chore(deps): update all non-major dependencies

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@types/chrome (source)	^0.1.38 → ^0.3.0
@vitejs/devtools (source)	^0.3.0 → ^0.8.0
pnpm (source)	11.1.0 → 11.28.5

---

Release Notes

vitejs/devtools (@​vitejs/devtools)

v0.8.0

Compare Source

   🚨 Breaking Changes

• kit: Move json-render to @​vitejs/devtools  -  by @​antfubot in #​604 (b3a12)

   🐞 Bug Fixes

• Use auto-loaded DevTools in UI dev servers  -  by @​webfansplz (29e11)
• core:
  • Missing types for DevTools() config options  -  by @​jycouet in #​608 (a4805)
• oxc:
  • Preserve successful formatting with stderr notices  -  by @​SaKaNa-Y and Leo in #​594 (1b10c)
• rolldown:
  • Prevent builds from inheriting development NODE_ENV  -  by @​zahidzorbaz in #​587 (bc2e8)
  • Include asset and package data in static reports  -  by @​SaKaNa-Y in #​598 (bc7ff)
  • Keep filtered-out importers from hiding modules in the module graph  -  by @​IWANABETHATGUY in #​610 (2579c)
  • Make run build record sessions and exit cleanly  -  by @​webfansplz in #​609 (aeee7)
• vite:
  • Include no-result transform hooks in module timings  -  by @​SaKaNa-Y in #​599 (6e933)
  • Include no-result load hooks in module timings  -  by @​SaKaNa-Y in #​606 (4cfb4)
  • Include same-ID resolutions in module timings  -  by @​SaKaNa-Y in #​607 (89a70)

    View changes on GitHub

v0.7.6

Compare Source

   🚀 Features

• core: Support devtools injection in builds  -  by @​webfansplz in #​580 (63c34)

   🐞 Bug Fixes

• Register Vite DevTools for devframe discovery  -  by @​posva in #​579 (d65db)
• Respect project paths and Vite+ build commands  -  by @​hyoban in #​581 (f23bf)
• core: Declare client module resolution before plugin setup  -  by @​morinokami in #​582 (006b0)
• vitest: Embed the tokenized Vitest UI URL  -  by @​zahidzorbaz and Claude Opus 5.5 (1M context) in #​588 (9cef6)

    View changes on GitHub

v0.7.5

Compare Source

   🚀 Features

• Forward onTrusted from DevToolsConfig to the interactive auth handler  -  by @​antfubot in #​575 (bdb29)
• Upgrade to devframe v1.0  -  by @​antfu (6f857)

    View changes on GitHub

v0.7.4

Compare Source

   🚀 Features

• Upgrade devframe to v0.10.0  -  by @​antfubot in #​573 (f7800)

   🐞 Bug Fixes

• docs: Prebundle fastdom for Mermaid  -  by @​yuyinws in #​567 (ba659)
• oxc: Align setup dialog actions  -  by @​yuyinws (0ed75)

   🏎 Performance

• Cleanup deps  -  by @​antfu (dc715)

    View changes on GitHub

v0.7.3

Compare Source

   🚀 Features

• oxfmt: Format inspector  -  by @​yuyinws in #​564 (09098)

    View changes on GitHub

v0.7.2

Compare Source

   🚀 Features

• core:
  • Honor deploy base in static build  -  by @​antfubot in #​555 (e6402)
  • Opt out of the MCP auto-mount for Vite-plugin consumers  -  by @​antfubot in #​559 (3f8b9)

    View changes on GitHub

v0.7.1

Compare Source

   🐞 Bug Fixes

• core: Allow omitted host and root in vite integration  -  by @​webfansplz (b8ee7)

    View changes on GitHub

v0.7.0

Compare Source

   🚀 Features

• core: Resolve vite integration options within devtools  -  by @​webfansplz in #​549 (6a8f0)

    View changes on GitHub

v0.6.3

Compare Source

   🚀 Features

• core: Harden build-mode auth with a per-process capability token  -  by @​antfubot in #​553 (acb2a)

    View changes on GitHub

v0.6.2

Compare Source

   🐞 Bug Fixes

• kit: Restore rpc module augmentation  -  by @​webfansplz in #​551 (c008f)

    View changes on GitHub

v0.6.1

Compare Source

   🚀 Features

• core:
  • Support configurable dock renderers  -  by @​dvcolomban in #​542 (e2928)
  • Allow hosts to override the client auth banner  -  by @​danielroe in #​548 (1c716)
• oxc:
  • Oxfmt setup  -  by @​yuyinws in #​545 (99329)

   🐞 Bug Fixes

• vite: Show unavailable tips in standalone mode  -  by @​webfansplz in #​544 (85e6f)

    View changes on GitHub

v0.6.0

Compare Source

No significant changes

    View changes on GitHub

v0.5.2

Compare Source

   🚀 Features

• core:
  • Allow hosts to override DevTools branding  -  by @​antfubot and @​antfu in #​543 (de9e3)
  • Support vite devtools in serve mode  -  by @​webfansplz in #​541 (9df9d)

    View changes on GitHub

v0.5.1

Compare Source

   🐞 Bug Fixes

• core: Skip interactive-auth registration when client auth is disabled  -  by @​antfubot in #​540 (80da2)
• ui: Align vite and rolldown home banner spacing  -  by @​webfansplz in #​536 (66bd0)

   🏎 Performance

• Trim package dependencies by reusing devframe utilities  -  by @​antfubot in #​538 (94302)

    View changes on GitHub

v0.5.0

Compare Source

   🚀 Features

• Upgrade to devframe v0.9.0-beta and adopt @​devframes/hub-ui client  -  by @​antfubot and @​antfu in #​529 (35245)
• Upgrade devframe to v0.9.1 and adopt bare-specifier dock client script resolution  -  by @​antfubot in #​534 (9230d)
• Upgrade devframe to v0.9.2  -  by @​antfubot in #​535 (111f7)
• core: Migrate to devframe 0.9.0-beta.4 and expose dockPreferences + embeddedVisibility  -  by @​antfubot in #​531 (0f69d)
• oxc: Add oxlint setup launcher  -  by @​yuyinws in #​512 (62796)

   🐞 Bug Fixes

• core:
  • Define Vue feature flags for non-Vue hosts  -  by @​webfansplz in #​514 (4fdf7)
  • Close ws transport on vite server shutdown  -  by @​webfansplz in #​519 (2fa4b)

    View changes on GitHub

v0.4.12

Compare Source

   🚀 Features

• Add Auto/Light/Dark color mode switcher to settings  -  by @​antfubot and @​antfu in #​510 (6c992)
• Always-fresh production tarballs + Nuxt DevTools production playground  -  by @​antfubot in #​511 (afca0)
• core:
  • Render group dock accentColor on group button and popover  -  by @​antfubot in #​509 (a2d20)
  • Select and Link components for json-render  -  by @​dvcolomban in #​508 (c2158)

    View changes on GitHub

v0.4.11

Compare Source

   🚀 Features

• core:
  • Tabs component for json-render, with real per-component prop types  -  by @​dvcolomban in #​492 (0d8ee)
  • Info/success/warning/danger variants on json-render Card & Stack  -  by @​dvcolomban in #​491 (0c871)

   🐞 Bug Fixes

• Keep plugin flow timeline visible when the calls table overflows  -  by @​SaKaNa-Y in #​504 (e6b4f)
• Keep plugin flow timeline vertically scrollable  -  by @​SaKaNa-Y in #​505 (37b67)
• core:
  • Forward loading to json-render Button's underlying BaseButton  -  by @​dvcolomban in #​497 (75483)
  • Card's collapse toggle now respects defaultCollapsed, and works without a title  -  by @​dvcolomban in #​490 (6ccc1)
  • Hide dock mode commands in popup mode  -  by @​SaKaNa-Y in #​502 (ff579)
  • Rebind frame-nav adapter when iframe realm changes  -  by @​SaKaNa-Y in #​503 (3d23c)

    View changes on GitHub

v0.4.10

Compare Source

   🚀 Features

• core: Type the remaining json-render catalog components' props  -  by @​dvcolomban in #​493 (341bc)
• oxc: Oxlint config inspector  -  by @​yuyinws in #​485 (04abd)
• playground: Mount official @​devframes/plugin-* dashboards  -  by @​antfubot, opencode and @​antfu in #​483 (06668)

   🐞 Bug Fixes

• core:
  • Render single overflow dock entry inline instead of behind overflow button  -  by @​antfubot in #​486 (b5b1d)
  • Add vite server fallback for embedded connections  -  by @​webfansplz in #​494 (969d4)
• ui:
  • Remove custom web fonts usage to reduce package size  -  by @​antfu (10f99)

