[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@babel/core (source)	^8.0.7 → ^8.0.10			devDependencies	patch
@cloudflare/vite-plugin (source)	^1.64.0 → ^1.66.0			devDependencies	minor
@rolldown/plugin-babel (source)	^0.2.4 → ^0.3.0			devDependencies	minor
@rolldown/plugin-transform-imports (source)	^0.1.2 → ^0.1.3			devDependencies	patch
@swc/core (source)	^1.16.18 → ^1.16.20			dependencies	patch
@types/estree (source)	^1.0.9 → ^1.0.10			devDependencies	patch
eslint-plugin-regexp	^3.3.1 → ^3.3.2			devDependencies	patch
magic-string	^1.4.3 → ^1.4.5			dependencies	patch
oxc-transform-react (source)	^0.155.0 → ^0.156.0			devDependencies	minor
oxfmt (source)	^0.74.0 → ^0.75.0			devDependencies	minor
oxlint (source)	^1.89.0 → ^1.90.0			devDependencies	minor
oxlint-tsgolint	^7.0.2004 → ^7.0.2005			devDependencies	patch
pnpm (source)	10.34.7 → 10.34.9			packageManager	patch
react-router (source)	8.5.0 → 8.5.1			dependencies	patch
rolldown (source)	^1.2.14 → ^1.2.16			devDependencies	patch
srvx	^1.0.6 → ^1.0.8			dependencies	patch
tsdown (source)	^0.23.1 → ^0.23.4			devDependencies	patch
vite (source)	^8.3.4 → ^8.3.5			devDependencies	patch
wrangler (source)	^4.151.2 → ^4.156.0			devDependencies	minor
zizmorcore/zizmor-action	v0.7.1 → v0.8.0			action	minor

---

Release Notes

babel/babel (@​babel/core)

v8.0.10

Compare Source

🐛 Bug Fix

• babel-parser
  • #​18420 fix(parser): improve radix literal rounding (@​JLHwung)
  • #​18372 fix(parser): allow parenthesized assignment target in arrow initializer (@​JLHwung)
  • #​18410 fix(parser): do not record strict mode errors during lookahead (@​JLHwung)
  • #​18433 fix(parser): invalid expectOnePlugin usage (@​JLHwung)
  • #​18409 fix(parser): handle ASI after let followed by a reserved word on the next line (@​JLHwung)
  • #​18406 fix(parser): parser should not crash for import defer {} (@​JLHwung)
  • #​18407 fix(parser): record start location in startNodeAt (@​JLHwung)
• babel-plugin-transform-block-scoping
  • #​18371 fix: closures in for-loop test and update capture wrong binding (@​joellemd)
• babel-generator
  • #​18418 fix(generator): keep aliases of string-literal module specifiers (@​JLHwung)
  • #​18427 Fix missing parentheses around TypeScript assertion targets (@​dagemawinegash)
  • #​18324 fix: invalid minified: true output for new expression (@​JLHwung)
  • #​18437 fix(generator): preserve type modifier in TSImportEqualsDeclaration (@​saiyam-jain-dev)
  • #​18424 Keep parentheses around TSInstantiationExpression operand (@​yulman2207)
  • #​18417 fix(generator): do not disallow line break after import source (@​JLHwung)
• babel-plugin-transform-optional-chaining, babel-traverse
  • #​18422 fix: Scope#push should not push iife param after rest element (@​JLHwung)
• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​18224 fix: avoid removable fields as decorator evaluation hosts (@​nyan-left)
• babel-types
  • #​18411 Allow member expression values in ObjectPattern properties (@​JLHwung)
• babel-plugin-transform-classes
  • #​18384 Leave loose class prototype mutable with accessors (@​nicolo-ribaudo)

🏠 Internal

• babel-build-external-helpers, babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-regenerator, babel-runtime-corejs3, babel-runtime
  • #​18397 Mangle top level names in helpers (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-traverse
  • #​18413 perf(traverse): improve generateUid and push (@​JLHwung)

🔬 Output optimization

• babel-helpers, babel-runtime-corejs3
  • #​18325 Shrink jsx helper size (@​JLHwung)

v8.0.9

Compare Source

v8.0.9 (2026-10-23)

This release contains no changes. It is needed only to update the repo (which is based on @babel/core's last release) in Node.js's CITGM.

