feat(deps): upgrade upstream dependencies

[voidzero-guard]

Summary

• Automated upgrade of upstream dependencies, headlined by rolldown v1.2.0 and vite v8.1.5.
• Bundled toolchain bumps: tsdown 0.22.9, oxfmt 0.59.0, oxlint 1.74.0, oxlint-tsgolint 0.25.0, and the oxc crates/packages to 0.140.0.
• Regenerated NAPI binding to track the rolldown dev-engine/HMR API changes, plus transitive Rust dep bumps.
• Migrator adjustment so ESLint→Oxlint migration tolerates @oxlint/migrate lagging oxlint's publish cadence.

Dependency updates

Package	From	To
rolldown	f09947a	v1.2.0 (03e1e34)
vite	a477454	v8.1.5 (5e7fe12)
tsdown	0.22.7	0.22.9
@tsdown/css	0.22.7	0.22.9
@tsdown/exe	0.22.7	0.22.9
oxfmt	0.58.0	0.59.0
oxlint	1.73.0	1.74.0
oxlint-tsgolint	0.24.0	0.25.0
@oxc-project/runtime	0.139.0	0.140.0
@oxc-project/types	0.139.0	0.140.0
oxc-minify	0.139.0	0.140.0
oxc-parser	0.139.0	0.140.0
oxc-transform	0.139.0	0.140.0
@vitejs/devtools	0.4.0	0.4.1

Unchanged dependencies

• vitest: 4.1.10
• @vitest/browser: 4.1.10
• @vitest/browser-playwright: 4.1.10
• @vitest/browser-preview: 4.1.10
• @vitest/browser-webdriverio: 4.1.10
• @vitest/expect: 4.1.10
• @vitest/mocker: 4.1.10
• @vitest/pretty-format: 4.1.10
• @vitest/runner: 4.1.10
• @vitest/snapshot: 4.1.10
• @vitest/spy: 4.1.10
• @vitest/utils: 4.1.10
• lightningcss: ^1.32.0
• @oxc-node/cli: 0.1.0
• @oxc-node/core: 0.1.0
• VITEST_VERSION constant: 4.1.10
• README vitest pins: 4.1.10

Code changes

• packages/cli/binding/index.d.cts: regenerated NAPI binding for the rolldown bump — the dev engine's invalidate/registerModules are replaced by registerClient/notifyPayloadDelivered, the HMR Patch envelope gains changedIds/seq and drops hmrBoundaries, compileEntry now returns BindingLazyChunkOutput, and BindingRebuildStrategy drops the Auto variant.
• packages/cli/src/migration/migrator/eslint.ts: runOxlintMigrateStep now tries a list of @oxlint/migrate specs, falling back from the bundled-oxlint pin to @oxlint/migrate@latest when the pinned version isn't on the registry yet.
• pnpm-workspace.yaml: dropped the postcss-modules override and patched dependency, added postcss and @jridgewell/trace-mapping catalog entries, and bumped rolldown-plugin-dts (^0.26.0 → ^0.27.0) and @napi-rs/cli (^3.7.2 → ^3.7.3).
• packages/core/package.json: moved postcss to the catalog reference.
• Cargo.toml: transitive Rust dependency bumps — itertools 0.14 → 0.15, jsonschema 0.46 → 0.47, phf 0.13 → 0.14 (with macros), sugar_path 2 → 3, oxc_resolver 11.23.0 → 11.24.2.
• Lockfiles (Cargo.lock, pnpm-lock.yaml) regenerated accordingly.

Build status

• sync-remote-and-build: failure
• build-upstream: failure

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	0f04eda
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a59938ca1782500085f1f6b

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​tsdown/​exe@​0.22.9
	npm/​@​vitejs/​devtools@​0.4.1
	npm/​@​oxc-project/​runtime@​0.140.0
	npm/​@​tsdown/​css@​0.22.9
	npm/​@​vitejs/​release-scripts@​1.8.0
	npm/​@​napi-rs/​cli@​3.7.3
	npm/​oxfmt@​0.59.0
	npm/​tsdown@​0.22.9
	npm/​oxc-parser@​0.140.0
	npm/​oxc-transform@​0.140.0
	npm/​postcss-modules@​9.0.1
	npm/​oxlint-tsgolint@​0.25.0
	npm/​eslint-plugin-n@​18.2.2
	cargo/​oxc_allocator@​0.139.0 ⏵ 0.140.0
	cargo/​oxc_ast@​0.139.0 ⏵ 0.140.0
	cargo/​oxc_parser@​0.139.0 ⏵ 0.140.0
	cargo/​oxc_resolver@​11.23.0 ⏵ 11.24.2
	cargo/​oxc_span@​0.139.0 ⏵ 0.140.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm cheerio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@vitest/browser-webdriverio@4.1.10 → npm/cheerio@1.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cheerio@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm data-urls is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/vitest@4.1.10 → npm/data-urls@6.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm edgedriver is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@vitest/browser-webdriverio@4.1.10 → npm/edgedriver@6.3.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/edgedriver@6.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@vitest/browser-webdriverio@4.1.10 → npm/mocha@11.7.5 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report