chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-23 — run · 14 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.273
@types/node	26.5.1	26.6.1
@vitest/coverage-v8	5.0.0	5.0.1
@vitest/ui	5.0.0	5.0.1
acorn	8.17.0	8.18.0
fast-check	4.10.0	4.10.1
magic-string	1.3.1	1.4.1
onnxruntime-node	1.20.1	1.30.0
rolldown-plugin-dts	0.28.4	0.28.6
snappy	7.3.3	7.4.3
typebox	1.3.30	1.3.32
vite	8.2.2	8.3.0
vitest	5.0.0	5.0.1
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-21 — run · 12 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
acorn	8.17.0	8.18.0
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
onnxruntime-node	1.20.1	1.29.0
rolldown-plugin-dts	0.28.4	0.28.5
snappy	7.3.3	7.4.3
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-20 — run · 12 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
acorn	8.17.0	8.18.0
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
onnxruntime-node	1.20.1	1.29.0
rolldown-plugin-dts	0.28.4	0.28.5
snappy	7.3.3	7.4.3
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 12 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.269
@mdn/browser-compat-data	8.1.0	8.1.1
acorn	8.17.0	8.18.0
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
onnxruntime-node	1.20.1	1.29.0
rolldown-plugin-dts	0.28.4	0.28.5
snappy	7.3.3	7.4.3
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 11 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.268
@mdn/browser-compat-data	8.1.0	8.1.1
acorn	8.17.0	8.18.0
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
onnxruntime-node	1.20.1	1.29.0
rolldown-plugin-dts	0.28.4	0.28.5
snappy	7.3.3	7.4.3
vite	8.2.2	8.3.0

commits

• chore(deps): apply weekly update fixes

---

Note

Medium Risk
Wide dependency and native-runtime bumps (especially onnxruntime-node and Vite/vitest) can affect CI and model-builder paths; devEngines now allows npm as well as pnpm for local tooling checks.

Overview
Rolling fleet catalog and lockfile refresh: bumps pinned dev/build tooling and libraries (including Vite 8.3, onnxruntime-node 1.29, snappy 7.4, Claude Code, acorn, magic-string, and related override/dedup pins) with a regenerated pnpm-lock.yaml.

Also bumps Node in .node-version to 26.8.2 and changes package.json devEngines.packageManager from pnpm-only to an array that accepts both npm and pnpm at the existing version ranges (lockfile’s bundled pnpm moves 12.4.2 → 12.4.1).

^{Reviewed by Cursor Bugbot for commit b14d90d. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​ui@​5.0.0 ⏵ 5.0.1				-1
	@​vitest/​coverage-v8@​5.0.0 ⏵ 5.0.1
	vitest@​5.0.0 ⏵ 5.0.1	+1		+1	-1
	@​types/​node@​26.6.1
	acorn@​8.17.0 ⏵ 8.18.0	+1		+1
	onnxruntime-node@​1.20.1 ⏵ 1.30.0	+1		+3	+4
	yaml@​2.9.0 ⏵ 2.9.1	+1
	snappy@​7.3.3 ⏵ 7.4.3	+2		+1	+7
	fast-check@​4.10.0 ⏵ 4.10.1			+1	+2
	magic-string@​1.2.3 ⏵ 1.4.1			+1
	typebox@​1.3.30 ⏵ 1.3.32			+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​ui@​5.0.0 ⏵ 5.0.1				-1
	@​vitest/​coverage-v8@​5.0.0 ⏵ 5.0.1				-1
	vitest@​5.0.0 ⏵ 5.0.1	+1		+1
	@​types/​node@​26.6.1
	onnxruntime-node@​1.20.1 ⏵ 1.30.0	+6		+3	+4
	snappy@​7.3.3 ⏵ 7.4.3	+2		+1	+7
	acorn@​8.17.0 ⏵ 8.18.0	+1			+3
	yaml@​2.9.0 ⏵ 2.9.1	+1			+6
	fast-check@​4.10.0 ⏵ 4.10.1			+1	+2
	magic-string@​1.2.3 ⏵ 1.4.1			+1
	typebox@​1.3.30 ⏵ 1.3.32			+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b14d90d. Configure here.}

[cursor]

Package manager pin test will fail

Medium Severity

devEngines.packageManager is now an array of npm and pnpm entries, but the seeded-manifest test still reads .name and .version on that value as if it were a single object. Those properties are undefined on an array, so the package-manager coherence assertion fails.

 

^{Reviewed by Cursor Bugbot for commit b14d90d. Configure here.}