chore(deps): bump the npm-minor-and-patch group across 1 directory with 10 updates

[dependabot]

Bumps the npm-minor-and-patch group with 10 updates in the / directory:

Package	From	To
@biomejs/biome	2.4.9	2.5.15
@types/node	26.1.1	26.6.5
vite	8.0.3	8.3.4
zod	4.3.6	4.6.6
it-merge	3.0.14	3.0.15
it-pushable	3.2.3	3.2.4
@privy-io/node	0.15.0	0.35.0
viem	2.47.10	2.57.4
type-fest	5.5.0	5.10.0
tsx	4.22.4	4.23.15

Updates @biomejs/biome from 2.4.9 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

• #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

• 0b4c11f ci: release (#11815)
• ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
• 034366d chore: update codspeed logo in readme (#12019)
• 717db8c feat(lint): add noMisplacedListElements (#11917)
• 089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
• 1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
• faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
• b2b4400 chore: update sponsors (#11973)
• ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
• 1b9479e feat(lint): add useLogicalProperties rule (#10816)
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.6.5

Commits

• See full diff in compare view

Updates vite from 8.0.3 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Commits

• b6c20f6 release: v8.3.4 (#23702)
• b28db28 fix(server): match static aliases on path boundaries (#23643)
• bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
• fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
• 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
• 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
• facc2fb fix: remove input option unescaping for now (#23694)
• 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
• cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
• fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
• Additional commits viewable in compare view

Updates zod from 4.3.6 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• 34a626f docs: tighten the z.locales tree-shaking note
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates it-merge from 3.0.14 to 3.0.15

Release notes

Sourced from it-merge's releases.

it-merge-3.0.15

it-merge-v3.0.15 (2026-08-15)

Bug Fixes

• it-merge: return the source iterators when the consumer exits early (#216) (b3deb12)

Trivial Changes

• bump aegir from 47.2.0 to 48.0.1 (#202) (856b57f)

Commits

• b7c51ff chore(release): 3.0.15 [skip ci]
• b5cd52f chore(release): 2.0.1 [skip ci]
• 74319cc deps: bump nanoid from 5.1.16 to 6.0.1 (#215)
• 5dc2642 deps: bump cborg from 5.1.11 to 6.1.1 (#214)
• b3deb12 fix(it-merge): return the source iterators when the consumer exits early (#216)
• ba365b6 chore(release): 3.0.16 [skip ci]
• 5dc93e4 fix: clean up source on a short read in it-parallel (#209)
• 86cf753 chore(release): 3.0.1 [skip ci]
• e4a4ad2 chore(release): 3.0.1 [skip ci]
• 31a6a23 chore(release): 3.0.1 [skip ci]
• Additional commits viewable in compare view

Updates it-pushable from 3.2.3 to 3.2.4

Release notes

Sourced from it-pushable's releases.

v3.2.4

3.2.4 (2026-05-08)

Dependencies

• dev: bump aegir from 41.3.5 to 42.2.5 (#87) (727590f)

Changelog

Sourced from it-pushable's changelog.

3.2.4 (2026-05-08)

Dependencies

• dev: bump aegir from 41.3.5 to 42.2.5 (#87) (727590f)

Commits

• a78b307 chore(release): 3.2.4 [skip ci]
• 727590f deps(dev): bump aegir from 41.3.5 to 42.2.5 (#87)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for it-pushable since your current version.

Updates @privy-io/node from 0.15.0 to 0.35.0

Release notes

Sourced from @​privy-io/node's releases.

v0.35.0

0.35.0 (2026-09-21)

Features

• add payout fiat convenience wrapper on PrivyClient (#25) (aba07a5)
• api: api update (2c9e416)
• api: api update (d4611f5)
• api: api update (cd38e42)
• api: api update (66a4856)
• api: api update (d0996bc)
• api: api update (1c61202)
• api: api update (652cae9)
• api: api update (f86806f)
• api: api update (c9e39fb)
• api: api update (056f45f)
• api: api update (a4c5adf)
• api: api update (e54bd7e)
• api: api update (cf5b2d8)
• api: api update (6dd8830)
• api: api update (58116ef)
• api: api update (b035183)

Bug Fixes

• ci: allow back-sync to update workflows (#29) (0868a4b)
• tests: correct generated wallet automations import (#27) (55fda4f)
• tests: use supported PrivyAPI export (#30) (ca4a6ca)

Chores

• publish stable GitHub releases (#18) (2794645)

Documentation

• add agent guidance (#26) (1d621e2)

v0.34.0

0.34.0 (2026-08-28)

Features

• add Claude skill for generating auth wrapper services (#13) (3c3dc78)
• api: api update (793b4ac)
• expose organizations service (incl. KYB) on PrivyClient (#17) (9ed30c4)

... (truncated)

Changelog

Sourced from @​privy-io/node's changelog.

0.35.0 (2026-09-21)

Features

• add payout fiat convenience wrapper on PrivyClient (#25) (aba07a5)
• api: api update (2c9e416)
• api: api update (d4611f5)
• api: api update (cd38e42)
• api: api update (66a4856)
• api: api update (d0996bc)
• api: api update (1c61202)
• api: api update (652cae9)
• api: api update (f86806f)
• api: api update (c9e39fb)
• api: api update (056f45f)
• api: api update (a4c5adf)
• api: api update (e54bd7e)
• api: api update (cf5b2d8)
• api: api update (6dd8830)
• api: api update (58116ef)
• api: api update (b035183)

Bug Fixes

• ci: allow back-sync to update workflows (#29) (0868a4b)
• tests: correct generated wallet automations import (#27) (55fda4f)
• tests: use supported PrivyAPI export (#30) (ca4a6ca)

Chores

• publish stable GitHub releases (#18) (2794645)

Documentation

• add agent guidance (#26) (1d621e2)

0.34.0 (2026-08-28)

Features

• add Claude skill for generating auth wrapper services (#13) (3c3dc78)
• api: api update (793b4ac)
• expose organizations service (incl. KYB) on PrivyClient (#17) (9ed30c4)

0.33.0 (2026-08-27)

... (truncated)

Commits

• ba60dcb release: 0.35.0 (#206)
• 2c9e416 feat(api): api update
• d4611f5 feat(api): api update
• cd38e42 feat(api): api update
• 66a4856 feat(api): api update
• 48a6fa8 ci: update PR title validation workflow 🪿✨ (#31)
• d0996bc feat(api): api update
• 1c61202 feat(api): api update
• 652cae9 feat(api): api update
• ca4a6ca fix(tests): use supported PrivyAPI export (#30)
• Additional commits viewable in compare view

Updates viem from 2.47.10 to 2.57.4

Release notes

Sourced from viem's releases.

viem@2.57.4

Patch Changes

• #5204 9adede02f2a5d171b8302e5671c3e4f70789fb57 Thanks @​jxom! - Updated ox to 0.14.54, which keeps absent Tempo key-authorization limits (unlimited) distinct from an empty list (deny-all).

• #5190 2149aa18fc0363e702c81b95e0759c1f171eaace Thanks @​struong! - Added the current Tempo ZoneInbox ABI, selectors, and predeploy address for reading deposit outcomes.

viem@2.57.3

Patch Changes

• #5180 031f5e2445031fed4328f32cb201f779b9101265 Thanks @​jxom! - Fixed sendCalls with experimental_fallback enabled to recognize Base RPC's unsupported-method response.

• #5168 d6f63b57b4cc9b93654ca20f848b46a1080551d3 Thanks @​bearpong! - Fixed getContractError throwing when an error cause is not an object.

• #5173 26d5bd227ba532ceff83bd76e807ea605c703e8b Thanks @​jxom! - Updated automatic relay fee-token selection to skip tokens without fee AMM liquidity in the existing preflight request.

• #5171 bbd9c15a1de604cc4948f6033456c7f7f15a5f9a Thanks @​Iretse! - Fixed IPC response framing for JSON strings containing braces and escaped quotes.

• #5160 ed89bfdf5c4595fbd7b38346c8dfb7b1250dbfcb Thanks @​KJdayo! - Updated Jasmy Chain and Jasmy Chain Testnet RPC URLs (rpc.jasmyscan.net / jasmy-chain-testnet.alt.technology) and added their block explorers.

