chore(deps): bump the npm-minor-and-patch group across 1 directory with 6 updates

[dependabot]

Bumps the npm-minor-and-patch group with 5 updates in the / directory:

Package	From	To
i18next	26.3.6	26.4.0
@typescript-eslint/eslint-plugin	8.67.0	8.68.0
@vitejs/plugin-react	6.0.5	6.1.0
aislop	0.14.1	0.15.0
vite	8.2.1	8.2.2

Updates i18next from 26.3.6 to 26.4.0

Release notes

Sourced from i18next's releases.

v26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Changelog

Sourced from i18next's changelog.

26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Commits

• 652847e 26.4.0
• 6c6025f prettier fix
• 742b9a9 chore: update dependencies and clean up dev tooling
• 06924d9 fix: invalidate toResolveHierarchy cache on in-place fallbackLng mutation
• bb80369 perf: cache toResolveHierarchy (#2444)
• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.67.0 to 8.68.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

• eslint-plugin: [strict-void-return] add fix suggestions (#12086)
• utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

• eslint-plugin: [unified-signatures] deduplicate types in report (#12656)
• eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
• eslint-plugin: [unified-signatures] report identical signatures (#12678)
• eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
• eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
• eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
• website: playground crashes on extends configs (#12608)
• website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Hugo @​hugop95
• Josh Goldberg ✨
• Niki @​phaux
• Thiago Barbosa
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.68.0 (2026-08-24)

🚀 Features

• eslint-plugin: [strict-void-return] add fix suggestions (#12086)

🩹 Fixes

• eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
• eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
• eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
• eslint-plugin: [unified-signatures] report identical signatures (#12678)
• eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
• eslint-plugin: [unified-signatures] deduplicate types in report (#12656)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Hugo @​hugop95
• Niki @​phaux
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 8f4e00a chore(release): publish 8.68.0
• db30514 feat(eslint-plugin): [strict-void-return] add fix suggestions (#12086)
• 9690339 test(eslint-plugin): [prefer-optional-chain] use createRuleTesterWithTypes ...
• abe9011 fix(eslint-plugin): [no-empty-object-type] ignore suggestions that result in ...
• 79c16e7 chore(eslint-plugin): extract FunctionSignature and enum comparison utils (#1...
• 2442e30 test(eslint-plugin): [no-floating-promises] format test snippets (#12723)
• 3596323 fix(eslint-plugin): [no-floating-promises] setting ignoreVoid: false result...
• 956a339 fix(eslint-plugin): [no-unnecessary-type-assertion] prevent stack overflow in...
• 55f6d5d chore: enable source maps (#12677)
• 3aefb6a test: improve vitest performance with isolate: false (#12703)
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.67.0 to 8.68.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

• eslint-plugin: [strict-void-return] add fix suggestions (#12086)
• utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

• eslint-plugin: [unified-signatures] deduplicate types in report (#12656)
• eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
• eslint-plugin: [unified-signatures] report identical signatures (#12678)
• eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
• eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
• eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
• website: playground crashes on extends configs (#12608)
• website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Hugo @​hugop95
• Josh Goldberg ✨
• Niki @​phaux
• Thiago Barbosa
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.68.0 (2026-08-24)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 8f4e00a chore(release): publish 8.68.0
• 55f6d5d chore: enable source maps (#12677)
• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.5 to 6.1.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits

• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• See full diff in compare view

Updates aislop from 0.14.1 to 0.15.0

Release notes

Sourced from aislop's releases.

v0.15.0 is a calibration release. Scores now describe how code is written rather than how much of it there is, and three rules that fired on ordinary hand-written code have been corrected.

Every score moves in this release, most of them upward. Badges, CI gates, and stored scans will all shift. If you gate CI on a score threshold, re-baseline after upgrading.

Changed

• Score reflects finding density, not project size. Deductions are divided by file count before the scoring curve, so a large project and a small one with the same habits land on the same number. Previously the density term clamped to 1 for any project with more findings than files + 10, which is effectively every real project, so deductions accumulated in absolute terms and larger trees scored worse for being larger. Copying a project three times, byte for byte, used to drop its score by 26 points.
• Rule caps scale with project size. A flat cap decided a small project's score and disappeared in a large one. Caps now mean the same thing at any scale.
• Default scoring smoothing lowered from 20 to 5. With the density term corrected, the old value was all that remained of a systematic advantage for small repositories.

Project	0.14.1	0.15.0
expressjs/express	72	78 Healthy
rohitg00/agentmemory	9	72 Needs Work
playcanvas/supersplat	14	65 Needs Work
obra/superpowers	33	57 Needs Work
github/spec-kit	3	41 Critical

Fixed

• ai-slop/trivial-comment no longer flags ordinary terse comments. The rule matched any short comment opening with a verb stem, which is normal English comment style rather than evidence of generation, and marked each one auto-fixable. It now requires a file to be saturated with them (at least one per 50 non-blank lines), which is the shape generated code actually has. A mature library carrying three such comments in 650 lines is left alone.
• security/vulnerable-dependency no longer scores dev tooling as shipped risk. Advisories reaching a project only through devDependencies are still reported, labelled dev-only, at info severity instead of raising an error. Runtime reachability is resolved by walking npm audit's effects chain back to the manifests, including every workspace member, so a production dependency declared by a member package is correctly treated as shipped. Where the origin cannot be determined, full severity is kept.
• ai-slop/python-mutable-default no longer flags call-wrapped keyword arguments. FastAPI, typer, and pydantic markers such as Body(default={}) are framework semantics the rule cannot decide from syntax. Signature scanning also masks string literals and comments, including f-string replacement fields, before counting parentheses.
• doctor derives languages from the configured scan scope rather than from manifests alone, so reported languages match what is actually scanned.
• Build no longer emits tsdown warnings.

