chore(deps): update parcel monorepo to v2.16.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@parcel/config-webextension	2.13.3 → 2.16.4
@parcel/resolver-default	2.13.3 → 2.16.4
parcel	2.13.3 → 2.16.4

---

Release Notes

parcel-bundler/parcel (@​parcel/config-webextension)

v2.16.4

Compare Source

Fixed

• Dev server
  • Add --no-cors option to disable CORS headers – Details

v2.16.3

Compare Source

Fixed

• React Server Components
  • Fix react-dom import (bug in 2.16.2)

v2.16.2

Compare Source

Fixed

• HTML

  • Fix siblings after <svg> being removed by HTML minifier – Details

• React Server Components

  • Bump react-server-dom-parcel to ^19.1.1 to fix vulnerability
  • Fix cache key clash in @parcel/packager-react-static – Details
  • Fix using inline string transformers with @parcel/packager-react-static – Details
  • Preload CSS as soon as the RSC payload loads, without waiting for it to mount. This is useful for pre-fetching. – Details

v2.16.1

Compare Source

Fixed

• JavaScript

  • Fix macro location information – Details

• React Server Components
  Improve performance of RSC builds – Details

v2.16.0

Compare Source

Added

• JavaScript
  • Code split re-exports when scope hoisting is disabled – Details

Fixed

• JavaScript
  • Scope macro asset unique keys to the parent asset – Details

v2.15.4

Compare Source

v2.15.3

Compare Source

Fixed

• JavaScript

  • Expose line and column number to macros – Details

• React Server Components

  • Invalidate cache in ReactStaticPackager when pages are added or client components change – Details
  • Fix lazy mode with React Server Components – Details
  • Fix @parcel/rsc duplicate types – Details
  • Ensure publicUrl ends with a slash in react-static packager – Details
  • Fix hash reference replacement in react-static packager – Details

v2.15.2

Compare Source

Fixed

• Core

  • Change minimum required glibc version to 2.26 – Details
  • Cache inline bundle packaging – Details
  • Use stable id for package requests – Details

• HTML

  • Do not remove <meta charset="utf-8"> – Details

• MDX

  • Make URL dependencies in MDX files optional – Details

• React Server Components

  • Fix memory leak in react-static packager – Details

• Resolver

  • Fix resolving source package exports condition from self reference – Details

• SVG

  • Update oxvg – Details

• Compressors

  • Use max level compression for brotli compressor – Details

v2.15.1

Compare Source

Fixed

• HTML

  • Fix serializing <template> element contents – Details

• JavaScript

  • Skip optional dependencies in ESM externals – Details

v2.15.0

Compare Source

Added

• Core

  • Distribute Rust binaries for each architecture as separate npm packages – Details

• HTML and SVG

  • Add Rust-based transformer/packager/optimizer for HTML and SVG – Details

• Resolver

  • Support cloudflare: scheme and no longer rewrite node: scheme – Details

Fixed

• Core

  • Avoid segmentation fault on thread exit on Linux – Details
  • Support older GLIBC versions on Linux – Details

• JavaScript

  • Include all symbols in non-browser entries – Details
  • Update swc and mdx-rs – Details
  • Fix exporting objects with non-configurable prototypes from React Server Components – Details

v2.14.4

Compare Source

Fixed

• Core

  • Fix duplicate bundles error message – Details

• JavaScript

  • Support ESM externals and exports in dev packager – Details
  • Treat Deno's jsr: dependencies as external – Details

v2.14.3

Compare Source

Fixed

• JavaScript
  • Updated to React 19.1, which enables Server Components to be used with stable React instead of only canary – Details

v2.14.2

Compare Source

Fixed

• Core

  • Enable resolving source field in dev dependencies – Details
  • Error when building a library target in serve mode – Details

• JavaScript

  • Fix MDX inline assets in static RSCs – Details
  • Fix symbol collection with multiple exports of same function (e.g. date-fns) – Details

• REPL

  • Fix error overlay resolution in REPL – Details

• create-parcel

  • Fix gitignore in create-parcel – Details
  • Fix create-parcel on windows – Details

v2.14.1

Compare Source

Fixed

• Resolver
  • Fix resolving package self references – Details

v2.14.0

Compare Source

Added

• Core

  • Add a CLI to create new Parcel apps – Details

• JavaScript

  • React Server Components – Details, Details, Details, Details, Details
  • Add RSC-based static site generator – Details
  • First-class MDX support – Details
  • Merge React Refresh runtime and transformer – Details
  • Modernize React error overlay – Details
  • Support bundling node native modules – Details
  • Use import maps for bundle manifest – Details

• Dev Server

  • Support running node bundles in dev server – Details
  • Apply HMR updates via node worker thread – Details

Fixed

• Core
  • Fix dev dep request missing 'invalidateOnCreate' – Details
  • Add napi-wasm as optional peer dependency in @​parcel/rust – Details

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[polylane]

Warning

Polylane could not verify the production impact of this pull request.

Lockfile-only Parcel devDependency bump (2.13.3→2.16.4): the delta since the last reviewed head is just transitive browserslist-chain bumps, and the Test workflow (which runs parcel build via npm test) passed at 91d24f8 — no runtime code or production resource changes.

View the full analysis →

Failure trajectories: none plausible. 1 failure mode was considered and refuted against observed production traffic.

Refuted trajectory (1): what was ruled out, and why

• Parcel 2.16.x regression produces a broken extension artifact at next release: CI already ran the identical build with the bumped bundler at the head SHA and passed (run 34991851411, conclusion success, 2026-09-15T15:57:09Z); package.json (unchanged) pins the same manifest source, targets, and distDir, so the only variable the PR introduces is the bundler version itself, which the CI build validated. No connected cloud account (Fly/Vercel/Cloudflare/Supabase) runs or serves this repository's code — the release pipeline is the sole consumer path, and it gates on this same green build.

Dependency changes

Package	Change	Jump	Release age
@msgpackr-extract/msgpackr-extract-darwin-arm64 (lockfile)	3.0.3 → 3.0.4	patch	—
@msgpackr-extract/msgpackr-extract-darwin-x64 (lockfile)	3.0.3 → 3.0.4	patch	—
@msgpackr-extract/msgpackr-extract-linux-arm (lockfile)	3.0.3 → 3.0.4	patch	—
@msgpackr-extract/msgpackr-extract-linux-arm64 (lockfile)	3.0.3 → 3.0.4	patch	—
@msgpackr-extract/msgpackr-extract-linux-x64 (lockfile)	3.0.3 → 3.0.4	patch	—
@msgpackr-extract/msgpackr-extract-win32-x64 (lockfile)	3.0.3 → 3.0.4	patch	—
@parcel/bundler-default (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/cache (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/codeframe (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/compressor-raw (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/config-default (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/config-webextension (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/core (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/diagnostic (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/error-overlay (lockfile)	added 2.16.4	—	—
@parcel/events (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/feature-flags (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/fs (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/graph (lockfile)	3.3.3 → 3.6.4	minor	—
@parcel/logger (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/markdown-ansi (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/namer-default (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/node-resolver-core (lockfile)	3.4.3 → 3.7.4	minor	—
@parcel/optimizer-css (lockfile)	2.13.3 → 2.16.4	minor	—
@parcel/optimizer-html (lockfile)	added 2.16.4	—	—

_{…and 32 more dependency changes not shown.}

Polylane could not find the cloud resources this repository manages, so this review looked at the entire cloud account. Connect this repository to its resources and the next review will focus on exactly what this code deploys to.

_{Polylane analysed 91d24f8 for production impact.}

Did this help? React 👍 or 👎 so the next review is sharper.