[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@iconify-json/lucide	^1.2.147 → ^1.2.151			devDependencies	patch
@sveltejs/kit (source)	^3.1.0 → ^3.1.1			devDependencies	patch
@tailwindcss/postcss (source)	^4.3.3 → ^4.3.4			devDependencies	patch
@tailwindcss/vite (source)	^4.3.3 → ^4.3.4			devDependencies	patch
@types/node (source)	^26.6.5 → ^26.6.6			devDependencies	patch
@types/node (source)	26.6.5 → 26.6.6			dependencies	patch
@vitejs/plugin-react (source)	^6.1.2 → ^6.2.1			devDependencies	minor
next (source)	^16.4.3 → ^16.4.5			dependencies	patch
node	26.12.1 → 26.13.0			uses-with	minor
nuxt (source)	^4.6.3 → ^4.6.4			dependencies	patch
prettier-plugin-packagejson	3.0.3 → 3.1.0			dependencies	minor
solid-js (source)	^1.9.17 → ^1.9.18			dependencies	patch
svelte-check	^4.7.7 → ^4.7.8			devDependencies	patch
tailwindcss (source)	^4.3.3 → ^4.3.4			devDependencies	patch
tslib (source)	^2.8.1 → ^2.9.1			devDependencies	minor
vite-plugin-solid	^2.11.14 → ^2.11.15			devDependencies	patch
vue-tsc (source)	^3.3.13 → ^3.3.14			devDependencies	patch

---

Release Notes

sveltejs/kit (@​sveltejs/kit)

v3.1.1

Compare Source

Patch Changes

• fix: return a 400 response instead of throwing when reroute rewrites a malformed pathname (1d21a3b)

• fix: restore function snapshots on reload when SSR is disabled (#​17477)

• fix: prevent separate non-exported query.batch functions from sharing a batch (3529813)

• fix: reuse the original fetch across dev server reloads (#​17548)

• fix: avoid adding a file watcher while loading src/env (#​17502)

• fix: parse remote form submissions in linear time (d593e7e)

• fix: prevent server-side route resolution from loading code from another origin for pathnames starting with // (dd63fd1)

• fix: preserve service worker sourcemaps when injecting env (#​17566)

• fix: prevent server-only modules from being imported into browser code via src/params.js (ae07803)

• fix: avoid injecting a non-serializable TypeScript config callback by default (#​17512)

• fix: report actionable errors for remote modules in server-only locations (#​17567)

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.4

Compare Source

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#​20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#​20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#​20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#​20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#​20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#​20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#​20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#​20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#​20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#​20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#​20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#​20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#​20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#​20408)
• Drop invalid UTF-8 candidates during class detection (#​20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#​20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#​20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#​20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#​20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#​20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#​20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#​20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#​20508)
• Improve style invalidation performance of group-* and peer-* variants (#​20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#​20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#​20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#​20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#​20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#​20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#​20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#​20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#​20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#​20547, #​20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#​20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#​20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#​20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#​20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#​20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#​20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#​20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#​20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#​20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#​20582)
• Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#​20593)
• Decode single-digit hexadecimal escapes in theme variable and @utility names as the CSS spec does (e.g. @theme { --color-\0: red; } no longer registers --color-0) (#​20591)
• Don't treat !important inside strings, comments or url() in declaration values as the important flag (e.g. content: "a !important b") (#​20627)
• Parse a custom property at the end of the input when it has no trailing ; (e.g. --foo: bar as the last declaration) (#​20653)
• Keep a declaration without a ; at the end of the CSS input (e.g. color: red) (#​20655)

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.2.1

Compare Source

Fix refreshInclude and refreshExclude options not working (#​1543)

Fix mistake from #​1516

v6.2.0

Compare Source

Add refreshInclude and refreshExclude options (#​1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#​1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#​1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

vercel/next.js (next)

v16.4.5

Compare Source

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#​100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#​100619)
• [lts-active] Revert "Optimize strict module factory chunks (#​98421)" (#​100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#​100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#​100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#​100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#​100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

actions/node-versions (node)

v26.13.0: 26.13.0

Compare Source

Node.js 26.13.0

nuxt/nuxt (nuxt)

v4.6.4

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

• nitro,nuxt: require unrouting 0.3.2 (768d21368)
• nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
• nitro: require nitropack 2.13.6 (1b13c6981)
• nitro: keep leading double slash in renderer request path (75c12c6fb)
• nuxt: use unambiguous encoding for island hash (6f1b93c64)
• vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
• nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
• nuxt: strip trailing slashes in linear time (97424dd21)
• nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
• webpack: skip hot middleware for forbidden dev requests (3c9645326)
• rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
• schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
• nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
• schema: only widen workspace dir to a declared workspace root (89d3306d1)
• nitro: only trust x-forwarded-proto in when opted-in (#​36818)
• nitro: stream the body read through a nuxt/server handler (#​36817)
• kit: suggest the specific fix when loading falls back to jiti (24d75659d)
• vite: use a single type checker (#​36774)
• nitro,vite: remove windows + virtual dev ssr css links after hydration (#​36765)
• nitro,vite: dedupe dev css by module node (#​36420)
• nuxt: avoid hoisting setup-only values from definePageMeta (#​36751)
• nuxt: only match hydration modifiers after lazy prefix (#​36750)
• kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#​36747)
• nuxt: render inlined component styles after stylesheet links (#​36714)
• webpack: use valid devtool for hidden client sourcemaps in dev (#​36555)

📖 Documentation

• clarify template dependency regeneration (#​36766)
• revise README structure and headings (#​36772)
• link the Nuxt DevTools docs on nuxt.com (#​36769)
• warn against spreading untrusted objects onto server components (1225ca7ff)
• update anchors for flat heading ids (#​36664)

🏡 Chore

• add 1000-row listing routes to the benchmark (c852d871f)
• add client page weight and browser timing suites (#​36788)

✅ Tests

• update bundle size snapshot (7528c3ce6)
• list new main-only diagnostic codes (545b5934c)
• tolerate node 26 proxy inspect output (40f72b40b)
• normalise rolldown comment (861e153dd)
• improve benchmark tests (#​36745)

🤖 CI

• check unversioned docs links against branch docs version (d093c88b1)
• skip unneeded checks for release prs (4b90681bd)
• skip benchmarks in merge groups (6428070e0)
• re-enable codspeed ⚡ (bc17c03d1)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Max (@​onmax)
• Sébastien Chopin (@​atinux)
• saini-25 (@​saini-25)
• Baptiste Leproux (@​larbish)

matzkoh/prettier-plugin-packagejson (prettier-plugin-packagejson)

v3.1.0

Compare Source

Features

• declare supported Node.js range in engines (47915a8)

sveltejs/language-tools (svelte-check)

v4.7.8

Compare Source

Patch Changes

• Preserve TypeScript files listed in tsconfig.json when running with --tsgo. (#​3146)

• fix: update --tsgo-experimental-api for typescript 7.1 (#​3168)

• Report a tsconfig parse error instead of an internal error on --incremental and --tsgo runs when the tsconfig path is not normalized. (#​3169)

• fix: type the exports of src/hooks.server with --tsgo-experimental-api (#​3154)

Microsoft/tslib (tslib)

v2.9.1: tslib 2.9.1

Compare Source

What's Changed

• Update dependencies by @​jakebailey in microsoft#283
• Switch to new release pipeline by @​jakebailey in microsoft#289
• Port content mapper changes to rewriteRelativeImportExtension by @​andrewbranch in microsoft#295
• Stop requiring an ignored lockfile in release workflows by @​jakebailey in microsoft#296
• Bump tslib to 2.9.0 by @​typescript-automation[bot] in microsoft#297
• Stop running tests in the Azure release pipeline by @​jakebailey in microsoft#298
• Bump tslib to 2.9.1 by @​typescript-automation[bot] in microsoft#299

Full Changelog: microsoft/tslib@v2.8.1...v2.9.1

solidjs/solid-vite-plugin (vite-plugin-solid)

