[dependabot]

Bumps the development group with 5 updates in the / directory:

Package	From	To
@types/node	26.6.4	26.6.5
@vinext/cloudflare	1.1.1	1.2.0
eslint	10.12.0	10.13.0
vinext	1.2.1	1.3.0
vite	8.3.4	8.3.5

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Updates @vinext/cloudflare from 1.1.1 to 1.2.0

Release notes

Sourced from @​vinext/cloudflare's releases.

@​vinext/cloudflare@​1.2.0

Read the Vinext 1.3 release post for the highlights.

Features

• Cloudflare: support Worker Previews via vinext-cloudflare previews deploy (#3900)

Bug Fixes

• Cloudflare: return redirects from cache-facing fetches (#3242)
• Cache: batch CDN tag purges per request and log purge failures (#4074)

Contributors

• @​james-elicx
• @​JamesbbBriz
• @​ktKongTong

Changelog

Sourced from @​vinext/cloudflare's changelog.

1.2.0

Read the Vinext 1.3 release post for the highlights.

Features

• Cloudflare: support Worker Previews via vinext-cloudflare previews deploy (#3900)

Bug Fixes

• Cloudflare: return redirects from cache-facing fetches (#3242)
• Cache: batch CDN tag purges per request and log purge failures (#4074)

Contributors

• @​james-elicx
• @​JamesbbBriz
• @​ktKongTong

Commits

• 9fcbed8 chore: version packages (#4023)
• 0afb1f8 fix(cloudflare): return redirects from cache-facing fetches (#3242)
• bf23df1 feat(cloudflare): support Worker Previews via vinext-cloudflare previews depl...
• 270d42b fix(cache): batch CDN tag purges per request and log purge failures (#4074)
• See full diff in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates vinext from 1.2.1 to 1.3.0

Release notes

Sourced from vinext's releases.

vinext@1.3.0

Read the Vinext 1.3 release post for the highlights.

Features

• Build: emit hash-only client chunk and CSS file names (#3615)
• App Router: group client references by route (#3697)

Bug Fixes

App

• keep route handler auth challenges after middleware's (#4050)
• order middleware Set-Cookie before route handler cookies (#4026)
• keep route handler request.signal aborting after GC (#4022)

App Router

• write the history entry before the destination replaces the page (#4127)
• only ship route handler paths the client needs (#4109)
• stop CSS-importing pages from reading searchParams in dev (#4031)
• load the browser route manifest from its own chunk (#4116)
• read the static export deployment version from the initial page (#3802)
• read the RSC compatibility ID from the page, not the bundle (#3797)
• suspend the tree during hard navigations so redirect boundaries can't loop (#4063)
• use React 19.3's #441 message for sanitized server errors (#4049)
• keep root params in stale page regeneration (#4004)
• stop dynamic = "error" searchParams from hanging the RSC stream (#4002)

Build

• honor user client entry, chunk and asset file names (#3614)
• stop prerender servers expiring idle keep-alive sockets (#4119)
• keep the build ID out of client JS (#4101)
• cache the Server Actions key and keep build IDs out of client JS (#3784)
• list Pages routes in _buildManifest.js sortedPages (#4035)

Config

• match redirects, rewrites and headers sources with path-to-regexp (#4062)
• run config and matcher regexes as written, like Next.js (#4106)
• match i18n headers() only in their locale-prefixed form (#4088)
• substitute matched params into headers() keys and values (#4087)
• match headers() sources with path-to-regexp like Next.js (#4030)
• reject basePath: false rewrites to internal destinations (#4058)

Nitro

• keep Vite's build manifests out of the static output (#4086)
• run middleware before serving public files (#4065)

... (truncated)

Commits

• 9fcbed8 chore: version packages (#4023)
• cb07509 docs(blog): add the Vinext 1.3 release post (#4131)
• b305e99 perf(pages): keep dev Pages client asset dependency lists across loads (#4108)
• 7463c94 fix(pages-router): stop shipping Pages API route paths to the client (#4129)
• ebfbfe5 fix(hybrid): ship App route handler patterns with hashed static segments (#4128)
• 97063c7 fix(app-router): write the history entry before the destination replaces the ...
• ff47458 fix(dev-overlay): ignore window error events without an error value (#4126)
• bee0932 fix(server): fail vinext start when the port is in use (#4073)
• 6685126 fix(app-router): only ship route handler paths the client needs (#4109)
• 6501f8d test: find the next/dynamic widget stylesheet by content under hash-only CSS ...
• Additional commits viewable in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T00:38:54.217280Z	9ad28e9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.