• #5179 60951cb0166d8f55615294b2b71de4c3526128e9 Thanks @​jxom! - Fixed waitForTransactionReceipt treating the awaited transaction as its own replacement when its receipt was unavailable.

• #5172 69e9facaba86a4a171b473fdc19419b12ff4ed74 Thanks @​Iretse! - Fixed retention of timed-out IPC and WebSocket request callbacks.

• #5176 2f97c5e1639969179e76ea61f5b10641f6f101f8 Thanks @​Kshot3000! - Fixed waitForUserOperationReceipt hanging until timeout on a later call for the same hash after concurrent calls for that hash had settled.

viem@2.57.2

Patch Changes

• #5157 bc45023eb72279e225ed924ac93e4aae1589356c Thanks @​myfxpaddy! - Added CRYMAD Chain and CRYMAD Chain L2 chains.

• #5162 cf4591306183f1622b376115cd4ed077b8fffb34 Thanks @​tmm! - Marked Open USD as popular in its token definition and included it in tokens.popular.

• #5166 f9f9d1bc0bc9d7fa116a164cf9deceadfe5f35a8 Thanks @​decofe! - Added from to Tempo token.burn and token.burnSync to burn from another address via TIP-1006 burnAt (T12), and synced Tempo ABIs.

• #5156 3f38e899dca519598165091c363faa9c884630bd Thanks @​decofe! - Fixed the Tempo preparation hook to preserve explicitly supplied expiring nonces for TIP-1106.

viem@2.57.1

Patch Changes

• #5151 93ea7b3928b41929e5e8b1116937c0caf4f2606f Thanks @​tmm! - Added Open USD (OUSD) token support on Ethereum, Tempo, and Base.

viem@2.57.0

Minor Changes

• #5138 6599af365a27476c9f9b7b6f2950941709807393 Thanks @​jxom! - Added createClientResolver to lazily resolve and cache typed clients across configured chains using a transport map or callback.

• #5140 8a5ef5b06400530e7a45b6b52ed0...

  Description has been truncated

  ---

  [!NOTE]
  Medium Risk
  Large jumps on optional @privy-io/node and viem plus zod 4.3→4.6 can change runtime validation and wallet integration behavior; risk is mostly dependency alignment and CI/test signal, not shipped logic changes in this diff.

  Overview
  Dependency refresh across the monorepo: version specifiers in workspace package.json files and a regenerated pnpm-lock.yaml. There are no application or library source changes.

  Tooling (root): @biomejs/biome ^2.4.9 → ^2.5.15, @types/node ^26.1.1 → ^26.6.5, vite ^8.0.3 → ^8.3.4.

  Packages: zod ^4.3.6 → ^4.6.6 in @polymarket/bindings and @polymarket/client; type-fest ^5.5.0 → ^5.10.0 in @polymarket/types; it-merge / it-pushable patch bumps in @polymarket/client.

  Wallet / chain stack (@polymarket/client + examples): viem peer/dev and examples dependency raised to ^2.57.4 (lock resolves 2.57.4). @privy-io/node optional peer and dev dependency jumps ^0.15.0 → ^0.35.0, which may affect consumers of ./privy and integration tests.

  Examples: tsx ^4.20.3 → ^4.23.15.

  The lockfile also pulls in transitive updates tied to Vite/tsx (e.g. rolldown 1.0.0-rc.12 → 1.2.13, esbuild 0.28.0 → 0.28.2).

  ^{Reviewed by} Cursor Bugbot for commit 1a631a40333b4bb47259aabdd702eefeafea5c77. Bugbot is set up for automated code reviews on this repo. Configure here.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 83508f2. Configure here.}

[cursor]

Peer range jump breaks consumers

Medium Severity

Raising the @privy-io/node peer from ^0.15.0 to ^0.35.0 changes the supported 0.x minor. Caret ranges on 0.x only allow that minor, so consumers still on 0.15.x no longer satisfy the published peer and can fail installs. The viem peer is also narrowed from ^2.46.3 to ^2.57.4.

 

^{Reviewed by Cursor Bugbot for commit 83508f2. Configure here.}