diff --git a/.github/actions/setup-and-cache/action.yml b/.github/actions/setup-and-cache/action.yml
index 408474e33ff2..7c2965a37c2b 100644
--- a/.github/actions/setup-and-cache/action.yml
+++ b/.github/actions/setup-and-cache/action.yml
@@ -11,7 +11,7 @@ runs:
 
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
 
     - name: Set node version to ${{ inputs.node-version }}
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 074717b54147..5fe03bc7d25f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
     env:
       PNPM_CONFIG_TRUST_LOCKFILE: false
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -74,13 +74,13 @@ jobs:
       should_skip: ${{ steps.changed-files.outputs.only_changed == 'true' }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           files: |
             docs/**
@@ -126,7 +126,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -204,7 +204,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -244,7 +244,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -284,7 +284,7 @@ jobs:
     name: Merge Reports
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/cr.yml b/.github/workflows/cr.yml
index 5157c1975043..4f24ce2c5e5e 100644
--- a/.github/workflows/cr.yml
+++ b/.github/workflows/cr.yml
@@ -19,13 +19,13 @@ jobs:
     name: 'Release: pkg.pr.new'
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml
index 3f88deccb2c9..5e237025d92c 100644
--- a/.github/workflows/issue-close-require.yml
+++ b/.github/workflows/issue-close-require.yml
@@ -16,7 +16,7 @@ jobs:
       issues: write # to close issues
       pull-requests: write # to close pull requests
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: needs reproduction
diff --git a/.github/workflows/issue-labeled.yml b/.github/workflows/issue-labeled.yml
index 2ad5f06111af..19d5147cf5da 100644
--- a/.github/workflows/issue-labeled.yml
+++ b/.github/workflows/issue-labeled.yml
@@ -24,7 +24,7 @@ jobs:
       contents: read # to check out the repo for local actions
       issues: write # adding a label
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: main
@@ -45,7 +45,7 @@ jobs:
       contents: read # to check out the repo for local actions
       issues: write # sending a comment
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: main
@@ -75,7 +75,7 @@ jobs:
       contents: read # to check out the repo for local actions
       pull-requests: write # sending a comment
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: main
diff --git a/.github/workflows/lock-closed-issues.yml b/.github/workflows/lock-closed-issues.yml
index 45aa4a1817e8..24becce2063f 100644
--- a/.github/workflows/lock-closed-issues.yml
+++ b/.github/workflows/lock-closed-issues.yml
@@ -15,7 +15,7 @@ jobs:
       issues: write # to lock issue
       pull-requests: write # to lock prs
     steps:
-      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+      - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-inactive-days: '14'
diff --git a/.github/workflows/pr-labeled-automated.yml b/.github/workflows/pr-labeled-automated.yml
index c975265df3f6..27daa36e06c3 100644
--- a/.github/workflows/pr-labeled-automated.yml
+++ b/.github/workflows/pr-labeled-automated.yml
@@ -21,7 +21,7 @@ jobs:
       contents: read # to check out the repo for local actions
       pull-requests: write # comment and label on PRs
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: main
@@ -54,7 +54,7 @@ jobs:
       contents: read # to check out the repo for local actions
       pull-requests: write # comment and label on PRs
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           # we checkout just to read ./issue-helper
