Bump the web-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the web-dependencies group with 4 updates in the /web directory: vue-router, @types/node, vite and vue-tsc.

Updates vue-router from 5.3.1 to 5.4.0

Release notes

Sourced from vue-router's releases.

v5.4.0

   🚨 Breaking Changes

• experimental: Normalize query values to arrays  -  by @​posva in vuejs/router#2824 (f1fbc)

   🚀 Features

• Accept a prebuilt matcher in createRouter  -  by @​danielroe in vuejs/router#2804 (9de96)
• UseScrollRestoration and onRouteRendered  -  by @​posva in vuejs/router#2805 (e3dde)
• Diagnose experimental beforeEnter migration  -  by @​posva (b695c)
• experimental:
  • Warn about legacy optional param removal  -  by @​posva in vuejs/router#2818 (c2f92)
  • Extract hash params with definePage  -  by @​posva (dbf2d)
  • Configure required and default hash params  -  by @​posva (cef5c)
  • Never decode the hash, protect-only encoding  -  by @​posva in vuejs/router#2760 (aca2c)
  • Allow custom regexp for path params in definePage  -  by @​posva in vuejs/router#2822 (3a192)
• router:
  • Restore hashes and top by default  -  by @​posva (7c385)

   🐞 Bug Fixes

• Resolve experimental guard redirects against target on history navigation  -  by @​posva (2c5fb)
• experimental:
  • Keep declared case of static prefix in MatcherPatternPathStar.build()  -  by @​contactjawad in vuejs/router#2798 (4dc6b)
  • Make hash params optional and nullable  -  by @​posva (d9a4c)
  • Exclude defaults from required hash params  -  by @​posva (346e2)
  • Align hash parameter parsing with queries  -  by @​posva (cf251)
  • Keep last hash param instead of throwing  -  by @​posva (d1e8a)
  • Disallow required with a default for query params  -  by @​posva (f60e9)
  • Make query params with a default optional on push  -  by @​posva (fb604)
  • Do not inherit params, query, or hash on redirects  -  by @​posva (02a92)
• history:
  • Invalidate obsolete scroll positions  -  by @​posva and @​liuly0322 in vuejs/router#2814 (071f1)
• unplugin:
  • Sanitize named view in definePage import  -  by @​giaBaoJS in vuejs/router#2809 (0711d)
  • Keep hex character codes in param segments regexp  -  by @​kwy404 in vuejs/router#2811 (07663)

   🏎 Performance

• unplugin: Cache merged route overrides  -  by @​posva in vuejs/router#2821 (732b7)

    View changes on GitHub

Commits

• 596d481 release: vue-router@5.4.0
• 2970e8e chore: fix back extends
• 16a62f8 chore(deps): upgrade dependencies (#2828)
• b810a7e chore: remove unused types
• a0efbde docs: adapt
• 2c5fbd6 fix: resolve experimental guard redirects against target on history navigation
• 6ef3163 refactor: allow undefined on optional param
• 8e89a60 chore: comment
• 72ceb99 refactor: absolute position
• 57dd1d6 refactor: allow guards to return relative location
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.5

Commits

• See full diff in compare view

Updates vite from 8.3.1 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Commits

• b6c20f6 release: v8.3.4 (#23702)
• b28db28 fix(server): match static aliases on path boundaries (#23643)
• bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
• fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
• 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
• 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
• facc2fb fix: remove input option unescaping for now (#23694)
• 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
• cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
• fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
• Additional commits viewable in compare view

Updates vue-tsc from 3.3.11 to 3.3.12

Release notes

Sourced from vue-tsc's releases.

v3.3.12

language-core

• security: improved handling of untrusted Vue files (cea0698)
• feat: infer first parameter type of default factory for defineModel (1be73b8)
• feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)
• fix: keep union props when using withDefaults (084f30f)
• fix: keep inference-only props string single-line with block comments (55ca36f)
• fix: support calling template bindings without .value (7ad4a94)
• fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)
• fix: pad directive hook signatures to check short-arity directive bindings (94052b8)
• fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)
• fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)
• fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)
• fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)
• perf: precompile attribute glob matchers (7d2e603)

component-meta

• fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

• fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

• fix: prevent watch mode crash on incremental build (a59da36)

vscode

• perf: reduce focus mode overhead (b0936d1)

Contributors: @​johnsoncodehk, @​serkodev, @​KazariEX, @​00200200, @​camonunez, @​Cherry, @​hungateJoseph, @​uturnr, @​ValentinYoushkevich, @​xia-chao

Changelog

Sourced from vue-tsc's changelog.

3.3.12 (2026-10-02)

language-core

• security: improved handling of untrusted Vue files (cea0698)
• feat: infer first parameter type of default factory for defineModel (1be73b8)
• feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)
• fix: keep union props when using withDefaults (084f30f)
• fix: keep inference-only props string single-line with block comments (55ca36f)
• fix: support calling template bindings without .value (7ad4a94)
• fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)
• fix: pad directive hook signatures to check short-arity directive bindings (94052b8)
• fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)
• fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)
• fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)
• fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)
• perf: precompile attribute glob matchers (7d2e603)

component-meta

• fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

• fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

• fix: prevent watch mode crash on incremental build (a59da36)

vscode

• perf: reduce focus mode overhead (b0936d1)

Contributors: @​johnsoncodehk, @​serkodev, @​KazariEX, @​00200200, @​camonunez, @​Cherry, @​hungateJoseph, @​uturnr, @​ValentinYoushkevich, @​xia-chao

Commits

• cea0698 v3.3.12 (#6234)
• d4d4139 fix(language-core): stop typedef jsdoc from leaking into emitted dts
• 045a6a7 fix(component-meta): stop checking JS Vue files as TS (#6231)
• a59da36 fix(tsc): prevent watch mode crash on incremental build (#6213)
• 94052b8 fix(language-core): pad directive hook signatures to check short-arity direct...
• ffb85e5 fix(language-core): report duplicate non-identifier CSS module names (#6199)
• d41d919 feat(language-core): report duplicate CSS module names (#6198)
• 3167acf test(tsc): assert emitted declarations are self-contained and add jsxSlots te...
• d797f44 chore(deps): upgrade Vue to 3.6.0-rc.6 (#6189)
• 04954dd fix(language-core): eliminate unmapped codegen diagnostics (#6179)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions