[dependabot]

Bumps the generated-app-dependencies group with 3 updates in the /src/generator/template-dependencies directory: eslint, viem and vite.

Updates eslint from 10.13.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates viem from 2.57.13 to 2.57.16

Release notes

Sourced from viem's releases.

viem@2.57.16

Patch Changes

• #5395 c60ca26e030706610bcf61689331008a30a3db2a Thanks @​jxom! - viem/tempo: gatewayActions paid in the Gateway currency the Client account held most of, threw Gateway.InsufficientFundsError (with the account's balances) when it couldn't pay, and explained how to pay in Gateway.PaymentRequiredError.

• #5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @​gakonst! - Stopped retrying JSON-RPC method-not-found (-32601) and method-not-supported (-32004) errors from non-2xx HTTP responses, since a retry gets the same refusal.

• #5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @​gakonst! - Reduced per-request overhead of the http, webSocket and ipc transports by building the onFetchRequest Request only when the hook is set and the TimeoutError only when a request times out, and fetched the withdrawal receipt once in the ZKsync finalizeWithdrawal and isWithdrawalFinalized actions.

• #5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @​gakonst! - Cached signature hashes in toSignatureHash, so selector lookups in decodeFunctionData, decodeEventLog, decodeErrorResult and encodeFunctionData no longer hash every ABI item on each call.

• #5391 721d6824516514195c0a98971731c6d81b2f9032 Thanks @​jxom! - viem/tempo: Added experimental Gateway and gatewayActions (client.ai, client.bucket, client.compute, client.kv), with standalone Actions.ai, Actions.bucket, Actions.compute, and Actions.kv, with client.gateway.getCapabilities, Actions.gateway.getCapabilities and defaults for every option (gatewayActions()), for wallet-paid inference (including streamed text), object storage, metered and streamed CPU and GPU compute, and key-value state on a Tempo Gateway paid with a local Client account through the optional mppx peer dependency, with Tempo Wallet through the Accounts SDK, or with an app-supplied payment-aware fetch.

viem@2.57.15

Patch Changes

• #5339 a864b864b8b9031d970910fb8247471924d09280 Thanks @​mortezashojaei! - Fixed getAbiItem to throw AbiItemAmbiguityError for overloads that JavaScript cannot distinguish, such as bytes vs bytes32, uint256 vs int256, and uint256[] vs uint256[2], while resolving distinguishable values by byte length and integer range.

• #5321 af062571382ec3631cf1901aeda9b58a87c8fad5 Thanks @​evanaronson! - Removed a trailing slash to the ZKsync explorer URL.

• #5358 179a53682d9bf2ac2b7a65a86ec312fca0c7c9a8 Thanks @​Turkchain1919! - Added Turkchain Mainnet (Chain ID: 1919) to the supported chains.

• #5375 bb12b94649962cd7f03c339c226399c614b49805 Thanks @​jxom! - Fixed decodeEventLog and parseEventLogs to decode anonymous event logs when eventName names the event or every event in abi is anonymous, as with getLogs and watchEvent given a single anonymous event.

• #5364 8f2a79ba8b4d235a24c4c101f4ef04a824c3e429 Thanks @​jxom! - ccip: Applied the HTTP transport timeout (including its override) and 10 MiB response cap to CCIP-Read gateway requests, refused non-HTTP(S) gateway URLs (including data: URLs, which previously worked), and limited one lookup to 4 nested callbacks, 4 nested local batches, 256 gateway requests and 16 concurrent requests.

• #5372 f32ef6c41e623683b99989422eac7ac6cea5c107 Thanks @​jxom! - Fixed estimateGas and estimateContractGas returning a gas limit filled by eth_fillTransaction that ignored blockNumber, blockTag, and stateOverride.

• #5360 41801d827e339b96d1b4dd775f4dd379f17cc610 Thanks @​jxom! - Raised the default expiring nonce validBefore from 25 to 270 seconds, capped Relay.feePayer expiring nonce windows at 300 seconds, added Transaction.expiringNonceMaxExpiry, and replaced the random expiring nonce validAfter with a random nonce discriminator.

• #5360 41801d827e339b96d1b4dd775f4dd379f17cc610 Thanks @​jxom! - Fixed sponsored prepareTransactionRequest fills keeping a requested feeToken that the fee payer did not sign, which made the fee payer signature invalid.

• #5378 cbdd61078378012368464c9b0e4a76804a5ea987 Thanks @​mmv08! - Fixed fillTransaction and prepareTransactionRequest returning gasPrice next to EIP-1559 fees on Anvil, which made estimateGas and sendTransaction fail on Anvil 1.8.5 and later with "both gasPrice and (maxFeePerGas or maxPriorityFeePerGas) specified".