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.66.0

Compare Source

Minor Changes

• #​16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #​16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #​16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #​16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #​16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #​16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

  Use Miniflare 5.20261023.0-beta and the matching Wrangler release for local development and preview. Align bundled helpers and Workers types with this runtime, and use 2026-10-23 as the fallback compatibility date when none is configured. The runtime and helper updates also prevent malformed HTTP responses with excessive content encodings from causing unhandled stream errors. The published helpers also update their bundled Zod validator and fix Windows keyring setup for remote-binding credentials when the configuration path contains spaces.

• #​16479 1d5354b Thanks @​petebacondarwin! - Treat cloudflare:durable-objects as a built-in runtime module

  Workers can import retryable() from cloudflare:durable-objects to mark Durable Object methods as safe to retry. The plugin now leaves that import for the runtime to resolve, as it does for cloudflare:workers, instead of trying to resolve it as a package.

• #​16493 4ce6176 Thanks @​petebacondarwin! - Preserve a Worker response's statusText in Vite dev and preview

  Responses such as new Response(body, { status: 231, statusText: "Custom" }) now reach the browser as 231 Custom instead of 231 unknown. Empty status text is also preserved over HTTP/1.x.

• #​16501 109844e Thanks @​petebacondarwin! - Preserve separate Set-Cookie request headers in Vite dev and preview

  Workers now receive each incoming Set-Cookie value separately for HTTP requests and WebSocket upgrades, including values with commas in an Expires date. Previously, multiple values could be combined into one header.

• #​16503 ca116f9 Thanks @​petebacondarwin! - Fix a dev server failing to start when an earlier dev server in the same process had different Worker exports

  The Vite plugin now clears the Worker export types it detected when a dev server closes. A dev server created afterwards in the same process derives them from its own config again, so it no longer fails with Class extends value undefined for a Durable Object the earlier server's Worker did not export.

• #​16504 436fa9a Thanks @​petebacondarwin! - Fix Vite DevTools WebSocket connections closing unexpectedly

  Leave upgrades at /__devtools/__ws to Vite DevTools instead of forwarding them to the Worker. Sandbox preview requests continue to reach the Worker.

v1.65.0

Compare Source

Minor Changes

• #​16363 d3240f2 Thanks @​jamesopstad! - Remove the experimental.newConfig option from Vite plugin v1

  Vite plugin v1 now supports Wrangler configuration files only. Projects using cloudflare.config.ts for configuration should upgrade to Vite plugin v2 beta.

Patch Changes

• #​16373 8cc5f87 Thanks @​petebacondarwin! - Report unsupported remote bindings under Bun instead of hanging

  Starting remote bindings now fails with an actionable error explaining Bun's unsupported request routing. Use Node.js or disable remote bindings to continue local development.

• #​16334 9cecd09 Thanks @​petebacondarwin! - Fix Container setup guidance in Vite development and preview

  Container registry instructions now show the Wrangler command and the configuration location, including Wrangler files and inline Vite configuration.

• #​16333 68d6eec Thanks @​petebacondarwin! - Update the local Workers runtime to the October 19 release

  Include the fix for nested asset paths during local development on Windows, together with the compatible Wrangler release.

  The runtime update also disposes Workflow step results and introspection modifiers after use, preventing undisposed RPC warnings and cancelled local Workflow requests.

• #​16379 160e655 Thanks @​petebacondarwin! - Update the local Workflow runtime to use native storage cleanup

  Consume the Miniflare fix that queues Workflow persistence deletion with instance recreation, including deletion through the local Explorer. This prevents storage cleanup from racing reuse of the same Workflow instance ID.

• #​16289 bbe822f Thanks @​petebacondarwin! - Retry remote preview token refreshes after transient failures

  Backport the retry fix to the private remote-bindings workspace package and require wrangler@4.151.1 so long-running remote development sessions recover after a network outage.

• #​16291 0262f7d Thanks @​petebacondarwin! - Use published SDK dependencies for Vite plugin v1 maintenance

  Pin the plugin's published SDK dependencies to their deployed npm versions. Keep private shared packages as workspace dependencies so their implementation and build tools remain available on the v1 maintenance branch.

rolldown/plugins (@​rolldown/plugin-babel)

v0.3.0

Features

• babel: add parallel option to transform in worker threads (#​139) (62b6144), references rollup/plugins#1956

Bug Fixes

• deps: update all non-major dependencies (#​133) (b8560ba), references #​8203 #​8203

