[dependabot]

Bumps the minor-and-patch group with 10 updates:

Package	From	To
@amplitude/analytics-browser	2.47.2	2.47.4
agentic-flow	2.1.3	2.1.4
idb	8.0.3	8.0.4
@vitejs/plugin-react	6.1.1	6.1.2
jsdom	30.1.1	30.1.2
postcss	8.5.28	8.5.29
ruflo	3.50.0	3.56.1
vite	8.3.2	8.3.4
@rollup/rollup-linux-x64-gnu	4.63.6	4.64.3
tsx	4.22.1	4.23.15

Updates @amplitude/analytics-browser from 2.47.2 to 2.47.4

Release notes

Sourced from @​amplitude/analytics-browser's releases.

@​amplitude/analytics-browser@​2.47.4

2.47.4 (2026-10-08)

Bug Fixes

• plugin-custom-enrichment-browser: stage dual-use releases (#2043) (3bb47d4)

@​amplitude/analytics-browser@​2.47.3

2.47.3 (2026-10-07)

Note: Version bump only for package @​amplitude/analytics-browser

Commits

• 365edf3 chore(release): publish
• ce14843 fix(analytics-core): clarify README package description (#2045)
• 3bb47d4 fix(plugin-custom-enrichment-browser): stage dual-use releases (#2043)
• faa131e chore(plugin-custom-enrichment-browser): declare dual-use content (#2042)
• 8255722 chore(release): publish
• 080f0af feat(unified): add maskAttributes to Session Replay options (#2040)
• 02ec439 feat(plugin-autocapture-browser): support shadow dom in elementInteractions (...
• ee67ead fix(analytics-core): resolve hung promises for duplicate insert_id during upl...
• 3b84ad5 perf(session-replay-browser): cache buffered event byte size (#2028)
• 2e8f63f docs(unified): point README links at canonical docs locations (#2038)
• Additional commits viewable in compare view

Updates agentic-flow from 2.1.3 to 2.1.4

Commits

• See full diff in compare view

Updates idb from 8.0.3 to 8.0.4

Commits

• 654c746 8.0.4
• 1b0f4a6 Minor byte savings
• 970aa05 Fix reads of NaN values (#352)
• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Commits

• ac47648 release: plugin-react@6.1.2 (#1491)
• 98277e7 fix(deps): update all non-major dependencies (#1486)
• 12eddea fix(hmr): better handle compound components (#1484)
• 3cfb1d1 fix(plugin-react): fix compiler.logDiagnostics (#1483)
• 6de9915 fix(plugin-react): disable refresh for non-jsx with compiler enabled (#1485)
• ee97d2f fix(deps): update all non-major dependencies (#1445)
• b0a014d chore: use Babel 8 for babel compiler playgrounds (#1460)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• See full diff in compare view

Updates jsdom from 30.1.1 to 30.1.2

Release notes

Sourced from jsdom's releases.

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

Commits

• a23bfb7 30.1.2
• 64a75d2 Update dependencies and dev dependencies
• 7bf9653 Invalidate styles after CSSOM and control state changes
• fe9009c Update focused area handling
• a8d28b3 Release windows retained by stylesheet parsing
• 05a2c01 Deduplicate generated CSS property metadata
• 1efa190 Reduce generated CSS property data
• a372e12 Avoid Document named-property rebuilds after irrelevant tree mutations
• b2cd235 Update css-color
• 0542d2b Release idle MutationObserver bookkeeping
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.29

Release notes

Sourced from postcss's releases.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• 7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
• ebffa97 Add postcss-smooth-corners plugin
• 57d6401 Speed up source map cleaning
• 7e46a03 Speed up parser
• 7f5c417 Improve </style> protection for the case when beffore nodes have different parts
• 7ba9051 Fix useless ESLint warning
• 12b4161 Update dependencies
• Additional commits viewable in compare view

Updates ruflo from 3.50.0 to 3.56.1

Changelog

Sourced from ruflo's changelog.

[3.56.1] - 2026-10-08

Patch release: five bug fixes (four in @claude-flow/cli, one console). No leaf package changed since 3.56.0 (git diff v3.56.0..HEAD -- v3/@claude-flow touches only cli), and no behaviour is removed. The ruflo-console plugin fixes merged since 3.56.0 (console 0.40.2/0.40.3, #3917, #3924) ship through the plugin marketplace, not this npm release.

