chore(deps-dev): bump the dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the dependencies group with 5 updates in the / directory:

Package	From	To
pnpm	12.9.1	12.12.1
tsdown	0.22.9	0.23.1
unplugin-dts	1.0.3	1.1.2
vite	8.1.5	8.3.4
vite-plugin-dts	5.0.3	5.1.2

Updates pnpm from 12.9.1 to 12.12.1

Release notes

Sourced from pnpm's releases.

pnpm 12.12.1

This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Patch Changes

• pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

• pnpm dist-tag add, rm, and ls now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.

• Added the tool: protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. pnpm add bun@tool:1.3.0, pnx node@tool:22, and pnx yarn@tool:4 work like the runtime: spelling, which stays supported as an alias. A lockfile written for runtime: stays up to date when package.json switches to tool:, and the other way around.

  A named registry can no longer be called tool.

Platinum Sponsors

... (truncated)

Commits

• 65f29a5 chore(release): pacquet 12.12.1 (#16844)
• 8bf75d0 chore(release): pacquet 12.12.0 (#16836)
• ddcd8de chore(release): pacquet 12.11.2 (#16802)
• 4ef3ce0 chore(release): pacquet 12.11.1 (#16791)
• 3c4ebe3 chore(release): pacquet 12.11.0 (#16772)
• e02e667 fix(pnpm): download the native binary from the configured registry (#16657)
• 343f3c4 chore(release): pacquet 12.10.1 (#16664)
• 68112ba chore(release): 11.28.5, pacquet 12.10.0 (#16637)
• 5c64726 fix(npm): keep the pnpm wrapper bins shebang-less (#16597)
• See full diff in compare view

Updates tsdown from 0.22.9 to 0.23.1

Release notes

Sourced from tsdown's releases.

v0.23.1

   🐞 Bug Fixes

• Preserve false tsconfig option  -  by @​Masutayunikon in rolldown/tsdown#1065 (407f8)
• entry: Honor custom root for object entry  -  by @​giaBaoJS in rolldown/tsdown#1072 (17452)
• pkg: Pack tarball inside npm publish --dry-run  -  by @​giaBaoJS in rolldown/tsdown#1076 (83f0c)

    View changes on GitHub

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)

... (truncated)

Commits

• 6493257 chore: release v0.23.1
• ba6acb9 chore: upgrade deps
• 6cbfec7 chore(deps): update dependency unplugin-vue to v8 (#1090)
• eb40c95 chore: declare package side effects
• f9c95d0 chore: align pnpm workspace settings
• e64bde4 chore: configure pnpm via devEngines
• 83f0c57 fix(pkg): pack tarball inside npm publish --dry-run (#1076)
• 1745223 fix(entry): honor custom root for object entry (#1072)
• 9655dcb chore: upgrade deps
• 30da631 docs: correct default value of minify
• Additional commits viewable in compare view

Updates unplugin-dts from 1.0.3 to 1.1.2

Release notes

Sourced from unplugin-dts's releases.

unplugin-dts@1.1.2

   🐞 Bug Fixes

• Preserve native declaration extensions  -  by @​qmhc (6dd5e)

    View changes on GitHub

unplugin-dts@1.1.1

   🐞 Bug Fixes

• Preserve declaration graph across module formats  -  by @​qmhc in qmhc/unplugin-dts#491 (9c6d2)

   🏎 Performance

• unplugin-dts: Cache declaration module resolution  -  by @​qmhc in qmhc/unplugin-dts#492 (2ed30)

    View changes on GitHub

unplugin-dts@1.1.0

   🐞 Bug Fixes

• unplugin-dts:
  • Preserve empty bundled entries  -  by @​qmhc (52042)
  • Preserve typeof in static imports  -  by @​qmhc (5b146)
  • Correct module-resolution precedence in setModuleResolution  -  by @​DanMat in qmhc/unplugin-dts#486 (8841c)
  • Stabilize Vue program lifecycle  -  by @​qmhc in qmhc/unplugin-dts#488 (254ea)

   🏎 Performance

• unplugin-dts:
  • Reduce build overhead  -  by @​qmhc (03782)
  • Optimize watch rebuilds  -  by @​qmhc in qmhc/unplugin-dts#487 (349e1)

    View changes on GitHub

Changelog

Sourced from unplugin-dts's changelog.

