY child output in 8 KiB chunks by @​anthonyshew in vercel/turborepo#14594
• perf: Load each package's tsconfig once when checking boundaries by @​anthonyshew in vercel/turborepo#14589
• perf: Skip the file watcher round trip when checking outputs for new task hashes by @​anthonyshew in vercel/turborepo#14626
• perf: Refresh only memory stats in turbo info by @​anthonyshew in vercel/turborepo#14593
• perf: Walk and record prune copy plans in parallel by @​anthonyshew in vercel/turborepo#14522
• feat: Reconcile sealed clone-local setup selections by @​anthonyshew in vercel/turborepo#14485

... (truncated)

Commits

• 64d5e48 publish 2.11.9 to registry
• 78b039e fix(cache): Parallelize dry-run HEAD fallback (#14801)
• 6834819 docs: Use .NET in the multi-language guide (#14793)
• 679efb8 refactor: Remove setup lifecycle script controls (#14818)
• 9c90852 fix: Allow native package manager configuration during setup (#14816)
• a3bcc4a chore: Release Turborepo 2.11.9-canary.1 (#14817)
• 9328416 fix: Stop installing the Unix shell hook automatically (#14813)
• 74c9fbc fix: Attribute Cargo.lock changes to the crates whose dependencies changed (#...
• a3ef52a chore: Update with-changesets example (#14638)
• f05411f perf: Skip newline normalization copies for already-normalized TUI output (#1...
• Additional commits viewable in compare view

Updates posthog-node from 5.55.0 to 5.56.2

Release notes

Sourced from posthog-node's releases.

posthog-node@5.56.2

5.56.2

Patch Changes

• #5263 cd31356 Thanks @​dustinbyrne! - Allow local feature flag evaluation from a shared definition cache without a secret or personal API key. (2026-10-16)

posthog-node@5.56.1

5.56.1

Patch Changes

• #5289 e6598be Thanks @​pauldambra! - Link captured exceptions to active OpenTelemetry traces when the API is available. (2026-10-14)

posthog-node@5.56.0

5.56.0

Minor Changes

• #5291 7c10169 Thanks @​DanielVisca! - Attach trace exemplars to metrics recorded inside sampled spans. (2026-10-13)

Patch Changes

• Updated dependencies [7c10169]:
  • @​posthog/core@​1.59.0

posthog-node@5.55.3

5.55.3

Patch Changes

• #5281 8f2d581 Thanks @​marandaneto! - Fix before_send callback types to accept non-null events while still allowing null returns to drop events. (2026-10-12)
• Updated dependencies [8f2d581]:
  • @​posthog/core@​1.58.1

posthog-node@5.55.2

5.55.2

Patch Changes

• #5268 74d7eb2 Thanks @​marandaneto! - Clarify which server-only credentials to use for local evaluation when a project API key is supplied instead. (2026-10-11)

posthog-node@5.55.1

5.55.1

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.56.2

Patch Changes

• #5263 cd31356 Thanks @​dustinbyrne! - Allow local feature flag evaluation from a shared definition cache without a secret or personal API key. (2026-10-16)

5.56.1

Patch Changes

• #5289 e6598be Thanks @​pauldambra! - Link captured exceptions to active OpenTelemetry traces when the API is available. (2026-10-14)

5.56.0

Minor Changes

• #5291 7c10169 Thanks @​DanielVisca! - Attach trace exemplars to metrics recorded inside sampled spans. (2026-10-13)

Patch Changes

• Updated dependencies [7c10169]:
  • @​posthog/core@​1.59.0

5.55.3

Patch Changes

• #5281 8f2d581 Thanks @​marandaneto! - Fix before_send callback types to accept non-null events while still allowing null returns to drop events. (2026-10-12)
• Updated dependencies [8f2d581]:
  • @​posthog/core@​1.58.1

5.55.2

Patch Changes

• #5268 74d7eb2 Thanks @​marandaneto! - Clarify which server-only credentials to use for local evaluation when a project API key is supplied instead. (2026-10-11)

5.55.1

Patch Changes

• #5134 175413f Thanks @​posthog! - Evict only the least recently used distinct ids from the $feature_flag_called dedupe cache instead of clearing it entirely. distinctIdHasSentFlagCalls now returns a snapshot, so writing or deleting individual keys on it no longer changes deduplication. (2026-10-08)

Commits

• 3ddaa65 chore: update versions and lockfile [version bump]
• cd31356 fix(flags): load shared definitions without a secret key (#5263)
• 9a196f9 chore: update versions and lockfile [version bump]
• e6598be feat(node): link captured exceptions to active OpenTelemetry spans (#5289)
• ab585bc chore: update versions and lockfile [version bump]
• 7c10169 feat(metrics): attach trace exemplars to flushed metric series (#5291)
• 635149f chore: update versions and lockfile [version bump]
• 8f2d581 fix: make before_send callback inputs non-null (#5281)
• d1b00d0 test(node): wait for local evaluation instead of a fixed delay (#5274)
• 4f590b3 chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Updates rolldown from 1.2.12 to 1.2.14

Release notes

Sourced from rolldown's releases.

v1.2.14

[1.2.14] - 2026-10-14

🚀 Features

• add output.charset option (#11194) by @​sapphi-red
• code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

• handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red
• tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev
• sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red
• strict-execution-order: account for init imports during code splitting (#11162) by @​hyfdev
• strict-execution-order: avoid eager loading through mixed re-exports (#11151) by @​hyfdev
• tree-shake expression statements that coerce known constants (#10825) by @​IWANABETHATGUY
• shim-missing-exports: shim deep namespace reads through default imports (#11184) by @​IWANABETHATGUY
• shim-missing-exports: shim missing static namespace members (#11179) by @​hyfdev
• preserve-entry-signatures: keep internal bindings out of entry exports (#11094) by @​hyfdev
• report ASSIGN_TO_IMPORT for writes to re-exported namespace members (#11148) by @​IWANABETHATGUY
• dev: keep files loaded by the HMR stage watched when the same task rebuilds (#11154) by @​Brooooooklyn
• dev: watch lazily compiled files even when a build starts first (#11152) by @​Brooooooklyn
• cjs: print a CommonJS module's top-level this as a wrapper parameter rolldown names (#11135) by @​IWANABETHATGUY
• renamer: keep fixed names off the bindings that would capture them (#11134) by @​IWANABETHATGUY
• renamer: keep an external require() local in a CJS module off the top-level names (#11133) by @​IWANABETHATGUY
• rolldown: make a repeated close() a no-op (#11142) by @​Brooooooklyn
• avoid renaming entry top-level bindings onto their nested bindings (#11122) by @​IWANABETHATGUY
• renamer: keep generated top-level names off inner bindings (#11121) by @​IWANABETHATGUY

🚜 Refactor

• renamer: treat a CJS-wrapped module's root scope as an inner scope (#11130) by @​IWANABETHATGUY

📚 Documentation

• add renaming design and implementation docs (#11131) by @​IWANABETHATGUY

⚡ Performance

• ci: overlap independent setup, checks, and artifacts (#11169) by @​hyfdev

🧪 Testing

• dev: use dunce::canonicalize so dev engine tests pass on Windows (#11192) by @​shulaoda
• preserve-entry-signatures: cover nested dynamic imports (#11164) by @​hyfdev

⚙️ Miscellaneous Tasks

• deps: upgrade oxc to 0.154.0 (#11209) by @​shulaoda
• make Security Analysis pass again (security-action v1.0.10, serde_yaml -> saphyr) (#11197) by @​Brooooooklyn

... (truncated)

Changelog

Sourced from rolldown's changelog.

[1.2.14] - 2026-10-14

🚀 Features

• add output.charset option (#11194) by @​sapphi-red
• code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

• handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red
• tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev
• sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red
• strict-execution-order: account for init imports during code splitting (#11162) by @​hyfdev
• strict-execution-order: avoid eager loading through mixed re-exports (#11151) by @​hyfdev
• tree-shake expression statements that coerce known constants (#10825) by @​IWANABETHATGUY
• shim-missing-exports: shim deep namespace reads through default imports (#11184) by @​IWANABETHATGUY
• shim-missing-exports: shim missing static namespace members (#11179) by @​hyfdev
• preserve-entry-signatures: keep internal bindings out of entry exports (#11094) by @​hyfdev
• report ASSIGN_TO_IMPORT for writes to re-exported namespace members (#11148) by @​IWANABETHATGUY
• dev: keep files loaded by the HMR stage watched when the same task rebuilds (#11154) by @​Brooooooklyn
• dev: watch lazily compiled files even when a build starts first (#11152) by @​Brooooooklyn
• cjs: print a CommonJS module's top-level this as a wrapper parameter rolldown names (#11135) by @​IWANABETHATGUY
• renamer: keep fixed names off the bindings that would capture them (#11134) by @​IWANABETHATGUY
• renamer: keep an external require() local in a CJS module off the top-level names (#11133) by @​IWANABETHATGUY
• rolldown: make a repeated close() a no-op (#11142) by @​Brooooooklyn
• avoid renaming entry top-level bindings onto their nested bindings (#11122) by @​IWANABETHATGUY
• renamer: keep generated top-level names off inner bindings (#11121) by @​IWANABETHATGUY

🚜 Refactor

• renamer: treat a CJS-wrapped module's root scope as an inner scope (#11130) by @​IWANABETHATGUY

📚 Documentation

• add renaming design and implementation docs (#11131) by @​IWANABETHATGUY

⚡ Performance

• ci: overlap independent setup, checks, and artifacts (#11169) by @​hyfdev

🧪 Testing

• dev: use dunce::canonicalize so dev engine tests pass on Windows (#11192) by @​shulaoda
• preserve-entry-signatures: cover nested dynamic imports (#11164) by @​hyfdev

⚙️ Miscellaneous Tasks

• deps: upgrade oxc to 0.154.0 (#11209) by @​shulaoda
• make Security Analysis pass again (security-action v1.0.10, serde_yaml -> saphyr) (#11197) by @​Brooooooklyn
• deps: update rollup submodule for tests to v4.64.5 (#11190) by @​rolldown-guard[bot]

... (truncated)

Commits

• c9a8cda release: v1.2.14 (#11210)
• 970ad1f fix: handle output.charset: 'ascii' + output.minify: false (#11207)
• dd2f65f feat: add output.charset option (#11194)
• e148823 feat(code-splitting): route independent ESM re-exports per consumer (#11177)
• 0c1de40 fix(strict-execution-order): account for init imports during code splitting (...
• f71e200 fix(shim-missing-exports): shim missing static namespace members (#11179)
• 5900698 fix(preserve-entry-signatures): keep internal bindings out of entry exports (...
• 59f88f8 fix(rolldown): make a repeated close() a no-op (#11142)
• f7de35f release: v1.2.13 (#11144)
• 4229721 chore(deps): upgrade oxc to 0.153.0 (#11109)
• Additional commits viewable in compare view

Updates vitest from 5.0.3 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-d...

    Description has been truncated