chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitejs/plugin-react (source)	6.0.5 → 6.1.0
harper (source)	5.2.2 → 5.2.4
vite (source)	8.2.1 → 8.2.2

---

Release Notes

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.1.0

Compare Source

Add experimental native React Compiler support (#​1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'

export default defineConfig({
  plugins: [
     react({ compiler: true })
  ]
})

harperfast/harper (harper)

v5.2.4

Compare Source

Regression fix: using a context after a mid-handler commit

Committing the current transaction mid-handler and then continuing to use the context — the pattern documented in the v5 migration notes and the 4.5.0 notes — started returning 500s on 5.2.1 and later. releaseContext() (added in #​2030 to stop a long-lived context pinning a completed transaction) set context.transaction = null, and the next touch threw Cannot read properties of null (reading 'commit').

On 5.2.3 this took out Central Manager's fabric connect and cluster create/delete for any non-super-user, because getUserPermissions() commits the caller's transaction mid-request.

A completed transaction now leaves a frozen, process-wide released placeholder in the slot: commit() and abort() are no-ops and reads through it see the latest committed state — the behavior the slot had before #​2030 — while retention stays O(1) per process. Every route that adopts a caller-supplied transaction or context refuses the placeholder rather than silently operating on it. (#​2230, closes #​2229)

Data integrity

• A replicated delete-then-put no longer strips a record's secondary indexes. A replicated delete K; put K transaction — the shape a replace-all writer produces — could leave a follower holding a live, correct record with none of its secondary index entries: invisible to every indexed search, and not repairable by rewriting the record. Same-key writes now execute in the order they were staged, and a transaction applied from a leader stages its same-key writes in the leader's order. (#​2235)
• Blind-write transaction bookkeeping corrected. Every write with no preceding read — invalidate, publish, crash-recovery replay, reload markers — installed a native handle without the per-handle reference bookkeeping, leaving the read-transaction count as NaN for each consumer that reads it (commit(), doneReadTxn(), disregardReadTxn(), releaseContext() and abort()). Those transactions are also now visible to the long-transaction monitor. (#​2232)
• Failed blob saves finish cleaning up before they reject. A failed re-streamable blob save could settle its rejection before PENDING-marker cleanup and blob unlock completed, so a caller attempting immediate recovery could not treat rejection as a lifecycle boundary. Cleanup is now a barrier ahead of rejection. Companion to harper-pro #​732. (#​2228)
• Asynchronous commit callbacks are awaited. Promise-returning transaction commit callbacks are now awaited by LMDB's optimistic and exclusive paths and by RocksDB before the native transaction commits, so a reload marker's immediate-visibility contract holds on both engines. (#​2208)

Availability

• The analytics storage metric can no longer OOM the main thread on boot. NODE_STORAGE walked the entire Harper root with an unbounded recursive Promise.all, holding a path, a dirent and a pending stat for every file at once. On a node with a large blob store the main thread grew about 72 MB/s until V8 aborted — and because the metric runs on the first analytics cycle after start, it happened on every boot (124 restarts observed on 5.2.3). The walk now streams each directory through opendir and stats one file at a time. (#​2242, fixes #​2240)
• storage.debugLongTransactions no longer breaks reads. With the flag on, any search() whose transaction had not opened its own read handle threw TypeError: Cannot read properties of undefined (reading 'push') and returned a 500 — the diagnostic broke exactly the reads an operator enables it to diagnose. (#​2225, refs #​2222)

Configuration and observability

• replication_receiveQueueHighWaterMark is now a registered configuration setting, so the bounded replication receive queue added in harper-pro #​735 can be tuned. (#​2233)
• harper status reports process uptime, and system_information returns process_uptime in seconds in its time response. (#​2209)

Also in this release

Windows CI deflakes for early-hints deployment and the QA-782 LMDB control arm (#​2227, #​2243/#​2248); promoted test coverage for streaming delivery and stream-error contracts (#​2070) and six QA eviction/removal/reclaim data-integrity anchors (#​1916); an in-repo guard for the new config registration; and a package-lock.json sync.

Full Changelog: HarperFast/harper@v5.2.3...v5.2.4

v5.2.3

Compare Source

Blob durability — dangling references and in-flight readers

Two related fixes close windows where a committed record could point at blob bytes that were no longer on disk.

• A transient replication save could leave a record referencing a missing, PENDING, or incomplete blob file. When the same record is later re-delivered by a base copy, Harper now repairs that existing file in place rather than writing a new orphan the duplicate-skipped record would never reference. The repair is fail-atomic — it holds the blob lock, writes and verifies a sibling temp file, flushes, and renames over the target — so a failed repair leaves the referenced file byte-for-byte unchanged. The orphan sweeper respects active repair locks. Adds the shared blob-header classifier and the replication.blobGapReconnectMs config key consumed by harper-pro (#​2177).
• Superseded blob files were unlinked on a fixed 500 ms timer with nothing checking whether a reader still needed the bytes. Because a blob file is opened lazily by path at stream()/bytes() time, a reader that resolved a record just before a concurrent write could open a file that was already gone — on the HTTP path that ENOENT lands after response headers are committed, reaching the client as a truncated body while every signal reports success. The delay is now configurable via storage.blobRetention and defaults to 2s, and reclamation is reference-aware so an in-flight reader can take a retention hold (#​2145).

Deploy — by reference, with a durable credential

harper deploy gains two opt-ins that together let an app be deployed from its git repository instead of an uploaded payload:

• by_ref=true (or ref=<committish>) resolves the app's GitHub owner/repo and commit from the local working copy (or from GitHub Actions env) and deploys git+https://github.com/<owner>/<repo>.git#<sha>. Everything that could move is resolved client-side to a SHA — including an explicit ref=, locally first and then via git ls-remote — so cluster peers, which resolve the package independently, cannot diverge on a moved tag. An unpinnable ref fails closed rather than being sent as a name the cluster would resolve for itself, and an attached credential is pinned to the package host (#​1850).
• setup=true is a guided, client-side credential provisioning flow — what harper login is for auth, but for deploy tokens. It fetches the cluster's public key, sources a token (a fine-grained PAT, your gh session, or an npm token), seals it locally into an enc:v1: envelope, and stores only ciphertext in the component-scoped secret tier. The plaintext never leaves the machine; the cluster decrypts in memory only at deploy/rollback time (#​1851).

package_component streams instead of base64

package_component returned the whole component tarball as a base64 string inside the JSON envelope, peaking at roughly 4.7× the archive size resident in a shared (on Fabric, multi-tenant) Harper process, and hard-failing with ERR_STRING_TOO_LONG once the base64 result exceeded V8's string cap. The operation now streams the archive; project-resolution failures other than ENOENT are rethrown instead of being swallowed (#​2152, #​2150).

Dependency pinning for load-bearing modules

A caret range does not bind the version that reaches a running node: harper-pro, a rebuilt container, or a plain npm install of published harper could resolve a newer native or encoder dependency with no Harper PR and no human merge. The load-bearing ranges — rocksdb-js, the encoder/iterator modules whose object identity crosses its boundary, structon, and the optional native addons — are now pinned to the versions the lockfile already resolved. No installed dependency moves; only the allowed resolution narrows. Docker smoke additionally requires the root msgpackr and @harperfast/extended-iterable specs to be byte-equal to rocksdb-js's requirements and rejects a nested copy (#​2179). A follow-up aligned the structon pin with the lockfile after it broke npm ci on main (#​2196).

Also in this release

A report-mode review-coverage CI check that surfaces cross-model review counts and a stale Human-Review-Need: footer without blocking (#​2183); an integration-test helper refactor (#​1904); and non-major dependency updates (#​2131, #​2189, #​2190).

Full Changelog: HarperFast/harper@v5.2.2...v5.2.3

vitejs/vite (vite)

v8.2.2

Compare Source

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#​23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#​23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#​23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#​23239) (05a003e)
• css: don't pass empty targets to lightningcss (#​23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#​23249) (dcf88bd)
• deps: update all non-major dependencies (#​23217) (ba958bd)
• deps: update rolldown-related dependencies (#​23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #​22999) (#​23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#​23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#​23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #​23197) (#​23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#​23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#​23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#​23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#​23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#​23258) (1d9fa39)
• use named regex constants over inline literals (#​22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#​23231) (b4d66fe)
• module-runner: add TLA circular import case (#​23299) (4a261f2)
• module-runner: simplify server-hmr tests (#​23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#​23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#​23251) (d615bcd)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dawsontoth]

Verified locally on 8c94b3ee (Node 24.17.0). Approving.

Checks:

check	result
npm ci	exit 0
npm run build (tsc)	exit 0
npm run format:check	exit 0
npm test	39 tests / 4 suites, 0 fail

This PR takes the same harper 5.2.2 → 5.2.4 bump that has agent#154 red, and is not affected. I checked specifically because the base commit here is b50f856 ci(renovate): drop the ineffective skipInstalls override, so this repo is known-exposed to that pruning problem. The lockfile retains 19 react-native* entries and npm ci exits 0, so the alasql optional subtree survived the re-resolve. No action needed — just noting the two PRs diverged despite the identical bump.

Lockfile audit (base vs head): keys 1465 → 1460, 0 major crossings, 50 version changes, and the add/remove churn is all platform-optional binaries rather than anything semantic:

• added: @rolldown/binding-android-arm-eabi@1.2.5, plus a nested fast-uri@4.1.2
• removed: @rolldown/binding-wasm32-wasi@1.2.1 and its 6 wasm shims (@emnapi/*, @napi-rs/wasm-runtime, @tybys/wasm-util, tslib)

That's rolldown swapping a wasm fallback binding for a native one as vite goes 8.2.1 → 8.2.2 — benign, and it doesn't reach shipped output.

@oxc-project/types 0.142.0 → 0.146.0 is the one 0.x minor in the diff, but it's transitive under vite/rolldown rather than a direct dependency, so it moves with them.