@@ -62,7 +62,7 @@ jobs:
           ref: main
       - name: AgentScan
         id: agentscan
-        uses: MatteoGabriele/agentscan-action@f41545309db947a68e22ed2643f182e754f4d41a # v1.8.0
+        uses: MatteoGabriele/agentscan-action@d8da234c758c9a195222a68c3ecfe02a603185b6 # v1.15.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           agent-scan-comment: false
diff --git a/.github/workflows/prepare-publish.yml b/.github/workflows/prepare-publish.yml
index f57bd9c85031..cff6bd790154 100644
--- a/.github/workflows/prepare-publish.yml
+++ b/.github/workflows/prepare-publish.yml
@@ -40,14 +40,14 @@ jobs:
     permissions:
       contents: read # checkout target branch
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.target_branch }}
           fetch-depth: 0
           persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b7aec496c573..28f28b468a35 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,7 @@ jobs:
       release: ${{ steps.detect.outputs.release }}
       version: ${{ steps.detect.outputs.version }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -53,7 +53,7 @@ jobs:
       id-token: write # trusted publishing requirement
     environment: Release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -70,7 +70,7 @@ jobs:
           fi
 
       - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
 
       - name: Set node version to 24
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 25f171ef68b2..60015d9b7f86 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -22,13 +22,13 @@ jobs:
     permissions:
       security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       # test locally by
       #   zizmor .github/workflows --pedantic
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
         with:
           persona: pedantic
diff --git a/docs/package.json b/docs/package.json
index f77d22c13f80..d20931d3241e 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -27,16 +27,16 @@
     "@vite-pwa/assets-generator": "^1.0.2",
     "@vite-pwa/vitepress": "^1.1.0",
     "@vitejs/plugin-vue": "catalog:",
-    "@voidzero-dev/vitepress-theme": "^4.8.3",
+    "@voidzero-dev/vitepress-theme": "^4.8.4",
     "https-localhost": "^4.7.1",
     "tinyglobby": "catalog:",
     "unocss": "catalog:",
     "vite": "^6.3.5",
-    "vite-plugin-pwa": "^1.2.0",
-    "vitepress": "2.0.0-alpha.16",
-    "vitepress-plugin-group-icons": "^1.7.1",
-    "vitepress-plugin-llms": "^1.11.0",
-    "vitepress-plugin-tabs": "^0.8.0",
-    "workbox-window": "^7.4.0"
+    "vite-plugin-pwa": "^1.3.0",
+    "vitepress": "2.0.0-alpha.18",
+    "vitepress-plugin-group-icons": "^1.7.5",
+    "vitepress-plugin-llms": "^1.13.2",
+    "vitepress-plugin-tabs": "^0.9.0",
+    "workbox-window": "^7.4.1"
   }
 }
diff --git a/examples/fastify/package.json b/examples/fastify/package.json
index 6adc8dcf1bf3..133c47cbb867 100644
--- a/examples/fastify/package.json
+++ b/examples/fastify/package.json
@@ -14,7 +14,7 @@
     "@vitest/ui": "latest",
     "fastify": "^5.7.2",
     "supertest": "^7.2.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.0",
     "vite": "latest",
     "vitest": "latest"
   },
diff --git a/examples/lit/package.json b/examples/lit/package.json
index 320e19cb4907..3a4501289903 100644
--- a/examples/lit/package.json
+++ b/examples/lit/package.json
@@ -14,12 +14,12 @@
     "test:ui": "vitest --ui"
   },
   "dependencies": {
-    "lit": "^3.3.2"
+    "lit": "^3.3.3"
   },
   "devDependencies": {
     "@vitest/browser-playwright": "latest",
     "jsdom": "^29.1.1",
-    "playwright": "^1.61.0",
+    "playwright": "^1.61.1",