Internal

• Workspace-aware runtime dependency resolution extracted to its own module with dedicated tests.
• The starved-pipe subprocess test asserts ordering instead of wall-clock timing, removing a source of flakiness on loaded Windows runners.
• Narrative comments removed from the trivial-comment detector.
• Dependency bumps: @biomejs/biome 2.5.8, knip 6.32.2, vite 8.2.2, @types/node 26.2.0, github/codeql-action 4.37.7.

Upgrading

npx aislop@0.15.0 scan

Scores will differ from 0.14.1 on the same code. That is expected. If your CI fails after upgrading, check whether it is a real regression or a threshold that needs re-baselining against the new curve.

Validation

• 2,064 tests passing across 200 files
• Linux and Windows CI passing on Node 22 and 24
• Typecheck and build clean
• aislop self-scan at 99/100
• Corpus scores above re-measured on the release commit

Changelog

Sourced from aislop's changelog.

0.15.0 (2026-08-26)

Calibration release. Scores now describe how code is written rather than how much of it there is, and three rules that fired on ordinary hand-written code have been corrected. Every score moves in this release, most of them upward. Badges, CI gates, and stored scans will all shift; if you gate CI on a threshold, re-baseline after upgrading.

Changed

• Score reflects finding density, not project size. Deductions are divided by file count before the scoring curve, so a large project and a small one with the same habits land on the same number. Previously the density term clamped to 1 for any project with more findings than files + 10, which is effectively every real project, so deductions accumulated in absolute terms and larger trees scored worse for being larger. Copying a project three times, byte for byte, used to drop its score by 26 points.
• Rule caps scale with project size. A flat cap decided a small project's score and disappeared in a large one. Caps now mean the same thing at any scale.
• Default scoring smoothing lowered from 20 to 5. With the density term corrected, the old value was all that remained of a systematic advantage for small repositories.

Representative scores, before and after:

Project	0.14.1	0.15.0
expressjs/express	72	78 Healthy
rohitg00/agentmemory	9	72 Needs Work
playcanvas/supersplat	14	65 Needs Work
obra/superpowers	33	57 Needs Work
github/spec-kit	3	41 Critical

Fixed

• ai-slop/trivial-comment no longer flags ordinary terse comments. The rule matched any short comment opening with a verb stem, which is normal English comment style rather than evidence of generation, and marked each one auto-fixable. It now requires a file to be saturated with them (at least one per 50 non-blank lines), which is the shape generated code actually has. A mature library carrying three such comments in 650 lines is left alone.
• security/vulnerable-dependency no longer scores dev tooling as shipped risk. Advisories reaching a project only through devDependencies are still reported, labelled dev-only, at info severity instead of raising an error. Runtime reachability is resolved by walking npm audit's effects chain back to the manifests, including every workspace member, so a production dependency declared by a member package is correctly treated as shipped. Where the origin cannot be determined, full severity is kept.
• ai-slop/python-mutable-default no longer flags call-wrapped keyword arguments. FastAPI, typer, and pydantic markers such as Body(default={}) are framework semantics the rule cannot decide from syntax. Signature scanning also masks string literals and comments, including f-string replacement fields, before counting parentheses.
• doctor derives languages from the configured scan scope rather than from manifests alone, so reported languages match what is actually scanned.
• Build no longer emits tsdown warnings.

Internal

• Workspace-aware runtime dependency resolution extracted to its own module with dedicated tests.
• The starved-pipe subprocess test asserts ordering instead of wall-clock timing, removing a source of flakiness on loaded Windows runners.
• Narrative comments removed from the trivial-comment detector.
• Dependency bumps: @biomejs/biome 2.5.8, knip 6.32.2, vite 8.2.2, @types/node 26.2.0, github/codeql-action 4.37.7.

Commits

• 647c869 Merge pull request #366 from scanaislop/develop
• 9858e09 Merge pull request #365 from scanaislop/release/v0.15.0
• 3880de6 chore(release): 0.15.0
• e917a8b Merge pull request #364 from scanaislop/fix/calibration-comment-density-dev-deps
• b746a3b Merge branch 'develop' into fix/calibration-comment-density-dev-deps
• 8ad23c1 Merge pull request #356 from mtschoen/fix/doctor-language-detection
• f7a25f1 Merge branch 'develop' into fix/calibration-comment-density-dev-deps
• 6216511 Merge branch 'develop' into fix/doctor-language-detection
• 8c49361 Merge pull request #361 from scanaislop/dependabot/npm_and_yarn/develop/knip-...
• 40e2085 Merge remote-tracking branch 'origin/fix/calibration-comment-density-dev-deps...
• Additional commits viewable in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
algebra-tiles	Ready	Preview	Aug 30, 2026 1:54pm

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.