[dependabot]

Bumps the npm-dependencies group with 60 updates in the / directory:

Package	From	To
driver.js	1.8.0	1.10.2
exifreader	4.46.0	4.52.0
vue	3.5.43	3.5.44
@vitejs/plugin-vue	6.0.9	6.0.10
autoprefixer	10.6.1	10.6.2
postcss	8.5.28	8.5.32
prettier	3.9.9	3.9.10
sass	1.105.0	1.107.0
vite	7.3.6	7.3.7
@babel/helper-string-parser	7.29.7	7.29.13
@babel/parser	7.29.9	7.29.13
@babel/types	7.29.8	7.29.11
@rollup/rollup-android-arm-eabi	4.64.0	4.68.0
@rollup/rollup-android-arm64	4.64.0	4.68.0
@rollup/rollup-darwin-arm64	4.64.0	4.68.0
@rollup/rollup-darwin-x64	4.64.0	4.68.0
@rollup/rollup-freebsd-arm64	4.64.0	4.68.0
@rollup/rollup-freebsd-x64	4.64.0	4.68.0
@rollup/rollup-linux-arm-gnueabihf	4.64.0	4.68.0
@rollup/rollup-linux-arm-musleabihf	4.64.0	4.68.0
@rollup/rollup-linux-arm64-gnu	4.64.0	4.68.0
@rollup/rollup-linux-arm64-musl	4.64.0	4.68.0
@rollup/rollup-linux-loong64-gnu	4.64.0	4.68.0
@rollup/rollup-linux-loong64-musl	4.64.0	4.68.0
@rollup/rollup-linux-ppc64-gnu	4.64.0	4.68.0
@rollup/rollup-linux-ppc64-musl	4.64.0	4.68.0
@rollup/rollup-linux-riscv64-gnu	4.64.0	4.68.0
@rollup/rollup-linux-riscv64-musl	4.64.0	4.68.0
@rollup/rollup-linux-s390x-gnu	4.64.0	4.68.0
@rollup/rollup-linux-x64-gnu	4.64.0	4.68.0
@rollup/rollup-linux-x64-musl	4.64.0	4.68.0
@rollup/rollup-openbsd-x64	4.64.0	4.68.0
@rollup/rollup-openharmony-arm64	4.64.0	4.68.0
@rollup/rollup-win32-arm64-msvc	4.64.0	4.68.0
@rollup/rollup-win32-ia32-msvc	4.64.0	4.68.0
@rollup/rollup-win32-x64-gnu	4.64.0	4.68.0
@rollup/rollup-win32-x64-msvc	4.64.0	4.68.0
@types/node	26.6.4	26.6.6
@vue/compiler-core	3.5.43	3.5.44
@vue/compiler-dom	3.5.43	3.5.44
@vue/compiler-sfc	3.5.43	3.5.44
@vue/compiler-ssr	3.5.43	3.5.44
@vue/reactivity	3.5.43	3.5.44
@vue/runtime-core	3.5.43	3.5.44
@vue/runtime-dom	3.5.43	3.5.44
@vue/server-renderer	3.5.43	3.5.44
@vue/shared	3.5.43	3.5.44
baseline-browser-mapping	2.11.27	2.11.35
browserslist	4.29.3	4.29.5
caniuse-lite	1.0.30001814	1.0.30001823
electron-to-chromium	1.5.444	1.5.478
enhanced-resolve	5.26.0	5.26.1
fast-uri	3.1.8	3.1.9
nanoid	3.3.19	3.3.20
node-releases	2.0.57	2.0.63
rollup	4.64.0	4.68.0
source-map-js	1.2.1	1.2.2
update-browserslist-db	1.3.3	1.3.4
watchpack	2.5.2	2.6.3
webpack-sources	3.6.0	3.7.0

Updates driver.js from 1.8.0 to 1.10.2

Release notes

Sourced from driver.js's releases.

1.10.2

Fixed

• Hints and popovers in an open <dialog> with a transform or filter now stay next to their element, also after the dialog reopens. (#627)
• Tour steps scrolled out of a visible scrollable container are now scrolled into view. (#577)
• The popover title and footer are divs instead of header and footer landmarks, and the centered dummy element gets no aria attributes. (#434)

1.10.1

Added

• Adds launcher: false to disable checklists floating launcher

Fixed

• Hints, and popovers now work with <dialog> (#625)
• Clicking the popover no longer throws when the event's target is a text node. (#626)

1.10.0

Added

• Added support for checklists.
• New reason option on the destroy hooks to distinguish between destroy reasons

Changed

• The popover's close button only darkens for keyboard focus (:focus-visible), so it no longer opens dark after a tour is started with a mouse click.

1.9.0

Added

• closeBtnLabel (driver and step level) to set the close button's aria-label, for translated tours. Defaults to Close. (#623)
• overlayClickBehavior: "none" to ignore overlay clicks while Escape and the close button still close the tour. (#435)

Changed

• Keyboard control follows the popover buttons: arrow keys do nothing when their button is hidden or disabled, and Escape does nothing when the close

... (truncated)

Commits

• 1c77160 1.10.2
• c20b74c Drop landmarks and dummy aria from popover
• 24762f9 Scroll steps clipped by scroll containers
• 80e8b36 Fix hint positioning in transformed dialogs
• ca44ea0 1.10.1
• 7e33b1d Polish checklist item focus and alignment
• 073c802 Add launcher option to checklist
• 5f2f1b8 Render hints inside open modal dialogs
• cde8235 Fix popover clicks on text node targets
• e741814 1.10.0
• Additional commits viewable in compare view

Updates exifreader from 4.46.0 to 4.52.0

Release notes

Sourced from exifreader's releases.

4.52.0: Output limit for custom decompress functions

Changed

• Custom builds now install their build toolchain with --ignore-scripts, so the install scripts of the toolchain packages and their dependencies no longer run during a custom build.

Security

• A custom brotli or deflate function without a limit of its own could be made to decompress far beyond maxDecompressedSize by a small crafted PNG or JPEG XL file, because ExifReader could only check the result afterwards. Every custom brotli or deflate function now receives the most bytes it may produce as {maxOutputLength} in a second argument. Passing it on to a decompressor that takes the same option, such as Node's zlib.inflateSync, makes decompression stop there.
• Every failure of a custom brotli or deflate function after the first in one load() or loadView() call now counts against maxDecompressedSize, so a file of many corrupt compressed blocks no longer makes it decompress up to the limit for each block.
• A custom brotli or deflate function that returns a Promise is now called for the next compressed block only after its previous call has settled, so blocks started together can no longer each be told the whole remaining maxDecompressedSize.
• The README and the type definitions now say that tag filtering removes parsed tags only, not the raw data they came from, such as xmp._raw. The output itself has not changed.

Full Changelog: mattiasw/ExifReader@v4.51.0...v4.52.0

4.51.0: Typed array input, File objects in Node and Bun, custom build fixes

Added

• ExifReader.load accepts any typed array, such as a Uint8Array, and a DataView, including a window into a larger buffer (GitHub issue #532).

Changed

• A Node Buffer that spans its whole underlying ArrayBuffer is no longer copied before parsing (a pooled or sliced Buffer still is), so, as with an ArrayBuffer, a typed array or a DataView, it must not be modified while an async load runs.
• An unsupported input to load throws a TypeError that names the accepted types instead of Error: DataView: Passed buffer type is unsupported.
• Custom builds now contain the format detection code for every metadata kind the included file formats can carry. Measured on six configurations, including the README examples, custom builds are between about 2.2 KB smaller and 0.6 KB larger than in 4.50.0 (minified, before gzip).
• A custom build with png and without xmp no longer returns a PNG's XMP iTXt chunk as the PNG text tag XML:com.adobe.xmp (nor a pngText group made from that chunk alone), and no longer lists it in metadataRange, so length: 'auto' rejects a PNG whose only listed chunk was that one.
• A custom build can now print the warnings the full build prints while locating metadata: the HEIC/AVIF warning about 64-bit iloc fields in builds with none of exif, xmp and icc, the HEIC/AVIF warning about iloc construction method 2 for an Exif item in builds without exif and for an XMP item in builds without xmp, and the warning about several Exif segments in a JPEG in builds without exif.
• Objects that only imitate a Node Buffer, with readUInt8 and the other read methods but without being a typed array, are no longer accepted. A Node Buffer is a Uint8Array and still works. In 4.50.0 such objects worked only for TIFF and GIF files, and every other format threw a TypeError from inside the parser.
• Internal function signatures under src/ changed (Tags.read and readIfd take the tag dictionaries as an argument) and the internal module src/dataview.js no longer exists. src/exif-reader.js is the only documented deep import.

Fixed

• ExifReader.load(file) with a File in Node and Bun no longer rejects with ReferenceError: FileReader is not defined. A File is now read with Blob.prototype.arrayBuffer, and browsers without that method still use FileReader. A Blob that is not a File, such as one from Node's fs.openAsBlob or from response.blob(), is still rejected: wrap it as new File([blob], 'name').
• Custom builds that leave out exif or thumbnail no longer include the thumbnail module.

Full Changelog: mattiasw/ExifReader@v4.50.0...v4.51.0

4.50.0: Package exports map and Node file loading in ES module bundles

Changed

• The package now declares an exports map. exifreader, exifreader/package.json, exifreader/src/* and exifreader/dist/* resolve as before, including the extension-less exifreader/src/exif-reader and exifreader/dist/exif-reader, which now also resolve for ES module imports in Node and Deno.
• With Node, Deno, esbuild and Rollup, any other src/ path now needs its .js extension: exifreader/src/tags.js resolves, exifreader/src/tags no longer does.
• bin/, webpack.config.js, babel.config.json and exif-reader.d.ts can no longer be imported by bare specifier. Nothing in the package resolves them that way, and the CLI reads them by file path. TypeScript users still get exif-reader.d.ts through the types condition and field.
• The map has a browser condition that points at the ES module source, so tools that apply the browser condition without the module condition keep getting it: esbuild with an explicit conditions list, which is what Cloudflare's Wrangler runs, bundles the source as before. Metro resolving for the web platform now gets the source instead of the UMD file, with identical behavior.
• The map has a node condition that points at the UMD file, so bundlers that target Node (esbuild with platform: 'node', webpack with target: 'node', Bun's bundler with --target=bun, and other tools that apply the node condition) bundle the same file Node loads. For webpack's default Node configuration and for bun build --target=bun this changes the bundled file from the ES module source to the UMD file. It parses images the same way, and the bundler includes @xmldom/xmldom in the bundle when that package is installed, instead of loading it from node_modules at run time. When @xmldom/xmldom is not installed, webpack reports a missing optional module and the build still works. Like any CommonJS file, the UMD file needs the bundler to support CommonJS: Rollup needs @rollup/plugin-commonjs, and Vite's development server needs exifreader left out of ssr.noExternal.

Fixed

• Bundling require('exifreader') for the browser with esbuild now works. esbuild now bundles the ES module source, as webpack, Vite, Rollup and Parcel already did, instead of picking the UMD file and failing on its http and https requires.
• Loading a file path or a URL in Node now works when exifreader is in an ES module bundle made by a tool other than webpack (esbuild with format: 'esm', Vite's SSR build with exifreader in ssr.noExternal, and the tools built on them), and when the ES module source is loaded directly by Node, Bun or Deno. Before, only the UMD file loaded by Node itself and webpack bundles could do this. On Node, those setups need 20.16 or later on the 20 line, or 22.3 or later. The UMD file loaded by Node itself keeps working on every supported version. The UMD file finds @xmldom/xmldom as before, and bundlers include it when it is installed. Outside webpack the ES module source gets no implicit @xmldom/xmldom: for XMP, pass the domParser option as described in Parsing XMP tags when not in a DOM environment.

... (truncated)

Changelog

Sourced from exifreader's changelog.

[4.52.0] - 2026-10-23

Changed

• Custom builds now install their build toolchain with --ignore-scripts, so the install scripts of the toolchain packages and their dependencies no longer run during a custom build.

Security

• A custom brotli or deflate function without a limit of its own could be made to decompress far beyond maxDecompressedSize by a small crafted PNG or JPEG XL file, because ExifReader could only check the result afterwards. Every custom brotli or deflate function now receives the most bytes it may produce as {maxOutputLength} in a second argument. Passing it on to a decompressor that takes the same option, such as Node's zlib.inflateSync, makes decompression stop there.
• Every failure of a custom brotli or deflate function after the first in one load() or loadView() call now counts against maxDecompressedSize, so a file of many corrupt compressed blocks no longer makes it decompress up to the limit for each block.
• A custom brotli or deflate function that returns a Promise is now called for the next compressed block only after its previous call has settled, so blocks started together can no longer each be told the whole remaining maxDecompressedSize.
• The README and the type definitions now say that tag filtering removes parsed tags only, not the raw data they came from, such as xmp._raw. The output itself has not changed.

