chore(deps): bump the dashboard-deps group in /dashboard with 8 updates

[dependabot]

Bumps the dashboard-deps group in /dashboard with 8 updates:

Package	From	To
sql.js	1.14.1	1.14.2
@testing-library/jest-dom	7.0.0	7.0.1
@testing-library/react	16.3.2	16.3.3
@types/react-dom	19.2.4	19.2.5
@vitejs/plugin-react	6.0.5	6.1.1
@vitest/coverage-v8	4.1.10	4.1.11
vite	8.2.0	8.2.2
vitest	4.1.10	4.1.11

Updates sql.js from 1.14.1 to 1.14.2

Commits

• 9c4e167 ci: debug npm publish http log
• 1d5db45 ci: use npm 11 for OIDC trusted publishing
• c2c6909 debug: oidc env dump
• 17159df debug: oidc
• 7e943bd ci: publish to npm via OIDC trusted publishing
• c11695f Bump version to 1.14.2
• 5489808 fix: restore WASM stack in Database.exec to prevent stack leak (#631)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sql.js since your current version.

Updates @testing-library/jest-dom from 7.0.0 to 7.0.1

Release notes

Sourced from @​testing-library/jest-dom's releases.

v7.0.1

7.0.1 (2026-08-09)

Bug Fixes

• declare vitest as an optional peer dependency (#733) (3782c78)

Commits

• 3782c78 fix: declare vitest as an optional peer dependency (#733)
• See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.5 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• See full diff in compare view

Updates vite from 8.2.0 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

8.2.1 (2026-08-06)

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)

... (truncated)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[labro-bot]

Labro picking up. Assigning to claude-code:claude-sonnet-5.

[labro-bot]

Labro's agent (claude-code) ran out of turns before completing this pr.

Progress so far:
Agent reached the turn limit before completing the task.

Remove the ai-handover label to re-queue this item.

[labro-bot]

Labro picking up. Assigning to claude-code:claude-sonnet-5.

[labro-bot]

Labro's agent (claude-code) ran out of turns before completing this pr.

Progress so far:
Agent reached the turn limit before completing the task.

Remove the ai-handover label to re-queue this item.

[labro-bot]

Labro picking up. Assigning to claude-code:claude-sonnet-5.

[labro-bot]

Labro's agent (claude-code) ran out of turns before completing this pr.

Reason: error_max_turns

[rssrn]

max_turns bumped from 15 to 40 (and timeout_s 600 to 900) — this run failed by running out of turns, and should be picked up by Labro again on its next scheduled pass.

[labro-bot]

Labro picking up. Assigning to claude-code:claude-sonnet-5.

[labro-bot]

Dependency upgrade review — dashboard-deps group (8 updates)

Semver risk: patch/minor — all eight bumps are patch releases except @vitejs/plugin-react (6.0.5 → 6.1.1, minor). No majors in this group; low risk.

Changes in this release:

• sql.js 1.14.1 → 1.14.2 — fixes a WASM stack leak in Database.exec (sql-js/sql.js#631); no CVE, but a real correctness/robustness fix worth having given the dashboard uses sql.js for its SPA.
• @testing-library/jest-dom 7.0.0 → 7.0.1 — declares vitest as an optional peer dep (fix for peer-dep resolution noise, no behavior change).
• @testing-library/react 16.3.2 → 16.3.3 — fixes an act() re-entrancy bug when dispatching events.
• @types/react-dom 19.2.4 → 19.2.5 — type-only update.
• @vitejs/plugin-react 6.0.5 → 6.1.1 (minor) — adds experimental native React Compiler support (opt-in, unused here) and a compiler.logDiagnostics option; also fixes a sourcemap regression under builder.sharedPlugins (not used in this repo's vite config).
• @vitest/coverage-v8 / vitest 4.1.10 → 4.1.11 — revives a global concurrency limit for test lifecycle and restricts redirect mocks to the fs allowlist (defensive hardening in the mocker, not a disclosed CVE).
• vite 8.2.0 → 8.2.2 — routine bug fixes (CSS/lightningcss, sourcemap path resolution, module-runner circular-import handling) plus widening the @vitejs/devtools peer range.

No security advisories are attached to this PR (no security label, no open Dependabot alerts for these packages), so this is a routine grouped update rather than a CVE-driven one.

Lock file: clean. Only the 8 named packages plus their own direct transitive dependents changed: rolldown 1.2.1→1.2.6 and @oxc-project/types 0.142.0→0.147.0 (pulled in by the vite/rolldown bump — the @rolldown/binding-* platform packages moved in lockstep, and @emnapi/*/@napi-rs/wasm-runtime/@tybys/wasm-util were dropped since the new @oxc-project/types no longer needs the emnapi WASI shim), and postcss 8.5.25→8.5.26 with nanoid 3.3.16→3.3.18 (postcss's own dependency bump). All of these are expected knock-on effects of the vite bump, not unrelated/unexpected transitive upgrades.

Prior pins: none found. sql.js's range in package.json has been ^1.12.0/^1.14.2-style (caret, never hand-pinned tighter) since the dashboard was scaffolded (33098ea). The one manual, intentional version constraint in this file's history — 59c3d01 fix: bump @vitejs/plugin-react to ^5.2.0 for Vite 8 compatibility — was itself superseded by later routine Dependabot bumps well before this PR (current range is already ^6.0.5), so it isn't in tension with this bump to ^6.1.1.

Conflict check: clean. This sandbox's write restrictions prevented checking out the PR branch or creating a scratch directory to run npm ci locally, but CI's build job (.github/workflows/ci-dashboard.yml) already runs npm ci on this exact branch/lockfile as its first step and succeeded — that is the equivalent resolver check and it passed with zero errors.

CI: passing. The build check (npm ci → vitest+axe → tsc -b && vite build) completed successfully on 2026-09-01.

Recommendation: ✅ Safe to merge — all patch/minor bumps, clean lock file with only expected transitive drift, no prior-pin conflicts, and CI is green.

(Prior Labro runs on this PR hit the agent turn limit before finishing this review — that has now been increased to 40 turns/900s per the maintainer's comment, which was sufficient to complete it. Per this harness's action permissions I cannot merge; a human maintainer should do so if they agree with the above.)