chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-10-10 — run · 7 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.288
@modelcontextprotocol/client	2.2.0	2.3.0
portless	0.15.6	0.15.7
shell-quote	1.11.0	1.12.0
typescript	7.1.0-dev.20261001.1	7.1.0-dev.20261002.1
vite	8.3.1	8.3.2
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-21 — run · 9 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-20 — run · 9 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 9 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.269
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 8 updated

package	from	to
@anthropic-ai/claude-code	2.1.220	2.1.268
@mdn/browser-compat-data	8.1.0	8.1.1
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
magic-string	1.2.3	1.3.1
rolldown-plugin-dts	0.28.4	0.28.5
vite	8.2.2	8.3.0

commits

• chore(deps): apply weekly update fixes

---

Note

Medium Risk
Touches the shared build/test toolchain (Vite 8.3 and Vitest’s Vite peer) plus many pinned transitives; no application runtime logic, but CI and local installs are the main blast radius.

Overview
This rolling dependency refresh bumps the fleet Node pin to 26.8.2 and updates the pnpm catalog (notably vite 8.2.2 → 8.3.0, @anthropic-ai/claude-code, ecc-agentshield, magic-string, fast-check, compromise, rolldown-plugin-dts, and @mdn/browser-compat-data), with matching override/lockfile churn for shared transitives (picomatch, protobufjs, content-type, etc.).

package.json devEngines.packageManager changes from a single pnpm entry to an array that also declares npm at the same version ranges as engines, so both package managers are explicitly allowed/enforced. pnpm-lock.yaml reflects the catalog bumps and refreshes the embedded pnpm tool pin (12.4.2 → 12.4.1).

^{Reviewed by Cursor Bugbot for commit d53f46a. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​modelcontextprotocol/​client@​2.2.0 ⏵ 2.3.0	+1		+1	+1
	typescript@​7.1.0-dev.20261001.1 ⏵ 7.1.0-dev.20261002.1	+1		+1
	shell-quote@​1.11.0 ⏵ 1.12.0	+1
	portless@​0.15.6 ⏵ 0.15.7	+2		+1	-1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​modelcontextprotocol/​client@​2.2.0 ⏵ 2.3.0	+1		+1
	typescript@​7.1.0-dev.20261001.1 ⏵ 7.1.0-dev.20261002.1	+1		+1
	shell-quote@​1.11.0 ⏵ 1.12.0	+1
	portless@​0.15.6 ⏵ 0.15.7	+2		+1	-1

View full report