chore(deps): update npm packages by renovate[bot] · Pull Request #621 · voidzero-dev/vite-task

renovate · 2026-08-09T16:28:01Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@anthropic-ai/sandbox-runtime	`0.0.67` → `0.0.71`
@openai/codex (source)	`0.146.0` → `0.147.0`
deno (source)	`2.9.4` → `2.9.5`
typescript (source)	`7.1.0-dev.20260812.1` → `7.1.0-dev.20260813.1`
vite-task-tools>vite (source)	`8.2.0` → `8.2.1`

Release Notes

anthropic-experimental/sandbox-runtime (@anthropic-ai/sandbox-runtime)

`v0.0.71`

Compare Source

What's Changed

feat: per-exec commandLabel for violation attribution; sanitize decoded proxy command by @shawnm-anthropic in #443
fix: strip trailing slashes from non-glob spellings at the normalizePathForSandbox chokepoint by @ronleizrowice-ant in #444
feat: commandId + commandText for attribution; sanitize violation lines at ingestion by @shawnm-anthropic in #445
Compact the generated macOS sandbox profile (~6-10x smaller) by @dylan-conway in #448
fix(network): bracket-aware IPv6 literals in allowed/denied domain entries by @shawnm-anthropic in #449
feat(socks): legible refusals for unauthenticatable clients; in-band SSH deny reasons by @shawnm-anthropic in #454
Release v0.0.71 by @shawnm-anthropic in #455

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.70...v0.0.71

`v0.0.70`

Compare Source

What's Changed

fix(seccomp): start the sandbox when the helper binary is execute-only by @ant-kurt in #438
fix(proxy): honor ignoreViolations and redact query strings on proxy deny lines by @shawnm-anthropic in #441
Bump 0.0.70 by @shawnm-anthropic in #442

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.69...v0.0.70

`v0.0.69`

Compare Source

What's Changed

fix(linux): skip creation stubs for absent deny paths under a read-only denied directory by @ronleizrowice-ant in #435
feat(network): per-entry deniedDomainReasons for model-facing deny reasons by @shawnm-anthropic in #437
Bump 0.0.69 by @shawnm-anthropic in #440

New Contributors

@ronleizrowice-ant made their first contribution in #435

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.68...v0.0.69

`v0.0.68`

Compare Source

What's Changed

feat(network): optional ":port" suffix on allowed/denied domains by @MarshallOfSound in #426
proxy: survive client aborts and keep abort semantics end-to-end by @sa3eed3ed in #423
feat(proxy): record proxy denials in SandboxViolationStore by @shawnm-anthropic in #436
Bump 0.0.68 by @MarshallOfSound in #439

New Contributors

@sa3eed3ed made their first contribution in #423

Full Changelog: anthropic-experimental/sandbox-runtime@v0.0.67...v0.0.68

denoland/deno (deno)

`v2.9.5`

Compare Source

feat(add): --unscoped flag to alias packages by their unscoped name (#36319)
feat(task): add --members flag to run tasks in workspace members only (#35748)
feat: add Blob/Body textStream() (#35616)
feat: add experimental QuickJS backend (#36194)
fix(bundle): avoid esbuild protocol deadlock (#36427)
fix(bundle): respect runtime file permissions (#36107)
fix(cjs): use loader sources for recursive analysis (#36111)
fix(cli): escape control characters in external metadata (#36198)
fix(core): don't resolve internal module imports with the user's import map
(#36303)
fix(crypto): add "raw-secret" to KeyFormat type (#35708)
fix(desktop): handle colored HMR URLs and page loads (#36316)
fix(desktop): retain update signature verification op (#36152)
fix(ext/crypto): allow deriveBits with length 0 (#36283)
fix(ext/napi): polyfill uv_handle_size and uv_strerror (#36308)
fix(ext/net): release completed QUIC stream resources (#36247)
fix(ext/net): require --allow-sys for node:dns.getServers() (#35941)
fix(ext/node): Node compat for web streams (#36285)
fix(ext/node): apply backpressure in Readable.toWeb() (#36321)
fix(ext/node): defer TLS write completion callback to avoid reentrancy panic
(#35867)
fix(ext/node): don't fire http2 settings callback after session destroy
(#36230)
fix(ext/node): gate constrained memory cgroup reads (#36218)
fix(ext/node): handle pre-quoted shell arguments (#36371)
fix(ext/node): implement node:test tags (#36292)
fix(ext/node): implement util.diff (#36289)
fix(ext/node): implement v8.promiseHooks API (#36281)
fix(ext/node): sort fs.readdir entries to match Node.js (#36341)
fix(ext/node): stop http2 file reads after stream close (#36300)
fix(ext/node): store blocklist ranges compactly (#36212)
fix(ext/node): support the fs flush option for writes (#36290)
fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify (#36326)
fix(ext/node_crypto): use named group exponent sizes (#36347)
fix(ext/web): attach Node error codes to WHATWG API validation errors (#36288)
fix(ext/websocket): disable HTTP/2 server push on wss upgrade path (#36327)
fix(fetch): scope redirect-sensitive headers by origin (#36361)
fix(ffi): reject resizable buffers in nonblocking calls (#36259)
fix(fmt): accept xml and svg extensions for stdin (#36149)
fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 (#36397)
fix(http): preserve stripped headers across redirects (#36360)
fix(inspector): validate request host headers (#36348)
fix(net): cancel pending writes on stream close (#36369)
fix(net): clean up concurrently dropped load-balanced listeners (#36246)
fix(net): handle malformed DNS record text (#36374)
fix(node): clean up Web Stream finished listeners (#36227)
fix(node): retain consumed HTTP stream wrapper (#36254)
fix(npm): ignore invalid package bin targets (#36354)
fix(npm): tolerate malformed scripts field in packuments (#36324)
fix(npmrc): match auth configs by authority and path (#36359)
fix(outdated): don't report JSR pre-release versions as latest (#36325)
fix(publish): report when the registry rejects a provenance attestation
(#36404)
fix(resolver): don't treat deno eval modules as npm package files (#36304)
fix(runtime): map notify's Windows missing-path error to NotFound (#35864)
fix(sync-types): add reason to too_many_arguments allows (lint)
fix(telemetry): handle reentrant attribute conversion (#36256)
fix(webgpu): own mapped range backing stores (#36257)
fix(webstorage): preserve Storage constructor name (#35944)
fix: capitalize IP in help text (#36170)
fix: upgrade deno_task_shell to 0.33.3 (#36406)
fix: wire no-legacy-abort unstable flag from deno.json config (#36312)
perf(core): run the common-path tick drain in Rust (#36157)
perf(ext/node): bypass dns lookup on literal IPs in udp send (#35909)
perf(ext/web): implement base64url encode/decode as simdutf ops (#36398)
perf(fs): open files on the blocking pool in async readFile/writeFile (#36160)
perf: order startup functions in release builds (#36219)
perf: reduce eager module evaluation at startup (#36331)
perf: remove Linux unwind tables from release artifacts (#36265)

