[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@rsbuild/core (source)	^2.2.12 → ^2.2.13
react (source)	^19.3.0 → ^19.3.1
react-dom (source)	^19.3.0 → ^19.3.1
tdesign-vue-next (source)	^1.20.9 → ^1.20.10
vike	0.4.267 → 0.4.268
vue (source)	^3.5.43 → ^3.5.44

---

Release Notes

web-infra-dev/rsbuild (@​rsbuild/core)

v2.2.13

Compare Source

What's Changed

New Features 🎉

• feat(core): add internal Host validation helper by @​chenjiahan in #​8661
• feat(core): export jiti subpath by @​chenjiahan in #​8662
• feat(core): add opt-in dev server Host validation by @​chenjiahan in #​8663
• feat(core): validate preview server request hosts by @​chenjiahan in #​8666
• feat(deps): update @​rspack/core to 2.2.9 by @​chenjiahan in #​8667

Performance 🚀

• perf(core): bound file size compression across environments by @​chenjiahan in #​8656
• perf(core): avoid asset descriptor lookups in file size reporting by @​chenjiahan in #​8657
• perf(core): reuse source buffers for file size reporting by @​chenjiahan in #​8658
• perf(core): skip file labels when size details are disabled by @​chenjiahan in #​8659

Bug Fixes 🐞

• fix(core): calculate file sizes during emit by @​LingyuCoder in #​8650
• fix(core): manage proxy WebSocket upgrades explicitly by @​chenjiahan in #​8660

Document 📖

• docs: fix preconnect link attribute example by @​chenjiahan in #​8637
• docs: fix Module Federation configuration examples by @​chenjiahan in #​8638
• docs: improve page descriptions for discovery by @​chenjiahan in #​8636
• docs: remove outdated Babel React Compiler example links by @​chenjiahan in #​8664
• docs: document server.allowedHosts by @​chenjiahan in #​8665

Other Changes

• chore(deps): update swc monorepo to v17 by @​renovate in #​8633
• chore(deps): update dependency preact to v11 by @​renovate in #​8632
• chore(docs): prepare website for type-aware linting by @​chenjiahan in #​8639
• chore(test): prepare core tests for type-aware linting by @​chenjiahan in #​8640
• chore(test): prepare plugin tests for type-aware linting by @​chenjiahan in #​8641
• chore(lint): scope typed linting for templates and fixtures by @​chenjiahan in #​8642
• chore(deps): upgrade rstack to 0.8.3 by @​chenjiahan in #​8644
• chore(lint): enable automatic TypeScript project discovery by @​chenjiahan in #​8643
• chore(lint): enable import/no-named-as-default by @​chenjiahan in #​8645
• chore(lint): enable import/named and await-thenable by @​chenjiahan in #​8646
• chore(lint): enable no-unsafe-member-access by @​chenjiahan in #​8647
• chore(deps): update all patch dependencies by @​renovate in #​8651
• chore(types): clarify core assignment boundaries by @​chenjiahan in #​8648
• chore(test): type dynamically loaded e2e fixtures by @​chenjiahan in #​8649
• chore(deps): update dependency octane to ^0.13.0 by @​renovate in #​8653
• release: v2.2.13 by @​chenjiahan in #​8668

Full Changelog: web-infra-dev/rsbuild@v2.2.12...v2.2.13

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

Tencent/tdesign-vue-next (tdesign-vue-next)

v1.20.10

Compare Source

🐞 Bug Fixes

• Cascader: 修复数字值不存在于 options 时展开面板产生 placeholder 类型警告的问题 @​Blackn-L (#​6993)
• Dialog: 修复启用 confirmOnEnter 时 Textarea 内换行触发对话框确认的问题 @​lifuyue (#​6991)
• Form: 修复 1.20.8 版本后引入的 Form 样式缺陷 @​uyarn (#​7005)
• InputNumber: 修复空输入失焦后未恢复父级保留值的问题，使 Slider 数字输入正确回显当前数值，接受空值的输入框继续保持为空 @​dvd233 (#​6995)
• Table: 修复 scrollToElement 方法不支持零值行标识及虚拟滚动定位偏移的问题 @​Blackn-L (#​6994)
• Tree:
  • 修复存在禁用的子节点时，父节点全选在展示异常的问题 @​RSS1102 (#​6999)
  • 修复存在禁用的子节点且 valueMode 为 all 时，返回值没有包含父节点的问题 @​RSS1102 (#​6999)
• TreeSelect: 修复 all 模式移除标签后值与树勾选状态不同步的问题 @​dvd233 (#​6998)

📝 Documentation

• Comment: 修正 avatar 属性的类型描述，移除不受支持的 AvatarProps 类型 @​liweijie0812 (#​7008)

vikejs/vike (vike)

v0.4.268

Compare Source

October 15, 2026

Bug Fixes

• +redirects with a Base URL (#​3615) (68a5edf)
• vike:server (deprecate vike:server-entry) (#​3581) (3fcdce2)
• a +server that awaits the global context at its top level no longer waits for itself (#​3589) (bc2b00b)
• always pass the public pageContext object to users (#​3543) (1f85b01)
• always use client router to render the error page (#​3600) (526cf99)
• an onRenderHtml() that returns a plain string renders the page (instead of 500) (#​3616) (9ad2b9a)
• check each environment's build input for HTML entries (#​3561) (255c953)
• deprecate vike/fetch (closes #​3608) (#​3609) (f0e65a6)
• don't add a trailing slash to URLs with a file extension (#​3560) (69fb85b)
• don't hang $ vike dev when +serverEntry.js handles SIGINT/SIGTERM (#​3618) (053cd1f)
• don't hang vike dev when a +vite plugin has cyclic objects (#​3548) (3bf584b)
• don't hang createDevMiddleware() when Vike's config recovers before the dev server exists (cd8c110)
• don't mistake other plugins' virtual modules for Vike page entries (#​3545) (f29653b)
• don't reject Vite CLI options (#​3544) (0e4a284)
• don't set Vike's entry file names on other server environments (#​3559) (b060148)
• don't share the temporary transpiled +config file between processes on the same root (4689368)
• don't wrap +server.js twice (#​3617) (8ba6ee8)
• exit when the terminal is closed instead of looping on write EIO (fix #​3577) (#​3579) (feffb0f)
• getReadableWebStream() converts a Node.js stream (#​3601) (cb5c756)
• improve handling when a static asset fails to load (#​3598) (ef5704e)
• name build.assetsDir in its empty-string error (#​3562) (732a6e5)
• pass public pageContext to +headersResponse and +csp.nonce (fix #​3535) (#​3536) (b005535)
• pre-render after all Vite environments are built (#​3564) (b2c0d52)
• preserve cookies on redirects and client-side navigation (#​3552) (033cb69)
• propagate stream cancellation (#​3556) (24ac6b5)
• remove slow crawling warning (59dcb35)
• remove the dev FOUC buster of virtual CSS (#​3605) (4f18d20)
• require Vite 7.1 or above (#​3565) (5fb3117)
• scope a +middleware with a path and an order to that path (Universal Middleware 0.6) (#​3583) (e3b43bd)
• support Vite's builder.sharedConfigBuild: true (#​3546) (774e3ca)
• update @​universal-middleware, @​universal-deploy, @​vikejs/*, vite-plugin-vercel and convert-route (rou3 1.x route syntax) (#​3580) (1a069a7)

Features

• +serverEntry (#​3582) (1e61bbe)
• +serverEntry at dev (#​3584) (8911cd3)
• pageContext.content for non-HTML pages (closes #​1525) (#​3551) (8ebbd09)
• enable Vike extensions to install middlewares (closes #​3407) (#​3594) (e667e7c)
• streamed pageContext values (d467deb)
• Vike Environment API (#​3550) (7884d91)
• globalContext.devMiddleware (#​3592) (5d09444)

Performance Improvements

• clean catchInfiniteLoop() trackers periodically (#​3576) (5676e14)

MINOR BREAKING CHANGES

[!NOTE]
We recommend ignoring MINOR BREAKING CHANGES unless this version breaks your app, see Vike Versioning.

• The path of universal middlewares set via +middleware now follows the rou3 1.x syntax, aligned with URLPattern: * matches the rest of the path including / (use :name to match a single segment).
• Update Vite 7.1 or above
• pageContext.pageProps.is404 removed, use pageContext.is404 instead

_{Automatically synced from CHANGELOG.md}

vuejs/core (vue)

v3.5.44

Compare Source

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #​11164) (#​15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#​15724) (d084b90), closes #​15723
• compiler-dom: correctly stringify 0 and false in v-html (#​15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#​15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#​15604) (38012a5), closes #​15602
• custom-element: skip mounting an async custom element removed while its component loads (#​15777) (0f8e7b4), closes #​15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#​15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#​15711) (92798ac), closes #​15710
• reactivity: avoid mutating native array iterators (#​15703) (7f9d45d), closes #​15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#​15782) (db00fe9), closes #​5009
• reactivity: once watcher should stop when its callback throws (#​15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#​15793) (b600466), closes #​15792
• runtime-core: detect new prop keys when comparing full props (#​15634) (702fa61), closes #​15632
• runtime-core: keep async placeholder for block patching and pending component updates (#​15554) (05ec25f), closes #​15551
• runtime-core: only flush jobs queued by the root render itself (#​15757) (0bea14b), closes #​6728
• runtime-core: render nothing for an invalid v-for range in production (#​15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#​15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#​15627) (a084e44)
• server-renderer: propagate async setup errors (#​15857) (6930374), closes #​15716
• ssr: honor falsy vnode content overrides (#​15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#​15640) (2a086a2), closes #​15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#​15818) (d3c6e02), closes #​15817
• transition-group: measure nested groups against their moving outer item (#​15848) (1936c87), closes #​5385 #​1531
• transition: handle comment-wrapped component roots (#​15853) (ff35014), closes #​6080 #​5500

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

More templates

• mobile-react-rsbuild
• mobile-react-vike
• mobile-react-vite
• mobile-vue-rsbuild
• mobile-vue-rsbuild-on-demand
• mobile-vue-tsx-rsbuild
• mobile-vue-tsx-vike
• mobile-vue-tsx-vite
• mobile-vue-vike
• mobile-vue-vike-on-demand
• mobile-vue-vite
• mobile-vue-vite-on-demand
• react-chat-rsbuild
• react-chat-vike
• react-chat-vite
• react-rsbuild
• react-vike
• react-vite
• vue-chat-rsbuild
• vue-chat-rsbuild-on-demand
• vue-chat-tsx-rsbuild
• vue-chat-tsx-vike
• vue-chat-tsx-vite
• vue-chat-vike
• vue-chat-vike-on-demand
• vue-chat-vite
• vue-chat-vite-on-demand
• vue-rsbuild
• vue-rsbuild-on-demand
• vue-tsx-rsbuild
• vue-tsx-vike
• vue-tsx-vite
• vue-vike
• vue-vike-on-demand
• vue-vite
• vue-vite-on-demand

npx https://pkg.pr.new/TDesignOteam/create-tdesign@111

pnpm dlx https://pkg.pr.new/TDesignOteam/create-tdesign@111

bunx https://pkg.pr.new/TDesignOteam/create-tdesign@111

commit: 39f04c6

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vike@​0.4.267 ⏵ 0.4.268	+1		+1	+1

View full report