[dependabot]

Bumps the app group with 2 updates in the /bench/apps/alpine directory: alpinejs and vite.
Bumps the app group with 12 updates in the /bench/apps/angular directory:

Package	From	To
@angular/common	22.2.0	22.2.4
@angular/compiler	22.2.0	22.2.4
@angular/core	22.2.0	22.2.4
@angular/platform-browser	22.2.0	22.2.4
@angular/platform-server	22.2.0	22.2.4
@angular/router	22.2.0	22.2.4
@angular/ssr	22.2.0	22.2.5
express	5.2.1	5.3.0
@angular/build	22.2.0	22.2.5
@angular/cli	22.2.0	22.2.5
@angular/compiler-cli	22.2.0	22.2.4
@types/node	22.20.4	22.20.5

Bumps the app group with 5 updates in the /bench/apps/astro directory:

Package	From	To
@astrojs/node	11.1.6	11.1.9
@astrojs/preact	6.0.5	6.1.1
@nanostores/preact	1.1.0	1.1.1
astro	7.3.5	7.4.4
nanostores	1.5.4	1.5.5

Bumps the app group with 1 update in the /bench/apps/cyclewire directory: vite.
Bumps the app group with 1 update in the /bench/apps/cyclewire--no-preload directory: vite.
Bumps the app group with 1 update in the /bench/apps/cyclewire--request directory: vite.
Bumps the app group with 2 updates in the /bench/apps/marko directory: marko and @marko/run.
Bumps the app group with 3 updates in the /bench/apps/next directory: next, react and react-dom.
Bumps the app group with 3 updates in the /bench/apps/next--searchparams directory: next, react and react-dom.
Bumps the app group with 3 updates in the /bench/apps/nuxt directory: nuxt, vue and vue-router.
Bumps the app group with 4 updates in the /bench/apps/qwik directory: vite, @builder.io/qwik, @builder.io/qwik-city and undici.
Bumps the app group with 3 updates in the /bench/apps/solidstart directory: vite, @solidjs/start and solid-js.
Bumps the app group with 2 updates in the /bench/apps/sveltekit directory: vite and svelte.

Updates alpinejs from 3.17.4 to 3.17.5

Release notes

Sourced from alpinejs's releases.

v3.17.5

What's Changed

• Don't re-apply x-cloak to rendered elements during morph by @​calebporzio in alpinejs/alpine#4922

Full Changelog: alpinejs/alpine@v3.17.4...v3.17.5

Commits

• 8d3d9a2 Bump version to 3.17.5
• da60871 Don't re-apply x-cloak to live elements during morph (#4922)
• See full diff in compare view

Updates vite from 8.3.1 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

Updates @angular/common from 22.2.0 to 22.2.4

Release notes

Sourced from @​angular/common's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• b9761c8 test(http): add XSRF specs for backslash and whitespace URLs
• 2251098 fix(http): account for multiple cache control headers
• 6f2fb3d docs: update the initializer fn entries.
• dcb29a9 docs: fix @​param names that don't match their parameters
• fafec77 fix(common): harden param encoding against prototype pollution
• ad2f291 fix(common): let NgOptimizedImage pass a [srcset] binding through when srcset...
• 6dee7fe fix(http): forward reportProgress of httpResource as `reportDownloadProgr...
• 270abc9 docs(docs-infra): throw on absolute links in @​see tags
• See full diff in compare view

Updates @angular/compiler from 22.2.0 to 22.2.4

Release notes

Sourced from @​angular/compiler's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 00229e1 fix(compiler): skip escaped characters when looking for comments in expressions
• 4e4df4a fix(compiler): report errors for malformed template literal interpolations
• 646e972 fix(language-service): resolve symbols for inputs with restricted access
• bc600a2 fix(compiler): avoid treating attributes with object prototype names as being...
• 04fb6d5 refactor(compiler): remove redundant 0.x version checks
• 1a7ebad fix(compiler): default to Eager change detection for pre-v22 libraries in JIT
• 54f3de5 fix(compiler): check @boundary blocks in the control flow content projectio...
• 5e50658 fix(compiler): compare the operand in ReadTemporaryExpr.isEquivalent
• 35a02f8 fix(compiler): harden JIT against prototype pollution
• b6f9cc5 fix(compiler): do not scope comments placed inside of a selector
• Additional commits viewable in compare view

Updates @angular/core from 22.2.0 to 22.2.4

Release notes

Sourced from @​angular/core's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 31b13fc build: update cross-repo angular dependencies
• 6c631a5 feat(migrations): migrate static string and array ngClass bindings to class
• 84a398b fix(core): improve the warning for bindings on elements inside ICU expressions
• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• 0206e52 refactor(core): move @​defer hydrate trigger registration inside binding check
• 3c1fed1 docs(core): say that value() throws in the resource error state
• d3c7274 fix(core): catch view effect errors in targeted change detection mode
• c1b8b0a perf(core): avoid reading linked signal debug names in production
• b8102eb fix(core): check every i18n attribute translation for ICUs
• 3f8574a build: update cross-repo angular dependencies
• Additional commits viewable in compare view

Updates @angular/platform-browser from 22.2.0 to 22.2.4

Release notes

Sourced from @​angular/platform-browser's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• 1663b5e docs(platform-browser): link the styling guide from the namespacing APIs (#70...
• 6298b30 refactor(platform-browser): type async animation renderer
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• See full diff in compare view

Updates @angular/platform-server from 22.2.0 to 22.2.4

Release notes

Sourced from