Miscellaneous Chores

• deps: update all non-major dependencies (#​137) (d427660), references #​8203 #​8203
• deps: update all non-major dependencies (#​140) (2fe2645)
• deps: update all non-major dependencies (#​142) (a0e8ff7), references #​8203
• deps: update all non-major dependencies (#​145) (a4444dc), references #​8203 #x #​8203 #​8203 #​8203 docs/api.md#optionsextendenv docs/api.md#optionsenv docs/api.md#optionsstdio docs/api.md#optionsmaxbuffer #​8203
• deps: update all non-major dependencies (#​149) (bcd3e00), references #​8203 #​8203 docs/api.md#optionsmaxbuffer docs/api.md#optionskillsignal
• deps: update rolldown-related dependencies (#​150) (277a919)

Tests

• exclude benchmarks from package Vitest projects (#​153) (9d071ad)

rolldown/plugins (@​rolldown/plugin-transform-imports)

v0.1.3

Bug Fixes

• transform-imports: handle query-suffixed module ids (#​152) (878652d), closes #​151

Miscellaneous Chores

• deps: update all non-major dependencies (#​137) (d427660), references #​8203 #​8203
• deps: update all non-major dependencies (#​140) (2fe2645)
• deps: update all non-major dependencies (#​142) (a0e8ff7), references #​8203
• deps: update all non-major dependencies (#​145) (a4444dc), references #​8203 #x #​8203 #​8203 #​8203 docs/api.md#optionsextendenv docs/api.md#optionsenv docs/api.md#optionsstdio docs/api.md#optionsmaxbuffer #​8203
• deps: update rolldown-related dependencies (#​147) (6cd4d4d)
• deps: update rolldown-related dependencies (#​150) (277a919)

Tests

• exclude benchmarks from package Vitest projects (#​153) (9d071ad)

swc-project/swc (@​swc/core)

v1.16.20

Compare Source

Bug Fixes

• (es/codegen) Disambiguate TSX generic arrows (#​12505) (2c9d198)

• (es/codegen) Preserve non-null token boundaries (#​12504) (410ae3a)

• (es/codegen) Parenthesize typed arrow parameters (#​12503) (aa1ffd6)

• (es/codegen) Preserve TypeScript token boundaries (#​12523) (9f36ae0)

• (es/codegen) Emit space after div if rhs starts with a regex (#​12544) (dddf716)

• (es/codegen) Preserve optional call type arguments (#​12549) (f7bef4d)

• (es/compat) Scope private access modes to each member (#​12526) (c0e3fa1)

• (es/fixer) Preserve TypeScript expression grouping (#​12518) (b9d3f8f)

• (es/fixer) Preserve TypeScript operand grouping (#​12539) (7c4a214)

• (es/fixer) Avoid panicking on recovered parenthesized assignment targets (#​12551) (ec34371)

• (es/fixer) Preserve optional chain boundaries (#​12550) (01d5630)

• (es/fixer) Wrap function declarations in sloppy-mode loop bodies (#​12567) (76ff943)

• (es/minifier) Bound literal expressions copied by the sequential inliner (#​12521) (60c700f)

• (es/minifier) Preserve rest array identity when its reference runs more than once (#​12546) (4768dbe)

• (es/minifier) Keep trimLeft and trimRight on string literals (#​12574) (663ffb0)

• (es/minifier) Keep directive prologue when merging if returns (#​12580) (fd0edaf)

• (es/minifier) Preserve new async and generator (#​12558) (8f06994)

• (es/minifier) Release utils API required by registry builds (#​12582) (b5a52b9)

• (es/parser) Isolate enum await context (#​12506) (b789495)

• (es/parser) Allow await function names in async arrow parameters (#​12517) (0827541)

• (es/parser) Preserve invalid JSX numeric entities as literal text (#​12524) (31b5fb9)

• (es/parser) Allow namespace await identifiers (#​12507) (3daa5dc)

• (es/parser) Align TypeScript expression lookahead (#​12535) (7ef5966)

• (es/parser) Do not treat optional get/set fields as accessors (#​12559) (a2fedec)

• (es/parser) Recover non-entity expressions in TypeScript heritage clauses (#​12552) (48586cb)

• (native) Allow unmapped overflow owners in Linux cache ancestors (#​12547) (8ce7daa)

• (native-addon) Use ProgramData after unsafe Windows profile caches (#​12534) (47394b8)

• (react-compiler) Preserve intrinsic JSX tags during binding renames (#​12536) (c25e42e)

• (ts/fast-strip) Preserve runtime boundaries during type erasure (#​12575) (ccdc3c1)

Documentation

• Prohibit references to issue-linked PRs and external SWC forks (#​12513) (5092a16)

• Add CodSpeed sponsor logo to README (#​12590) (9c5b1df)

Features

• (es/minifier) Inline async function used only once (#​12416) (b9b2ebe)