Fixed

• The policy trust mirror and key now honour HOME and XDG_CONFIG_HOME instead of a fixed home directory, so a throwaway HOME no longer yields policy-anchor-log-missing (#3922, fixes #3919, reported by @​HF-teamdev).
• ensureSchemaColumns rewrites the store only when a column was actually added; an up-to-date encrypted memory store is no longer rewritten by a read such as memory stats (#3923, fixes #3918, reported by @​HF-teamdev).
• config reset --section <name> resets only that section and removes the matching flat overrides, preserving unrelated configuration (#3901, @​rudycelekli).
• MCP config tools (config_get/set/list/export/import/reset) now work on the plain nested JSON document written by the config CLI command instead of assuming a {values, scopes} envelope; existing envelope stores keep their format (#3902, @​rudycelekli). This does not change how the daemon reads config.json (see #3192, #3449, #3239).
• Console approvals badge counts only rows that have an approve or deny action (#3924, fixes #3920, reported by @​HF-teamdev); delivered as ruflo-console 0.40.3 via the plugin marketplace.

[3.56.0] - 2026-10-08

Minor release: a hardening and correctness batch from @​rudycelekli, @​nicholas-ruest, @​martinvlad, @​HF-teamdev, @​drakeo338 and @​stuinfla. Several fixes change behaviour on purpose (see Behaviour changes). Integrated by merging each PR head, so authorship is preserved.

Behaviour changes

• Unknown ids and value-less options are now errors (#3911, @​martinvlad) — agent status / task status with an unknown id print not found and exit 1; a declared string/number option with no value (hooks route --task) now reports Option --task needs a value instead of silently becoming true. Applies to every command.
• session_save captures the persisted task/agent/memory stores by default, and session_import rejects malformed stores (#3489, #3490); explicit false still excludes a store.
• Default project memory backup snapshots both memory.db and agentdb-memory.db (#3903); explicit --db and a non-blank CLAUDE_FLOW_DB_PATH still select one file.
• Agent pool scale-to-zero is honored and invalid targets fail before writing (#3488); a zero fallback retry budget is honored (#3496).
• Project path validators block sensitive directory names anywhere under the project root, not only at the leaf (#3504, @claude-flow/security 3.0.3).
• The OAuth callback server retains an early callback and ignores unrelated requests (#3507, @claude-flow/security 3.0.3).
• Provider selection honors an explicit execution provider (#3493) and Anthropic gateway credentials/endpoint (ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL; #3494, fixes #3100); provider timeouts now cover reading the response body (#3495).
• hooks_route consults persisted SONA outcome patterns before local routing (#3904) — only a supported agent at confidence >= 0.6 is used; useSemanticRouter: false keeps keyword routing. With the opt-in neural router, selection uses calibrated quality predictions (#3498) so calibration can move the pick across the quality bar.
• The WAL-sidecar safety gate is liveness-based (#3894, fixes #3161) — leftover -wal/-shm files from a closed connection no longer block memory store/list; a genuinely open holder is still refused.
• ruflo init no longer pins a Claude model in generated .claude/settings.json (#3528, fixes #3527).
• The ruflo wrapper pins the matching @claude-flow/cli and warns when the resolved CLI version differs (#3438, fixes #3306); it warns and continues, it does not refuse.
• Claims are stored in one lossless format shared by CLI and MCP; unreadable stores are refused rather than replaced (#3502).
• Native immutable conditional append for memory store (--append-only, --append-conditions, --require-native, --no-embedding; #3750, @​stuinfla) — additive, CLI only.

Fixed

• Shipped .claude/settings.json had unescaped quotes in hook commands and did not parse (#3895, fixes #3888, @​nicholas-ruest); a new test checks that every shipped settings/plugin JSON parses.
• Remaining better-sqlite3 opens go through the shared loader (#3896, fixes #3883's sites, @​nicholas-ruest); an RFE1-encrypted store is reported as encrypted, not broken (#3906, fixes #2889, @​nicholas-ruest); the demo-registry fallback is labelled as unverified (#3897, @​martinvlad).
• analyze preserves machine-readable JSON (#3910); doctor rejects unsupported component selections (#3907) and loads MetaHarness modules via file URLs on Windows (#3523, fixes #3186); daemon start honors explicit scheduled workers (#3586).
• Unreadable task/agent records are preserved, not overwritten (#3484); async agent-registry updates do not revive retired agents (#3492); fallback learning is attributed to each attempted model (#3497).
• Workflow step boundaries are validated (#3491), persisted workflows resume without duplicate executors (#3500) and keep control signals and sibling state across awaits (#3505).
• Memory JSON import reports rejected writes accurately (#3499); export reads all pages only after successful reads (#3501); concurrent rotating-token refreshes coalesce (#3506).
• Test fixtures no longer break under pnpm's NODE_PATH (#3543, fixes #3529) and the vitest runner is resolved via package.json.
• @claude-flow/memory 3.0.2: cache admission accounts for replacement sizes (#3679, fixes #3678) and invalidation matches each key independently (#3687, fixes #3686).
• Removed an empty .claude/agents/tmp.json that shipped in the CLI tarball.

Not included

#3503 (fail-closed policy envelope: it would deny MCP dispatch for any envelope with a ceiling because dispatch does not supply the metering), #3892, #3831, #3879, #3835, #3751, #3694, #3909 and the draft security PRs: see each PR for the status.

Leaf packages published with this release

... (truncated)

Commits

• 6ecabbb chore(release): 3.56.1 versions and changelog
• 6991551 chore(release): 3.56.0 versions, leaf pins (memory 3.0.2, security 3.0.3), lo...
• 5ca1540 Merge current main and pin the already-published matching CLI
• b02e224 chore(release): 3.55.0 versions, leaf pins, lockfiles, plugin bumps, changelog
• 48c7b48 release: 3.54.1
• 613df52 release: 3.54.0
• c4d2421 Merge remote-tracking branch 'origin/main' into repair/ruflo3438-feedback-202...
• db1fef5 Add neon flicker GIF as full width Ruflo README header
• 9c2e851 docs: keep neon header visible in static SVG renderers
• 2e07bd4 docs: add bitmap neon Ruflo header with flicker and ASCII animation
• Additional commits viewable in compare view

Updates vite from 8.3.2 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

Commits

• b6c20f6 release: v8.3.4 (#23702)
• b28db28 fix(server): match static aliases on path boundaries (#23643)
• bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
• fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
• 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
• 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
• facc2fb fix: remove input option unescaping for now (#23694)
• 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
• cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
• fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
• Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.63.6 to 4.64.3

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.64.3

4.64.3

2026-10-08

Bug Fixes

• Fix a performance regression when bundling code with deeply nested property calls (#6565)

Pull Requests

• #6565: Fix path-dependent explosion when including call arguments of reassigned variables (@​lukastaegert)

v4.64.2

4.64.2

2026-10-07

Bug Fixes

• Fix a regression where certain CoreJS helpers were wrongly tree-shaken (#6562)
• Do not show errors from closeBundle if there were also build errors (#6554)

Pull Requests

• #6554: Preserve build errors when closeBundle fails (@​Jo2234, @​lukastaegert)
• #6561: Rework REPL artefacts and performance report workflows (@​lukastaegert)
• #6562: Do not resolve values of assigned variables returned on all paths (@​lukastaegert)

v4.64.1

4.64.1

2026-10-07

Bug Fixes

• Slightly improve performance when rendering ES output (#6534)

Pull Requests

• #6534: Avoid repeated export name scans when rendering ES chunks (@​irontaek, @​lukastaegert)
• #6552: chore(ci): remove redundant rust-src setup (@​TrickyPi, @​lukastaegert)
• #6555: Lock file maintenance (@​renovate[bot], @​lukastaegert)

v4.64.0

4.64.0

2026-10-02

Features

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.64.3

2026-10-08

Bug Fixes

• Fix a performance regression when bundling code with deeply nested property calls (#6565)

Pull Requests

• #6565: Fix path-dependent explosion when including call arguments of reassigned variables (@​lukastaegert)

4.64.2

2026-10-07

Bug Fixes

• Fix a regression where certain CoreJS helpers were wrongly tree-shaken (#6562)
• Do not show errors from closeBundle if there were also build errors (#6554)

Pull Requests

• #6554: Preserve build errors when closeBundle fails (@​Jo2234, @​lukastaegert)
• #6561: Rework REPL artefacts and performance report workflows (@​lukastaegert)
• #6562: Do not resolve values of assigned variables returned on all paths (@​lukastaegert)

4.64.1

2026-10-07

Bug Fixes

• Slightly improve performance when rendering ES output (#6534)

Pull Requests

• #6534: Avoid repeated export name scans when rendering ES chunks (@​irontaek, @​lukastaegert)
• #6552: chore(ci): remove redundant rust-src setup (@​TrickyPi, @​lukastaegert)
• #6555: Lock file maintenance (@​renovate[bot], @​lukastaegert)

4.64.0

2026-10-02

Features

• Improve try-catch deoptimization to cover calling methods on objects (#6541)

Bug Fixes

... (truncated)

Commits

• eea952f 4.64.3
• f1f7c4a Fix path-dependent explosion when including call arguments of reassigned vari...
• 19e0dcb 4.64.2
• 98ad757 Do not resolve values of assigned variables returned on all paths (#6562)
• 76c631a Preserve build errors when closeBundle fails (#6554)
• 9863ae7 Rework REPL artefacts and performance report workflows (#6561)
• 2e1a753 4.64.1
• f48508c Avoid repeated export name scans when rendering ES chunks (#6534)
• 68da212 Resolve audit
• 1cc31f7 Lock file maintenance (#6555)
• Additional commits viewable in compare view

Updates tsx from 4.22.1 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications