chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

---

Note

Low Risk
Routine pin and lockfile churn with no application logic changes; the Vite minor bump is the main toolchain touchpoint for Vitest and local builds.

Overview
This rolling dependency update refreshes fleet catalog pins and the lockfile for seven packages: vite 8.3.0 (with matching overrides and Vitest’s transitive Vite peers), @anthropic-ai/claude-code, ecc-agentshield, magic-string, compromise (and its suffix-thumb transitive), @mdn/browser-compat-data, and rolldown-plugin-dts.

.node-version moves to 26.8.2. package.json changes devEngines.packageManager from a single pnpm entry to an array that also allows npm at the same version ranges already declared under engines. The lockfile also records a pnpm bootstrap/tooling pin at 12.4.1 (down from 12.4.2 in the prior lockfile section).

^{Reviewed by Cursor Bugbot for commit 4b90f47. Configure here.}

2026-10-10 — run · 16 updated

package	from	to
@anthropic-ai/claude-code	2.1.278	2.1.288
@mdn/browser-compat-data	8.1.3	8.1.4
@modelcontextprotocol/client	2.2.0	2.3.0
@socketregistry/packageurl-js	1.5.3	1.6.0
@socketregistry/packageurl-js-stable	npm:@socketregistry/packageurl-js@1.5.3	npm:@socketregistry/packageurl-js@1.6.0
@socketsecurity/lib	7.0.3	7.1.0
@socketsecurity/lib-stable	npm:@socketsecurity/lib@7.0.3	npm:@socketsecurity/lib@7.1.0
@socketsecurity/sdk	4.1.5	4.2.0
@socketsecurity/sdk-stable	npm:@socketsecurity/sdk@4.1.5	npm:@socketsecurity/sdk@4.2.0
@types/node	26.6.3	26.6.4
fallow	3.30.0	3.31.0
portless	0.15.6	0.15.7
shell-quote	1.11.0	1.12.0
taze	21.2.0	21.3.0
typescript	7.1.0-dev.20260929.1	7.1.0-dev.20261002.1
vite	8.3.1	8.3.2

commits

• chore(deps): apply weekly update fixes

2026-10-09 — run · 14 updated

package	from	to
@anthropic-ai/claude-code	2.1.278	2.1.287
@mdn/browser-compat-data	8.1.3	8.1.4
@socketregistry/packageurl-js	1.5.3	1.6.0
@socketregistry/packageurl-js-stable	npm:@socketregistry/packageurl-js@1.5.3	npm:@socketregistry/packageurl-js@1.6.0
@socketsecurity/lib	7.0.3	7.1.0
@socketsecurity/lib-stable	npm:@socketsecurity/lib@7.0.3	npm:@socketsecurity/lib@7.1.0
@socketsecurity/sdk	4.1.5	4.2.0
@socketsecurity/sdk-stable	npm:@socketsecurity/sdk@4.1.5	npm:@socketsecurity/sdk@4.2.0
@types/node	26.6.3	26.6.4
fallow	3.30.0	3.31.0
portless	0.15.6	0.15.7
taze	21.2.0	21.3.0
typescript	7.1.0-dev.20260929.1	7.1.0-dev.20261001.1
vite	8.3.1	8.3.2

commits

• chore(deps): apply weekly update fixes

2026-09-21 — run · 9 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-20 — run · 9 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 9 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.269
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 8 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.268
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0

commits

• chore(deps): apply weekly update fixes

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​26.6.3 ⏵ 26.6.4			+1
	npm/​@​modelcontextprotocol/​client@​2.2.0 ⏵ 2.3.0	+1		+1	+1
	npm/​typescript@​7.1.0-dev.20260929.1 ⏵ 7.1.0-dev.20261002.1	+1		+1
	npm/​shell-quote@​1.11.0 ⏵ 1.12.0	+1
	npm/​@​socketsecurity/​lib@​7.0.3 ⏵ 7.1.0	+2		+1
	npm/​@​socketregistry/​packageurl-js@​1.5.3 ⏵ 1.6.0
	npm/​portless@​0.15.6 ⏵ 0.15.7	+2		+1	-1
	npm/​@​socketsecurity/​sdk@​4.1.5 ⏵ 4.2.0	+2		+1
	npm/​fallow@​3.30.0 ⏵ 3.31.0	+1
	npm/​taze@​21.2.0 ⏵ 21.3.0				+1
	npm/​@​mdn/​browser-compat-data@​8.1.3 ⏵ 8.1.4				+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​26.6.3 ⏵ 26.6.4			+1	+1
	npm/​@​modelcontextprotocol/​client@​2.2.0 ⏵ 2.3.0	+1		+1
	npm/​typescript@​7.1.0-dev.20260929.1 ⏵ 7.1.0-dev.20261002.1	+1		+1
	npm/​shell-quote@​1.11.0 ⏵ 1.12.0	+1
	npm/​@​socketsecurity/​sdk@​4.1.5 ⏵ 4.2.0	+2		+1	-3
	npm/​@​socketsecurity/​lib@​7.0.3 ⏵ 7.1.0	+2		+1
	npm/​portless@​0.15.6 ⏵ 0.15.7	+2		+1	-1
	npm/​@​socketregistry/​packageurl-js@​1.5.3 ⏵ 1.6.0
	npm/​taze@​21.2.0 ⏵ 21.3.0				-1
	npm/​fallow@​3.30.0 ⏵ 3.31.0	+1
	npm/​@​mdn/​browser-compat-data@​8.1.3 ⏵ 8.1.4

View full report