• (es/minifier) Implement more rules for if-break (#​12561) (644f85a)

Performance

• (es/parser) Streamline numeric separator stripping (#​12515) (220a82c)

• (hstr) Allow Atom::as_str to inline across crates (#​12522) (c07290b)

Testing

• (es/transforms) Isolate transform timing from AST cloning (#​12540) (63ee4aa)

Ci

• Allow vjeux as a React contributor (#​12520) (4e8ee99)

• Allow jimmyhmiller in the Next.js group (#​12532) (346a025)

• Ignore unreachable ruzstd advisory in Wasmer (#​12533) (1a55a5b)

• Remove empty contributor changeset (#​12537) (3986d88)

• Require changesets for crate changes (#​12583) (ee2cd8a)

ota-meshi/eslint-plugin-regexp (eslint-plugin-regexp)

v3.3.2

Compare Source

Patch Changes

• Add names to flat configurations for ESLint's config inspector. (#​1073)

Rich-Harris/magic-string (magic-string)

v1.4.5

Compare Source

Bug Fixes

• bundle: stop addSource mutating the caller's source description (#​375) (c14d303)
• keep the stored name when an overwritten range was split (#​374) (729cbb2)
• reject non-integer and out-of-range indices consistently (#​373) (02dfc82)
• respect indent exclusions on moved edits and CRLF bundle intros (#​377) (280bc3e)
• shift replacesUntil and replacedFrom in Bundle#toMagicString (#​369) (ab6e912), closes Bundle#toMagicString

Performance Improvements

• cut allocations and quadratic lookups on the sourcemap and bundle paths (#​379) (d081246)
• find the slice start chunk without scanning the list (#​378) (6ab6b04)

v1.4.4

Compare Source

Bug Fixes

• don't treat chunks emptied by an overwrite as removed in replace (#​367) (aed5675)
• keep the content when update throws across a split point (#​364) (f815ec4)
• respect the offset in snip (#​363) (bb5c6c2)
• skip empty matches at a chunk boundary inside removed content (#​366) (5aab3bd)

oxc-project/oxc (oxc-transform-react)

v0.156.0

🐛 Bug Fixes

• def47b8 react-compiler: Keep manual memoization as written when its dependencies can't be honoured (#​28101) (Dunqing)

oxc-project/oxc (oxfmt)

v0.75.0: oxfmt v0.75.0

Compare Source

🐛 Bug Fixes

• 5042019 formatter: Keep fill layout for array with comment after [ (#​28170) (leaysgur)
• 9d37ff6 formatter: Use position-based comment checks for concise arrays (#​28169) (leaysgur)
• 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#​28103) (vidigoat)
• 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#​28168) (leaysgur)
• a5314a1 formatter: Keep ; before in and instanceof class members (#​28166) (leaysgur)
• 3a56e7c formatter: Keep closing HTML comments at the start of a line (#​28064) (Cameron)
• 23d23d6 formatter_markdown: Honor range ignore inside directives (#​28164) (leaysgur)
• 5f1fd3d formatter: Measure width heuristics by display width (#​28098) (leaysgur)
• a5a52cf formatter: Keep parens around private in expressions (#​28096) (leaysgur)
• 999496e formatter: Measure a short key by its display width (#​28026) (vidigoat)
• 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#​28025) (vidigoat)
• 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#​27989) (leaysgur)
• eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#​27987) (leaysgur)

⚡ Performance

• 1ed93af data_structures: Copy short strings without a memcpy call (#​27953) (leaysgur)
• 7948f0b formatter_core: Shrink FormatElement to 16B (#​28012) (leaysgur)
• 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#​27963) (leaysgur)

📚 Documentation

• 068a8ea formatter: Fix up wording (#​28167) (leaysgur)
• db55461 formatter_core: Document text width divergence (#​28095) (leaysgur)
• 880d229 formatter: Add vitest-test-call to known divergences (#​28006) (leaysgur)

oxc-project/oxc (oxlint)

v1.90.0

Compare Source

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#​28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#​28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#​28116) (camc314)

pnpm/pnpm (pnpm)

v10.34.9: pnpm 10.34.9

Compare Source

Patch Changes

• 0bff20d: The pnpm version that packageManager pins now records that pin in a fresh pnpm-lock.yaml when pnpm 10 switched to it. A later pnpm install --frozen-lockfile then succeeds #​17303.

Platinum Sponsors

Gold Sponsors

		< [!IMPORTANT]✂ PR body was truncated to here. Configuration 📅 Schedule: (UTC) Branch creation Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1) Automerge At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.