    View changes on GitHub

v0.4.9

Compare Source

   🚀 Features

• core:
  • Allow configuring extra allowed origins for the DevTools WS transport  -  by @​dvcolomban in #​471 (f9087)
  • Opt-in variant/interactive on json-render Card & Stack, fix dock scrollbar in dark mode  -  by @​dvcolomban in #​477 (c279e)

   🐞 Bug Fixes

• core:
  • Scroll selected command palette item into view inside shad…  -  by @​SaKaNa-Y in #​474 (9ab86)
  • Hide stale panes when switching docks in popup mode  -  by @​SaKaNa-Y in #​475 (073ff)
  • Land a subTabs anchor on its live member tab, not the hidden anchor  -  by @​antfubot in #​473 (5d668)
  • Align grouped iframe address bar with sidebar  -  by @​webfansplz in #​482 (95c9f)
  • Prevent popup dock icons from being dimmed  -  by @​SaKaNa-Y in #​481 (4dfbe)
  • Command palette dark-on-dark text + glass-panel mismatch  -  by @​dvcolomban in #​478 (8becc)
• oxc:
  • Tolerate stdout notices ahead of oxlint's JSON payload  -  by @​dvcolomban in #​476 (c9504)
• ui:
  • Prevent dark mode from mutating host document  -  by @​SaKaNa-Y in #​480 (2ee70)

    View changes on GitHub

v0.4.8

Compare Source

   🚀 Features

• core: Add passive mode for the injected overlay  -  by @​antfubot in #​465 (c1440)

   🐞 Bug Fixes

• core: Keep a group's defaultChildId reachable regardless of visibility, respecting when  -  by @​antfubot in #​472 (a93cf)

    View changes on GitHub

v0.4.7

Compare Source

   🚀 Features

• core: Support render-only visibility on dock entries  -  by @​antfubot in #​470 (f4fd7)

    View changes on GitHub

v0.4.6

Compare Source

   🚀 Features

• core:
  • Fold group side nav overflow into a height-based show-more  -  by @​antfubot in #​467 (08127)
  • Re-bucket pinned docks into a dedicated ~pinned category  -  by @​antfubot in #​466 (7ccd6)
  • Allow a group entry to override its in-group sub-category order  -  by @​antfubot in #​468 (69bed)

    View changes on GitHub

v0.4.5

Compare Source

   🚀 Features

• core: Shared-iframe soft navigation (devframe 0.7.11)  -  by @​antfubot in #​464 (5cb6e)

   🐞 Bug Fixes

• kit: Disable devframe auth prompt fallback  -  by @​antfu in #​463 (0e9be)

    View changes on GitHub

v0.4.4

Compare Source

   🚀 Features

• core: Treat a grouped dock entry's category as an in-group sub-category  -  by @​antfubot and @​antfu in #​462 (17213)
• oxc: Open lint results in pages  -  by @​yuyinws in #​460 (dcd9e)
• vite: Add cache for rpc functions  -  by @​webfansplz in #​458 (c2898)

   🐞 Bug Fixes

• core: Clamp popovers to viewport  -  by @​webfansplz in #​461 (02128)

    View changes on GitHub

v0.4.3

Compare Source

   🚀 Features

• Upgrade devframe to v0.7.6  -  by @​antfu (572e0)
• Add pnpm run play playground picker  -  by @​antfubot in #​453 (14f51)
• Move viteplus group to framework category  -  by @​antfu (ff8d8)
• kit:
  • Let launchers offer selectable launch roots  -  by @​antfubot in #​448 (6dd78)
  • Revert serve launchers to launcher mode when their process exits  -  by @​antfubot in #​451 (f22f1)
  • Track install launcher progress in a terminal session  -  by @​antfubot in #​457 (77db1)
  • Adopt @​devframes/json-render (devframe v0.7.9)  -  by @​antfubot in #​454 (89b16)
• oxc:
  • Vite-plus detection  -  by @​yuyinws in #​449 (03e71)
• rolldown:
  • Add "Run build with devtools" button  -  by @​antfubot in #​431 (0b4a1)
  • Rework landing page with session panel, filtering and actions  -  by @​antfubot and @​antfu in #​452 (dff26)