microsoft/TypeScript (typescript)

`v7.1.0-dev.20260813.1`

Compare Source

vitejs/vite (vite-task-tools>vite)

`v8.2.1`

Compare Source

Bug Fixes

build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
deps: update all non-major dependencies (#23136) (14454fd)
deps: update rolldown-related dependencies (#23070) (7ac6f7f)
don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

css: look up pure CSS chunks through a Set (#23114) (1331b0b)

Documentation

build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

bundled-dev: enable sourcemap playgrounds (#23080) (c2155fe)
reduce logs (#23138) (7673c02)

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 10am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-08-09T16:28:20Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/deno@2.9.5
	npm/@openai/codex@0.147.0
	npm/vite@8.2.1
	npm/typescript@7.1.0-dev.20260813.1
	npm/@anthropic-ai/sandbox-runtime@0.0.71

View full report

github-actions · 2026-08-09T16:33:26Z

fspy benchmark

linux

dynamic/launch             change  +0.40%  [ -2.61% ..  +4.07%]  overhead   +51.34%
dynamic/access             change  -0.21%  [ -0.97% ..  +0.66%]  overhead    +5.45%
dynamic/access-relative    change  +0.01%  [ -3.50% ..  +3.69%]  overhead   +51.86%
static/launch              change  +0.85%  [ -3.38% ..  +6.81%]  overhead  +147.02%
static/access              change  -0.41%  [ -7.73% ..  +3.32%]  overhead  +731.03%
static/access-relative     change  -0.55%  [ -4.94% ..  +4.60%]  overhead +1173.62%

macos

dynamic/launch             change  +0.04%  [ -4.35% ..  +5.06%]  overhead  +243.26%
dynamic/access             change  +0.00%  [-55.87% ..  +4.25%]  overhead    +2.52%
dynamic/access-relative    change  +0.10%  [ -3.57% ..  +7.23%]  overhead  +260.67%

windows

dynamic/launch             change  +0.17%  [ -2.80% ..  +4.35%]  overhead   +27.17%
dynamic/access             change  +0.18%  [ -0.92% ..  +0.96%]  overhead    +1.52%
dynamic/access-relative    change  +0.00%  [ -1.43% ..  +0.92%]  overhead    +1.65%

renovate Bot force-pushed the renovate/npm-packages branch 2 times, most recently from fc1e4c9 to 633785c Compare August 9, 2026 21:12

chore(deps): update npm packages

a320414

renovate Bot force-pushed the renovate/npm-packages branch from 633785c to a320414 Compare August 16, 2026 16:42

Navigation Menu

Uh oh!

chore(deps): update npm packages - #621

chore(deps): update npm packages#621
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages

renovate Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.0.71

What's Changed

v0.0.70

What's Changed

v0.0.69

What's Changed

New Contributors

v0.0.68

What's Changed

New Contributors

v2.9.5

v7.1.0-dev.20260813.1

v8.2.1

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Configuration

Uh oh!

socket-security Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

fspy benchmark

linux

macos

windows

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 9, 2026 •

edited

Loading

`v0.0.71`

`v0.0.70`

`v0.0.69`

`v0.0.68`

`v2.9.5`

`v7.1.0-dev.20260813.1`

`v8.2.1`

socket-security Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading