chore(deps): update npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@anthropic-ai/sandbox-runtime	0.0.77 → 0.0.78
@openai/codex (source)	0.156.1 → 0.160.0
typescript (source)	7.1.0-dev.20260924.1 → 7.1.0-dev.20261001.1
vite-task-tools>vite (source)	8.3.1 → 8.3.2

---

Release Notes

anthropics/sandbox-runtime (@​anthropic-ai/sandbox-runtime)

v0.0.78

Compare Source

What's Changed

• Make nine tests able to fail, and cover globToRegex and the public export list by @​ronleizrowice-ant in #​570
• Correct five false statements, and remove dead and duplicated code by @​ronleizrowice-ant in #​571
• test: fix the typecheck of the seccomp suite that broke main by @​ronleizrowice-ant in #​583
• linux: exit status under zsh, and import zod/v3 by @​ronleizrowice-ant in #​590
• Write limits are judged by where a write lands: say so, and test it by @​ronleizrowice-ant in #​614
• linux: bind a deny path that another sandbox makes while the wrap is looking by @​ronleizrowice-ant in #​618
• ci: pin workflow inputs, use npm trusted publishing, pack on pull requests by @​dylan-conway in #​632

Full Changelog: anthropics/sandbox-runtime@v0.0.77...v0.0.78

openai/codex (@​openai/codex)

v0.157.1

v0.157.0

microsoft/TypeScript (typescript)

v7.1.0-dev.20261001.1

Compare Source

v7.1.0-dev.20260930.4

Compare Source

v7.1.0-dev.20260929.1

Compare Source

v7.1.0-dev.20260928.1

Compare Source

v7.1.0-dev.20260926.1

Compare Source

v7.1.0-dev.20260925.1

Compare Source

vitejs/vite (vite-task-tools>vite)

v8.3.2

Compare Source

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#​23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#​23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#​23568) (bc598a6)
• deps: update all non-major dependencies (#​23601) (9944fa6)
• deps: update rolldown-related dependencies (#​23602) (88c1741)
• html: resolve percent-encoded srcset urls (#​23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#​23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#​23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#​23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#​23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#​23586) (744269e)
• server: handle file watcher errors without crashing (#​23503) (6894f5c)
• server: release previous environments after initialization (#​23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#​23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#​23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#​23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#​23510) (cf5c028)
• only register time middleware when debug logging is enabled (#​23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#​23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#​23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vite@​8.3.1 ⏵ 8.3.2
	npm/​typescript@​7.1.0-dev.20260924.1 ⏵ 7.1.0-dev.20261001.1	+1		+1
	npm/​@​anthropic-ai/​sandbox-runtime@​0.0.77 ⏵ 0.0.78	+4			+1
	npm/​@​openai/​codex@​0.156.1-win32-x64 ⏵ 0.160.0					+31

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  -0.42%  [ -9.22% ..  +6.59%]  overhead  +286.45%
dynamic/access             change  +0.29%  [ -1.62% ..  +1.81%]  overhead   +13.55%
dynamic/access-relative    change  -0.33%  [ -3.45% ..  +1.55%]  overhead   +58.36%
dynamic/access-contended   change  -0.34%  [ -2.72% ..  +4.96%]  overhead   +16.54%
static/launch              change  +1.62%  [ -4.22% ..  +6.75%]  overhead  +750.28%
static/access              change  -0.50%  [ -2.18% ..  +1.17%]  overhead  +806.03%
static/access-relative     change  +0.24%  [ -1.14% ..  +2.64%]  overhead +1367.40%
static/access-contended    change  -0.45%  [ -1.75% ..  +2.79%]  overhead +3149.72%

macos

dynamic/launch             change  -0.28%  [ -5.78% ..  +5.24%]  overhead  +242.02%
dynamic/access             change  +1.38%  [ -6.44% ..  +6.82%]  overhead    +5.23%
dynamic/access-relative    change  -0.69%  [ -5.80% ..  +8.06%]  overhead  +254.59%
dynamic/access-contended   change  +3.82%  [ -8.15% .. +691.26%]  overhead    +1.69%

windows

dynamic/launch             change  +0.71%  [ -4.16% ..  +4.53%]  overhead   +25.88%
dynamic/access             change  -0.18%  [ -2.15% ..  +1.66%]  overhead    +1.30%
dynamic/access-relative    change  -0.54%  [ -1.62% ..  +0.90%]  overhead    +1.12%
dynamic/access-contended   change  +0.11%  [ -9.26% .. +10.00%]  overhead    +1.61%