Merge branch 'main' into codex/fix-bridge-css-dedupe

Author: BleedingDev

.changeset/bright-pots-vanish.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/retry-plugin': patch
+---
+
+fix: externalize @module-federation/runtime and runtime-core from DTS bundle to prevent type incompatibility in consumers

.changeset/drop-ansi-colors-dts-plugin.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/dts-plugin': patch
+---
+
+chore(dts-plugin): drop `ansi-colors` dependency in favor of inline ANSI escape for the single red error message.

.changeset/drop-lodash-get.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/typescript': patch
+---
+
+chore(typescript): drop `lodash.get` dependency in favor of optional chaining in `normalizeOptions`.

.changeset/drop-resolve-extractor.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/third-party-dts-extractor': patch
+---
+
+chore(third-party-dts-extractor): replace `resolve` with `exsolve` (0 transitive deps, ~100KB smaller) for the single `package.json` lookup.

.changeset/replace-find-pkg-with-empathic.md

@@ -0,0 +1,7 @@
+---
+'@module-federation/managers': patch
+'@module-federation/third-party-dts-extractor': patch
+'@module-federation/manifest': patch
+---
+
+chore: replace `find-pkg` with `empathic` (per [e18e replacements](https://e18e.dev/docs/replacements/find-pkg.html)). Removes unused `find-pkg` dependency from `@module-federation/manifest`.

.changeset/small-deps-consolidated.md

@@ -0,0 +1,9 @@
+---
+'@module-federation/devtools': patch
+'@module-federation/treeshake-server': patch
+'@module-federation/rspress-plugin': patch
+'create-module-federation': patch
+'@module-federation/third-party-dts-extractor': patch
+---
+
+Bump runtime dependencies: echarts 6.1.0 (devtools), hono 4.12.26 and @hono/node-server 1.19.13 (treeshake-server), lodash-es 4.18.1 (rspress-plugin), handlebars 4.7.9 (create-module-federation), resolve 1.22.12 (third-party-dts-extractor).

.changeset/tricky-pants-rescue.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/treeshake-server': patch
+---
+
+Bump undici to 7.28.0 to resolve known vulnerabilities (CVE-2026-12151 and related advisories).

apps/3000-home/package.json

@@ -6,7 +6,7 @@
   "dependencies": {
     "@ant-design/cssinjs": "^1.21.0",
     "antd": "5.19.1",
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "next": "14.2.35",
     "react": "18.3.1",
     "react-dom": "18.3.1"

apps/3001-shop/package.json

@@ -6,7 +6,7 @@
   "dependencies": {
     "@ant-design/cssinjs": "^1.21.0",
     "antd": "5.19.1",
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "next": "14.2.35",
     "react": "18.3.1",
     "react-dom": "18.3.1"

apps/3002-checkout/package.json

@@ -6,7 +6,7 @@
   "dependencies": {
     "@ant-design/cssinjs": "^1.21.0",
     "antd": "5.19.1",
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "next": "14.2.35",
     "react": "18.3.1",
     "react-dom": "18.3.1"