[dependabot]

Bumps the minor-updates group with 8 updates in the / directory:

Package	From	To
@bimdata/typescript-fetch-api-client	10.48.1	10.49.0
@paddle/paddle-js	1.6.5	1.6.6
vue	3.5.44	3.5.45
vue-i18n	11.4.17	11.4.18
eslint-plugin-vue	10.11.1	10.12.0
sass-embedded	1.107.1	1.108.1
vite	8.3.5	8.3.6
vitest	5.0.5	5.1.0

Updates @bimdata/typescript-fetch-api-client from 10.48.1 to 10.49.0

Release notes

Sourced from @​bimdata/typescript-fetch-api-client's releases.

v10.49.0

10.49.0 (2026-11-06)

Commits

• cb0fca8 MINOR: Add the ability to filter logs by date (#1118)
• See full diff in compare view

Updates @paddle/paddle-js from 1.6.5 to 1.6.6

Changelog

Sourced from @​paddle/paddle-js's changelog.

1.6.6 - 2026-11-04

Added

• Added cancellationFlowId to RetainCancellationFlowAttributeProps to choose which cancellation flow to show.

Commits

• See full diff in compare view

Updates vue from 3.5.44 to 3.5.45

Release notes

Sourced from vue's releases.

v3.5.45

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.45 (2026-11-05)

Bug Fixes

• compiler-core: copy loc in cloneLoc instead of recomputing it (#16092) (3cee79a), closes #16091
• compiler-dom: preserve static boolean binding semantics (#16055) (05db7e8), closes #16051
• compiler-sfc: respect catch and switch lexical scopes (fix #16098) (#16101) (0f20152)
• hmr: retry reloads after pending async roots resolve (#16060) (fbaa794)
• hydration: only update component el when replacing its host node (#16001) (51fd0cb)
• KeepAlive: cache a resolved Suspense child right away (#16119) (716a29e)
• KeepAlive: unmount a child deactivated before it was cached (#15981) (02d2c2b)
• reactivity: run onScopeDispose in a stopped scope (#16108) (21dd33c)
• runtime-core: anchor on the async placeholder when a component root has no el (#16122) (b5abf8c)
• runtime-core: call directive mounted hooks with the latest binding (#16120) (6416207), closes #12460 #12482
• runtime-core: remove the placeholder of an unmounted pending async component (#15982) (2b9a0bb)
• runtime-core: render nothing for a component whose async setup rejects (#16111) (f64bfa5)
• runtime-core: skip stopped error boundaries for async failures (#16061) (0326ed8)
• runtime-dom: treat disablepictureinpicture and disableremoteplayback as boolean attributes (#15952) (ef81ddc)
• suspense: do not mount the fallback after the boundary is unmounted (#15939) (4fd6a6b)
• suspense: drop the unmount hooks of a pending branch when the boundary is unmounted (d04b662)
• suspense: enter transitions nested in the pending branch on reveal (#16121) (b8074de), closes #12435 #15294
• suspense: keep a discarded component marked unmounted (1dc8cdf)
• suspense: keep the async root update retry across a discarded pending branch (#16107) (06bea73)
• suspense: keep the internal cleanup of a discarded component (79b80b7)
• suspense: keep the timeout counting when the root is switched again while pending (#16143) (a045acd)
• suspense: patch same-root updates of nested boundaries in retained content (#16109) (2dbcea8), closes #15878
• suspense: release parent dep on suspensible unmount (#15870) (46e5dbf)
• suspense: resolve async deps whose pending cycle was discarded (#15980) (f7d0811)
• suspense: resolve the boundary when an async setup rejects without an error handler in dev (#16110) (a14aa0b)
• suspense: skip a root replacement in a retained nested boundary showing its fallback (#16125) (a47af77)
• suspense: skip the out-in afterLeave of an unmounted boundary (#16115) (85e71c0), closes #11037 #11059
• transition: handle leave immediately done in out-in mode (#11824) (70599b5), closes #15727
• transition: switch modes around a keyed suspense boundary (#16124) (ff0b341)
• types: add dialog closedby attribute (#16064) (24c9d0b)
• v-model: respect number modifier for Set select values (0ff253b)

