chore(deps): lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Africa/Johannesburg)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.59.0
	tsx@​4.21.0
	vite@​8.0.8
	vite@​6.4.2
	ulid@​3.0.2
	vitepress@​1.6.4
	turbo@​2.9.6
	vite-tsconfig-paths@​6.1.1
	typescript@​5.8.3
	typescript@​6.0.3
	wrangler@​4.84.0
	wait-on@​9.0.5

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm svgo is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/@builder.io/qwik-city@1.19.2 → npm/svgo@3.3.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svgo@3.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

⚡ Benchmark Results

benchmarks/renderer/ring-buffer.bench.ts

Suite — Benchmark	ops/sec	mean (µs)	p99 (µs)	±rme	vs main
SharedRingBuffer – small payload (64 B) — write 64 bytes	508.2 K	0.0020	0.0071	±1.02%	-6.4%
SharedRingBuffer – small payload (64 B) — write + read 64 bytes	467.0 K	0.0021	0.0077	±1.29%	-11.2% ⚠️
SharedRingBuffer – medium payload (1 KB) — write 1 KB	311.8 K	0.0032	0.0134	±1.42%	-10.2% ⚠️
SharedRingBuffer – medium payload (1 KB) — write + read 1 KB	245.2 K	0.0041	0.0170	±0.86%	-5.7%
SharedRingBuffer – large payload (16 KB) — write 16 KB	35.8 K	0.0279	0.0592	±0.60%	-38.5% ⚠️
SharedRingBuffer – large payload (16 KB) — write + read 16 KB	90.0 K	0.0111	0.0435	±27.28%	+16.8% 🚀
SharedRingBuffer – sequential throughput (100 × 64 B) — 100 write + read cycles	45.9 K	0.0218	0.0526	±0.55%	+12.9% 🚀
SharedRingBuffer – introspection — availableToRead	14.91 M	0.0001	0.0001	±0.12%	~0%
SharedRingBuffer – introspection — isEmpty	14.95 M	0.0001	0.0001	±0.10%	+2.3%
SharedRingBuffer – introspection — isFull	14.65 M	0.0001	0.0001	±0.11%	~0%

benchmarks/renderer/shared-buffer.bench.ts

Suite — Benchmark	ops/sec	mean (µs)	p99 (µs)	±rme	vs main
SharedBuffer – allocation — createSharedBuffer(4 KB)	601.3 K	0.0017	0.0062	±0.96%	-15.7% ⚠️
SharedBuffer – allocation — createSharedBuffer(64 KB)	48.1 K	0.0208	0.0442	±5.09%	-14.6% ⚠️
SharedBuffer – small payload round-trip — write small JSON	336.1 K	0.0030	0.0087	±1.15%	-6.5%
SharedBuffer – small payload round-trip — write + read small JSON	228.9 K	0.0044	0.0120	±0.38%	-16.3% ⚠️
SharedBuffer – medium payload round-trip — write medium JSON (~2 KB)	97.7 K	0.0102	0.0267	±0.46%	+9.7%
SharedBuffer – medium payload round-trip — write + read medium JSON (~2 KB)	57.6 K	0.0174	0.0369	±0.39%	-1.3%
SharedBuffer – large payload round-trip — write large JSON (~10 KB)	16.1 K	0.0620	0.1026	±0.40%	+4.5%
SharedBuffer – large payload round-trip — write + read large JSON (~10 KB)	7.9 K	0.1266	0.1869	±0.42%	+1.1%

benchmarks/utils/ip-address.bench.ts

Suite — Benchmark	ops/sec	mean (µs)	p99 (µs)	±rme	vs main
getClientIPAddress – no IP headers — no IP-related headers → null	2.68 M	0.0004	0.0007	±1.28%	+1.6%
getClientIPAddress – single header — cf-connecting-ip (Cloudflare)	1.69 M	0.0006	0.0010	±1.16%	~0%
getClientIPAddress – single header — x-forwarded-for (simple)	1.95 M	0.0005	0.0008	±1.32%	+1.0%
getClientIPAddress – single header — x-real-ip	1.49 M	0.0007	0.0012	±1.30%	~0%
getClientIPAddress – single header — true-client-ip (Akamai / Cloudflare Enterprise)	1.59 M	0.0006	0.0011	±1.28%	+2.5%
getClientIPAddress – x-forwarded-for multi-hop — 2-hop chain	1.89 M	0.0005	0.0007	±0.12%	+8.4%
getClientIPAddress – x-forwarded-for multi-hop — 4-hop chain	1.70 M	0.0006	0.0010	±0.26%	+1.6%
getClientIPAddress – Forwarded header (RFC 7239) — simple for= directive	984.2 K	0.0010	0.0013	±1.21%	-3.0%
getClientIPAddress – Forwarded header (RFC 7239) — for= with port	720.2 K	0.0014	0.0023	±1.13%	-1.2%
getClientIPAddress – Forwarded header (RFC 7239) — IPv6 literal	746.3 K	0.0013	0.0021	±0.36%	-1.9%
getClientIPAddress – Forwarded header (RFC 7239) — multi-hop Forwarded	808.2 K	0.0012	0.0020	±1.34%	-4.0%
getClientIPAddress – IPv6 addresses — x-forwarded-for IPv6	1.18 M	0.0008	0.0012	±0.36%	+3.2%

