[dependabot]

Bumps the all-dependencies group with 9 updates in the / directory:

Package	From	To
@biomejs/biome	2.6.3	2.6.5
@cloudflare/vite-plugin	1.65.0	1.67.0
@cloudflare/vitest-plugin	1.4.7	1.6.0
@playwright/test	1.64.1	1.65.0
@types/node	26.6.5	26.6.6
playwright-core	1.64.1	1.65.0
vite	8.3.5	8.3.6
vitest	5.0.5	5.1.0
wrangler	4.152.0	4.158.0

Updates @biomejs/biome from 2.6.3 to 2.6.5

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.5

2.6.5

Patch Changes

• #12755 bbc4887 Thanks @​dyc3! - Added the new nursery rule noArrayForEach, which reports forEach() calls that can be written as for...of loops. Values known not to be arrays, such as a Map or a Set, are ignored.

  array.forEach((element) => {
  	bar(element);
  });

• #12777 ba692e4 Thanks @​dyc3! - Added the new nursery rule noAwaitInPromiseMethods, which reports await inside the array passed to Promise.all(), Promise.allSettled(), Promise.any(), or Promise.race(). The await pauses the code before the method is called, so the promises no longer run at the same time.

  Promise.all([await promise, anotherPromise]);

• #12765 af84fb4 Thanks @​dyc3! - Added the new nursery rule noChainedComparison, which reports comparisons chained like a < b < c or a === b === c. JavaScript compares a with b first, and then compares the resulting true or false with c, so 3 > 2 > 1 is false.

  if (a < b < c) {}

• #12547 0a2073d Thanks @​dyc3! - Added the nursery rule noDynamicDelete, which disallows using delete with a property name that is computed at runtime. Fixed property names written as string or number literals are allowed.

  delete container[name];

• #12481 ed7adc2 Thanks @​dyc3! - Added the nursery rule noLateEventControl, which reports calls to preventDefault(), stopPropagation(), and stopImmediatePropagation() that run after the browser has finished handling the event, where they have no effect.

  element.addEventListener("click", async (event) => {
    await save();
    event.preventDefault();
  });

• #12795 179666d Thanks @​dyc3! - Added the nursery rule noMapSpread, which disallows spreading objects or arrays in the values returned by map() and flatMap() callbacks. Each spread copies a whole object or array for every item, which is slow for large arrays. Its unsafe fix replaces an object that starts with a spread with Object.assign().

  const users = getUsers();
  const rows = users.map((user) => ({ ...user, role: getRole(user) }));

• #12793 d9a99fd Thanks @​dyc3! - Added the nursery rule noMismatchedMapKey, which reports get() and set() calls that use a different key than the has() check before them. Checking one key and then using another is usually a copy-paste mistake.

... (truncated)

Commits

• fca5c35 ci: release (#12918)
• d96de1d feat(lint): add noSvelteBindValueOnCheckableInputs (#12241)
• 8f28e3f feat(lint): add useVueOneComponentPerFile (#12773)
• 041c800 feat(lint): add noVueUselessTemplateAttributes (#12789)
• d9a99fd feat(lint): add noMismatchedMapKey (#12793)
• 179666d feat(lint): add noMapSpread (#12795)
• b0d3390 feat(lint): add useSvelteStoreInitialValue (#12302)
• c23e4c3 feat(lint): add noObjectLiteralComparison (#12790)
• a108773 feat(lint): add noUselessAwait (#12772)
• 793f07d feat(lint): add noPlaywrightUnsafeReferences (#12450)
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.65.0 to 1.67.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.67.0

Minor Changes

• #16543 0489cda Thanks @​petebacondarwin! - Validate asset ignore files and update local Flagship support

  Upgrade Miniflare to 5.20261023.2-beta and Wrangler to 4.155.0. Builds and asset manifest generation now reject .assetsignore files with invalid UTF-8 or null characters instead of silently ignoring their patterns. The Local Explorer also supports Flagship management by app ID, and local flag evaluations retain metadata.

  Miniflare also waits for temporary file cleanup before disposal completes, so closing or restarting a Vite dev server finishes cleanup before returning.

• #16579 e696113 Thanks @​petebacondarwin! - Support remote Analytics Engine bindings in Vite plugin v1

  Set remote: true on an analytics_engine_datasets entry in wrangler.jsonc to send writeDataPoint() calls from local development and preview to the real dataset.

Patch Changes

• #16578 2eae147 Thanks @​petebacondarwin! - Close Vite HMR WebSocket upgrades when Vite WebSockets are disabled

  Previously, server.ws: false left the browser's raw upgrade socket pending because no Vite handler claimed it. Worker and Sandbox WebSocket forwarding remains unchanged.

• #16639 a6f98d0 Thanks @​petebacondarwin! - Update the v1 local runtime to workerd 1.20261101.1

  Upgrade Miniflare to 5.20261101.0-beta with matching Wrangler and shared SDK dependencies. Local development and preview use the November 1 runtime, and Workers without an explicit compatibility date default to 2026-11-01. Update Workers types to match the runtime.

