feat(deps): upgrade upstream dependencies

Cargo.toml

@@ -276,7 +276,7 @@ simdutf8 = "0.1.5"
 smallvec = { version = "1.15.1", features = ["union"] }
 snapshot_test = { git = "https://github.com/voidzero-dev/vite-task.git", rev = "4003f65a3e5e3d957ff81b157e85e6ee41cc59fc" }
 string_cache = "0.9.0"
-sugar_path = { version = "2.0.1", features = ["cached_current_dir"] }
+sugar_path = { version = "3", features = ["cached_current_dir"] }
 supports-color = "3"
 syn = { version = "2", default-features = false }
 tar = "0.4.43"
@@ -317,7 +317,7 @@ xxhash-rust = "0.8.15"
 zip = { version = "7.2", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 
 # oxc crates with the same version
-oxc = { version = "0.139.0", features = [
+oxc = { version = "0.140.0", features = [
   "ast_visit",
   "transformer",
   "minifier",
@@ -329,22 +329,22 @@ oxc = { version = "0.139.0", features = [
   "regular_expression",
   "cfg",
 ] }
-oxc_allocator = { version = "0.139.0", features = ["pool"] }
-oxc_ast = "0.139.0"
-oxc_ecmascript = "0.139.0"
-oxc_parser = "0.139.0"
-oxc_span = "0.139.0"
-oxc_napi = "0.139.0"
-oxc_str = "0.139.0"
-oxc_minify_napi = "0.139.0"
-oxc_parser_napi = "0.139.0"
-oxc_transform_napi = "0.139.0"
-oxc_traverse = "0.139.0"
+oxc_allocator = { version = "0.140.0", features = ["pool"] }
+oxc_ast = "0.140.0"
+oxc_ecmascript = "0.140.0"
+oxc_parser = "0.140.0"
+oxc_span = "0.140.0"
+oxc_napi = "0.140.0"
+oxc_str = "0.140.0"
+oxc_minify_napi = "0.140.0"
+oxc_parser_napi = "0.140.0"
+oxc_transform_napi = "0.140.0"
+oxc_traverse = "0.140.0"
 
 # oxc crates in their own repos
 oxc_index = { version = "5", features = ["rayon", "serde"] }
-oxc_resolver = { version = "11.23.0", features = ["yarn_pnp"] }
-oxc_resolver_napi = { version = "11.23.0", default-features = false, features = ["yarn_pnp"] }
+oxc_resolver = { version = "11.24.2", features = ["yarn_pnp"] }
+oxc_resolver_napi = { version = "11.24.2", default-features = false, features = ["yarn_pnp"] }
 oxc_sourcemap = "8.1.0"
 
 # rolldown crates

packages/cli/binding/index.d.cts

@@ -1631,11 +1631,16 @@ export declare class BindingDevEngine {
   getBundleState(): Promise<BindingBundleState>;
   ensureLatestBuildOutput(): Promise<BindingResult<undefined>>;
   triggerFullBuild(): void;
-  invalidate(
-    caller: string,
-    firstInvalidatedBy?: string | undefined | null,
-  ): Promise<BindingResult<Array<BindingClientHmrUpdate>>>;
-  registerModules(clientId: string, modules: Array<string>): Promise<void>;
+  /**
+   * Client-connect signal (the clientId hello): creates the per-client session
+   * with an empty ship map. Reconnects arrive as fresh clientIds.
+   */
+  registerClient(clientId: string): Promise<void>;
+  /**
+   * Delivery notification from the serving middleware: the response for
+   * `filename` completed, so record its modules as shipped to that client.
+   */
+  notifyPayloadDelivered(filename: string): Promise<void>;
   removeClient(clientId: string): Promise<void>;
   close(): Promise<void>;
   /**
@@ -1645,7 +1650,7 @@ export declare class BindingDevEngine {
    * The module was previously stubbed with a proxy, and now we need to compile the
    * actual module and its dependencies.
    */
-  compileEntry(moduleId: string, clientId: string): Promise<string>;
+  compileEntry(moduleId: string, clientId: string): Promise<BindingLazyChunkOutput>;
 }
 
 export declare class BindingLoadPluginContext {
@@ -2355,19 +2360,18 @@ export interface BindingGeneratedCodeOptions {
   preset?: string;
 }
 
-export interface BindingHmrBoundaryOutput {
-  boundary: string;
-  acceptedVia: string;
-}
-
 export type BindingHmrUpdate =
   | {
       type: 'Patch';
       code: string;
       filename: string;
       sourcemap?: string;
-      sourcemapFilename?: string;
-      hmrBoundaries: Array<BindingHmrBoundaryOutput>;
+      sourcemapFilename?: string /**
+       * Stable ids of the changed modules — the `changedIds` of the push envelope.
+       * The client walks from these on its own graph.
+       */;
+      changedIds: Array<string> /** Per-client envelope sequence number. */;
+      seq: number;
     }
   | { type: 'FullReload'; reason?: string }
   | { type: 'Noop' };
@@ -2538,6 +2542,15 @@ export interface BindingJsWatchChangeEvent {
   event: string;
 }
 
