chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/platform-browser-dynamic (source)	^22.0.1 → ^22.1.0
@arethetypeswrong/core>fflate (source)	0.8.2 → 0.8.3
@vitejs/devtools (source)	0.4.1 → 0.4.10
@vitejs/devtools-kit (source)	^0.4.1 → ^0.4.10
eslint (source)	>=9.0.0 → >=9.39.5
lightningcss	>=1.20.0 → >=1.33.0
nuxt (source)	4.5.0 → 4.5.1
oxc-parser (source)	>=0.98.0 → >=0.142.0
pnpm (source)	11.18.0 → 11.19.0
react (source)	>=19.2.4 → >=19.2.8
rolldown (source)	>=1.0.0 → >=1.2.1
solid-js (source)	>=1.9.0 → >=1.9.14
svelte (source)	>=5.38.0 → >=5.56.8
vite (source)	>=6.4.2 → >=6.4.3
vue (source)	>=3.5.18 → >=3.5.40
webpack	>=5.0.0 → >=5.109.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

angular/angular (@​angular/platform-browser-dynamic)

v22.1.0

Compare Source

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#​69017)

compiler

Commit	Type	Description
af5e4e1131	feat	Add an error for --global-foo cases (#​68846)
d579ecaf73	feat	Disable '--global-' error outside of g3 (#​68846)
f98547675c	feat	Namespace CSS variables to the app (#​68846)
8c8b2f7783	feat	Support css var namespacing in properties (#​68846)
292199aa4d	fix	permissive whitespace parsing in default never blocks
25c744c4d0	fix	support foreign components defined outside top-level scope
5bd00add07	fix	support foreign components inside control flow blocks (#​69674)
2e442f7876	perf	do not emit tag name when control flow root is foreign component (#​69674)

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#​68674)

core

Commit	Type	Description
124ba10ead	feat	add custom set option to linkedSignal
eab4847a8b	feat	Adds deep linking from Performance panel to DevTools
091456a214	fix	account for namespaces in host binding sanitization (#​69558)
b3748e9fe4	fix	correct container anchor collection order to match DOM layout
11b206b919	fix	introduce disposal mechanism for Angular views in foreign @content
56607967db	fix	introduce logical-only containers for foreign content
23cf1a828b	fix	sanitize host bindings on concrete hosts (#​69558)
0c07356c5c	fix	set current tnode in foreign component instruction on reuse

forms

Commit	Type	Description
bbbd357bd2	fix	add utility to assert that value is a field tree

http

Commit	Type	Description
e3630c23c5	feat	add options to allow caching of credentialed and non-cacheable HTTP requests
ec16a3d6c6	fix	enable xsrf for root-provided HttpClient
39e362eea5	fix	match header values exactly when deleting
be46ca8696	fix	preserve immutability of materialized clones
c0cbd46bd7	fix	skip transfer cache for fetch credentialed requests (#​69017)
af04e266cc	refactor	deprecate jsonp support

language-service

Commit	Type	Description
7f0265e43a	feat	compile non-exported classes if standalone (#​68454)
4f9c824dd9	feat	Typecheck templates which would require inline typecheck blocks (#​68454)
a99fb915c0	fix	account for strictTemplates being enabled by default

migrations

Commit	Type	Description
c75ff0255c	feat	add migration from injectable to service
5d5b2ea72d	fix	correctly detect then/else keywords in control flow migration

platform-server

Commit	Type	Description
cf9d7fa0f8	fix	harden platform location origin validation during SSR (#​69184)

router

Commit	Type	Description
97a3fd6a55	feat	handle null and undefined inputs in RouterLinkActive

v22.0.8

Compare Source

common

Commit	Type	Description
c0368f2278	fix	preserve crossorigin on image preloads

core

Commit	Type	Description
8616ba9db6	fix	ensure SVG animation attributeName is checked case-insensitively

forms

Commit	Type	Description
d302c7ab83	fix	ensure pending status propagates to the root form in signal forms