[4.51.0] - 2026-10-21

Added

• ExifReader.load accepts any typed array, such as a Uint8Array, and a DataView, including a window into a larger buffer (GitHub issue #532).

Changed

• A Node Buffer that spans its whole underlying ArrayBuffer is no longer copied before parsing (a pooled or sliced Buffer still is), so, as with an ArrayBuffer, a typed array or a DataView, it must not be modified while an async load runs.
• An unsupported input to load throws a TypeError that names the accepted types instead of Error: DataView: Passed buffer type is unsupported.
• Custom builds now contain the format detection code for every metadata kind the included file formats can carry. Measured on six configurations, including the README examples, custom builds are between about 2.2 KB smaller and 0.6 KB larger than in 4.50.0 (minified, before gzip).
• A custom build with png and without xmp no longer returns a PNG's XMP iTXt chunk as the PNG text tag XML:com.adobe.xmp (nor a pngText group made

... (truncated)

Commits

• 30128de 4.52.0
• 06b212f Update changelog for 4.52.0
• 2dcf8d3 Drop the custom-function failure note from the README
• 16e05c5 Queue async custom decompress calls so each is told what is left
• 07a6d08 Bump the all-actions group with 4 updates
• 70beac1 Charge repeated failed custom decompress calls against the total
• 67dd7a5 Charge a synchronous custom decompress result before the next block
• 9b29eec Render metadata and errors as text on the example pages, add a CSP
• a234c0e Skip install scripts when installing the custom build toolchain
• 3628c27 Document that tag filtering removes parsed tags only
• Additional commits viewable in compare view

Updates vue from 3.5.43 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
• custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
• reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
• reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
• runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
• runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
• runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
• runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
• server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
• ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
• transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
• transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

Commits

• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• 8e8c547 chore(deps): update all non-major dependencies (#15585)
• 4cb0ca8 chore(deps): update playground (#15685)
• e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
• 1caed5a chore(deps): update compiler (#15586)
• a49f451 chore(deps): update lint (#15680)
• 219b858 chore(deps): update build (#15679)
• ff35014 fix(transition): handle comment-wrapped component roots (#15853)
• d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
• Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 6.0.9 to 6.0.10

Release notes

Sourced from @​vitejs/plugin-vue's releases.

plugin-vue@6.0.10

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-vue's changelog.

6.0.10 (2026-10-10)

Bug Fixes

• plugin-vue: compile transformed normal scripts outside vapor mode (#857) (7b63e3c)
• plugin-vue: correct AST reuse checks and allow Vue 3.6 RC (ccc06dd)

Documentation

• plugin-vue: clarify compiler initialization hooks (55d0cab)

Commits

• a03675e release: plugin-vue@6.0.10
• 7b63e3c fix(plugin-vue): compile transformed normal scripts outside vapor mode (#857)
• ccc06dd fix(plugin-vue): correct AST reuse checks and allow Vue 3.6 RC
• 55d0cab docs(plugin-vue): clarify compiler initialization hooks
• See full diff in compare view

Updates autoprefixer from 10.6.1 to 10.6.2

Release notes

Sourced from autoprefixer's releases.

10.6.2

• Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
• Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
• Fixed selector duplicates on multiple Autoprefixer runs.
• Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
• Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
• Fixed source maps for Grid prefixes (by @​dualfroz).

Changelog

Sourced from autoprefixer's changelog.

10.6.2

• Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
• Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
• Fixed selector duplicates on multiple Autoprefixer runs.
• Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
• Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
• Fixed source maps for Grid prefixes (by @​dualfroz).

Commits

• a7dbf4d Release 10.6.2 version
• c3cd98d Fix selector duplicates on multiple Autoprefixer runs
• 5ae399e Keep unprefixed selectors in prefixed grouping rules (#1561)
• 50ca3e2 Fix -webkit-cross-fade() for images with numbers (#1562)
• 0efb61b Add /* autoprefixer: ignore next warning */ control comment (#1560)
• 7ca1fad Set source for Grid prefixes in source maps (#1559)
• c6d89bc Fix case-insensitive pseudo-selector prefixing (#1558)
• See full diff in compare view

Updates postcss from 8.5.28 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• 2455ac8 Release 8.5.32 version
• e367106 Update dependencies
• f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
• eb28619 Fix final-word lookup without source offsets (#2178)
• 095654b Preserve explicit start in Warning#toString() (#2177)
• 9b3d8b8 Preserve Promise semantics in result finally() (#2176)
• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• f1aca7e Release 8.5.30 version
• Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Updates sass from 1.105.0 to 1.107.0

Release notes

Sourced from sass's releases.

Dart Sass 1.107.0

To install Sass 1.107.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Command-Line Interface

• The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

• The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

• Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

• Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

• Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

• Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

• Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

• Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.

See the full changelog for changes in earlier releases.

Dart Sass 1.106.1

To install Sass 1.106.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

• Don't crash when serializing a number with an empty unit. This is only possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass

• More robustly convert invalid value errors into PARAMS errors.

... (truncated)

Changelog

Sourced from sass's changelog.

1.107.0

Command-Line Interface

• The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

• The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

• Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

• Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

• Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

• Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

• Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

• Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.

1.106.1

• Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

... (truncated)

Commits

• 455cbc0 [Deprecations Except] Implement the change (#2895)
• 0cc2fa2 Bump postcss from 8.5.30 to 8.5.31 in /pkg/sass-parser (#2899)
• 811ecc6 Pull the version back to 1.106.1 (#2893)
• b10205e Fix serializing a number with an empty-string unit (#2892)
• e79f8a7 Fix serializing an attribute selector with an empty value (#2891)
• 2ea4fc0 Merge pull request #2883 from sass/fuzz
• a113995 Bump postcss from 8.5.28 to 8.5.30 in /pkg/sass-parser (#2886)
• 2d2e76c Try using the SassBot GitHub token when auto-merging dependabot PRs (#2885)
• 5660824 Improve the accuracy of FileSpan.trimLeft() and .trimRight()
• 09e4024 Throw an error for duplicate rest and non-rest parameter names
• Additional commits viewable in compare view

Updates vite from 7.3.6 to 7.3.7

Release notes

Sourced from vite's releases.

v7.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.7 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (a0a3339)
• html: filename passed to transformIndexHtml should not include queries (#23653) (8d479f9)
• server: store ids to safeModulePaths rather than URLs (#23656) (f0d76c7)

Commits

• 284f6b5 release: v7.3.7
• f0d76c7 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• a0a3339 fix(deps): update launch-editor to v2.14.2 (#23654)
• 8d479f9 fix(html): filename passed to transformIndexHtml should not include queries (...
• See full diff in compare view

Updates @babel/helper-string-parser from 7.29.7 to 7.29.13

Release notes

Sourced from @​babel/helper-string-parser's releases.

v7.29.13 (2026-11-04)

🐛 Bug Fix

• babel-generator, babel-parser
  • #18522 fix(parser): start decorated object members at their first decorator (@​babel-bot)
• babel-parser
  • #18520 fix(parser): allow TS imports to define exports declared before them (@​babel-bot)
  • #18485 fix(parser): allow lone yield before in in an Annex B for-in init (@​babel-bot)
  • #18483 fix(parser): respect unicode escape in isUnparsedContextual (@​babel-bot)
  • #18452 fix(parser): remove non-decimal prefix from bigint (@​babel-bot)
  • #18449 fix(parser): allow await as a function expression name inside async arrow (@​babel-bot)
  • #18453 Disallow new import prop access (@​babel-bot)
  • #18450 Improve F# pipeline direct body check (@​babel-bot)
  • #18446 fix(parser): set phase: null for non-deferred imports with deferredImportEvaluation (#18313) (@​babel-bot)
  • #18448 Fix TypeScript parser failing on async calls in ternary consequent (@​babel-bot)
• babel-generator
  • #18521 fix(generator): print override modifier of TSParameterProperty (@​babel-bot)
  • #18509 fix(generator): do not apply jsesc number rad...

    Description has been truncated