[dependabot]

Bumps the npm_and_yarn group with 6 updates in the /samples/autonomous-pipeline directory:

Package	From	To
@github/copilot	0.0.414	1.0.107
@vitest/mocker	4.1.10	5.1.0
protobufjs	7.5.4	7.6.6
vite	8.1.5	8.3.6
ws	8.19.0	8.22.1
zod	4.3.6	4.6.7

Bumps the npm_and_yarn group with 3 updates in the /samples/cost-aware-router directory: @vitest/mocker, vite and zod.
Bumps the npm_and_yarn group with 2 updates in the /samples/hello-squad directory: @vitest/mocker and vite.
Bumps the npm_and_yarn group with 2 updates in the /samples/hook-governance directory: @vitest/mocker and vite.
Bumps the npm_and_yarn group with 1 update in the /samples/storage-provider-azure directory: @azure/msal-node.
Bumps the npm_and_yarn group with 3 updates in the /samples/streaming-chat directory: @vitest/mocker, source-map-js and vite.
Bumps the npm_and_yarn group with 1 update in the /test-fixtures/dogfood/node-monorepo/packages/core directory: vitest.

Updates @github/copilot from 0.0.414 to 1.0.107

Release notes

Sourced from @​github/copilot's releases.

1.0.107

2026-11-06

• Rex terminals render inline images using Kitty direct placements.
• Add /code command to open the current session in VS Code
• Add a Fusion tier setting to copilot config.
• Make /settings open the unified dashboard for all users and add global search across settings and local resources.
• Interactive CLI reports program status to supporting terminals, including when attention is needed.
• Add opt-in session management tools and @​mentions for opted-in local sessions
• Add COPILOT_SESSION_CWD for launching and expanding LSP and local MCP server configs
• Add GPT-6.1 Terra as a selectable model under New models when available to your account
• Add a Sandbox extensions setting to run extension processes inside the sandbox
• Add MATS telemetry for Entra authentication through OneAuth, respecting client telemetry opt-out.
• An image removed from the prompt with Ctrl+U, Ctrl+K or Ctrl+W, or replaced by a recalled history entry, is no longer sent with the message, and Ctrl+S can stash the prompt afterwards.
• Pasted text containing NEL, Unicode line or paragraph separators now fills separate prompt lines, and pasted DEL and C1 control characters are dropped, instead of being kept in the prompt and cutting characters off the end of the row.
• In copilot -p --plan, the agent is no longer told to suggest Shift+Tab to leave plan mode, which only works in the interactive interface, and is asked to include the plan's key points in its reply instead.
• copilot --resume <id> no longer waits with no output and no end when the Copilot task service does not respond; the task lookup now gives up after 10 seconds and resolution continues.
• Sandboxed grep, rg, and glob now report Windows launch failures instead of silent no-match results
• Model picker shows context window size for flat, unpriced, and single-tier models
• Sandboxed local MCP servers respect relative filesystem permissions from the session directory, even when configured with a different working directory.
• PowerShell commands work on Windows when the CLI is installed in a long directory path
• Switching sessions while other sessions are busy no longer crashes the CLI and leaves a blank terminal
• Keep readable image attachments when retrying a prompt that contains a corrupt image
• MCP Entra authentication now falls back to the VS Code registration when Copilot CLI preauthorization is unavailable.
• Sandboxed local MCP servers now start correctly when configured with a relative cwd.
• On Windows, sandboxed sessions in nested Git directories can change to and write at the repository root
• Autopilot no longer starts implementing its own recommendation after a request that only asked for a review or analysis
• Suppress unnecessary MCP reload summaries when plugin servers remain unchanged