http

Commit	Type	Description
9d40f8aefe	fix	prevent transfer cache key collisions

migrations

Commit	Type	Description
388daea2fc	fix	correctly migrate ngClass with mixed space-separated keys
bb39cda648	fix	preserve NgClass import on partial migration

v22.0.7

Compare Source

common

Commit	Type	Description
91e33aa1de	fix	avoid prototype lookups in date format caches

compiler

Commit	Type	Description
5b516e3a58	fix	parsing of an empty template literal interpolation

compiler-cli

Commit	Type	Description
c88ddde1c9	fix	re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit	Type	Description
94d9591b51	fix	allow static attributes for explicit input transforms
c89f71a74c	fix	ignore processing instruction syntax in templates
70500e4067	fix	preserve explicit input transform write type

forms

Commit	Type	Description
1b9964675f	fix	allow multiple async validators
64d6d47a0c	fix	preserve intermediate number values in signal forms
6cf7446afa	fix	prevent stale CVA writeback during debounce

http

Commit	Type	Description
20b7dc3023	fix	prevent interceptor signal reads from leaking into calling reactive contexts

localize

Commit	Type	Description
22d5a091d1	fix	build runtime translations map with a null prototype
8ce1fcf7fa	fix	use Object.hasOwn for placeholder lookup in translate

platform-browser

Commit	Type	Description
b34bf0dce8	fix	prevent ReDoS in SOURCEMAP_URL_REGEXP

v22.0.6

Compare Source

compiler

Commit	Type	Description
fd4ddcafed	fix	use regular optional chaining expression for safe function calls in TCBs

compiler-cli

Commit	Type	Description
534fe81a89	fix	apply debugName transform to required signal queries
3b08201bfb	fix	detect uninvoked signals in bound expressions using ternary

forms/signals

Commit	Type	Description
171669f7b2	fix	make extractValue reactive for compat AbstractControl values

migrations

Commit	Type	Description
0a6af1496b	fix	preserve transitive NgModule references when pruning
d4a926a762	fix	remove stale model import in model-output migration

router

Commit	Type	Description
c238bd2ad7	fix	handle outlet named proto in segment group maps
8e6d7f7190	fix	use safe hasOwnProperty when parsing query params

v22.0.5

Compare Source

common

Commit	Type	Description
eb8fb9fe58	fix	use Object.hasOwn in I18nSelectPipe to handle null-prototype and shadowed mappings

compiler-cli

Commit	Type	Description
baf09a9939	fix	include toSignal in debugName transform

core

Commit	Type	Description
e598dc843f	fix	improve input writes migration in best effort mode
ced0180b06	fix	reject dynamic script host elements

router

Commit	Type	Description
ca13b42e7c	fix	fix malformed jsdoc comment for RouterLinkWithHref export

v22.0.4

Compare Source

migrations

Commit	Type	Description
fd37f09f37	fix	resolve migration failure when tsconfig specifies rootDir

v22.0.3

Compare Source

compiler

Commit	Type	Description
f90c20df40	fix	account for NgModule dependencies in JIT-compiled partial declarations
f4f7f3755c	fix	remove unused import breaking CI in 22.0.x

compiler-cli

Commit	Type	Description
06d854929c	fix	report diagnostic instead of crashing on malformed host binding

core

Commit	Type	Description
2799304259	fix	avoid uncaught promise errors in injectAsync prefetching

http

Commit	Type	Description
8cdc202dfc	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
b4a5a2fb4e	fix	preserve referrer in asset requests
a16f9b2263	fix	preserve referrer policy in asset requests

upgrade

Commit	Type	Description
bcc648f4b6	fix	support model() signals in downgradeComponent

v22.0.2

Compare Source

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#​69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#​69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