@​cloudflare/vite-plugin@​1.66.0

Minor Changes

• #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.67.0

Minor Changes

• #16543 0489cda Thanks @​petebacondarwin! - Validate asset ignore files and update local Flagship support

  Upgrade Miniflare to 5.20261023.2-beta and Wrangler to 4.155.0. Builds and asset manifest generation now reject .assetsignore files with invalid UTF-8 or null characters instead of silently ignoring their patterns. The Local Explorer also supports Flagship management by app ID, and local flag evaluations retain metadata.

  Miniflare also waits for temporary file cleanup before disposal completes, so closing or restarting a Vite dev server finishes cleanup before returning.

• #16579 e696113 Thanks @​petebacondarwin! - Support remote Analytics Engine bindings in Vite plugin v1

  Set remote: true on an analytics_engine_datasets entry in wrangler.jsonc to send writeDataPoint() calls from local development and preview to the real dataset.

Patch Changes

• #16578 2eae147 Thanks @​petebacondarwin! - Close Vite HMR WebSocket upgrades when Vite WebSockets are disabled

  Previously, server.ws: false left the browser's raw upgrade socket pending because no Vite handler claimed it. Worker and Sandbox WebSocket forwarding remains unchanged.

• #16639 a6f98d0 Thanks @​petebacondarwin! - Update the v1 local runtime to workerd 1.20261101.1

  Upgrade Miniflare to 5.20261101.0-beta with matching Wrangler and shared SDK dependencies. Local development and preview use the November 1 runtime, and Workers without an explicit compatibility date default to 2026-11-01. Update Workers types to match the runtime.

1.66.0

Minor Changes

• #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

... (truncated)

Commits

• 7a293fc [vite-plugin] Version v1 maintenance release (#16600)
• a6f98d0 [vite-plugin] Update v1 to the November 1 runtime (#16639)
• 2eae147 [vite-plugin] Close disabled v1 HMR WebSocket upgrades (#16578)
• 0489cda [vite-plugin] Update v1 asset validation, Flagship and disposal runtime (#16543)
• ae80956 [vite-plugin] Version v1 maintenance release (#16544)
• 046db08 [vite-plugin] Update v1 development registry and runtime (#16539)
• 79678c4 [vite-plugin] Update v1 to the October 23 runtime (#16444)
• d3b872f [vite-plugin] Route v1 DevTools WebSocket upgrades explicitly (#16540)
• 436fa9a [vite-plugin] Preserve WebSockets owned by other v1 listeners (#16504)
• ca116f9 [vite-plugin] Clear v1 Worker exports between dev servers (#16503)
• Additional commits viewable in compare view

Updates @cloudflare/vitest-plugin from 1.4.7 to 1.6.0

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.6.0

Minor Changes

• #16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #16700 dc35efb Thanks @​cjol! - Bump bundled devalue from 5.6.3 to 5.9.3 to pick up security fixes

  devalue is bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.

• #16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, fa3edb3, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

  • wrangler@4.158.0
  • miniflare@5.20261104.0-beta

@​cloudflare/vitest-plugin@​1.5.1

Patch Changes

• #16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16609 da26b7f Thanks @​gpanders! - Fix tests failing to start with resolve.preserveSymlinks in isolated node_modules layouts

  With resolve.preserveSymlinks: true in a pnpm project, tests failed to start with No such module ".../node_modules/vitest/dist/chai", because a package's own dependencies are linked only next to its real path. Packages linked from a store inside node_modules now load from their real paths, and other files keep their symlinked paths.

• Updated dependencies [b14b9dc, 44d1ee4, b14b9dc, d2eda1c, 2750917, 34f34b3]:

  • miniflare@5.20261103.0-beta
  • wrangler@4.157.0

@​cloudflare/vitest-plugin@​1.5.0

Minor Changes

• #16424 1598fd3 Thanks @​edmundhung! - Promote experimental.newConfig to a stable config option

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.6.0

Minor Changes

• #16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #16700 dc35efb Thanks @​cjol! - Bump bundled devalue from 5.6.3 to 5.9.3 to pick up security fixes

  devalue is bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.

• #16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, fa3edb3, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

  • wrangler@4.158.0
  • miniflare@5.20261104.0-beta

1.5.1

Patch Changes

• #16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16609 da26b7f Thanks @​gpanders! - Fix tests failing to start with resolve.preserveSymlinks in isolated node_modules layouts

  With resolve.preserveSymlinks: true in a pnpm project, tests failed to start with No such module ".../node_modules/vitest/dist/chai", because a package's own dependencies are linked only next to its real path. Packages linked from a store inside node_modules now load from their real paths, and other files keep their symlinked paths.

• Updated dependencies [b14b9dc, 44d1ee4, b14b9dc, d2eda1c, 2750917, 34f34b3]:

  • miniflare@5.20261103.0-beta
  • wrangler@4.157.0

1.5.0

... (truncated)

Commits

• See full diff in compare view

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

Commits

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates playwright-core from 1.64.1 to 1.65.0

Release notes

Sourced from playwright-core's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

Commits

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Updates vite from 8.3.5 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

• align charset case (#23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

• await overlapping plugin container close call...

  Description has been truncated