chore(deps): consolidate Dependabot bumps + re-vendor diff CSS

[baanish]

Summary

Consolidates the open Dependabot bumps into one CI-clean PR. (The Dependabot PRs show red only because the claude-review check can't run on them — Dependabot PRs don't receive repo secrets — even though their build + test pass.) Stacked on #69.

Bumps

• @git-diff-view/react ^0.1.1 → ^0.1.5 — re-vendored public/vendor/diff-view-pure.css + .br to keep the deferred stylesheet in sync (pinned by tests/diff-style-asset.test.ts).
• @playwright/test ^1.58.2 → ^1.61.0
• vitest ^4.0.18 → ^4.1.9 — no config change needed: on regular vite 7 the existing esbuild JSX config still applies. The 4.1.5 rolldown/oxc parse failure that broke chore(deps-dev): bump vitest from 4.0.18 to 4.1.5 #64 does not reproduce on 4.1.9.

Deliberately held

• @types/node: kept at ^22. It should track the supported runtime (engines: node >=20.10); bumping to 25 types Node-25 APIs that don't exist there and broke the Buffer typings in tests. Revisit when the runtime floor moves.
• @codemirror/search: already removed by Optimize fragment rendering and homepage link generation #67, so its bump is moot.

Supersedes #62, #63, #64, #65, #66.

Verification

npm run check green — lint + 216 tests + bench + typecheck + build + budgets (rich-diff deferred JS 323.9 / 340 KiB).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2fec1595-d51e-44d7-bf37-6bda9a1569d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/dependabot-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.0.18 ⏵ 4.1.9		+75	+1	+1
	@​types/​node@​22.19.15 ⏵ 22.19.21	+1		+1
	@​git-diff-view/​react@​0.1.1 ⏵ 0.1.5	+1		+1	-1
	@​playwright/​test@​1.58.2 ⏵ 1.61.0

View full report

[cloudflare-workers-and-pages]

Deploying agent-render with    Cloudflare Pages

Latest commit:	6fa4157
Status:	✅  Deploy successful!
Preview URL:	https://0e787ee8.agent-render.pages.dev
Branch Preview URL:	https://codex-dependabot-deps.agent-render.pages.dev

View logs

[greptile-apps]

Greptile Summary

This PR consolidates several open Dependabot bumps into a single CI-clean commit, and re-vendors the @git-diff-view/react deferred stylesheet to match the upgraded package version.

• @git-diff-view/react ^0.1.1 → ^0.1.5: CSS vendor files (diff-view-pure.css + .br) are re-generated from the new package; the diff adds !container responsive overrides, a display: flow-root rule for extend/widget wrappers, and a full multi-select / line-range-selection style block. tests/diff-style-asset.test.ts enforces exact byte-for-byte sync between the vendored copies and the package source, so any future drift is caught automatically.
• @playwright/test ^1.58.2 → ^1.61.0 and vitest ^4.0.18 → ^4.1.9: test-toolchain upgrades; the PR explains why vitest 4.1.5 (rolldown/oxc parse failure) was skipped in favour of 4.1.9.
• @types/node ^22.13.10 → ^22.19.21: patch-level bump within the ^22 range; deliberately held at ^22 to stay aligned with the engines: node >=20.10 runtime floor.

Confidence Score: 5/5

Safe to merge — all changes are version bumps and a matching CSS re-vendor with automated sync tests already guarding the assets.

Every changed file is either a manifest/lock update or a re-vendored static asset. The re-vendored CSS is byte-for-byte validated against the package source by the existing test suite, the deliberate version holds are clearly documented, and the PR description confirms the full npm run check suite (lint + 216 tests + typecheck + build + budgets) is green.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Bumps @git-diff-view/react ^0.1.1→^0.1.5, @playwright/test ^1.58.2→^1.61.0, vitest ^4.0.18→^4.1.9, and @types/node ^22.13.10→^22.19.21. Deliberate holds for @types/node major and @codemirror/search are explained in the PR.
package-lock.json	Lock file updated to reflect resolved package versions; transitive dependency reactivity-store bumped from ^0.3.12 to ^0.4.0 (driven by @git-diff-view/react 0.1.5's own dependency upgrade).
public/vendor/diff-view-pure.css	Re-vendored from @git-diff-view/react 0.1.5; additions include !container responsive overrides, flow-root display rule, and multi-select/drag-selection styles. tests/diff-style-asset.test.ts enforces exact byte-for-byte sync with the package copy.
public/vendor/diff-view-pure.css.br	Brotli-compressed counterpart of diff-view-pure.css regenerated to match the updated plain asset; the sync test decompresses and compares both files byte-for-byte.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["npm install\n@git-diff-view/react@0.1.5"] --> B["node_modules/@git-diff-view/react\n/styles/diff-view-pure.css"]
    A --> C["npm run assets:compress"]
    C --> D["public/vendor/diff-view-pure.css\n(re-vendored plain copy)"]
    C --> E["public/vendor/diff-view-pure.css.br\n(Brotli-compressed copy)"]
    D --> F["tests/diff-style-asset.test.ts"]
    E --> F
    B --> F
    F -- "expect(public) === expect(package)" --> G["✅ Test passes – assets in sync"]
    D --> H["DiffRenderer\n(deferred stylesheet load)"]
    E --> H

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["npm install\n@git-diff-view/react@0.1.5"] --> B["node_modules/@git-diff-view/react\n/styles/diff-view-pure.css"]
    A --> C["npm run assets:compress"]
    C --> D["public/vendor/diff-view-pure.css\n(re-vendored plain copy)"]
    C --> E["public/vendor/diff-view-pure.css.br\n(Brotli-compressed copy)"]
    D --> F["tests/diff-style-asset.test.ts"]
    E --> F
    B --> F
    F -- "expect(public) === expect(package)" --> G["✅ Test passes – assets in sync"]
    D --> H["DiffRenderer\n(deferred stylesheet load)"]
    E --> H

Loading

_{Reviews (3): Last reviewed commit: "chore(deps): bump @git-diff-view/react, ..." | Re-trigger Greptile}