101arrowz/fflate (@​arethetypeswrong/core>fflate)

v0.8.3

Compare Source

• Fix buffer over-read for Zip64 extra fields
• Support sync flushes (Z_SYNC_FLUSH in zlib)
  • Allows for immediate decompression of all pushed bytes
  • Enables DEFLATE stream concatenation
• Fix zip/zipSync when using cross-realm Uint8Array
• Improve Zip64 support for streamed or undersized archives
• Update performance estimates in README
• Fix typings for TypeScript v5.7+
• Reduce memory consumption after compression stream completion

vitejs/devtools (@​vitejs/devtools)

v0.4.10

Compare Source

   🚀 Features

• core: Type the remaining json-render catalog components' props  -  by @​dvcolomban in #​493 (341bc)
• oxc: Oxlint config inspector  -  by @​yuyinws in #​485 (04abd)
• playground: Mount official @​devframes/plugin-* dashboards  -  by @​antfubot, opencode and @​antfu in #​483 (06668)

   🐞 Bug Fixes

• core:
  • Render single overflow dock entry inline instead of behind overflow button  -  by @​antfubot in #​486 (b5b1d)
  • Add vite server fallback for embedded connections  -  by @​webfansplz in #​494 (969d4)
• ui:
  • Remove custom web fonts usage to reduce package size  -  by @​antfu (10f99)

    View changes on GitHub

v0.4.9

Compare Source

   🚀 Features

• core:
  • Allow configuring extra allowed origins for the DevTools WS transport  -  by @​dvcolomban in #​471 (f9087)
  • Opt-in variant/interactive on json-render Card & Stack, fix dock scrollbar in dark mode  -  by @​dvcolomban in #​477 (c279e)

   🐞 Bug Fixes

• core:
  • Scroll selected command palette item into view inside shad…  -  by @​SaKaNa-Y in #​474 (9ab86)
  • Hide stale panes when switching docks in popup mode  -  by @​SaKaNa-Y in #​475 (073ff)
  • Land a subTabs anchor on its live member tab, not the hidden anchor  -  by @​antfubot in #​473 (5d668)
  • Align grouped iframe address bar with sidebar  -  by @​webfansplz in #​482 (95c9f)
  • Prevent popup dock icons from being dimmed  -  by @​SaKaNa-Y in #​481 (4dfbe)
  • Command palette dark-on-dark text + glass-panel mismatch  -  by @​dvcolomban in #​478 (8becc)
• oxc:
  • Tolerate stdout notices ahead of oxlint's JSON payload  -  by @​dvcolomban in #​476 (c9504)
• ui:
  • Prevent dark mode from mutating host document  -  by @​SaKaNa-Y in #​480 (2ee70)

    View changes on GitHub

v0.4.8

Compare Source

   🚀 Features

• core: Add passive mode for the injected overlay  -  by @​antfubot in #​465 (c1440)

   🐞 Bug Fixes

• core: Keep a group's defaultChildId reachable regardless of visibility, respecting when  -  by @​antfubot in #​472 (a93cf)

    View changes on GitHub

v0.4.7

Compare Source

   🚀 Features

• core: Support render-only visibility on dock entries  -  by @​antfubot in #​470 (f4fd7)

    View changes on GitHub

v0.4.6

Compare Source

   🚀 Features

• core:
  • Fold group side nav overflow into a height-based show-more  -  by @​antfubot in #​467 (08127)
  • Re-bucket pinned docks into a dedicated ~pinned category  -  by @​antfubot in #​466 (7ccd6)
  • Allow a group entry to override its in-group sub-category order  -  by @​antfubot in #​468 (69bed)

    View changes on GitHub

v0.4.5

Compare Source

   🚀 Features

• core: Shared-iframe soft navigation (devframe 0.7.11)  -  by @​antfubot in #​464 (5cb6e)

   🐞 Bug Fixes

• kit: Disable devframe auth prompt fallback  -  by @​antfu in #​463 (0e9be)

    View changes on GitHub

v0.4.4

Compare Source

   🚀 Features

• core: Treat a grouped dock entry's category as an in-group sub-category  -  by @​antfubot and @​antfu in #​462 (17213)
• oxc: Open lint results in pages  -  by @​yuyinws in #​460 (dcd9e)
• vite: Add cache for rpc functions  -  by @​webfansplz in #​458 (c2898)

   🐞 Bug Fixes

• core: Clamp popovers to viewport  -  by @​webfansplz in #​461 (02128)

    View changes on GitHub

v0.4.3

Compare Source

   🚀 Features

• Upgrade devframe to v0.7.6  -  by @​antfu (572e0)
• Add pnpm run play playground picker  -  by @​antfubot in #​453 (14f51)
• Move viteplus group to framework category  -  by @​antfu (ff8d8)
• kit:
  • Let launchers offer selectable launch roots  -  by @​antfubot in #​448 (6dd78)
  • Revert serve launchers to launcher mode when their process exits  -  by @​antfubot in #​451 (f22f1)
  • Track install launcher progress in a terminal session  -  by @​antfubot in #​457 (77db1)
  • Adopt @​devframes/json-render (devframe v0.7.9)  -  by @​antfubot in #​454 (89b16)
• oxc:
  • Vite-plus detection  -  by @​yuyinws in #​449 (03e71)
• rolldown:
  • Add "Run build with devtools" button  -  by @​antfubot in #​431 (0b4a1)
  • Rework landing page with session panel, filtering and actions  -  by @​antfubot and @​antfu in #​452 (dff26)

    View changes on GitHub

v0.4.2

[Compare Source](https://redirect.git

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

📦 Bundle Size

✅ No notable changes

All bundles (14)

Bundle	Gzipped	Brotli	Raw
Core
Client (Minimal)	5.4 kB	4.9 kB	13.6 kB	✅
Client (Full)	9.6 kB	8.7 kB	25.1 kB	✅
Client (Self-Contained)	5.7 kB	5.1 kB	14.3 kB	✅
Server (Minimal)	4.9 kB	4.4 kB	12.3 kB	✅
Server (Self-Contained)	5.2 kB	4.7 kB	13 kB	✅
Vue
Vue Client (Minimal)	5.9 kB	5.3 kB	14.6 kB	✅
Vue Client (Full)	10.6 kB	9.7 kB	27.9 kB	✅
Vue Server (Minimal)	5.4 kB	4.9 kB	13.4 kB	✅
React
React Client (Minimal)	5.8 kB	5.3 kB	14.7 kB	✅
React Client (Full)	10.7 kB	9.7 kB	28.3 kB	✅
React Server (Minimal)	5.2 kB	4.7 kB	13 kB	✅
Schema.org
Schema.org (Minimal)	11.7 kB	10.5 kB	34.2 kB	✅
Schema.org Imports	0.1 kB	0.1 kB	0.1 kB	✅
Schema.org Vue Meta	0.5 kB	0.4 kB	1 kB	✅

---

📦 Runtime Dependencies

✅ No runtime dependency changes

All packages (10)

Package	External deps	Install size	Largest dependency	Skipped optional
@unhead/angular	10	773.6 kB	@jridgewell/trace-mapping 146.7 kB	0
@unhead/bundler	10	786.9 kB	@jridgewell/trace-mapping 146.7 kB	0
@unhead/cli	18	4.4 MB	@oxc-parser/binding-linux-arm64-gnu 2 MB	19
@unhead/eslint-plugin	9	683.2 kB	@jridgewell/trace-mapping 146.7 kB	0
@unhead/react	11	810.7 kB	@jridgewell/trace-mapping 146.7 kB	0
@unhead/schema-org	9	683.2 kB	@jridgewell/trace-mapping 146.7 kB	0
@unhead/solid-js	11	810.7 kB	@jridgewell/trace-mapping 146.7 kB	0
@unhead/svelte	11	810.7 kB	@jridgewell/trace-mapping 146.7 kB	0
@unhead/vue	11	810.7 kB	@jridgewell/trace-mapping 146.7 kB	0
unhead	9	683.2 kB	@jridgewell/trace-mapping 146.7 kB	0

Skipped optional dependencies (19)

• @unhead/cli: oxc-parser -> @oxc-parser/binding-android-arm-eabi, oxc-parser -> @oxc-parser/binding-android-arm64, oxc-parser -> @oxc-parser/binding-darwin-arm64, oxc-parser -> @oxc-parser/binding-darwin-x64, oxc-parser -> @oxc-parser/binding-freebsd-x64, oxc-parser -> @oxc-parser/binding-linux-arm-gnueabihf, oxc-parser -> @oxc-parser/binding-linux-arm-musleabihf, oxc-parser -> @oxc-parser/binding-linux-arm64-musl, oxc-parser -> @oxc-parser/binding-linux-ppc64-gnu, oxc-parser -> @oxc-parser/binding-linux-riscv64-gnu, oxc-parser -> @oxc-parser/binding-linux-riscv64-musl, oxc-parser -> @oxc-parser/binding-linux-s390x-gnu, oxc-parser -> @oxc-parser/binding-linux-x64-gnu, oxc-parser -> @oxc-parser/binding-linux-x64-musl, oxc-parser -> @oxc-parser/binding-openharmony-arm64, oxc-parser -> @oxc-parser/binding-wasm32-wasi, oxc-parser -> @oxc-parser/binding-win32-arm64-msvc, oxc-parser -> @oxc-parser/binding-win32-ia32-msvc, oxc-parser -> @oxc-parser/binding-win32-x64-msvc

_{Production dependencies only. Peer dependencies and Unhead workspace packages are excluded. Skipped optional dependencies are unavailable on the CI platform.}

---

⚡ Performance (directional)

✅ No significant change (within CI noise)

All benchmarks (25)

Benchmark	PR	Δ	RME
SSR render (CPU)	0.363 ms	~ noise	±9.6%
SSR render (wall)	0.263 ms	~ noise	±4.8%
SSR allocated / render	243.5 KiB	~ noise	±4.9%
Schema.org cached render (CPU)	0.366 ms	~ noise	±6.6%
Schema.org cached render (wall)	0.260 ms	~ noise	±2.9%
Schema.org cached allocated / render	138.2 KiB	~ noise	±2.5%
Streaming wrapStream drain (CPU)	0.244 ms	~ noise	±5.2%
Streaming wrapStream drain (wall)	0.146 ms	~ noise	±4.4%
Streaming allocated / drain	149.4 KiB	~ noise	±0.4%
Streaming suspense chunk (CPU)	0.012 ms	~ noise	±5.5%
Streaming allocated / suspense chunk	5.1 KiB	~ noise	±0.2%
CSR DOM mutations / nav	38	~ noise	—
CSR re-render (CPU)	0.845 ms	~ noise	±5.1%
CSR re-render (wall)	0.474 ms	~ noise	±2.7%
Bundler: transformInclude mixed ids	0.385 ms	~ noise	±0.4%
Bundler: useSeoMetaTransform static calls	3.627 ms	~ noise	±4.0%
Bundler: minifyTransform inline script/style	0.521 ms	~ noise	±3.1%
Bundler: treeshakeServerComposables many calls	2.635 ms	~ noise	±6.7%
Bundler: treeshakeServerComposables skip unrelated code	0.002 ms	~ noise	±0.9%
Bundler: ssrStaticReplace many head.ssr reads	1.642 ms	~ noise	±6.4%
Bundler: ssrStaticReplace skip unrelated code	0.002 ms	~ noise	±1.2%
Bundler: createHeadTransform many createHead calls	0.582 ms	~ noise	±5.0%
Bundler: react streaming skip JSX without head calls	0.003 ms	~ noise	±1.3%
Bundler: react streaming transform JSX with head calls	1.575 ms	~ noise	±6.7%
Bundler: solid streaming skip JSX without head calls	0.003 ms	~ noise	±1.1%

_{Baseline: main @ 8a44f1a · 2026-08-03 · gzipped is the headline size metric · perf is directional (shared-runner, gated)}