    View changes on GitHub

v0.4.2

Compare Source

   🚀 Features

• Client vip  -  by @​yuyinws (a9547)
• Client vip  -  by @​yuyinws (98714)
• Update  -  by @​yuyinws (92737)
• Update  -  by @​yuyinws (fb42c)
• Add generate time  -  by @​yuyinws (9ffb5)
• Update  -  by @​yuyinws (60fd6)
• Update  -  by @​yuyinws (eda24)
• Update  -  by @​yuyinws (f9d15)
• Overview page  -  by @​yuyinws (c7da9)
• Add formatter configuration page and RPC function to retrieve formatter settings  -  by @​yuyinws (4d381)
• Enhance lint command to automatically append .oxc-inspector to .gitignore and improve version retrieval logic  -  by @​yuyinws (759dd)
• Upgrade devframe to 0.6.2 and adopt integration-owned built-in docks  -  by @​antfubot in #​411 (18c0d)
• Add production playground for testing the real user install path  -  by @​antfubot and @​antfu in #​413 (22e90)
• Unify devtools logos  -  by @​antfu (d8791)
• core:
  • Dependency-light install-launcher shell for built-in integrations  -  by @​antfubot and @​antfu in #​409 (a5766)
• kit:
  • Enrich launcher view with command binding, terminal digest, and session navigation  -  by @​antfubot in #​435 (c6644)
• oxc:
  • Build in turbo and mount in the core playground  -  by @​antfubot (76bc5)
  • Adopt oxc-inspector as the first-party @​vitejs/devtools-oxc package  -  by @​antfu (31dcf)
  • Migrate the DevTools UI onto @​vitejs/devtools-ui + UnoCSS  -  by @​antfubot in #​430 (40cd2)
  • Lint results inspecteor  -  by @​yuyinws and @​antfubot in #​432 (2a7a5)
• rolldown:
  • Show enable-devtools snippet in empty session state  -  by @​antfubot and @​antfu in #​410 (eca8f)
  • Group session list by date with collapsible sections  -  by @​antfubot in #​425 (53326)
• vitest:
  • Add Vitest UI launcher in the Vite+ group; mount Vite & Vitest as builtins  -  by @​antfubot and @​antfu in #​407 (0ddfa)

   🐞 Bug Fixes

• Project setup  -  by @​yuyinws (0f682)
• Add --yes flag to npx command in wrapOxlintCommand function  -  by @​yuyinws (79894)
• Grammar in README.md  -  by @​WuMingDao in #​1 (d37f1)
• Update RPC types and improve session page logic [close #​3]  -  by @​yuyinws in #​3 (d0cd0)
• Remove extraneous character in session page template  -  by @​yuyinws (b1a09)
• Adjust layout structure in index.vue for better responsiveness and visual consistency  -  by @​yuyinws (dc737)
• Update output message in lint command to clarify log generation location  -  by @​yuyinws (bb918)
• Update package and README descriptions for clarity  -  by @​yuyinws (95fa6)
• Web font path  -  by @​antfu (06712)
• core:
  • Use standalone root for integration detection  -  by @​webfansplz in #​423 (b0f43)
  • Restore integration cwd detection and harden build exit  -  by @​antfubot in #​427 (ba8a9)
  • Match settings toggle switches and checkboxes to primary color  -  by @​antfubot in #​426 (7f50b)
  • Inherit group category when grouping dock members  -  by @​SaKaNa-Y in #​437 (d35d0)
  • Handle keyboard shortcuts in popup windows  -  by @​SaKaNa-Y in #​440 (0c518)
  • Hide CommandPalette while dock popup is open  -  by @​SaKaNa-Y in #​438 (c9e0a)
• dock:
  • Prevent group buttons from sharing popover state  -  by @​SaKaNa-Y in #​442 (b2533)
• e2e:
  • Ignore HTTPS cert errors when fetching Iconify fallback icons  -  by @​antfubot in #​416 (b8608)
• kit:
  • Serve RPC connection meta at each devframe base  -  by @​antfubot and @​antfu in #​414 (11ea6)
• shortcuts:
  • Hide shortcut binding for non-executable commands  -  by @​SaKaNa-Y in #​441 (81c80)
• vite:
  • Correct font assets dir to Nuxt public dir  -  by @​antfubot in #​408 (9e778)

    View changes on GitHub

v0.4.1

Compare Source

   🐞 Bug Fixes

• Unify rolldown and vite icon  -  by @​antfu (032ec)
• core:
  • Stop password managers from offering to save the OTP auth code  -  by @​antfubot in #​404 (00556)
  • Propagate connection meta and owner document to popup  -  by @​SaKaNa-Y in #​402 (c79df)
  • Reposition FloatingPopover on window resize  -  by @​SaKaNa-Y in #​403 (5a359)
• ui:
  • Make ui more consistant  -  by @​antfu (0cef4)
  • Consistant ui  -  by @​antfu (210a7)
  • Update color  -  by @​antfu (98a20)

