4.18.1
Maintenance release — dependency updates and a security pin. No functional changes for end users.
Security
- Pinned the transitive
vitedev-dependency to 8.0.16, clearing two advisories (GHSA-v6wh-96g9-6wx3, GHSA-fx2h-pf6j-xcff) affecting8.0.0–8.0.15. Both are Windows dev-server issues;viteis only used to run the test suite and is never part of the shipped plugin, so end users were never exposed.
Build
- Bumped JavaScript dev-dependencies (eslint, esbuild, vitest, tailwindcss, typescript-eslint and others) and the Rust/WASM crates (
itertools0.15,smallvec,hashbrown), and regenerated the committedwasm/pkg/bindings.
Full changelog: 4.18.0...4.18.1