[dependabot]

Bumps the minor-and-patch group with 8 updates:

Package	From	To
@amplitude/analytics-browser	2.48.0	2.48.1
postcss	8.5.30	8.5.31
ruflo	3.56.10	3.59.17
sass-embedded	1.105.2	1.106.1
vite	8.3.4	8.3.5
@rollup/rollup-linux-x64-gnu	4.64.7	4.65.0
@uiw/react-md-editor	4.1.2	4.1.3
tsx	4.22.1	4.23.15

Updates @amplitude/analytics-browser from 2.48.0 to 2.48.1

Release notes

Sourced from @​amplitude/analytics-browser's releases.

@​amplitude/analytics-browser@​2.48.1

2.48.1 (2026-10-20)

Note: Version bump only for package @​amplitude/analytics-browser

Commits

• f86c52d chore(release): publish
• 9243572 feat(analytics-react-native): make React Native autocapture generally availab...
• a2230a1 docs: document trackVideo (#2065)
• 4de670b fix(browser): share page view ids across sdk instances (#2052)
• See full diff in compare view

Updates postcss from 8.5.30 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

Changelog

Sourced from postcss's changelog.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

Commits

• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• See full diff in compare view

Updates ruflo from 3.56.10 to 3.59.17

Changelog

Sourced from ruflo's changelog.

Changelog

All notable changes to the Ruflo project (formerly Claude Flow) are documented here.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[3.63.1] - 2026-10-25

Patch release: @claude-flow/cli, claude-flow, ruflo 3.63.1. No leaf package published (the swarm fixes below live in @claude-flow/swarm, which the CLI does not depend on).

Fixed

• ruflo-console 0.49.3: the install record for a plugin installed more than once no longer comes from another project; with none applying the console says "not installed here", and the record with the longest projectPath wins (#4496, #4497). Also in this train: Windows path and autopilot guard fixes (0.49.1/0.49.2, #4490, #4491, #4494).
• flywheel run skips the directory fsync on Windows so it can commit (#4492, #4493).
• federation_bbs_watch pages forward from sinceEnvelopeId (#4480).
• Managed agents refuse . and .. resource ids and the guard reads common argument wrappers (ruflo-agent 0.4.1, #4478).
• ruflo-mods 0.7.1 loads again (#4485, #4487).
• Swarm (source only, unpublished): downgraded topology leaders wire only to the leader, consensus waits on events instead of polling, retries release the old domain slot (#4483, #4498, #4499).

[3.63.0] - 2026-10-25

Minor release: @claude-flow/cli, claude-flow, ruflo 3.63.0. Adds four MCP tools for Anthropic Claude Managed Agents (managed_agent_capabilities, managed_agent_control, managed_agent_learning, managed_agent_interrupt). No leaf package changed, so no standalone publishes.

Added

• Managed cloud agents: dynamic workflows, controls and verified advisory learning (ruflo-agent 0.4.0, ruflo-workflows 0.7.0, ruflo-console 0.49.0; ADR 0003 and 0004). Everything is opt-in. A cloud agent can run bounded dynamic workflows (dynamicWorkflows: true with a mandatory budgetCents, limited networking, optional predefinedAgents); provider completion is reported as verification: "unverified". Managed sessions show up in the console's Workflows page with their budget, blockers and worker counts, with zero provider traffic from the panels. managed_agent_control inspects, interrupts or terminates one session only when the host sets RUFLO_MANAGED_CONTROL=1 and lists the session in RUFLO_MANAGED_CONTROL_SESSIONS, after a fresh read of the provider's state. With RUFLO_MANAGED_LEARNING=1 and a host-configured RUFLO_MANAGED_VERIFIER_PUBLIC_KEY, managed_agent_learning admits signed outcomes (unsigned ones stay quarantined), recommends a strategy and evaluates paired holdouts; nothing changes routing on its own.
• User guide: a "Managed cloud agents" section in docs/USERGUIDE.md.

Fixed

• memory_search_unified dropped an entry whenever the same key existed in two namespaces; it now deduplicates on namespace and key (#4470, thanks @​kevin9327).
• Before this release shipped, an independent review of the managed-agent change found and fixed: managed_agent_interrupt had no host policy gate (it now uses the managed_agent_control path, and managed_agent_terminate obeys the same allowlist, deleting only the session's own environment, once RUFLO_MANAGED_CONTROL=1); managed_agent_prompt could report the previous turn's answer as finished on a later poll; several valid base64 spellings of one verifier signature were stored as separate ledger records; and the console showed rescheduling, budget-stopped and action-blocked sessions as finished.

Notes

• Known limits (ADR 0004): the verifier signs with a key in the same user account as the checks it runs, so run only host-authored checks, never ones an agent produced; evidence is only partly bound to what ran; a crashed process can leave a lock file that needs removing by hand; a session in an error state cannot be controlled. Live execution against the Anthropic Managed Agents beta has not been exercised (it needs an executor key), so treat the cloud runtime as unproven in production.
• ruflo-ai-team 0.3.5 (#4475) also changed in this tree.
• RUFLO_MANAGED_AGENTS_BASE_URL is an operator-only override of the API origin (an HTTPS origin, no credentials, path or redirects); it is never a tool argument.

[3.62.0] - 2026-10-24

Minor release: @claude-flow/cli, claude-flow, ruflo 3.62.0. Adds one MCP tool (rure_cuda_launch_plan). No leaf package changed, so no standalone publishes.

Added

• ruRE: CUDA launch plan (ruflo-rure 0.6.0, ADR-501). New read-only MCP tool rure_cuda_launch_plan turns what rure_analyze_cuda found into a plan for measuring: per architecture and kernel, how many blocks and warps fit on one multiprocessor at each block size, which resource sets the limit (registers, shared memory, warps, block slots, barriers), the best block sizes and flags. Eight architectures have a table (sm_70 to sm_120); any other gets no figure rather than a guess. It still parses and never runs: includeHarness only returns the text of a small CUDA program for you to build and run yourself. The occupancy model matches NVIDIA's cuda_occupancy.h on 1.77 million combinations and the CUDA driver on five real GPUs (ADR-501, ADR-500).

Fixed

... (truncated)

Commits

• f5af263 release: 3.59.17 (#4393)
• 69f4daa fix(init): stop advertising a memory path the runtime ignores (#4392)
• d5c341f release: 3.59.16 (#4391)
• 6e213d5 fix(memory): distinguish recent dead locks from live writers (#4389)
• 732e9f0 chore(marketplace): pin agentic-qe-fleet to v3.15.11 (#4390)
• 11e35e3 fix(auth): honor --no-browser for auth login (#4388)
• 9f35d16 fix(hooks): honor --no-color in hooks statusline (#4387)
• 76efb01 release: @​claude-flow/hooks 3.0.1 (#4386)
• 731661c fix(hooks): stop injecting retracted performance claims (#4385)
• 450f653 release: 3.59.15 (#4383)
• Additional commits viewable in compare view

Updates sass-embedded from 1.105.2 to 1.106.1

Changelog

Sourced from sass-embedded's changelog.

1.106.1

• Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

• Don't crash when serializing a number with an empty unit. This is only possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass

• More robustly convert invalid value errors into PARAMS errors.

1.106.0

• Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

• Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

• Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

• Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

• Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

• Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

  As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

• Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

• Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

... (truncated)

Commits

• c60459d Update Dart Sass version and release
• 5d64b1e Update Dart Sass version and release
• See full diff in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.64.7 to 4.65.0

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.65.0

4.65.0

2026-10-22

Features

• Support synthetic named exports in namespaces when preserving modules (#6589)

Bug Fixes

• Fix a situation where unaligned sourcemaps resulted in a wrong segment (#6591)
• Forward startup errors on native module load when starting rollup (#6592)