• #5346 7156f80f77c47c0a3f9df479b0a6e856029edb3b Thanks @​KieranAltman! - Updated HashKey Chain and HashKey Chain Testnet display names, native currency name, and block explorer URLs.

• #5373 ddc2d365d093793f9d8f5818743f169c98eed8d7 Thanks @​jxom! - Added an optional nonce to NonceManager reset parameters, which sendTransaction and sendTransactionSync now set to the consumed nonce when a send fails after consume returned.

• #5371 035c519b6b6b3f179fa741953751a501f05132a2 Thanks @​jxom! - Fixed parseTransaction to accept an EIP-7702 authorization yParity from 2 to 255 so a serialized transaction parses back, and made recoverAuthorizationAddress throw InvalidYParityError (and verifyAuthorization return false) for a yParity other than 0 or 1, which EIP-7702 treats as having no authority.

• #5318 57db085e896dfee3a3387fb7573bf7f7ebc6170d Thanks @​jxom! - Fixed parseTransaction not raising TipAboveFeeCapError when the encoded maxFeePerGas is zero.

• #5377 42c41ca3c42792e56a2e1f64d3007c28adc9fbba Thanks @​mmv08! - Fixed sendTransactionSync and writeContractSync failing at once and freeing the nonce when the node had accepted the transaction but stopped waiting for its receipt (eth_sendRawTransactionSync error code 4), even if the error had no transaction hash, and stopped fallback from sending that transaction to the next node.

• #5388 141f8c0ed7f5fdeafbfc514131781638e9340bd9 Thanks @​jxom! - Added Account.serialize and Account.deserialize to viem/tempo, which store a configurable account (TIP-1107) as JSON and rebuild it with passkey owners that sign, and Account.AddressMismatchError for a version-zero config that does not derive the stored address. Added a keyAuthorization option to access key accounts, which attaches a signed key authorization to the account's transactions until the chain registers the access key.

• #5318 57db085e896dfee3a3387fb7573bf7f7ebc6170d Thanks @​jxom! - Fixed maxPriorityFeePerGas above a maxFeePerGas of 0n not raising TipAboveFeeCapError or MaxFeePerGasTooLowError (including in actions that validate requests before calling the node, such as call and estimateGas), and fixed fee error messages dropping 0n values.

• #5370 18b6b9041ef9d19421d182e6b0ca4b1caf5be09e Thanks @​jxom! - Fixed validateTypedData (and so hashTypedData and signTypedData) accepting field types that are not EIP-712 types, such as uint7, uint264, uint08, int0 or bytes0, and field types that reference a struct missing from types, including in structs only referenced as array elements; it now throws InvalidTypedDataTypeError.

... (truncated)

Commits

• 98aa491 chore: raise viem/ens size limit (#5398)
• 71241b2 chore: version package (#5393)
• e1329c9 fix(tempo): check Gateway chain and refresh balances before payment errors (#...
• c60ca26 feat(tempo): fund-aware Gateway payments and InsufficientFundsError (#5395)
• 264ab41 docs(tempo): use code groups with viem.config in Gateway guides (#5394)
• 721d682 feat(tempo): add experimental Gateway actions (#5391)
• 9348d38 perf: skip retries for method refusals and trim per-request overhead (#5392)
• 5711b7e chore: version package (#5363)
• dbf8ae6 test: stabilize sendTransactionSync timeout and watchBlocks catch-up test...
• 141f8c0 feat(tempo): add Account.serialize, Account.deserialize and keyAuthorization ...
• Additional commits viewable in compare view

Updates vite from 8.3.5 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

• align charset case (#23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

• align charset case (#23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

Commits

• 0fd9a29 release: v8.3.6 (#23996)
• eab1dc2 fix(html): remove adjacent module tags on the first line (#23823)
• a270391 fix(server): escape HTML attributes (#23995)
• 7139ef3 fix(worker): keep chunks conflicted with unused workers that are still used b...
• 0fdd81e fix(optimizer): resolve subpath imports (#) with Vite's resolver (#23959)
• 8069835 fix(build): use stable module ids in chunk import map hash signatures (fix #2...
• 95c2daf fix: ignore pnpm's .modules.yaml as a Vite Task input (#23634)
• b3cb057 fix(deps): update all non-major dependencies (#23966)
• 0105733 fix(deps): update rolldown-related dependencies (#23967)
• 90bc034 fix: use top-level input for SSR build when build.ssr: true (#23898)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unit	96.70% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.