benchmarks/utils/promise.bench.ts

Suite — Benchmark	ops/sec	mean (µs)	p99 (µs)	±rme	vs main
promiseHash – concurrent resolution — 2 already-resolved promises	832.5 K	0.0012	0.0034	±1.01%	-2.8%
promiseHash – concurrent resolution — 5 already-resolved promises	487.5 K	0.0021	0.0031	±1.39%	-7.0%
promiseHash – concurrent resolution — 10 already-resolved promises	286.9 K	0.0035	0.0047	±1.28%	~0%
promiseHash – concurrent resolution — 5 promises with object values	441.6 K	0.0023	0.0033	±0.38%	-9.1%
timeout – wrapping fast promises — timeout wrapping an already-resolved promise (1 s budget)	908.5 K	0.0011	0.0018	±0.41%	-6.2%
timeout – wrapping fast promises — timeout wrapping an already-resolved object (5 s budget)	855.1 K	0.0012	0.0020	±1.76%	-8.5%

benchmarks/utils/safe-redirect.bench.ts

Suite — Benchmark	ops/sec	mean (µs)	p99 (µs)	±rme	vs main
safeRedirect – valid paths — root path /	7.98 M	0.0001	0.0002	±0.14%	+18.0% 🚀
safeRedirect – valid paths — simple path /dashboard	4.00 M	0.0003	0.0003	±0.11%	+10.5% 🚀
safeRedirect – valid paths — nested path /settings/profile	3.50 M	0.0003	0.0003	±3.56%	+9.6%
safeRedirect – valid paths — path with query string /search?q=hello	3.87 M	0.0003	0.0003	±0.11%	+10.7% 🚀
safeRedirect – valid paths — path with hash /docs#section	3.94 M	0.0003	0.0003	±0.11%	+9.6%
safeRedirect – rejected inputs — absolute URL https://evil.com	4.94 M	0.0002	0.0002	±0.11%	+7.2%
safeRedirect – rejected inputs — protocol-relative URL //evil.com	5.00 M	0.0002	0.0003	±0.12%	+11.1% 🚀
safeRedirect – rejected inputs — backslash-relative /\evil.com	4.95 M	0.0002	0.0002	±0.12%	+7.0%
safeRedirect – rejected inputs — path traversal /../etc/passwd	4.47 M	0.0002	0.0003	±0.12%	+8.7%
safeRedirect – rejected inputs — null input	16.15 M	0.0001	0.0001	±0.11%	~0%
safeRedirect – rejected inputs — undefined input	15.96 M	0.0001	0.0001	±0.11%	-1.5%
safeRedirect – rejected inputs — empty string	15.95 M	0.0001	0.0001	±0.11%	-1.5%
safeRedirect – percent-encoded bypass — percent-encoded // (%2F%2F)	4.82 M	0.0002	0.0003	±0.11%	+1.4%
safeRedirect – percent-encoded bypass — percent-encoded path traversal (%2e%2e)	4.98 M	0.0002	0.0002	±0.25%	+4.7%
safeRedirect – percent-encoded bypass — mixed percent-encoded absolute URL	4.72 M	0.0002	0.0003	±0.12%	+3.1%
safeRedirect – custom default redirect — valid path with custom default	4.13 M	0.0002	0.0003	±0.11%	+10.3% 🚀
safeRedirect – custom default redirect — invalid input with custom default	4.93 M	0.0002	0.0002	±0.11%	+2.6%

🔬 Compared against the latest benchmark run on main. ⚠️ = >10% slower · 🚀 = >10% faster.

[github-actions]

📚 Docs preview deployed

https://scratchyjs-docs-pr-87.asjas.workers.dev

Updates automatically on every push to this PR.