v2.11.15

Compare Source

Patch Changes

• 62e2b75: Production builds now dedupe solid-js the same way dev does. A dependency with its own nested copy of solid-js no longer adds a second runtime to the bundle, which broke context lookups (#​112).
• a732eeb: Avoid overriding environments configured in Vitest workspaces and projects with the jsdom default
• 9e67618: fix: exclude test mode from HMR setup
• a7ec25f: Fix TypeError: Cannot read properties of undefined (reading 'extend') in tests on Vitest before 1.0 with @testing-library/jest-dom 6 or later installed (#​141). The plugin now injects jest-dom's ESM vitest entry as an absolute path for those Vitest versions, because they load the CommonJS entry from a bare specifier.
• 6cc30fe: Only inject the @testing-library/jest-dom Vitest setup file when the package resolves from the project root. Previously the check ran from the plugin's own location, so with pnpm a transitive jest-dom (for example via Storybook) made Vitest fail with Failed to load url .../@testing-library/jest-dom/vitest.
• d0e47f1: Vitest runs keep the jsdom environment and the @testing-library/jest-dom setup file when test.server.deps.external already lists solid-js. The plugin used to drop its whole test config in that case.
• f8439e8: The plugin no longer changes resolve.alias. An alias object in your config now keeps priority over aliases that later plugins add, such as vite-plugin-node-polyfills mapping path (#​130).
• df3ba8a: Compile modules whose id has the extension after the query, such as unplugin-icons' ~icons/mdi/folder?width=2em.tsx. Since 2.11.2 these were left to Vite's default JSX transform, which produced React code (#​206). Custom extensions are now also matched when the query contains a dot.
• b50c064: Keep $ServerOnly templates in client transforms while HMR is active so hot updates of components using $ServerOnly no longer throw template is not a function. An explicit solid.omitServerOnlyTemplates setting still takes precedence.
• cd79ed9: Without ssr: true, modules loaded on the server now compile to non-hydratable SSR output instead of DOM output. Prerendering a client-rendered app with ssrLoadModule no longer throws "Client-only API called on the server side" (#​64). Vitest keeps DOM output.
• 9c17655: Server builds with ssr.target: 'webworker' now resolve the server build of solid-js. The plugin adds the worker export condition to that build, so renderToString and the other server APIs no longer resolve to their browser stubs (#​153). This works on Vite 4 and later.
• 8909380: Vite 8's dependency scan no longer breaks on .tsx files (issue #​262).
  The plugin previously set optimizeDeps.rolldownOptions.transform.jsx: 'preserve' to stop Rolldown from injecting react/jsx-dev-runtime
  imports during the scan — but the scanner re-parses the transformed
  output as plain JS (import.meta.glob handling force-tags modules as
  js), so any .tsx with JSX was a hard PARSE_ERROR: Unexpected JSX expression that aborted the whole scan and skipped pre-bundling. The
  scan transform now uses the classic JSX runtime, which lowers JSX to bare
  React.createElement calls without injecting any import: the scan output
  is never executed, it only exists so rolldown can walk the import graph,
  so the undefined identifier is harmless. Backport of the fix already on
  the 3.0.0-next line.
• 5d6846c: When the root config declares test.projects and leaves test.sharedViteServer unset, the plugin now sets it to false so every inline project resolves its own Vite config, as under Vitest 4. An explicit value is respected. Vitest 5 defaults the option to true, and a shared inline project takes its test options from the raw root block captured before any config hook runs, so it lost everything the plugin injects (the jsdom default, the @testing-library/jest-dom setup file, server.deps). Ports #​370; refs #​369.
• 32adc90: In Vitest DOM tests (the jsdom default, no ssr option), the plugin now inlines solid-js and the packages that import it without a solid export condition, such as @solidjs/testing-library. Before, they stayed external, and the host runtime resolved their own imports. Node gets the browser condition from Vitest's worker --conditions, but Deno does not apply it in worker threads and resolves deno/node. Under Deno, @solidjs/testing-library loaded the server build of solid-js/web and render threw "Client-only API called on the server side" (#​369). Inlining sends these imports through Vite's browser condition and loads one client-build instance. A test.server.deps.inline list is merged with the plugin's, and a test.server.deps.external entry for solid-js still opts out. With ssr: true, tests keep solid-js external as before.
• 765a406: In jsdom and happy-dom tests, Node no longer gets the browser condition for packages that Vitest leaves external. Node-only packages such as msw/node now load under Vitest 4 and later (#​125).
• c750c34: Packages with a solid export condition that are declared only in the workspace root's package.json are now inlined for projects in that workspace. Before, Vitest loaded them with Node and failed with Unknown file extension ".jsx" (#​157).

vuejs/language-tools (vue-tsc)

v3.3.14

Compare Source

language-core

• fix: isolate template virtual code from setup control flow (d31557b)
• fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)
• fix: avoid TS2454 from the withDotValue assertion (c774144)
• fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)
• fix: avoid never slot props for dynamic slot names in generic components (7957e7f)
• fix: omit emitted events from inherited attrs of generic components (2d94d89)
• fix: check bindings of generic directive hooks (0cb7d92)
• fix: wrap the v-model assignment target in parentheses (9bb1dc9)
• fix: type the $event parameter of inline handlers explicitly (d3b42a1)
• fix: type unknown components without diagnostic filters (b3909a3)
• fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)
• fix: declare component context vars before slot code (b7c773d)
• fix: avoid non-null assertion in JS slot codegen (5633525)
• fix: restore tag navigation for barrel imports (6358d15)
• fix: map the whole hyphenated directive name in the auto-import access (beb0151)

language-service

• fix: prevent crash on malformed html.customData configuration (3961653)

typescript-plugin

• fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @​johnsoncodehk, @​lazerg, @​ValentinYoushkevich, @​so1ve, @​WangKepeople

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.