     "vite": "latest",
     "vitest": "latest"
   },
diff --git a/examples/opentelemetry/package.json b/examples/opentelemetry/package.json
index def82d82b90b..5401e9b903c2 100644
--- a/examples/opentelemetry/package.json
+++ b/examples/opentelemetry/package.json
@@ -8,12 +8,12 @@
     "test": "vitest"
   },
   "devDependencies": {
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/context-zone": "^2.6.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.213.0",
-    "@opentelemetry/resources": "^2.6.0",
-    "@opentelemetry/sdk-node": "^0.217.0",
-    "@opentelemetry/sdk-trace-web": "^2.6.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/context-zone": "^2.9.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.220.0",
+    "@opentelemetry/resources": "^2.9.0",
+    "@opentelemetry/sdk-node": "^0.220.0",
+    "@opentelemetry/sdk-trace-web": "^2.9.0",
     "@vitest/browser-playwright": "latest",
     "vite": "latest",
     "vitest": "latest"
diff --git a/examples/projects/package.json b/examples/projects/package.json
index e6a32cc71ac5..c2eb6b9c866a 100644
--- a/examples/projects/package.json
+++ b/examples/projects/package.json
@@ -12,14 +12,14 @@
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/react": "^19.2.14",
-    "@vitejs/plugin-react": "^5.1.4",
+    "@types/react": "^19.2.17",
+    "@vitejs/plugin-react": "^5.2.0",
     "@vitest/ui": "latest",
     "fastify": "^5.7.2",
     "jsdom": "^29.1.1",
-    "react": "^19.2.4",
+    "react": "^19.2.7",
     "supertest": "^7.2.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.0",
     "vite": "latest",
     "vitest": "latest"
   },
diff --git a/examples/typecheck/package.json b/examples/typecheck/package.json
index e8b85ecf2608..4e1db563b407 100644
--- a/examples/typecheck/package.json
+++ b/examples/typecheck/package.json
@@ -10,7 +10,7 @@
     "test:run": "vitest run"
   },
   "devDependencies": {
-    "@types/node": "^24.12.0",
+    "@types/node": "^24.13.2",
     "@vitest/ui": "latest",
     "typescript": "^5.9.3",
     "vite": "latest",
diff --git a/package.json b/package.json
index 623c64a7dd05..5686bf13e1d4 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
   "type": "module",
   "version": "5.0.0-beta.6",
   "private": true,
-  "packageManager": "pnpm@11.6.0",
+  "packageManager": "pnpm@11.10.0",
   "description": "Next generation testing framework powered by Vite",
   "engines": {
     "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
@@ -44,10 +44,10 @@
     "@antfu/eslint-config": "^7.7.3",
     "@antfu/ni": "^28.3.0",
     "@playwright/test": "catalog:",
-    "@rollup/plugin-commonjs": "^29.0.2",
+    "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
-    "@types/node": "24.12.0",
+    "@types/node": "24.13.2",
     "@types/semver": "catalog:",
     "@types/ws": "catalog:",
     "@vitest/browser": "workspace:*",
@@ -56,20 +56,20 @@
     "@vitest/ui": "workspace:*",
     "bumpp": "^10.4.1",
     "changelogithub": "^14.0.0",
-    "esbuild": "^0.27.3",
+    "esbuild": "^0.28.1",
     "eslint": "^10.6.0",
     "magic-string": "^0.30.21",
     "pathe": "^2.0.3",
     "premove": "^4.0.0",
-    "rollup": "^4.59.0",
-    "rollup-plugin-dts": "^6.3.0",
-    "rollup-plugin-license": "^3.7.0",
+    "rollup": "^4.62.2",
+    "rollup-plugin-dts": "^6.4.1",
+    "rollup-plugin-license": "^3.7.1",
     "semver": "catalog:",
     "tinyglobby": "catalog:",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.0",
     "typescript": "^5.9.3",
-    "unplugin-isolated-decl": "^0.15.7",
-    "unplugin-oxc": "^0.6.0",
+    "unplugin-isolated-decl": "^0.16.0",
+    "unplugin-oxc": "^0.6.1",
     "vite": "8.0.11",
     "vitest": "workspace:*",
     "zx": "^8.8.5"
diff --git a/packages/browser/package.json b/packages/browser/package.json
index 75a08629e691..acd11e5b2927 100644
--- a/packages/browser/package.json
+++ b/packages/browser/package.json
@@ -76,7 +76,7 @@
     "vitest": "workspace:*"
   },
   "dependencies": {
-    "@blazediff/core": "1.9.1",
+    "@blazediff/core": "1.9.3",
     "@vitest/mocker": "workspace:*",
     "@vitest/ui": "workspace:*",
     "@vitest/utils": "workspace:*",
@@ -87,7 +87,7 @@
     "ws": "catalog:"
   },
   "devDependencies": {
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "^1.9.1",
     "@testing-library/user-event": "^14.6.1",
     "@types/node": "catalog:",
     "@types/pngjs": "^6.0.5",
@@ -97,7 +97,7 @@
     "ivya": "^1.8.2",
     "mime": "^4.1.0",
     "pathe": "catalog:",
-    "rrweb-snapshot": "2.0.1",
+    "rrweb-snapshot": "2.1.0",
     "vitest": "workspace:*"
   }
 }
diff --git a/packages/coverage-istanbul/package.json b/packages/coverage-istanbul/package.json
index 49dfe1bc4561..fc933772f345 100644
--- a/packages/coverage-istanbul/package.json
+++ b/packages/coverage-istanbul/package.json
@@ -44,8 +44,8 @@
     "vitest": "workspace:*"
   },
   "dependencies": {
-    "@babel/core": "^7.29.0",
-    "@istanbuljs/schema": "^0.1.3",
+    "@babel/core": "^7.29.7",
+    "@istanbuljs/schema": "^0.1.6",
     "@jridgewell/gen-mapping": "^0.3.13",
     "@jridgewell/trace-mapping": "catalog:",
     "istanbul-lib-coverage": "catalog:",
diff --git a/packages/coverage-v8/package.json b/packages/coverage-v8/package.json
index 0e178420dbd6..fedc29d32879 100644
--- a/packages/coverage-v8/package.json
+++ b/packages/coverage-v8/package.json
@@ -56,7 +56,7 @@
   "dependencies": {
     "@bcoe/v8-coverage": "^1.0.2",
     "@vitest/utils": "workspace:*",
-    "ast-v8-to-istanbul": "^1.0.0",
+    "ast-v8-to-istanbul": "^1.0.4",
     "istanbul-lib-coverage": "catalog:",
     "istanbul-lib-report": "catalog:",
     "istanbul-reports": "catalog:",
diff --git a/packages/mocker/package.json b/packages/mocker/package.json
index efc3ad0618e8..fe530bdac5e3 100644
--- a/packages/mocker/package.json
+++ b/packages/mocker/package.json
@@ -98,7 +98,7 @@
     "@vitest/utils": "workspace:*",
     "acorn-walk": "catalog:",
     "cjs-module-lexer": "^2.2.0",
-    "es-module-lexer": "^2.0.0",
+    "es-module-lexer": "^2.3.0",
     "msw": "catalog:",
     "pathe": "catalog:",
     "vite": "^6.3.5"
diff --git a/packages/pretty-format/package.json b/packages/pretty-format/package.json
index aa04f2686ad7..6ff7be3a4b81 100644
--- a/packages/pretty-format/package.json
+++ b/packages/pretty-format/package.json
@@ -44,7 +44,7 @@
   },
   "devDependencies": {
     "@types/react-is": "^19.2.0",
-    "react-is": "^19.2.4",
+    "react-is": "^19.2.7",
     "react-is-18": "npm:react-is@18.3.1"
   }
 }
diff --git a/packages/ui/package.json b/packages/ui/package.json
index e7a309da469c..46bf85fae005 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -54,7 +54,7 @@
   },
   "dependencies": {
     "@vitest/utils": "workspace:*",
-    "fflate": "^0.8.2",
+    "fflate": "^0.8.3",
     "flatted": "catalog:",
     "pathe": "catalog:",
     "sirv": "catalog:",
@@ -62,7 +62,7 @@
     "tinyrainbow": "catalog:"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.3.0",
+    "@faker-js/faker": "^10.5.0",
     "@iconify-json/carbon": "catalog:",
     "@iconify-json/logos": "catalog:",
     "@types/codemirror": "^5.60.17",
@@ -78,20 +78,20 @@
     "birpc": "catalog:",
     "codemirror": "^5.65.18",
     "codemirror-theme-vars": "^0.1.2",
-    "cookie": "^1.0.2",
-    "d3-graph-controller": "^3.1.8",
+    "cookie": "^1.1.1",
+    "d3-graph-controller": "^3.1.13",
     "floating-vue": "^5.2.2",
     "mime": "^4.1.0",
-    "rollup": "^4.59.0",
-    "rrweb-snapshot": "2.0.1",
-    "splitpanes": "^4.0.4",
+    "rollup": "^4.62.2",
+    "rrweb-snapshot": "2.1.0",
+    "splitpanes": "^4.1.2",
     "typescript": "^5.9.3",
     "unocss": "catalog:",
     "vite": "latest",
     "vitest-browser-vue": "2.1.0",
     "vue": "catalog:",
-    "vue-router": "^5.0.3",
-    "vue-tsc": "^3.2.5",
-    "vue-virtual-scroller": "2.0.0-beta.8"
+    "vue-router": "^5.1.0",
+    "vue-tsc": "^3.3.6",
+    "vue-virtual-scroller": "2.0.1"
   }
 }
diff --git a/packages/vitest/package.json b/packages/vitest/package.json
index 740b13921fdd..fe6e777e024f 100644
--- a/packages/vitest/package.json
+++ b/packages/vitest/package.json
@@ -173,32 +173,32 @@
     "@vitest/spy": "workspace:*",
     "@vitest/utils": "workspace:*",
     "chai": "catalog:",
-    "es-module-lexer": "^2.0.0",
-    "expect-type": "^1.3.0",
+    "es-module-lexer": "^2.3.0",
+    "expect-type": "^1.4.0",
     "magic-string": "catalog:",
     "obug": "catalog:",
     "pathe": "catalog:",
     "picomatch": "^4.0.3",
     "std-env": "catalog:",
     "tinybench": "catalog:",
-    "tinyexec": "^1.0.2",
+    "tinyexec": "^1.2.4",
     "tinyglobby": "catalog:",
     "tinyrainbow": "catalog:",
     "why-is-node-running": "^2.3.0"
   },
   "devDependencies": {
     "@antfu/install-pkg": "^1.1.0",
-    "@bomb.sh/tab": "^0.0.14",
+    "@bomb.sh/tab": "^0.0.19",
     "@edge-runtime/vm": "^5.0.0",
     "@jridgewell/trace-mapping": "catalog:",
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "^1.9.1",
     "@sinonjs/fake-timers": "15.4.0",
     "@types/estree": "catalog:",
     "@types/istanbul-lib-coverage": "catalog:",
     "@types/istanbul-reports": "catalog:",
     "@types/jsdom": "^27.0.0",
-    "@types/node": "^24.12.0",
-    "@types/picomatch": "^4.0.2",
+    "@types/node": "^24.13.2",
+    "@types/picomatch": "^4.0.3",
     "@types/prompts": "^2.4.9",
     "@vitest/expect": "workspace:*",
     "@vitest/snapshot": "workspace:*",
@@ -209,7 +209,7 @@
     "flatted": "catalog:",
     "happy-dom": "^20.10.6",
     "jsdom": "^29.1.1",
-    "local-pkg": "^1.1.2",
+    "local-pkg": "^1.2.1",
     "mime": "^4.1.0",
     "prompts": "^2.4.2",
     "strip-literal": "catalog:",
diff --git a/packages/web-worker/package.json b/packages/web-worker/package.json
index 0c63fca21d3c..f7936157b537 100644
--- a/packages/web-worker/package.json
+++ b/packages/web-worker/package.json
@@ -45,6 +45,6 @@
   },
   "devDependencies": {
     "@types/ungap__structured-clone": "^1.2.0",
-    "@ungap/structured-clone": "^1.3.0"
+    "@ungap/structured-clone": "^1.3.2"
   }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 7efe13da660f..9d633adacf82 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -33,7 +33,7 @@ overrides:
   '@vitest/browser-preview': workspace:*
   '@vitest/ui': workspace:*
   acorn: 8.11.3
-  mlly: ^1.8.0
+  mlly: ^1.8.2
   rollup: 'catalog:'
   vite: 'catalog:'
   vitest: workspace:*
@@ -45,30 +45,30 @@ patchedDependencies:
   istanbul-lib-source-maps: patches/istanbul-lib-source-maps.patch
   rrweb-snapshot@2.0.1: patches/rrweb-snapshot@2.0.1.patch
 catalog:
-  '@babel/core': ^7.29.0
-  '@babel/plugin-proposal-decorators': ^7.29.0
-  '@iconify-json/carbon': ^1.2.19
-  '@iconify-json/logos': ^1.2.10
-  '@iconify/vue': ^5.0.0
+  '@babel/core': ^7.29.7
+  '@babel/plugin-proposal-decorators': ^7.29.7
+  '@iconify-json/carbon': ^1.2.24
+  '@iconify-json/logos': ^1.2.11
+  '@iconify/vue': ^5.0.1
   '@jridgewell/remapping': ^2.3.5
   '@jridgewell/trace-mapping': 0.3.31
-  '@playwright/test': ^1.61.0
-  '@rolldown/plugin-babel': ^0.2.1
+  '@playwright/test': ^1.61.1
+  '@rolldown/plugin-babel': ^0.2.3
   '@types/chai': ^5.2.2
-  '@types/estree': ^1.0.8
+  '@types/estree': ^1.0.9
   '@types/istanbul-lib-coverage': ^2.0.6
   '@types/istanbul-lib-report': ^3.0.3
   '@types/istanbul-lib-source-maps': ^4.0.4
   '@types/istanbul-reports': ^3.0.4
-  '@types/node': 24.12.0
+  '@types/node': 24.13.2
   '@types/semver': ^7.7.1
   '@types/ws': ^8.18.1
   '@types/yauzl': ^2.10.3
-  '@unocss/reset': ^66.6.6
+  '@unocss/reset': ^66.7.5
   '@vitejs/plugin-vue': ^6.0.7
-  '@vueuse/core': ^14.2.1
+  '@vueuse/core': ^14.3.0
   acorn-walk: ^8.3.5
-  ansivision: ^0.2.7
+  ansivision: ^0.4.0
   birpc: ^4.0.0
   cac: ^6.7.14
   chai: ^6.2.2
@@ -79,31 +79,31 @@ catalog:
   istanbul-reports: ^3.2.0
   loupe: ^3.2.1
   magic-string: ^0.30.21
-  magicast: ^0.5.2
-  msw: ^2.12.10
-  obug: ^2.1.1
+  magicast: ^0.5.3
+  msw: ^2.14.6
+  obug: ^2.1.3
   pathe: ^2.0.3
-  playwright: ^1.61.0
-  rollup: ^4.59.0
-  semver: ^7.8.3
+  playwright: ^1.61.1
+  rollup: ^4.62.2
+  semver: ^7.8.5
   sinon: ^22.0.0
   sinon-chai: ^4.0.1
   sirv: ^3.0.2
-  std-env: ^4.0.0-rc.1
+  std-env: ^4.1.0
   strip-literal: ^3.1.0
-  tinybench: ^6.0.1
-  tinyexec: ^1.0.2
-  tinyglobby: ^0.2.15
+  tinybench: ^6.0.2
+  tinyexec: ^1.2.4
+  tinyglobby: ^0.2.17
   tinyhighlight: ^0.3.2
   tinyrainbow: ^3.1.0
   tinyspy: ^4.0.4
   typescript: ^5.9.3
-  unocss: ^66.6.6
+  unocss: ^66.7.5
   vite: 8.0.11
   vitest-sonar-reporter: 3.0.0
-  vue: ^3.5.29
-  ws: ^8.20.1
-  yauzl: ^3.2.0
+  vue: ^3.5.39
+  ws: ^8.21.0
+  yauzl: ^3.4.0
 peerDependencyRules:
   ignoreMissing:
     - '@algolia/client-search'
diff --git a/test/browser/package.json b/test/browser/package.json
index 7afb0c50ffb1..1ae4145db38f 100644
--- a/test/browser/package.json
+++ b/test/browser/package.json
@@ -29,22 +29,22 @@
     "docker": "docker compose"
   },
   "devDependencies": {
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.17",
     "@types/yauzl": "catalog:",
-    "@vitejs/plugin-basic-ssl": "^2.1.4",
+    "@vitejs/plugin-basic-ssl": "^2.3.0",
     "@vitest/browser": "workspace:*",
     "@vitest/browser-playwright": "workspace:*",
     "@vitest/browser-preview": "workspace:*",
     "@vitest/bundled-lib": "link:./bundled-lib",
     "@vitest/cjs-lib": "link:./cjs-lib",
     "playwright": "catalog:",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "test-dep-error": "file:./deps/test-dep-error",
     "tinyexec": "catalog:",
     "url": "^0.11.4",
     "vitest": "workspace:*",
-    "vitest-browser-react": "^2.0.5",
+    "vitest-browser-react": "^2.2.0",
     "ws": "catalog:",
     "yauzl": "catalog:"
   }
diff --git a/test/coverage-test/package.json b/test/coverage-test/package.json
index 35bde8985b90..bbdb825dd6d8 100644
--- a/test/coverage-test/package.json
+++ b/test/coverage-test/package.json
@@ -21,8 +21,8 @@
     "istanbul-lib-coverage": "catalog:",
     "istanbul-lib-report": "catalog:",
     "magic-string": "^0.30.21",
-    "magicast": "^0.5.2",
-    "sass-embedded": "^1.97.3",
+    "magicast": "^0.5.3",
+    "sass-embedded": "^1.100.0",
     "unplugin-swc": "^1.5.9",
     "vite": "latest",
     "vitest": "workspace:*",
diff --git a/test/e2e/fixtures/no-module-runner/package.json b/test/e2e/fixtures/no-module-runner/package.json
index 723bc6d2dc86..5621bd08e1f6 100644
--- a/test/e2e/fixtures/no-module-runner/package.json
+++ b/test/e2e/fixtures/no-module-runner/package.json
@@ -10,7 +10,7 @@
