chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-20 — run · 18 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.270
@mdn/browser-compat-data	8.1.0	8.1.1
@pnpm/lockfile.detect-dep-types	1100.0.21	1100.0.23
@pnpm/lockfile.fs	1100.2.5	1100.2.7
@types/react	19.2.18	19.3.0
browserslist	4.28.8	4.28.9
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
ignore	7.0.7	7.0.9
magic-string	1.2.3	1.3.1
pastoralist	1.13.0	1.13.2
react	19.2.8	19.3.0
rolldown-plugin-dts	0.28.4	0.28.5
undici	6.28.0	6.28.1
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1
zod	4.5.4	4.6.4

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 18 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.269
@mdn/browser-compat-data	8.1.0	8.1.1
@pnpm/lockfile.detect-dep-types	1100.0.21	1100.0.22
@pnpm/lockfile.fs	1100.2.5	1100.2.6
@types/react	19.2.18	19.3.0
browserslist	4.28.8	4.28.9
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
ignore	7.0.7	7.0.9
magic-string	1.2.3	1.3.1
pastoralist	1.13.0	1.13.2
react	19.2.8	19.3.0
rolldown-plugin-dts	0.28.4	0.28.5
undici	6.28.0	6.28.1
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1
zod	4.5.4	4.6.2

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 17 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.268
@mdn/browser-compat-data	8.1.0	8.1.1
@pnpm/lockfile.detect-dep-types	1100.0.21	1100.0.22
@pnpm/lockfile.fs	1100.2.5	1100.2.6
@types/react	19.2.18	19.3.0
browserslist	4.28.8	4.28.9
compromise	14.16.0	14.17.0
ecc-agentshield	1.4.0	1.6.0
fast-check	4.9.0	4.10.0
ignore	7.0.7	7.0.9
magic-string	1.2.3	1.3.1
pastoralist	1.13.0	1.13.2
react	19.2.8	19.3.0
rolldown-plugin-dts	0.28.4	0.28.5
undici	6.28.0	6.28.1
vite	8.2.2	8.3.0
zod	4.5.4	4.6.2

commits

• chore(deps): apply weekly update fixes

---

Note

Medium Risk
Touches mandatory install-time binaries (SFW, uv) and the dev/build stack (Vite, React, agent tooling); changes are version/hash bumps only but affect CI bootstrap and local installs fleet-wide.

Overview
Rolling weekly dependency refresh: catalog pins in pnpm-workspace.yaml and the lockfile move 17 npm packages forward, including Vite 8.3.0, React / @types/react 19.3, Zod 4.6.2, @anthropic-ai/claude-code 2.1.268, and ecc-agentshield 1.6.0, plus smaller bumps (pnpm lockfile helpers, browserslist, compromise, vitest-related overrides like magic-string, hono, postcss, undici).

Pinned external binaries in .config/repo/external-tools.json are updated with new sha512 integrity values: Socket Firewall enterprise and free 1.15.2 (each with a dated soakBypass through 2026-09-22), uv 0.12.13, and zizmor 1.30.1. The repo Node pin in .node-version goes 26.8.1 → 26.8.2.

^{Reviewed by Cursor Bugbot for commit 4f2c7a4. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​pnpm/​lockfile.detect-dep-types@​1100.0.21 ⏵ 1100.0.23	-2			+1
	npm/​@​anthropic-ai/​claude-code@​2.1.251 ⏵ 2.1.270	+1		+1
	npm/​pastoralist@​1.13.0 ⏵ 1.13.2	-5		+1	-1
	npm/​@​pnpm/​lockfile.fs@​1100.2.5 ⏵ 1100.2.7
	npm/​ecc-agentshield@​1.4.0 ⏵ 1.6.0	+10			+2
	npm/​ignore@​7.0.7 ⏵ 7.0.9	+1		+1
	npm/​ast-v8-to-istanbul@​1.0.5 ⏵ 1.0.6	+1
	npm/​yaml@​2.9.0 ⏵ 2.9.1	+1
	npm/​fast-check@​4.9.0 ⏵ 4.10.0	+1		+1	-2
	npm/​browserslist@​4.28.8 ⏵ 4.28.9	+1		+1
	npm/​compromise@​14.16.0 ⏵ 14.17.0				+1
	npm/​zod@​4.5.4 ⏵ 4.6.4
	npm/​magic-string@​1.2.3 ⏵ 1.3.1			+1	+1
	npm/​@​mdn/​browser-compat-data@​8.1.0 ⏵ 8.1.1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​pnpm/​lockfile.detect-dep-types@​1100.0.21 ⏵ 1100.0.22	-4			+1
	npm/​pastoralist@​1.13.0 ⏵ 1.13.2	-3		+1	+2
	npm/​@​anthropic-ai/​claude-code@​2.1.251 ⏵ 2.1.269	+1		+1	+1
	npm/​ecc-agentshield@​1.4.0 ⏵ 1.6.0	+10			+7
	npm/​@​pnpm/​lockfile.fs@​1100.2.5 ⏵ 1100.2.6
	npm/​ast-v8-to-istanbul@​1.0.5 ⏵ 1.0.6	+1			-2
	npm/​compromise@​14.16.0 ⏵ 14.17.0				-1
	npm/​fast-check@​4.9.0 ⏵ 4.10.0	+1
	npm/​browserslist@​4.28.8 ⏵ 4.28.9	+1		+1
	npm/​ignore@​7.0.7 ⏵ 7.0.9	+1		+1	+1
	npm/​yaml@​2.9.0 ⏵ 2.9.1	+1			+6
	npm/​zod@​4.5.4 ⏵ 4.6.2	+1
	npm/​magic-string@​1.2.3 ⏵ 1.3.1			+1	+1
	npm/​@​mdn/​browser-compat-data@​8.1.0 ⏵ 8.1.1

View full report