Performance Improvements

• compiler-sfc: skip unused tsconfig include enumeration (#15899) (1612403), closes #15898
• compiler-ssr: render static style attributes at compile time (#16010) (2629c89)
• mark internal initializers as pure (#16012) (34fbeb1)
• runtime-core: copy raw attrs when setup context attrs are passed as vnode props (#16129) (823c744)

Commits

• 8b479a8 release: v3.5.45
• 9f9b71c chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#16150)
• 1d718d2 chore(deps): update dependency @​types/node to v26 (#16087)
• 68583ce chore(deps): bump undici from 8.9.0 to 8.12.3 (#16149)
• 91f2625 chore(deps): bump fast-uri from 3.1.0 to 3.1.9 (#16148)
• a8ab1f8 chore(deps): update build (#15918)
• a0d1388 chore(deps): update dependency minimatch to v11 [security] (#16145)
• 923f70d fix(deps): update compiler (#15920)
• 3cb1161 chore(deps): update lint (#15921)
• 0ce9e16 chore(deps): update dawidd6/action-download-artifact action to v28 (#16086)
• Additional commits viewable in compare view

Updates vue-i18n from 11.4.17 to 11.4.18

Release notes

Sourced from vue-i18n's releases.

v11.4.18

escapeParameter: The sanitizer now also turns <script> in translations into text. A <script> does not run with v-html in the browser, but it runs when the translation is rendered on the server (SSR). (#2757) See GHSA-jrxq-gc2q-9357.

What's Changed

🔒 Security Fixes

• fix(shared): neutralize script elements in sanitizeTranslatedHtml by @​kazupon in intlify/vue-i18n#2757

Full Changelog: intlify/vue-i18n@v11.4.17...v11.4.18

Changelog

Sourced from vue-i18n's changelog.

v11.4.18 (2026-11-03T10:49:56.188Z)

This changelog is generated by GitHub Releases

What's Changed

🔒 Security Fixes

• fix(shared): neutralize script elements in sanitizeTranslatedHtml by @​kazupon in intlify/vue-i18n#2757

Full Changelog: intlify/vue-i18n@v11.4.17...v11.4.18

Commits

• 73ed6ec release: v11.4.18
• See full diff in compare view

Updates eslint-plugin-vue from 10.11.1 to 10.12.0

Release notes

Sourced from eslint-plugin-vue's releases.

v10.12.0

New rules

• Added new vue/no-content-outside-block rule (#3119)
• Added new vue/no-define-model-default rule (#3146)
• Added new vue/no-props-shadow rule (#3118)

New rule options

• Added required option to vue/block-lang to report components that omit a required block entirely (#3125)
• Added ignoreMixins option to vue/require-explicit-emits rule (#3141)

Fixed false negatives (may result in more lint issues)

• Added support for refs detected by type information, such as refs returned from composables, to vue/no-ref-as-operand rule (#3144)
• Fixed vue/no-dupe-keys not reporting defineModel() names that collide with a prop, another model, or a <script setup> variable (#3163)
• Fixed vue/no-dupe-keys not reporting <script setup> variables that shadow a prop while aliasing a different one, such as const foo = toRef(props, 'bar') (#3124)
• Fixed vue/no-multi-spaces not reporting multiple spaces in the tags of some top-level blocks, e.g. <script setup> (#3162)
• Fixed vue/no-ref-as-operand and vue/no-ref-object-reactivity-loss to also check refs created with useTemplateRef() (#3154)
• Fixed vue/no-unused-properties not reporting unused non-props properties in components that use $props as a whole (e.g. v-bind="$props") (#3161)
• Fixed vue/padding-lines-in-component-definition to check every pair of adjacent properties, not only the first, when withinOption or withinEach is not set (#3155)
• Fixed vue/require-default-prop, vue/no-boolean-default, vue/no-required-prop-with-default and vue/require-valid-default-prop not handling defaults that are passed to withDefaults() by reference or spread instead of an inline object literal (#3114)

Fixed false positives (may result in fewer lint issues)

• Changed vue/singleline-html-element-content-newline and vue/multiline-html-element-content-newline rules to ignore router-link and nuxt-link elements by default (#3165)
• Fixed vue/no-undef-properties false positives for properties returned via ...toRefs(reactive({ ... })) from setup() (#3134)
• Fixed vue/require-typed-ref false positives when an explicit type annotation already applies to the ref() call (#3123)
• Fixed vue/v-if-else-key false positive for components with a bound :key (#3150)

