chore(deps): update all non-major dependencies (js/ts) j:kit-282

[renovate-coveo]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@vitejs/plugin-react (source)	6.0.5 → 6.1.0
dompurify	3.4.13 → 3.4.14
rollup (source)	4.62.4 → 4.62.5
vite (source)	8.2.1 → 8.2.2

---

Release Notes

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.1.0

Compare Source

Add experimental native React Compiler support (#​1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'

export default defineConfig({
  plugins: [
     react({ compiler: true })
  ]
})

cure53/DOMPurify (dompurify)

v3.4.14: DOMPurify 3.4.14

Compare Source

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

rollup/rollup (rollup)

v4.62.5

Compare Source

2026-08-20

Bug Fixes

• Resolve an issue where compact mode could result in invalid module concatenations (#​6468)

Pull Requests

• #​6468: Keep the semicolon added after a replaced default export (@​Jaybhade, @​lukastaegert)
• #​6469: fix(deps): update minor/patch updates (@​renovate[bot])
• #​6470: fix(deps): update swc monorepo (major) (@​renovate[bot])
• #​6471: chore(deps): lock file maintenance (@​renovate[bot])
• #​6472: chore(deps): update dependency eslint-plugin-unicorn to v73 (@​renovate[bot])
• #​6476: chore(deps): update dtolnay/rust-toolchain digest to 4360b52 (@​renovate[bot])
• #​6477: fix(deps): update minor/patch updates (@​renovate[bot])
• #​6478: chore(deps): lock file maintenance (@​renovate[bot])
• #​6479: chore(deps): lock file maintenance (@​renovate[bot])
• #​6480: chore(deps): lock file maintenance (@​renovate[bot])

vitejs/vite (vite)

v8.2.2

Compare Source

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#​23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#​23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#​23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#​23239) (05a003e)
• css: don't pass empty targets to lightningcss (#​23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#​23249) (dcf88bd)
• deps: update all non-major dependencies (#​23217) (ba958bd)
• deps: update rolldown-related dependencies (#​23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #​22999) (#​23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#​23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#​23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #​23197) (#​23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#​23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#​23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#​23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#​23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#​23258) (1d9fa39)
• use named regex constants over inline literals (#​22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#​23231) (b4d66fe)
• module-runner: add TLA circular import case (#​23299) (4a261f2)
• module-runner: simplify server-hmr tests (#​23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#​23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#​23251) (d615bcd)

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • "before 6:00am on Tuesday"
• Automerge
  • "after 9:00am and before 12:00pm on tuesday, wednesday, thursday"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a54af37

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[svcsnykcoveo]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Updates the monorepo’s shared dependency catalog and lockfile to bring a small set of JS/TS tooling/security dependencies to their latest non-major versions.

Changes:

• Bump @vitejs/plugin-react from 6.0.5 to 6.1.0.
• Bump dompurify from 3.4.13 to 3.4.14.
• Bump vite from 8.2.1 to 8.2.2 (and refresh transitive lock entries accordingly).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Updates the workspace catalog versions for @vitejs/plugin-react, dompurify, and vite.
pnpm-lock.yaml	Regenerates lock entries to reflect the updated catalog versions across importers and snapshots.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[pkg-pr-new]

• @coveo/pkg-new-template

@coveo/atomic

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/atomic@8380

@coveo/atomic-hosted-page

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/atomic-hosted-page@8380

@coveo/atomic-legacy

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/atomic-legacy@8380

@coveo/atomic-react

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/atomic-react@8380

@coveo/auth

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/auth@8380

@coveo/bueno

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/bueno@8380

coveo.analytics

npm i https://pkg.pr.new/coveo/ui-kit/coveo.analytics@8380

@coveo/create-atomic

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/create-atomic@8380

@coveo/create-atomic-rollup-plugin

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/create-atomic-rollup-plugin@8380

@coveo/create-ui

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/create-ui@8380

@coveo/headless

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/headless@8380

@coveo/headless-react

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/headless-react@8380

@coveo/quantic

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/quantic@8380

@coveo/relay

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/relay@8380

@coveo/shopify

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/shopify@8380

@coveo/thermidor

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/thermidor@8380

@coveo/atomic-angular

npm i https://pkg.pr.new/coveo/ui-kit/@coveo/atomic-angular@8380

commit: a54af37

[github-actions]

🔗 Scratch Orgs ready to test this PR:

• ✅ LWS Enabled: Open Org
• ✅ LWS Disabled: Open Org