1.1.2 (2026-10-03)

Bug Fixes

• aliases in namespace imports (#418) (#443) (3ca6044)
• avoid self-referencing synthetic entry when entry dts path equals types path (f08ae3e), closes #420
• ensure parse default out dir from scaffold (46cfca4)
• include .vue files when resolving tsconfig include patterns (d4e41d2), closes #469
• loop through all aliases so wildcard _ does not block @/_ resolution (#477) (57b6278)
• plugin: allow custom resolver files to pass through transform (63dc649), closes #444
• plugin: auto-detect Vue files and auto-set processor (802d243), closes #454
• plugin: re-emit declarations when non-type files change in watch mode (a6bc975), closes #335
• preserve declaration graph across module formats (#491) (9c6d284)
• preserve native declaration extensions (6dd5eda), closes #495
• relax vue language core peer range (89b6634)
• resolve tsconfig globs relative to tsconfig dir (#455) (8df62f1)
• rolldown: correct exported type for Rolldown plugin (6e0c0d2), closes #470
• stricter strategy for skipping insert index (8c30eb2), closes #415
• unplugin-dts: add .js extension to synthetic entry imports for nodenext (fff6ee3), closes #417
• unplugin-dts: avoid leaking optional peer types into declaration files (e0eda08), closes #476
• unplugin-dts: correct module-resolution precedence in setModuleResolution (#486) (8841cd8)
• unplugin-dts: fix getResolvedModule error when bundling dts files outside src (89a12db), closes #401
• unplugin-dts: forward aliasesExclude to Runtime (739db62), closes #472
• unplugin-dts: preserve empty bundled entries (5204271), closes #483
• unplugin-dts: preserve typeof in static imports (5b146c7), closes #485
• unplugin-dts: publicRoot mismatch of TS 6.0 rootDir (b0a695e), closes #467
• unplugin-dts: remove forceDtsEmit to support declarationMap (f417ffe), closes #449
• unplugin-dts: resolve API Extractor failure with Vue internal types in bundleTypes (e6c4eea), closes #456
• unplugin-dts: resolve tsconfig paths without baseUrl relative to config dir (051f2ea), closes #458
• unplugin-dts: separate publicRoot/entryRoot for TS 6.0 (#479) (351500a), closes #467 #467
• unplugin-dts: stabilize Vue program lifecycle (#488) (254ea3d)
• use native createParsedCommandLine (1070f46), closes #446 #448 #451

Features

• auto fallback to @​typescript/typescript6 for TS 7+ compatibility (d150536), closes #465
• supports specify module format for output (a917f3c)

Performance Improvements

• unplugin-dts: cache declaration module resolution (#492) (2ed30b1)
• unplugin-dts: optimize watch rebuilds (#487) (349e1b4)
• unplugin-dts: reduce build overhead (03782b7)

1.1.1 (2026-09-20)

Bug Fixes

• avoid self-referencing synthetic entry when entry dts path equals types path (f08ae3e), closes #420
• include .vue files when resolving tsconfig include patterns (d4e41d2), closes #469

... (truncated)

Commits

• bc603fd release(unplugin-dts): v1.1.2
• 4468e9b ci: stabilize Windows declaration and watch tests
• 6dd5eda fix: preserve native declaration extensions
• ffacafb refactor: add hook filter rules to transform hook (#493)
• 41beb5f release(unplugin-dts): v1.1.1
• 2ed30b1 perf(unplugin-dts): cache declaration module resolution (#492)
• 9c6d284 fix: preserve declaration graph across module formats (#491)
• 8f45eca release(unplugin-dts): v1.1.0
• 254ea3d fix(unplugin-dts): stabilize Vue program lifecycle (#488)
• 349e1b4 perf(unplugin-dts): optimize watch rebuilds (#487)
• Additional commits viewable in compare view

Updates vite from 8.1.5 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Commits

• b6c20f6 release: v8.3.4 (#23702)
• b28db28 fix(server): match static aliases on path boundaries (#23643)
• bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
• fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
• 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
• 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
• facc2fb fix: remove input option unescaping for now (#23694)
• 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
• cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
• fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
• Additional commits viewable in compare view

Updates vite-plugin-dts from 5.0.3 to 5.1.2

Changelog

Sourced from vite-plugin-dts's changelog.

5.1.2 (2026-10-03)

Bug Fixes

• bump @​microsoft/api-extractor to fix security vulnerabilities (#462) (ee2acd5)
• preserve declaration graph across module formats (#491) (9c6d284)
• preserve native declaration extensions (6dd5eda), closes #495

5.1.1 (2026-09-20)

Bug Fixes

• preserve declaration graph across module formats (#491) (9c6d284)

5.1.0 (2026-09-01)

Commits

• 02bd787 release(vite-plugin-dts): v5.1.2
• 4468e9b ci: stabilize Windows declaration and watch tests
• 6dd5eda fix: preserve native declaration extensions
• 21a59d4 release(vite-plugin-dts): v5.1.1
• 9c6d284 fix: preserve declaration graph across module formats (#491)
• 73c9bff release(vite-plugin-dts): v5.1.0
• See full diff in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.