Stu Mason

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
@vitejs/plugin-vue	`6.0.6`	`6.0.7`
axios	`1.16.0`	`1.16.1`
postcss	`8.5.14`	`8.5.15`
vite	`8.0.12`	`8.0.16`
vue	`3.5.34`	`3.5.35`
vue-router	`5.0.6`	`5.1.0`

Updates @vitejs/plugin-vue from 6.0.6 to 6.0.7

▶Release notes

Sourced from @vitejs/plugin-vue's releases.

[email protected]

Please refer to CHANGELOG.md for details.

▶Changelog

Sourced from @vitejs/plugin-vue's changelog.

6.0.7 (2026-05-15)

Features

use carets for @rolldown/pluginutils version (#776) (941b651)

Bug Fixes

deps: update all non-major dependencies (#762) (9e825b8)

deps: update all non-major dependencies (#774) (77dc8bc)

▶Commits

f93aceb release: [email protected]
941b651 feat: use carets for @rolldown/pluginutils version (#776)
77dc8bc fix(deps): update all non-major dependencies (#774)
9e825b8 fix(deps): update all non-major dependencies (#762)
See full diff in compare view

Updates axios from 1.16.0 to 1.16.1

▶Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)

Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)

CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)

Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)

XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)

Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)

Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)

URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)

composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)

AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)

Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)

Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)

Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@hpinmetaverse (#10836)

@tommyhgunz14 (#7413)

@abhu85 (#10829)

@divyanshuraj1095 (#10853)

@sagodi97 (#10856)

@rkdfx (#10868)

@Liuwei1125 (#10866)

Full Changelog

▶Changelog

Sourced from axios's changelog.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)

Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)

CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)

Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)

XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)

Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)

Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)

URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)

composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)

AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)

Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)

Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)

Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@hpinmetaverse (#10836)

@tommyhgunz14 (#7413)

@abhu85 (#10829)

@divyanshuraj1095 (#10853)

@sagodi97 (#10856)

@rkdfx (#10868)

@Liuwei1125 (#10866)

Full Changelog

▶Commits

1337d6b chore(release): prepare release 1.16.1 (#10877)
858a790 fix: remove all caches (#10882)
34adfd9 revert: "fix: support URL object as config.url input (#10866)" (#10874)
847d89b fix: support URL object as config.url input (#10866)
4094886 fix(progress): guard malformed XHR upload events (#10868)
44f0c5b chore: change sponsorship link and add Twicsy advertisement (#10869)
64e1095 chore: update PR and issue template to use h2 (#10865)
3e6b4e1 fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...
c4453ba fix: add the ability to add additional sponsors to the process sponsors scrip...
caa00a9 fix: https data in cleartext to proxy (#10858)
Additional commits viewable in compare view

Updates postcss from 8.5.14 to 8.5.15

▶Release notes

Sourced from postcss's releases.

8.5.15

Fixed declaration parsing performance (by @homanp).

▶Changelog

Sourced from postcss's changelog.

8.5.15

Fixed declaration parsing performance (by @homanp).

▶Commits

eae46db Release 8.5.15 version
79508ff Update CI actions
b128e21 Speed up declaration parsing by avoiding creating new array on each token
9825dca Fix code format
55789c8 Update dependencies
84fbbe9 Install older pnpm action for old Node.js
9f860bd Revert pnpm action for old Node.js
0877198 Update CI actions
b2d1a33 Fix linter warnings
0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
Additional commits viewable in compare view

Updates vite from 8.0.12 to 8.0.16

▶Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

▶Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)

reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

send 408 on request timeout (#22476) (c85c9ee)

update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)

deps: update all non-major dependencies (#22511) (2686d7d)

dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)

glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)

optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)

resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22566) (3052a67)

Code Refactoring

correct logic in collectAllModules function (#22562) (6978a9c)

8.0.14 (2026-05-21)

Features

update rolldown to 1.0.2 (#22484) (96efc88)

Bug Fixes

deps: update all non-major dependencies (#22471) (98b8163)

dev: handle errors when sending messages to vite server (#22450) (e8e9a34)

html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)

optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22470) (7cb728e)

remove irrelevant commits from changelog (2c69495)

Code Refactoring

glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

▶Commits

f94df87 release: v8.0.16
dc245c7 fix: reject windows alternate paths (#22572)
50b9512 fix(deps): reject UNC paths for launch-editor-middleware (#22571)
8d1b019 release: v8.0.15
2686d7d fix(deps): update all non-major dependencies (#22511)
3052a67 chore(deps): update rolldown-related dependencies (#22566)
e3cfb9d fix(optimizer): close the rolldown bundle when write() rejects (#22528)
6978a9c refactor: correct logic in collectAllModules function (#22562)
646dbed feat: update rolldown to 1.0.3 (#22538)
85a0eff fix: capitalize error messages and remove spurious space in parse error (#22488)
Additional commits viewable in compare view

Updates vue from 3.5.34 to 3.5.35

▶Release notes

Sourced from vue's releases.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

▶Changelog

Sourced from vue's changelog.

3.5.35 (2026-05-27)

Bug Fixes

compiler-core: avoid double processing v-for keys with v-memo (#14861) (34a0ded), closes #14859

compiler-sfc: resolve top-level exports from files registered as global types (#14805) (3d077f2), closes nuxt/nuxt#33694

runtime-core: avoid repeated hydration mismatch checks (#14857) (170fc95), closes #14855

runtime-core: skip idle persisted transition hooks in keep-alive moves (#14865) (80fc139), closes #14031

server-renderer: propagate sync errors from ssrRenderSuspense (#14804) (4760997), closes nuxt/nuxt#28162

teleport: skip child unmount when pending mount discarded (#14876) (#14877) (584beb1)

Performance Improvements

reactivity: skip type checks for cached proxies (#14860) (5734fe9)

runtime-dom: optimize array event handler dispatch (#14828) (bb18dc8)

server-renderer: avoid materializing iterables in ssrRenderList (#14821) (1b7a2cc)

▶Commits

8be32d6 release: v3.5.35
80fc139 fix(runtime-core): skip idle persisted transition hooks in keep-alive moves (...
d6c7371 ci: use backup action for size report comments
bb18dc8 perf(runtime-dom): optimize array event handler dispatch (#14828)
5734fe9 perf(reactivity): skip type checks for cached proxies (#14860)
584beb1 fix(teleport): skip child unmount when pending mount discarded (#14876) (#14877)
34a0ded fix(compiler-core): avoid double processing v-for keys with v-memo (#14861)
170fc95 fix(runtime-core): avoid repeated hydration mismatch checks (#14857)
1b7a2cc perf(server-renderer): avoid materializing iterables in ssrRenderList (#14821)
3d077f2 fix(compiler-sfc): resolve top-level exports from files registered as global ...
Additional commits viewable in compare view

Updates vue-router from 5.0.6 to 5.1.0

▶Release notes

Sourced from vue-router's releases.

v5.1.0

   🚀 Features

Typed definePage params.path - by @posva in vuejs/router#2716 (d65de)

Strict type for definePage param default - by @posva (0ae10)

Support raw param parsers - by @posva (eadec)

Force array type raw param parsers - by @posva (7a68b)

Allow overriding the global Router type - by @posva (1cd93)

Emit runtime warning for invalid format in query params - by @posva (8259a)

Override useRouter() return with experimental types config - by @posva (39a34)

Allow string as a param parser for convenience - by @posva (be37b)

   🐞 Bug Fixes

Fix auto import fixes and make experimental esm only - by @posva (db3a6)

Deterministic param parser types order - by @posva (bf0fc)

Avoid importing unused param parsers - by @posva (41c00)

Filter invalid query params without failing to match - by @posva (db717)

Detect not set format - by @posva (aa89e)

Allow undefined values for params in query - by @posva (4726e)

experimental: Repeatable params in subsegments - by @posva (84664)

types: Add vite as optional peer dependency - by @ForgottenR, @posva and shihuijie in vuejs/router#2712 (facbf)

    View changes on GitHub

v5.0.7

   🚀 Features

Upgrade to babel 8 - by @posva (8d3e6)

Make defineParamParser() more intuitive - by @posva (8715b)

Upgrade @vue/devtools-api - by @posva (87c3a)

matcher: Hint at params: {} workaround in discarded params warning - by @posva and shanliuling in vuejs/router#2689 (c2b13)

param-parsers: Add include/exclude options - by @posva (91cde)

   🐞 Bug Fixes

matcher:

Finalize param token before processing escaped colon - by @babu-ch and @posva in vuejs/router#2654 (20521)

query:

Use Object.create(null) to prevent prototype pollution - by @wdskuki, wdsmini and @posva in vuejs/router#2661 (be88c)

resolve:

Omit empty optional params from resolved params - by @babu-ch and @posva in vuejs/router#2434 (1ef09)

types:

Wire RouteNamedMap via generated routes.d.ts - by @posva in vuejs/router#2700 (aef99)

unplugin:

Avoid generating empty routes - by @FrontEndDog and @posva in vuejs/router#2642 (10a8b)

Apply definePage path-param parser overrides - by @posva in vuejs/router#2699 (c8074)

volar:

Drop runtime @vue/language-core import - by @danielroe in vuejs/router#2710 (8af50)

... (truncated)

▶Commits

c0e3226 release: [email protected]
9ca7672 chore: fix playgroundc usage
315cc09 refactor(experimental): remove defineQueryParamParser and definePathParamParser
7fa42f4 docs: fix gen and dead links
1b3a068 refactor: organize imports and exports add back Router
665be2d docs: links update
5d79bd2 chore: unused param
9ccf3d1 docs: experimental
eee8ac6 chore: playground param parsers testing
0194b85 build: build before test:types
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

▶Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

PR #104 merged: chore(deps-dev): bump the minor-and-patch group across 1 directory with 6 updates

[email protected]

6.0.7 (2026-05-15)

Features

Bug Fixes

v1.16.1 — May 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.16.1 — May 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

8.5.15

8.5.15

v8.0.16

v8.0.15

v8.0.14

v8.0.13

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

v3.5.35

3.5.35 (2026-05-27)

Bug Fixes

Performance Improvements

v5.1.0

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v5.0.7

🚀 Features

🐞 Bug Fixes