+/**
+ * The client-facing slice of a lazy-compile result. The carried modules and
+ * stamps stay server-side as the engine's pending-payload entry.
+ */
+export interface BindingLazyChunkOutput {
+  code: string;
+  filename: string;
+}
+
 export interface BindingLog {
   message: string;
   id?: string;
@@ -2843,8 +2856,7 @@ export declare const enum BindingPropertyWriteSideEffects {
 
 export declare const enum BindingRebuildStrategy {
   Always = 0,
-  Auto = 1,
-  Never = 2,
+  Never = 1,
 }
 
 export interface BindingReplacePluginConfig {
@@ -3189,7 +3201,6 @@ export interface JsOutputChunk {
   map?: BindingSourcemap;
   sourcemapFilename?: string;
   preliminaryFilename: string;
-  preliminarySourcemapFilename?: string;
 }
 
 /** Error emitted from native side, it only contains kind and message, no stack trace. */

packages/cli/src/migration/migrator/eslint.ts

@@ -9,6 +9,7 @@ import { rewriteEslint } from '../../../binding/index.js';
 import { type WorkspacePackage } from '../../types/index.ts';
 import { runCommandSilently } from '../../utils/command.ts';
 import { editJsonFile, isJsonFile, readJsonFile } from '../../utils/json.ts';
+import { fetchNpmResource, getNpmRegistry } from '../../utils/npm-config.ts';
 import { displayRelative } from '../../utils/path.ts';
 import { cancelAndExit } from '../../utils/prompts.ts';
 import { getSpinner } from '../../utils/spinner.ts';
@@ -86,6 +87,39 @@ export function detectEslintProject(
   return { hasDependency, configFile, legacyConfigFile };
 }
 
+/**
+ * Resolve the `@oxlint/migrate` version to run.
+ *
+ * `@oxlint/migrate` normally tracks the bundled oxlint version, so we prefer an
+ * exact pin for reproducibility. But it is published from a separate release
+ * pipeline and occasionally lags oxlint by a version. When the exact bundled
+ * version isn't on the registry yet, fall back to the latest published
+ * `@oxlint/migrate` so migration keeps working instead of failing on a
+ * nonexistent version. Any network/registry error falls back to the bundled
+ * version string (best-effort — `vp dlx` then surfaces the real error).
+ */
+async function resolveOxlintMigrateVersion(bundledOxlintVersion: string): Promise<string> {
+  try {
+    const response = await fetchNpmResource(`${getNpmRegistry('@oxlint')}/@oxlint/migrate`, {
+      headers: { accept: 'application/json' },
+      timeoutMs: 5000,
+    });
+    if (!response.ok) {
+      return bundledOxlintVersion;
+    }
+    const packument = (await response.json()) as {
+      'dist-tags'?: Record<string, string>;
+      versions?: Record<string, unknown>;
+    };
+    if (packument.versions?.[bundledOxlintVersion]) {
+      return bundledOxlintVersion;
+    }
+    return packument['dist-tags']?.latest ?? bundledOxlintVersion;
+  } catch {
+    return bundledOxlintVersion;
+  }
+}
+
 /**
  * Run a `vp dlx @oxlint/migrate` step with graceful error handling.
  * Returns true on success, false on failure (spawn error or non-zero exit).
@@ -147,10 +181,11 @@ export async function migrateEslintToOxlint(
 
   // Steps 1-2: Only run @oxlint/migrate if there's an eslint config at root
   if (eslintConfigFile) {
-    // Pin @oxlint/migrate to the bundled oxlint version.
+    // Pin @oxlint/migrate to the bundled oxlint version (falling back to its
+    // latest published release when that exact version isn't on the registry yet).
     // @ts-expect-error — resolved at runtime from dist/ → dist/versions.js
     const { versions } = await import('../versions.js');
-    const migratePackage = `@oxlint/migrate@${versions.oxlint}`;
+    const migratePackage = `@oxlint/migrate@${await resolveOxlintMigrateVersion(versions.oxlint)}`;
     const migrateArgs = [
       '--merge',
       ...(!hasBaseUrlInTsconfig(projectPath) ? ['--type-aware'] : []),

packages/core/package.json

@@ -116,7 +116,7 @@
     "@oxc-node/core": "catalog:",
     "@tsdown/css": "catalog:",
     "@tsdown/exe": "catalog:",
-    "@vitejs/devtools": "^0.4.0",
+    "@vitejs/devtools": "^0.4.1",
     "es-module-lexer": "^1.7.0",
     "hookable": "^6.0.1",
     "magic-string": "^0.30.21",
@@ -215,7 +215,7 @@
   },
   "bundledVersions": {
     "vite": "8.1.4",
-    "rolldown": "1.1.5",
-    "tsdown": "0.22.7"
+    "rolldown": "1.2.0",
+    "tsdown": "0.22.8"
   }
 }

packages/tools/.upstream-versions.json

@@ -2,7 +2,7 @@
   "rolldown": {
     "repo": "https://github.com/rolldown/rolldown.git",
     "branch": "main",
-    "hash": "f09947ab017d6df74299f691853dcfc4f4f0f86e"
+    "hash": "03e1e3422cd85495c9863ff3bc3b24212d9f4be2"
   },
   "vite": {
     "repo": "https://github.com/vitejs/vite.git",