chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	26.4.1 → 26.6.4			devDependencies	minor
danielroe/uppt	v0.6.9 → v0.6.11			action	patch
tsdown (source)	0.22.14 → 0.23.0			devDependencies	minor

---

Release Notes

danielroe/uppt (danielroe/uppt)

v0.6.11

Compare Source

compare changes

🚀 Enhancements

• Add nightly publishing (#​75)
• Respect hand-edited release pr versions (00ffbe0)
• pr: Run on pushes to release branches (800be04)

🩹 Fixes

• publish: Tolerate E403 when republishing nightlies (3934767)
• pr: Tighten hand-edited version pinning and surface warnings (113eb4c)
• pr: Paginate open release PR lookups and keep updating PRs with extra commits (6ec2714)

💅 Refactors

• Sync lockstep release branches via syncReleaseBranch (c777f2b)

❤️ Contributors

• @​danielroe

v0.6.10

Compare Source

compare changes

🚀 Enhancements

• pr: Treat revert commits as release-worthy (#​70)

🩹 Fixes

• pr,release: Use correct diff link + strip pending timetable line (6959b96)

🏡 Chore

• Pin README example to v0.6.9 (e01133f)
• Add back zizmor-ignore comment (83d5a78)

✅ Tests

• Add some additional tests (d79b75d)

🤖 CI

• Use pnpm/setup and devEngines (#​64)
• Replace agentscan action with the github app (511fe92)

❤️ Contributors

• Daniel Roe (@​danielroe)

rolldown/tsdown (tsdown)

v0.23.0

Compare Source

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in #​1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)
• report: Add summary option to skip per-file size logs  -  by @​lazerg in #​1036 (020e9)

   🐞 Bug Fixes

• Allow unplugin-unused v0.5+  -  by @​sxzz (53c78)
• Ignore optional dependencies in type definitions  -  by @​sxzz (94622)
• cli:
  • Camel-case nested flag keys  -  by @​sxzz (bf53f)
• css:
  • Watch files imported via @import  -  by @​lazerg in #​1038 (ebee5)
• deps:
  • Apply resolveDepSubpath when neverBundle is true  -  by @​lazerg in #​1053 (4943c)
• exports:
  • Scope inlined dependencies to configs with exports  -  by @​lazerg in #​1040 (d5b80)
• migrate:
  • Pin migrated projects to tsdown 0.22.14  -  by @​sxzz (113fb)
  • Support non-interactive environments  -  by @​sxzz (51e41)

   🏎 Performance

• Remove asyncDispose polyfill  -  by @​sxzz (82675)
• Replace ansis with util.styleText  -  by @​sxzz (be6bf)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coldtea-pr-lens]

◈ PR Lens

Note

This drawing shows 2890972, and the branch has new commits since. Tick Redraw to draw the latest one

• Redraw

🟢 +0 new · 🟠 ~1 changed · 🔴 -0 removed · 0 flows · 2 files · commit 2890972

Architecture

1 component touched across 2 lanes.

Open the interactive canvas

Data flow

No data-flow sequence changed in this PR.

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change.

🪧 More tips

• Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists.
• Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds.
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through.
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time.
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time.
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push.
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works.
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one.
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion.

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​26.4.1 ⏵ 26.6.4	+1		+1
	tsdown@​0.22.14 ⏵ 0.23.0			+1	+3

View full report

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0a2a525f-d5ec-45df-b337-47b721944aa5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}