• A model request that Copilot's service answers with an empty 404 while under load is now retried instead of ending the turn with "Execution failed: 404".
• copilot help config now lists every setting the settings catalog offers, including the ones that were missing from its hand-written text, such as askUser, effortLevel, planModel, toolSearch and worktreeBaseRef
• ACP clients can switch a session started with --yolo out of autopilot, and allow-all stays on, instead of the switch failing as blocked by policy and a second attempt turning allow-all off.
• The @ file picker now underlines a name with a capital dotted I, such as İstanbul.txt, when the query is typed without the dot, and no longer shortens that row's matched folder.
• The @ file picker now underlines matches in names stored with decomposed accents or found by a query typed without accents, and no longer shortens such a row's matched folder.
• Up and Down in a multi-line prompt keep the column you started from when they pass through a shorter line, instead of leaving the caret near the start of the line.
• Ctrl+Y and /share research skip research folder entries that are not readable files, such as a broken link or a folder named like a report, instead of failing or offering them.
• Show each agent's selection ID in /agent when multiple agents share a display name.
• The edit tool now fails at once on a named pipe, socket or device instead of waiting forever for the other end of a FIFO, which stalled the turn.
• An empty plan.md no longer shows the ctrl+y plan hint or Plan: yes in /session, and ctrl+y opens the research report instead, matching /session plan.
• The footer keeps the "N scheduled", sandbox, YOLO and CI status items whole on narrow terminals by shortening the directory and branch first, instead of cutting the items off the end of the row.
• Pull request, issue and gist details, and their load errors, no longer let escape sequences in titles, names, branches, gist files or server messages restyle the terminal.
• Show the saved paused goal and continuation guidance when resuming an autopilot session.
• Issues and pull requests picked with # are no longer dropped from the message when another one is picked in front of them, and an issue picked twice is sent once.
• copilot help billing now says the footer shows the AI credits used in this session (nothing by default on the legacy billing platform), and that the /statusline quota item is off by default and ai-used is on.
• copilot help config now says copyOnSelect is on by default on macOS, that /keep-alive changes only the current session, that logLevel is set in the /settings dialog or settings.json rather than copilot config, and that trustedFolders lives in config.json and is filled by the folder-trust prompt.
• copilot help environment now says a COPILOT_AUTO_TIER value of "fast" is ignored with a notice rather than rejected, and that USE_TGREP=true does not override whether indexed search is available for your account or USE_BUILTIN_RIPGREP=false.
• copilot help config, copilot help environment and copilot help acp no longer name the hidden --prefer-version, --server and --stdio options.
• copilot help limits shows a status example at the real minimum AI credit limit and says the final-call warning appears when 10% or less of the limit remains
• copilot help monitoring now says an http:// OTLP endpoint disables export only when an OTLP CA certificate or client certificate/key variable is set, not for every http:// endpoint.
• copilot help permissions now documents glob patterns in write(path) and read(path) rules, lists the read and memory kinds, and explains that an unscoped write rule approves shell output redirection but not the command itself; it no longer says wildcard matching is coming in the future.
• copilot --help and copilot help --help now list the acp help topic, and copilot help --help no longer prints its description and topic list with stray indentation.

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.107 - 2026-11-06

• Rex terminals render inline images using Kitty direct placements.
• Add /code command to open the current session in VS Code
• Add a Fusion tier setting to copilot config.
• Make /settings open the unified dashboard for all users and add global search across settings and local resources.
• Interactive CLI reports program status to supporting terminals, including when attention is needed.
• Add opt-in session management tools and @​mentions for opted-in local sessions
• Add COPILOT_SESSION_CWD for launching and expanding LSP and local MCP server configs
• Add GPT-6.1 Terra as a selectable model under New models when available to your account
• Add a Sandbox extensions setting to run extension processes inside the sandbox
• Add MATS telemetry for Entra authentication through OneAuth, respecting client telemetry opt-out.
• An image removed from the prompt with Ctrl+U, Ctrl+K or Ctrl+W, or replaced by a recalled history entry, is no longer sent with the message, and Ctrl+S can stash the prompt afterwards.
• Pasted text containing NEL, Unicode line or paragraph separators now fills separate prompt lines, and pasted DEL and C1 control characters are dropped, instead of being kept in the prompt and cutting characters off the end of the row.
• In copilot -p --plan, the agent is no longer told to suggest Shift+Tab to leave plan mode, which only works in the interactive interface, and is asked to include the plan's key points in its reply instead.
• copilot --resume <id> no longer waits with no output and no end when the Copilot task service does not respond; the task lookup now gives up after 10 seconds and resolution continues.
• Sandboxed grep, rg, and glob now report Windows launch failures instead of silent no-match results
• Model picker shows context window size for flat, unpriced, and single-tier models
• Sandboxed local MCP servers respect relative filesystem permissions from the session directory, even when configured with a different working directory.
• PowerShell commands work on Windows when the CLI is installed in a long directory path
• Switching sessions while other sessions are busy no longer crashes the CLI and leaves a blank terminal
• Keep readable image attachments when retrying a prompt that contains a corrupt image
• MCP Entra authentication now falls back to the VS Code registration when Copilot CLI preauthorization is unavailable.
• Sandboxed local MCP servers now start correctly when configured with a relative cwd.
• On Windows, sandboxed sessions in nested Git directories can change to and write at the repository root
• Autopilot no longer starts implementing its own recommendation after a request that only asked for a review or analysis
• Suppress unnecessary MCP reload summaries when plugin servers remain unchanged
• A model request that Copilot's service answers with an empty 404 while under load is now retried instead of ending the turn with "Execution failed: 404".
• copilot help config now lists every setting the settings catalog offers, including the ones that were missing from its hand-written text, such as askUser, effortLevel, planModel, toolSearch and worktreeBaseRef
• ACP clients can switch a session started with --yolo out of autopilot, and allow-all stays on, instead of the switch failing as blocked by policy and a second attempt turning allow-all off.
• The @ file picker now underlines a name with a capital dotted I, such as İstanbul.txt, when the query is typed without the dot, and no longer shortens that row's matched folder.
• The @ file picker now underlines matches in names stored with decomposed accents or found by a query typed without accents, and no longer shortens such a row's matched folder.
• Up and Down in a multi-line prompt keep the column you started from when they pass through a shorter line, instead of leaving the caret near the start of the line.
• Ctrl+Y and /share research skip research folder entries that are not readable files, such as a broken link or a folder named like a report, instead of failing or offering them.
• Show each agent's selection ID in /agent when multiple agents share a display name.
• The edit tool now fails at once on a named pipe, socket or device instead of waiting forever for the other end of a FIFO, which stalled the turn.
• An empty plan.md no longer shows the ctrl+y plan hint or Plan: yes in /session, and ctrl+y opens the research report instead, matching /session plan.
• The footer keeps the "N scheduled", sandbox, YOLO and CI status items whole on narrow terminals by shortening the directory and branch first, instead of cutting the items off the end of the row.
• Pull request, issue and gist details, and their load errors, no longer let escape sequences in titles, names, branches, gist files or server messages restyle the terminal.
• Show the saved paused goal and continuation guidance when resuming an autopilot session.
• Issues and pull requests picked with # are no longer dropped from the message when another one is picked in front of them, and an issue picked twice is sent once.
• copilot help billing now says the footer shows the AI credits used in this session (nothing by default on the legacy billing platform), and that the /statusline quota item is off by default and ai-used is on.
• copilot help config now says copyOnSelect is on by default on macOS, that /keep-alive changes only the current session, that logLevel is set in the /settings dialog or settings.json rather than copilot config, and that trustedFolders lives in config.json and is filled by the folder-trust prompt.
• copilot help environment now says a COPILOT_AUTO_TIER value of "fast" is ignored with a notice rather than rejected, and that USE_TGREP=true does not override whether indexed search is available for your account or USE_BUILTIN_RIPGREP=false.
• copilot help config, copilot help environment and copilot help acp no longer name the hidden --prefer-version, --server and --stdio options.
• copilot help limits shows a status example at the real minimum AI credit limit and says the final-call warning appears when 10% or less of the limit remains
• copilot help monitoring now says an http:// OTLP endpoint disables export only when an OTLP CA certificate or client certificate/key variable is set, not for every http:// endpoint.
• copilot help permissions now documents glob patterns in write(path) and read(path) rules, lists the read and memory kinds, and explains that an unscoped write rule approves shell output redirection but not the command itself; it no longer says wildcard matching is coming in the future.
• copilot --help and copilot help --help now list the acp help topic, and copilot help --help no longer prints its description and topic list with stray indentation.
• Form and settings text fields show the control characters of a stored value, such as an MCP server command, instead of letting them recolor or hide its text.

... (truncated)

Commits

• 841e7a5 Update changelog.md for version 1.0.106
• e192829 Publish a Copilot CLI server container image on release (#5308)
• 84ee80e Update changelog.md for version 1.0.105
• 8f18bec Update changelog.md for version 1.0.104
• 7ea98df Update changelog.md for version 1.0.103
• 17631dc Update changelog.md for version 1.0.102
• c66d206 Update changelog.md for version 1.0.101
• 84a2bd3 Update changelog.md for version 1.0.100
• c01c663 Update changelog.md for version 1.0.98
• 76c3172 Update changelog.md for version 1.0.97
• Additional commits viewable in compare view

Updates @vitest/mocker from 4.1.10 to 5.1.0

Release notes

Sourced from @​vitest/mocker's releases.

v5.1.0

   🚀 Features

• Add --last-failed to run only failed tests  -  by @​sheremet-va in vitest-dev/vitest#11558 (82f63)
• Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime()  -  by @​Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @​hi-ogawa and Codex (GPT-6) in vitest-dev/vitest#11321 (f150f)
• Introduce --since-last-run flag  -  by @​sheremet-va in vitest-dev/vitest#11516 (08bd9)
• Expose per-retry/repeat attempt result  -  by @​hi-ogawa, Codex (GPT-6) and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11232 (21be4)
• Support fake timers for node:timers and node:timers/promise  -  by @​hi-ogawa, OpenCode and Codex (GPT-6) in vitest-dev/vitest#10899 (fbe97)
• Allow coverage providers to store data in fs module cache  -  by @​AriPerkkio in vitest-dev/vitest#11747 (54a2b)
• Interactively review failed snapshots  -  by @​macarie and @​hi-ogawa in vitest-dev/vitest#11325 (54e5b)
• browser:
  • Mock modules through an import map  -  by @​sheremet-va in vitest-dev/vitest#11534 (707f8)
  • Drop experimental label from trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11518 (44c3c)
  • Introduce experimental pointer API  -  by @​macarie in vitest-dev/vitest#10780 (5dc09)
  • Capture aria snapshot in trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11492 (0cc39)
  • Show trace steps timeline on terminal on test failure  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11594 (973dc)
  • Add failure-only trace view mode  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11612 (d5d7d)
  • Enable failure-only trace view by default  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11766 (f37b6)
• coverage:
  • V8 to support ignoreNode option  -  by @​erickserra and @​AriPerkkio in vitest-dev/vitest#11688 (e02db)
• experimental:
  • Add trace timeline for node  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11753 (4e985)
  • Add message option to vi.waitFor and vi.waitUntil  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11754 (fd145)

   🐞 Bug Fixes

• Rerun setup files after --changed filtering  -  by @​sheremet-va in vitest-dev/vitest#11621 (3a39c)
• Return the mock to concurrent imports  -  by @​sheremet-va in vitest-dev/vitest#11623 (1453b)
• Don't fail on console log pending at teardown  -  by @​sheremet-va in vitest-dev/vitest#11619 (a60b8)
• Reference chai types in every d.ts chunk  -  by @​sheremet-va in vitest-dev/vitest#11618 (fb150)
• Detect mock factory cycles that form later  -  by @​sheremet-va in vitest-dev/vitest#11642 (e9554)
• Skip fs module cache for typed import.meta.glob  -  by @​sheremet-va in vitest-dev/vitest#11666 (79501)
• Run tests that import a deleted file  -  by @​sheremet-va in vitest-dev/vitest#11669 (80aa1)
• Keep syntax highlighting in code frames  -  by @​sheremet-va in vitest-dev/vitest#11705 (d39f5)
• Respect CLI filters when prewarming browsers  -  by @​sheremet-va and Benjamin Tang in vitest-dev/vitest#11706 (10947)
• Read cached source as utf-8  -  by @​juan-fernandez in vitest-dev/vitest#11682 and vitest-dev/vitest#11709 (867a5)
• Inherit watch from the root config in projects  -  by @​nstepien and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11724 (77c12)
• Prefix expect.poll message to all errors  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11756 (cab58)
• Support api.port 0  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11641 (3667c)
• Show attempts in test error logs of retried tests  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11696 (77a94)
• Preserve rootDir in project paths  -  by @​btea in vitest-dev/vitest#11816 (bf96d)
• browser:
  • Change default port to 23315  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11640 (a2ec4)
  • Advance fake timers in actions and expect.element  -  by @​julienw, @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11242 (68190)
  • Drop trace view warning without html reporter  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11665 (e6407)
  • Detect shared chunks via the optimizer  -  by @​sheremet-va in vitest-dev/vitest#11661 (e2e9c)
  • Clear screenshot stability timeout  -  by @​sheremet-va in vitest-dev/vitest#11659 (fbe37)
  • Measure prepare duration with one clock  -  by @​sheremet-va in vitest-dev/vitest#11667 (a3ed4)
  • Keep failure screenshot per attempt  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11694 (a5022)
  • Print trace timeline of each attempt  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11695 (27229)

... (truncated)

Commits

• 7a38449 chore: release v5.1.0 (#11838)
• 810ec66 fix(mocker): use root mocks for linked packages (fix #7708) (#11739)
• cca423d fix(mocker): don't change the original prototype chain (#11737)
• e1b0d33 chore: release v5.1.0-beta.1 (#11647)
• 707f8ad feat(browser): mock modules through an import map (#11534)
• 7a825db chore: release v5.0.5 (#11609)
• 6a11cf6 chore: release v5.0.4 (#11554)
• 58c86ed chore(deps): update all non-major dependencies (#11550)
• 5c95521 fix(browser): clean up unmocked and pending mocks (#11537)
• cd423ba fix(mocker): fix native loader mocking edge cases (#11540)
• Additional commits viewable in compare view

Updates protobufjs from 7.5.4 to 7.6.6

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.6

7.6.6 (2026-08-27)

Bug Fixes

• Backport recent 8.x fixes to 7.x (#2422) (d3db676)

protobufjs: v7.6.5

7.6.5 (2026-07-04)

Bug Fixes

• handle EOF during options parsing (#2352) (#2356) (10fba6d)

protobufjs: v7.6.4

7.6.4 (2026-06-12)

Bug Fixes

• Reconfigure and speed up CI (#2329) (574f761)
• Remove inquire submodule (#2327) (06ddd07)

protobufjs: v7.6.3

7.6.3 (2026-06-09)

Bug Fixes

• Avoid name collisions in generated code (#2311) (78a9576)
• Preserve null conversion behavior for fieldless messages (#2312) (df91652)

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

• Backport consistency and correctness fixes (#2294) (a92f72e)

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

• Backport misc utility hardening (#2280) (8a45c13)
• Treat fixed64 as unsigned in converters (#2266) (479dfdc)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.6.6 (2026-08-27)

Bug Fixes

• Backport recent 8.x fixes to 7.x (#2422) (d3db676)

7.6.5 (2026-07-04)

Bug Fixes

• handle EOF during options parsing (#2352) (#2356) (10fba6d)

7.6.4 (2026-06-12)

Bug Fixes

• Reconfigure and speed up CI (#2329) (574f761)
• Remove inquire submodule (#2327) (06ddd07)

7.6.3 (2026-06-09)

Bug Fixes

• Avoid name collisions in generated code (#2311) (78a9576)
• Preserve null conversion behavior for fieldless messages (#2312) (df91652)

7.6.2 (2026-05-30)

Bug Fixes

• Backport consistency and correctness fixes (#2294) (a92f72e)

7.6.1 (2026-05-22)

Bug Fixes

• Backport misc utility hardening (#2280) (8a45c13)
• Treat fixed64 as unsigned in converters (#2266) (479dfdc)

7.6.0 (2026-05-18)

Features

... (truncated)

Commits

• 795704d chore: release protobufjs-v7.x (#2423)
• d3db676 fix: Backport recent 8.x fixes to 7.x (#2422)
• fe82f72 chore: Update micromodule repository urls (#2362)
• d29ff67 chore: release protobufjs-v7.x (#2361)
• d1ae3ce perf: Batch String.fromCharCode in @​protobufjs/utf8 read (#2355)
• 89048ba chore: release protobufjs-v7.x (#2357)
• 10fba6d fix: handle EOF during options parsing (#2352) (#2356)
• f8f64ef chore: release protobufjs-v7.x (#2330)
• 574f761 fix: Reconfigure and speed up CI (#2329)
• 06ddd07 fix: Remove inquire submodule (#2327)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.

Updates vite from 8.1.5 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

• align charset case (#23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467<...

  Description has been truncated

[Copilot]

🟡 Changes recommended

Several samples still document and allow Node 20 while upgraded dependencies require Node 22 or newer, leaving their stated setup unsupported.

6 open issues

• Vitest 5 requires a newer Node version than the sample advertises · New
• Vitest 5 requires a newer Node version than the sample advertises · New
• Documented Node 20 minimum is unsupported by Vitest 5 · New
• Documented Node 20 minimum is unsupported by Vitest 5 · New
• Azure Identity 4.14.1 requires Node 22, not the documented Node 20 · New
• Vitest 5 requires a newer Node version than the sample advertises · New

6 files not reviewed

• samples/autonomous-pipeline/package-lock.json: Generated file
• samples/cost-aware-router/package-lock.json: Generated file
• samples/hello-squad/package-lock.json: Generated file
• samples/hook-governance/package-lock.json: Generated file
• samples/storage-provider-azure/package-lock.json: Generated file
• samples/streaming-chat/package-lock.json: Generated file

What changed in this PR

This dependency-maintenance pull request updates Vitest, Vite, Azure Identity, and related transitive dependencies across sample applications and the dogfood monorepo fixture.

Changes:

• Upgrades Vitest to 5.1.0 across the samples and fixture.
• Updates Azure Identity to 4.14.1 and refreshes authentication dependencies.
• Regenerates lockfiles for Vitest, Vite, Rolldown, and related packages.
• Several samples still document Node.js 20 support despite updated dependencies requiring Node.js 22 or later.

This pull request requires changes.

File	Description
test-fixtures/​dogfood/​node-monorepo/​packages/​core/​package.json	Updates the fixture's Vitest development dependency.
samples/​streaming-chat/​package.json	Updates Vitest while retaining Node.js 20 support documentation.
samples/​storage-provider-azure/​package.json	Updates Azure Identity; the documented Node.js 20 prerequisite conflicts with the updated dependency requirement.
samples/​storage-provider-azure/​package-lock.json	Locks Azure Identity, MSAL, and related transitive dependency updates.
samples/​hook-governance/​package.json	Updates Vitest while retaining Node.js 20 support documentation.
samples/​hook-governance/​package-lock.json	Refreshes the Vitest 5 and Vite dependency tree.
samples/​hello-squad/​package.json	Updates Vitest while retaining Node.js 20 support documentation.
samples/​hello-squad/​package-lock.json	Refreshes the Vitest 5 and Vite dependency tree.
samples/​cost-aware-router/​package.json	Updates Vitest while retaining the Node.js 20 engine declaration.
samples/​autonomous-pipeline/​package.json	Updates Vitest while retaining the Node.js 20 engine declaration.

_{Review effort: Lite (auto)}

[bradygaster]

Dependency triage: holding this grouped update. Its Vitest 5.1 lock entries exclude the documented Node 20 sample runtime, and @azure/identity 4.14.1 also requires a higher Node floor. The active review findings remain valid. This overlaps #2401 but is not being declared superseded until equivalent compatible updates actually land. I am not changing sample support policy or suppressing tests to merge the group.