     "test:run": "vitest run"
   },
   "devDependencies": {
-    "@types/node": "^24.12.0",
+    "@types/node": "^24.13.2",
     "@vitest/ui": "workspace:*",
     "tinyspy": "^4.0.4",
     "vite": "latest",
diff --git a/test/e2e/package.json b/test/e2e/package.json
index b517371d3c89..a1e989d85b42 100644
--- a/test/e2e/package.json
+++ b/test/e2e/package.json
@@ -11,16 +11,16 @@
     "native": "vitest --root=./fixtures/no-module-runner --watch=false --no-isolate --max-workers=1"
   },
   "devDependencies": {
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/sdk-node": "^0.217.0",
-    "@opentelemetry/sdk-trace-web": "^2.6.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/sdk-node": "^0.220.0",
+    "@opentelemetry/sdk-trace-web": "^2.9.0",
     "@test/pkg-reporter": "link:./deps/pkg-reporter",
     "@test/test-dep-config": "link:./deps/test-dep-config",
     "@test/test-dep-error": "file:./deps/error",
     "@test/test-dep-linked": "link:./deps/linked",
     "@test/test-dep-url": "link:./deps/dep-url",
     "@types/ws": "catalog:",
-    "@vitejs/plugin-basic-ssl": "^2.1.4",
+    "@vitejs/plugin-basic-ssl": "^2.3.0",
     "@vitejs/test-dep-virtual": "file:./deps/test-dep-virtual",
     "@vitest/browser-playwright": "workspace:*",
     "@vitest/browser-preview": "workspace:*",
@@ -31,8 +31,8 @@
     "ansivision": "catalog:",
     "flatted": "catalog:",
     "inline-dep": "file:./deps/vite-ssr-resolve/inline-dep",
-    "jest-image-snapshot": "^6.5.1",
-    "obug": "^2.1.1",
+    "jest-image-snapshot": "^6.5.2",
+    "obug": "^2.1.3",
     "other-dep": "file:./deps/vite-ssr-resolve/other-dep",
     "pathe": "catalog:",
     "playwright": "catalog:",
@@ -41,7 +41,7 @@
     "test-dep-invalid": "link:./deps/dep-invalid",
     "test-dep-simple": "file:./deps/dep-simple",
     "test-dep-simple2": "file:./deps/dep-simple2",
-    "tinyexec": "^1.0.2",
+    "tinyexec": "^1.2.4",
     "tinyspy": "catalog:",
     "typescript": "catalog:",
     "unplugin-swc": "^1.5.9",
diff --git a/test/test-utils/package.json b/test/test-utils/package.json
index 70f26fd643d0..f7edc6071de9 100644
--- a/test/test-utils/package.json
+++ b/test/test-utils/package.json
@@ -7,7 +7,7 @@
     "test": "echo \"No tests\""
   },
   "devDependencies": {
-    "tinyexec": "^1.0.2",
+    "tinyexec": "^1.2.4",
     "tinyrainbow": "catalog:",
     "vite": "latest",
     "vitest": "workspace:*"
diff --git a/test/typescript/package.json b/test/typescript/package.json
index 7de2e450d045..3876cbff446e 100644
--- a/test/typescript/package.json
+++ b/test/typescript/package.json
@@ -11,6 +11,6 @@
   },
   "devDependencies": {
     "typescript": "^5.9.3",
-    "vue-tsc": "^3.2.5"
+    "vue-tsc": "^3.3.6"
   }
 }
diff --git a/test/unit/package.json b/test/unit/package.json
index 2179eaa6c280..8f4a82c875df 100644
--- a/test/unit/package.json
+++ b/test/unit/package.json
@@ -31,17 +31,17 @@
     "@vitest/test-fn": "file:./deps/dep-fn",
     "@vitest/utils": "workspace:*",
     "@vitest/web-worker": "workspace:^",
-    "@vueuse/integrations": "^14.2.1",
+    "@vueuse/integrations": "^14.3.0",
     "http-client": "file:./projects/http-client",
-    "immutable": "5.1.5",
+    "immutable": "5.1.9",
     "loupe": "catalog:",
-    "memfs": "^4.56.11",
-    "obug": "^2.1.1",
-    "react": "^19.2.4",
+    "memfs": "^4.63.0",
+    "obug": "^2.1.3",
+    "react": "^19.2.7",
     "react-18": "npm:react@18.3.1",
     "sinon": "catalog:",
     "sinon-chai": "catalog:",
-    "temporal-polyfill": "~0.3.0",
+    "temporal-polyfill": "~0.3.2",
     "tinyrainbow": "catalog:",
     "tinyspy": "^4.0.4",
     "url": "^0.11.4",