   🏎 Performance

• vite: Use disk logs with in-memory metadata  -  by @​webfansplz and @​antfu in #​400 (12bf5)

    View changes on GitHub

v0.4.0

Compare Source

   🚨 Breaking Changes

• Migrate to devframe 0.6 — official plugins, crossws + OTP auth  -  by @​antfubot in #​396 (ae955)

   🚀 Features

• Manage persistent iframes/panels with iframe-pane  -  by @​antfubot in #​394 (4429e)
• Hide Devframe Inspector by default and auto-hide empty terminals/messages docks  -  by @​antfubot in #​399 (67cf4)
• core: Add Storybook coverage for dock and floating-panel components  -  by @​antfubot and @​antfu in #​398 (68f00)

   🐞 Bug Fixes

• core: Bind draggable to owner document window in SettingsDocks  -  by @​SaKaNa-Y in #​392 (e993e)
• dock: Open position dropdown inward based on dock edge  -  by @​SaKaNa-Y in #​393 (3d59f)

    View changes on GitHub

v0.3.4

Compare Source

   🚀 Features

• core: Add Switch component to json-render catalog  -  by @​JianJroh in #​382 (a3d5e)
• vite: Inspect modules and plugins page  -  by @​webfansplz in #​389 (106f6)

   🐞 Bug Fixes

• Isolate typecheck for nuxt apps  -  by @​webfansplz in #​387 (12d36)
• core:
  • Use reactive settings ref in SettingsDocks  -  by @​SaKaNa-Y in #​379 (49be8)
  • Resolve vite server.https for websocket server  -  by @​webfansplz in #​381 (d62b9)
  • Preserve object-form dock icons in command projection  -  by @​SaKaNa-Y in #​378 (db10e)
  • Clear docks custom order when it matches default  -  by @​SaKaNa-Y in #​385 (c6ea6)
  • Include group members when checking/resetting docks custom order  -  by @​SaKaNa-Y in #​380 (1a7cb)
  • Use virtual module instead of fs URL for client injection  -  by @​webfansplz in #​388 (1e836)
• rolldown:
  • Empty status for module imports graph  -  by @​webfansplz (ced00)

    View changes on GitHub

v0.3.3

Compare Source

   🐞 Bug Fixes

• kit: Resolve constants exports  -  by @​webfansplz (47538)

    View changes on GitHub

pnpm/pnpm (pnpm)

v11.28.5: pnpm 11.28.5

Compare Source

This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.

Patch Changes

Security

• pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with version+integrity.

• Lockfile verification now checks the tarballs inside a variations resolution against the registry. A name@version lockfile entry with an empty variations resolution is now rejected.

• pnpm audit signatures now verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification.

• pnpm now rejects a git dependency whose lockfile repository is empty, begins with -, or contains a null byte. Git can no longer read such a value as a command-line option pnpm/tasks#84.

• A git dependency with a #path: subpath can no longer reach files outside the repository through a symlink in the subpath.

• pnpm pack, pnpm publish, and installs of git and local directory dependencies now leave out files that a directory symlink or a bundleDependencies entry points to outside the package directory pnpm/tasks#83 pnpm/tasks#93.

• pnpm deploy with deployAllFiles now rejects symlinks that point outside the package directory. Local package installs with this setting apply the same check.

• pnpm no longer hangs on a package archive with a negative PAX record length or an entry of 4 GiB or more pnpm/tasks#78 pnpm/tasks#79.

• Large package downloads and large files inside gzip and bzip2 package archives now use bounded memory during installation. Package manifests and ar

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (1706 entries)...
[WARN] Request took 10811ms: https://registry.npmjs.org/@typescript-eslint%2Feslint-plugin
[WARN] Request took 10032ms: https://registry.npmjs.org/@types%2Fnode
✗ Lockfile failed supply-chain policy check (1706 entries in 23.6s)
[ERR_PNPM_TRUST_DOWNGRADE] 4 lockfile entries failed verification:
  chokidar@4.0.3 High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)
  semver@6.3.1 High-risk trust downgrade for "semver@6.3.1" (possible package takeover)
  tinyexec@1.2.2 High-risk trust downgrade for "tinyexec@1.2.2" (possible package takeover)
  undici-types@6.21.0 High-risk trust downgrade for "undici-types@6.21.0" (possible package takeover)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. If the fresh resolution still fails and you trust the affected packages, relax the policy that flagged them.