Other changes

• Removed Reactivity Transform support from vue/no-ref-object-reactivity-loss, since the Reactivity Transform proposal was dropped from Vue (#3126)
• Changed vue/html-self-closing to treat Vue's special <slot> and \<template> elements as components (html.component option) instead of normal HTML elements (#3164)
• Changed vue/attributes-order rule to provide a suggestion instead of an autofix when the fix would move a binding across v-bind="object" (#3145)
• Improved performance of vue/no-reserved-component-names by no longer rebuilding its reserved name sets for every file (#3147)

Changelog

Sourced from eslint-plugin-vue's changelog.

10.12.0

New rules

• Added new vue/no-content-outside-block rule (#3119)
• Added new vue/no-define-model-default rule (#3146)
• Added new vue/no-props-shadow rule (#3118)

New rule options

• Added required option to vue/block-lang to report components that omit a required block entirely (#3125)
• Added ignoreMixins option to vue/require-explicit-emits rule (#3141)

Fixed false negatives (may result in more lint issues)

• Added support for refs detected by type information, such as refs returned from composables, to vue/no-ref-as-operand rule (#3144)
• Fixed vue/no-dupe-keys not reporting defineModel() names that collide with a prop, another model, or a <script setup> variable (#3163)
• Fixed vue/no-dupe-keys not reporting <script setup> variables that shadow a prop while aliasing a different one, such as const foo = toRef(props, 'bar') (#3124)
• Fixed vue/no-multi-spaces not reporting multiple spaces in the tags of some top-level blocks, e.g. <script setup> (#3162)
• Fixed vue/no-ref-as-operand and vue/no-ref-object-reactivity-loss to also check refs created with useTemplateRef() (#3154)
• Fixed vue/no-unused-properties not reporting unused non-props properties in components that use $props as a whole (e.g. v-bind="$props") (#3161)
• Fixed vue/padding-lines-in-component-definition to check every pair of adjacent properties, not only the first, when withinOption or withinEach is not set (#3155)
• Fixed vue/require-default-prop, vue/no-boolean-default, vue/no-required-prop-with-default and vue/require-valid-default-prop not handling defaults that are passed to withDefaults() by reference or spread instead of an inline object literal (#3114)

Fixed false positives (may result in fewer lint issues)

• Changed vue/singleline-html-element-content-newline and vue/multiline-html-element-content-newline rules to ignore router-link and nuxt-link elements by default (#3165)
• Fixed vue/no-undef-properties false positives for properties returned via ...toRefs(reactive({ ... })) from setup() (#3134)
• Fixed vue/require-typed-ref false positives when an explicit type annotation already applies to the ref() call (#3123)
• Fixed vue/v-if-else-key false positive for components with a bound :key (#3150)

Other changes

• Removed Reactivity Transform support from vue/no-ref-object-reactivity-loss, since the Reactivity Transform proposal was dropped from Vue (#3126)
• Changed vue/html-self-closing to treat Vue's special <slot> and \<template> elements as components (html.component option) instead of normal HTML elements (#3164)
• Changed vue/attributes-order rule to provide a suggestion instead of an autofix when the fix would move a binding across v-bind="object" (#3145)
• Improved performance of vue/no-reserved-component-names by no longer rebuilding its reserved name sets for every file (#3147)

Commits

• f2a0cb5 Version Packages (#3153)
• 9814050 fix(no-dupe-keys): detect defineModel() name collisions (#3163)
• 1741d59 fix(no-multi-spaces): check tags of all top-level blocks (#3162)
• d743582 fix(no-unused-properties): report unused non-props along $props (#3161)
• d2a1f76 fix(padding-lines-in-component-definition): check every property pair when `w...
• 2a7ad86 fix: recognize useTemplateRef() (#3154)
• 515614e fix(attributes-order): change unsafe autofix to suggestion (#3145)
• 9175cc5 feat: remove Reactivity Transform support (#3126)
• f115fd6 refactor: migrate block-lang to TypeScript (#3209)
• 30a2a53 refactor: migrate class name and valid-next-tick rules to TypeScript (#3202)
• Additional commits viewable in compare view

Updates sass-embedded from 1.107.1 to 1.108.1

Changelog

Sourced from sass-embedded's changelog.

1.108.1

Node.js Embedded Host

• Fix an issue in the release process causing the OS-specific embedded Sass packages to be missing their Dart Sass snapshots.

1.108.0

• Undo some unintentional breaking changes added in 1.106.0 relating to how escaped identifiers interact with sass:meta functions and named rest arguments.

Commits

• 942c36c Update Dart Sass version and release
• 19b094e Lock the Node version used for releasing to 24.x (#459)
• b531241 Update Dart Sass version and release
• 487126c Enable Zizmor and fix findings (#455)
• See full diff in compare view

Updates vite from 8.3.5 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

• align charset case (#23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

• align charset case (#23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

Commits

• 0fd9a29 release: v8.3.6 (#23996)
• eab1dc2 fix(html): remove adjacent module tags on the first line (#23823)
• a270391 fix(server): escape HTML attributes (#23995)
• 7139ef3 fix(worker): keep chunks conflicted with unused workers that are still used b...
• 0fdd81e fix(optimizer): resolve subpath imports (#) with Vite's resolver (#23959)
• 8069835 fix(build): use stable module ids in chunk import map hash signatures (fix #2...
• 95c2daf fix: ignore pnpm's .modules.yaml as a Vite Task input (#23634)
• b3cb057 fix(deps): update all non-major dependencies (#23966)
• 0105733 fix(deps): update rolldown-related dependencies (#23967)
• 90bc034 fix: use top-level input for SSR build when build.ssr: true (#23898)
• Additional commits viewable in compare view

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

• Add --last-failed to run only failed tests  -  by @​sheremet-va in vitest-dev/vitest#11558 (82f63)
• Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime()  -  by @​Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @​hi-ogawa and Codex (GPT-6) in vitest-dev/vitest#11321 (f150f)
• Introduce --since-last-run flag  -  by @​sheremet-va in vitest-dev/vitest#11516 (08bd9)
• Expose per-retry/repeat attempt result  -  by @​hi-ogawa, Codex (GPT-6) and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11232 (21be4)
• Support fake timers for node:timers and node:timers/promise  -  by @​hi-ogawa, OpenCode and Codex (GPT-6) in vitest-dev/vitest#10899 (fbe97)
• Allow coverage providers to store data in fs module cache  -  by @​AriPerkkio in vitest-dev/vitest#11747 (54a2b)
• Interactively review failed snapshots  -  by @​macarie and @​hi-ogawa in vitest-dev/vitest#11325 (54e5b)
• browser:
  • Mock modules through an import map  -  by @​sheremet-va in vitest-dev/vitest#11534 (707f8)
  • Drop experimental label from trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11518 (44c3c)
  • Introduce experimental pointer API  -  by @​macarie in vitest-dev/vitest#10780 (5dc09)
  • Capture aria snapshot in trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11492 (0cc39)
  • Show trace steps timeline on terminal on test failure  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11594 (973dc)
  • Add failure-only trace view mode  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11612 (d5d7d)
  • Enable failure-only trace view by default  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11766 (f37b6)
• coverage:
  • V8 to support ignoreNode option  -  by @​erickserra and @​AriPerkkio in vitest-dev/vitest#11688 (e02db)
• experimental:
  • Add trace timeline for node  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11753 (4e985)
  • Add message option to vi.waitFor and vi.waitUntil  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11754 (fd145)

   🐞 Bug Fixes

• Rerun setup files after --changed filtering  -  by @​sheremet-va in vitest-dev/vitest#11621 (3a39c)
• Return the mock to concurrent imports  -  by @​sheremet-va in vitest-dev/vitest#11623 (1453b)
• Don't fail on console log pending at teardown  -  by @​sheremet-va in vitest-dev/vitest#11619 (a60b8)
• Reference chai types in every d.ts chunk  -  by @​sheremet-va in vitest-dev/vitest#11618 (fb150)
• Detect mock factory cycles that form later  -  by @​sheremet-va in vitest-dev/vitest#11642 (e9554)
• Skip fs module cache for typed import.meta.glob  -  by @​sheremet-va in vitest-dev/vitest#11666 Description has been truncated