chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-20 — run · 15 updated

package	from	to
@inquirer/checkbox	5.2.2	5.2.5
@inquirer/confirm	6.2.0	6.3.2
@inquirer/input	5.1.3	5.1.6
@inquirer/password	5.1.2	5.2.2
@inquirer/search	4.3.0	4.3.3
@inquirer/select	5.2.2	5.2.5
@perryts/perry	0.5.1220	0.5.1520
fast-check	4.9.0	4.10.0
globals	17.11.0	17.12.0
libnpmpack	9.1.12	9.1.13
p-map	7.0.6	7.0.8
vite	8.2.2	8.3.0
webpack	5.109.2	5.110.3
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.4

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · 15 updated

package	from	to
@inquirer/checkbox	5.2.2	5.2.5
@inquirer/confirm	6.2.0	6.3.2
@inquirer/input	5.1.3	5.1.6
@inquirer/password	5.1.2	5.2.2
@inquirer/search	4.3.0	4.3.3
@inquirer/select	5.2.2	5.2.5
@perryts/perry	0.5.1220	0.5.1520
fast-check	4.9.0	4.10.0
globals	17.11.0	17.12.0
libnpmpack	9.1.12	9.1.13
p-map	7.0.6	7.0.7
vite	8.2.2	8.3.0
webpack	5.109.2	5.110.3
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.2

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · 14 updated

package	from	to
@inquirer/checkbox	5.2.2	5.2.5
@inquirer/confirm	6.2.0	6.3.2
@inquirer/input	5.1.3	5.1.6
@inquirer/password	5.1.2	5.2.2
@inquirer/search	4.3.0	4.3.3
@inquirer/select	5.2.2	5.2.5
@perryts/perry	0.5.1220	0.5.1520
fast-check	4.9.0	4.10.0
globals	17.11.0	17.12.0
libnpmpack	9.1.12	9.1.13
p-map	7.0.6	7.0.7
vite	8.2.2	8.3.0
webpack	5.109.2	5.110.3
zod	4.4.3	4.6.2

commits

• chore(deps): apply weekly update fixes

---

Note

Low Risk
Routine pin and lockfile refresh across dev/build tooling; the zod and vite bumps are the widest blast radius but stay in test/agent tooling rather than production runtime paths.

Overview
This is the rolling weekly dependency refresh: catalog pins and pnpm-lock.yaml move forward together with a small runtime/toolchain bump.

Toolchain & external tools: Node is bumped to 26.8.2 in .node-version. The pinned GitHub CLI in external-tools.json goes 2.99.0 → 2.100.0 (new per-platform assets and integrity hashes); the temporary soakBypass for gh is removed, indicating that version is now treated as past soak.

Notable catalog / override bumps (also reflected in pnpm-workspace.yaml): vite 8.2.2 → 8.3.0, webpack 5.109.2 → 5.110.3, zod 4.4.3 → 4.6.2, @perryts/perry 0.5.1220 → 0.5.1520, refreshed @inquirer/* prompts, plus smaller bumps (fast-check, globals, libnpmpack, p-map, magic-string, hono, js-yaml, postcss, qs, and related transitives). The lockfile also adjusts pnpm’s packaged exe pin (12.4.2 → 12.4.1) and refreshes @perryts/perry optional platform binaries (e.g. win32-arm64 added, some musl variants dropped).

Build/test impact: Vitest/Vitiate and MCP-related packages now resolve against Vite 8.3 and Zod 4.6; webpack’s minimizer plugin chain updates (including svgo in the webpack minimizer graph).

^{Reviewed by Cursor Bugbot for commit 1269f1f. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​perryts/​perry@​0.5.1220 ⏵ 0.5.1520	+4		+6	-1
	libnpmpack@​9.1.12 ⏵ 9.1.13	+1		+1
	globals@​17.11.0 ⏵ 17.12.0	+1		+1
	yaml@​2.9.0 ⏵ 2.9.1	+1
	fast-check@​4.9.0 ⏵ 4.10.0	+1		+1	-2
	p-map@​7.0.6 ⏵ 7.0.8	+1		+1	+6
	webpack@​5.109.2 ⏵ 5.110.3			+1	-1
	@​inquirer/​search@​4.3.0 ⏵ 4.3.3	+1		+1	+7
	@​inquirer/​checkbox@​5.2.2 ⏵ 5.2.5	+1		+1	+7
	@​inquirer/​confirm@​6.2.0 ⏵ 6.3.2	+1		+3
	@​inquirer/​password@​5.1.2 ⏵ 5.2.2	+1		+3	+7
	@​inquirer/​select@​5.2.2 ⏵ 5.2.5	+1		+1	+7
	@​inquirer/​input@​5.1.3 ⏵ 5.1.6	+1		+1	+7
	zod@​4.4.3 ⏵ 4.6.4
	magic-string@​1.2.3 ⏵ 1.3.1			+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @perryts/perry-win32-x64 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@perryts/perry@0.5.1520 → npm/@perryts/perry-win32-x64@0.5.1520 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@perryts/perry-win32-x64@0.5.1520. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @perryts/perry-win32-x64 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@perryts/perry@0.5.1520 → npm/@perryts/perry-win32-x64@0.5.1520 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@perryts/perry-win32-x64@0.5.1520. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​perryts/​perry@​0.5.1220 ⏵ 0.5.1520	+4		+6	-1
	libnpmpack@​9.1.12 ⏵ 9.1.13	+1		+1
	globals@​17.11.0 ⏵ 17.12.0	+1		+1	+2
	fast-check@​4.9.0 ⏵ 4.10.0	+1
	p-map@​7.0.6 ⏵ 7.0.8	+1		+1	+2
	yaml@​2.9.0 ⏵ 2.9.1	+1			+6
	webpack@​5.109.2 ⏵ 5.110.3			+1	+1
	@​inquirer/​search@​4.3.0 ⏵ 4.3.3	+1		+1	+3
	@​inquirer/​checkbox@​5.2.2 ⏵ 5.2.5	+1		+1	+3
	@​inquirer/​confirm@​6.2.0 ⏵ 6.3.2	+1		+3	+3
	@​inquirer/​password@​5.1.2 ⏵ 5.2.2	+1		+3	+3
	@​inquirer/​select@​5.2.2 ⏵ 5.2.5	+1		+1	+3
	@​inquirer/​input@​5.1.3 ⏵ 5.1.6	+1		+1	+3
	zod@​4.4.3 ⏵ 4.6.4	+1			+4
	magic-string@​1.2.3 ⏵ 1.3.1			+1	+1

View full report

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm @perryts/perry-darwin-arm64 Location: Package overview From: pnpm-lock.yaml → npm/@perryts/perry@0.5.1520 → npm/@perryts/perry-darwin-arm64@0.5.1520 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@perryts/perry-darwin-arm64@0.5.1520. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @perryts/perry-darwin-x64 Location: Package overview From: pnpm-lock.yaml → npm/@perryts/perry@0.5.1520 → npm/@perryts/perry-darwin-x64@0.5.1520 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@perryts/perry-darwin-x64@0.5.1520. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @perryts/perry-linux-arm64 Location: Package overview From: pnpm-lock.yaml → npm/@perryts/perry@0.5.1520 → npm/@perryts/perry-linux-arm64@0.5.1520 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@perryts/perry-linux-arm64@0.5.1520. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @perryts/perry-win32-arm64 Location: Package overview From: pnpm-lock.yaml → npm/@perryts/perry@0.5.1520 → npm/@perryts/perry-win32-arm64@0.5.1520 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@perryts/perry-win32-arm64@0.5.1520. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @perryts/perry-win32-x64 Location: Package overview From: pnpm-lock.yaml → npm/@perryts/perry@0.5.1520 → npm/@perryts/perry-win32-x64@0.5.1520 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@perryts/perry-win32-x64@0.5.1520. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @perryts/perry Location: Package overview From: package.json → npm/@perryts/perry@0.5.1520 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@perryts/perry@0.5.1520. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report