Pull Requests

• #6589: Merge synthetic named exports into static namespaces when preserving modules (@​b84330808, @​lukastaegert)
• #6590: Stabilize flaky watch test "treats filenames literally, not as globs" (@​lukastaegert)
• #6591: Use the last sourcemap segment for log locations after its start (@​Dev-next-gen)
• #6592: Preserve native module load errors (@​shuaiyafei, @​lukastaegert)
• #6593: Close bundles in the Gulp examples (@​shuaiyafei, @​lukastaegert)
• #6594: Improve review instructions and resolve audit (@​lukastaegert)

v4.64.12

4.64.12

2026-10-20

Bug Fixes

• Allow generating logs from transform hooks at position 0 (#6587)
• Properly handle global or sticky regular expressions for file names (#6588)

Pull Requests

• #6587: Fix transform diagnostics at position zero (@​shuaiyafei)
• #6588: Match stateful external regular expressions consistently (@​shuaiyafei)

v4.64.10

4.64.10

2026-10-18

Bug Fixes

• Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
• Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.65.0

2026-10-22

Features

• Support synthetic named exports in namespaces when preserving modules (#6589)

Bug Fixes

• Fix a situation where unaligned sourcemaps resulted in a wrong segment (#6591)
• Forward startup errors on native module load when starting rollup (#6592)

Pull Requests

• #6589: Merge synthetic named exports into static namespaces when preserving modules (@​b84330808, @​lukastaegert)
• #6590: Stabilize flaky watch test "treats filenames literally, not as globs" (@​lukastaegert)
• #6591: Use the last sourcemap segment for log locations after its start (@​Dev-next-gen)
• #6592: Preserve native module load errors (@​shuaiyafei, @​lukastaegert)
• #6593: Close bundles in the Gulp examples (@​shuaiyafei, @​lukastaegert)
• #6594: Improve review instructions and resolve audit (@​lukastaegert)

4.64.12

2026-10-20

Bug Fixes

• Allow generating logs from transform hooks at position 0 (#6587)
• Properly handle global or sticky regular expressions for file names (#6588)

Pull Requests

• #6587: Fix transform diagnostics at position zero (@​shuaiyafei)
• #6588: Match stateful external regular expressions consistently (@​shuaiyafei)

4.64.10

2026-10-18

Bug Fixes

• Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
• Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

• #6583: Track manual chunk dependencies when merging small chunks (@​ybai08, @​lukastaegert)
• #6584: Use decoded values for JSX string attributes (@​luantaraschi)

... (truncated)

Commits

• 9aac09a 4.65.0
• 56200ea Preserve native module load errors (#6592)
• 61ce2a7 Close bundles in the Gulp examples (#6593)
• fba8c01 Merge synthetic named exports into static namespaces when preserving modules ...
• 0cae2c7 Improve review instructions and resolve audit (#6594)
• 05c6ba2 Use the last sourcemap segment for log locations after its start (#6591)
• e70c19b Stabilize flaky watch test "treats filenames literally, not as globs" (#6590)
• 78d43df 4.64.12
• 375a2d0 Match stateful external regular expressions consistently (#6588)
• 3a9f4af Fix transform diagnostics at position zero (#6587)
• Additional commits viewable in compare view

Updates @uiw/react-md-editor from 4.1.2 to 4.1.3

Release notes

Sourced from @​uiw/react-md-editor's releases.

v4.1.3

Documentation v4.1.3: https://raw.githack.com/uiwjs/react-md-editor/5bf21f7/index.html
Comparing Changes: uiwjs/react-md-editor@v4.1.2...v4.1.3

npm i @uiw/react-md-editor@4.1.3

• 🐞 fix: fill the editor input area with the textarea (#713) 6c22730 @​snowyukitty
• 📖 doc: update core/README.md. 08491f0 @​github-actions-bot
• 🐞 fix: require a literal period for ordered-list Enter continuation (#711) f6ae156 @​BetterAndBetterII

Commits

• 35bd36d released v4.1.3
• f6ae156 fix: require a literal period for ordered-list Enter continuation (#711)
• 08491f0 doc: update core/README.md.
• 6c22730 fix: fill the editor input area with the textarea (#713)
• See full diff in compare view

Updates tsx from 4.22.1 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions