build(deps-dev): bump the javascript-development group across 1 directory with 23 updates

[dependabot]

Bumps the javascript-development group with 23 updates in the / directory:

Package	From	To
@cloudflare/vite-plugin	1.51.1	1.62.5
@cloudflare/workers-types	5.20260808.1	5.20261006.1
@types/node	24.13.3	26.6.4
@vitejs/plugin-react	6.0.5	6.1.2
@vitejs/plugin-rsc	0.5.34	0.5.35
@vitest/coverage-v8	4.1.10	5.0.3
eslint	9.39.4	10.12.0
eslint-config-next	16.3.0	16.3.8
js-yaml	5.2.3	5.4.3
lucide-react	1.30.0	1.52.0
monaco-editor	0.56.0	0.57.0
next	16.3.0	16.3.8
playwright	1.62.1	1.63.0
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
react-server-dom-webpack	19.2.8	19.3.0
rollup	4.62.4	4.64.0
vinext	1.0.0-beta.5	1.0.1
vite	8.2.1	8.3.3
vitest	4.1.10	5.0.3
wrangler	4.120.0	4.147.0

Updates @cloudflare/vite-plugin from 1.51.1 to 1.62.5

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.62.5

Patch Changes

• Updated dependencies [7f700ef, 90e6a1b, 7f57b1c, 6a4b0fe]:
  • wrangler@4.147.0
  • miniflare@5.20261001.0-alpha

@​cloudflare/vite-plugin@​1.62.4

Patch Changes

• Updated dependencies [b8e7cc3, b00ef4f, 9d7b08e, 464a582, aee2842, efd67e6]:
  • wrangler@4.146.0
  • miniflare@5.20261001.0-alpha

@​cloudflare/vite-plugin@​1.62.3

Patch Changes

• Updated dependencies [b9f1cdc, ddaa558, 8468487, a0712e5, a0712e5]:
  • miniflare@5.20260930.0-alpha
  • wrangler@4.145.0

@​cloudflare/vite-plugin@​1.62.2

Patch Changes

• Updated dependencies [91a3606, 2a15ae2]:
  • wrangler@4.144.0
  • miniflare@5.20260926.1-alpha

@​cloudflare/vite-plugin@​1.62.1

Patch Changes

• #15938 62fd03a Thanks @​dieub! - Resolve the affected Undici dependency in new Wrangler and Vite plugin installs

  Undici 7.29.1 fixes GHSA-3wwx-pv8p-q78v. Update the shared dependency catalog and matching types used by Miniflare and Wrangler so downstream installs can resolve the patched runtime without an application-level override. A published release is still required for consumers; this changeset does not alter already published package metadata.

• Updated dependencies [7bb6eae, 60ccdbd, 62fd03a, 06ed9c8, 86211fe, c2bb4c8, eb1efe0, 485cfb3]:

  • wrangler@4.143.1
  • miniflare@5.20260926.1-alpha

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.62.5

Patch Changes

• Updated dependencies [7f700ef, 90e6a1b, 7f57b1c, 6a4b0fe]:
  • wrangler@4.147.0
  • miniflare@5.20261001.0-alpha

1.62.4

Patch Changes

• Updated dependencies [b8e7cc3, b00ef4f, 9d7b08e, 464a582, aee2842, efd67e6]:
  • wrangler@4.146.0
  • miniflare@5.20261001.0-alpha

1.62.3

Patch Changes

• Updated dependencies [b9f1cdc, ddaa558, 8468487, a0712e5, a0712e5]:
  • miniflare@5.20260930.0-alpha
  • wrangler@4.145.0

1.62.2

Patch Changes

• Updated dependencies [91a3606, 2a15ae2]:
  • wrangler@4.144.0
  • miniflare@5.20260926.1-alpha

1.62.1

Patch Changes

• #15938 62fd03a Thanks @​dieub! - Resolve the affected Undici dependency in new Wrangler and Vite plugin installs

  Undici 7.29.1 fixes GHSA-3wwx-pv8p-q78v. Update the shared dependency catalog and matching types used by Miniflare and Wrangler so downstream installs can resolve the patched runtime without an application-level override. A published release is still required for consumers; this changeset does not alter already published package metadata.

• Updated dependencies [7bb6eae, 60ccdbd, 62fd03a, 06ed9c8, 86211fe, c2bb4c8, eb1efe0, 485cfb3]:

  • wrangler@4.143.1
  • miniflare@5.20260926.1-alpha

1.62.0

Minor Changes

• #15914 7f0734c Thanks @​jamesopstad! - Use cf/config for cloudflare.config.ts authoring

... (truncated)

Commits

• 64c1337 Version Packages (#15996)
• b4954c1 Version Packages (#15983)
• 89061a4 Version Packages (#15957)
• 4ee367c Version Packages (#15949)
• d866c09 Version Packages (#15929)
• 3bdcd0d Version Packages (#15909)
• 7f0734c Use cf/config for cloudflare.config.ts authoring (#15914)
• e7915c1 [vite-plugin] Keep dependency optimizer hash stable on first restart (#15878)
• f96458c Version Packages (#15882)
• 4c2993b Emit new Worker config for same-worker Workflows (#15856)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260808.1 to 5.20261006.1

Commits

• See full diff in compare view

Updates @types/node from 24.13.3 to 26.6.4

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.5 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits

• ac47648 release: plugin-react@6.1.2 (#1491)
• 98277e7 fix(deps): update all non-major dependencies (#1486)
• 12eddea fix(hmr): better handle compound components (#1484)
• 3cfb1d1 fix(plugin-react): fix compiler.logDiagnostics (#1483)
• 6de9915 fix(plugin-react): disable refresh for non-jsx with compiler enabled (#1485)
• ee97d2f fix(deps): update all non-major dependencies (#1445)
• b0a014d chore: use Babel 8 for babel compiler playgrounds (#1460)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• 04cac50 release: plugin-react@6.1.1 (#1440)
• Additional commits viewable in compare view

Updates @vitejs/plugin-rsc from 0.5.34 to 0.5.35

Release notes

Sourced from @​vitejs/plugin-rsc's releases.

plugin-rsc@0.5.35

Features

• plugin-rsc: expose Node.js stream APIs (#1276) (32105d5)

Bug Fixes

• deps: update all non-major dependencies (#1375) (9ab698e)
• deps: update all non-major dependencies (#1427) (fb2d6f3)
• deps: update all non-major dependencies (#1433) (61006e6)
• deps: update all non-major dependencies (#1442) (55895a4)
• deps: update dependency magic-string to v1 (#1443) (c9eba3e)
• deps: update dependency strip-literal to v4 (#1457) (9657ea1)
• deps: update react-related dependencies (#1452) (61b650f)

Miscellaneous Chores

• deps: update dependency @​types/react-dom to ^19.2.5 (#1432) (e7c2b6d)
• deps: update dependency @​types/react-dom to ^19.2.7 (#1444) (f135533)
• deps: update tsdown to v0.23 (#1451) (736efe2)

Code Refactoring

• rsc: replace utils package (#1454) (389897e)

Tests

• rsc: copy use cache/server mixed directive handling to examples/use-cache-persistent (#1417) (523e45b)

Changelog

Sourced from @​vitejs/plugin-rsc's changelog.

0.5.35 (2026-09-16)

Features

• plugin-rsc: expose Node.js stream APIs (#1276) (32105d5)

Bug Fixes

• deps: update all non-major dependencies (#1375) (9ab698e)
• deps: update all non-major dependencies (#1427) (fb2d6f3)
• deps: update all non-major dependencies (#1433) (61006e6)
• deps: update all non-major dependencies (#1442) (55895a4)
• deps: update dependency magic-string to v1 (#1443) (c9eba3e)
• deps: update dependency strip-literal to v4 (#1457) (9657ea1)
• deps: update react-related dependencies (#1452) (61b650f)

Miscellaneous Chores

• deps: update dependency @​types/react-dom to ^19.2.5 (#1432) (e7c2b6d)
• deps: update dependency @​types/react-dom to ^19.2.7 (#1444) (f135533)
• deps: update tsdown to v0.23 (#1451) (736efe2)

Code Refactoring

• rsc: replace utils package (#1454) (389897e)

Tests

• rsc: copy use cache/server mixed directive handling to examples/use-cache-persistent (#1417) (523e45b)

Commits

• a309c8b release: plugin-rsc@0.5.35 (#1459)
• 9657ea1 fix(deps): update dependency strip-literal to v4 (#1457)
• 389897e refactor(rsc): replace utils package (#1454)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• f135533 chore(deps): update dependency @​types/react-dom to ^19.2.7 (#1444)
• c9eba3e fix(deps): update dependency magic-string to v1 (#1443)
• 55895a4 fix(deps): update all non-major dependencies (#1442)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e7c2b6d chore(deps): update dependency @​types/react-dom to ^19.2.5 (#1432)
• Additional commits viewable in compare view

Updates @vitest/coverage-v8 from 4.1.10 to 5.0.3

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in vitest-dev/vitest#11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in vitest-dev/vitest#11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in vitest-dev/vitest#11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in vitest-dev/vitest#11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in vitest-dev/vitest#11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in vitest-dev/vitest#11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

• 33cadea chore: release v5.0.3 (#11409)
• a029e76 chore: migrate to oxc (#11367)
• 428e2e5 chore: release v5.0.2 (#11357)
• 03630a5 chore: release v5.0.1 (#11275)
• f441c6f chore: release v5.0.0 (#11130)
• c4473e4 fix(coverage): prevent crash on /@fs/ prepended virtual files (#11119)
• 897f51f chore: release v5.0.0-rc.4 (#11107)
• 7db80dc chore: release v5.0.0-rc.3 (#11089)
• 5f6a5e8 feat(coverage): switch to @vitest/istanbuljs packages (#11053)
• c6174a6 fix(coverage): v8 to ignore Vite SSR's generated import bindings (#11023)
• Additional commits viewable in compare view

Updates eslint from 9.39.4 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits

• a438ec3 10.12.0
• 32a73f1 Build: changelog update for 10.12.0
• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
• 152067f chore: update ecosystem plugins (#21362)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
• 67eb586 docs: Update README
• bfaea12 perf: cache normalized config globals per languageOptions (#21364)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
• d166567 chore: update dependency prettier to v3.9.9 (#21371)
• Additional commits viewable in compare view

Updates eslint-config-next from 16.3.0 to 16.3.8

Release notes

Sourced from eslint-config-next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persiste...

  Description has been truncated