@gooddata/sdk-ui-pluggable-host 11.40.0-alpha.3 → 11.40.0-alpha.4

package/esm/loader/routing.js

@@ -1,12 +1,16 @@
 // (C) 2026 GoodData Corporation
 import { isExternalPluggableApplicationRegistryItem, isLocalPluggableApplicationRegistryItem, isRemotePluggableApplicationRegistryItem, } from "@gooddata/sdk-model";
 const WORKSPACE_PATH_PATTERN = /^\/workspace\/(?<workspaceId>[^/]+)(?:\/|$)/;
+function stripEmbedPrefix(pathname) {
+    return pathname.startsWith("/embedded/") ? pathname.slice("/embedded".length) : pathname;
+}
 /**
  * Returns the application scope for the given URL path, or undefined if the path
  * does not match a known scope.
  */
 export function getApplicationScopeFromPath(path) {
-    const isPathMatching = (definitionPath) => path === definitionPath || path.startsWith(definitionPath + "/");
+    const stripped = stripEmbedPrefix(path);
+    const isPathMatching = (definitionPath) => stripped === definitionPath || stripped.startsWith(definitionPath + "/");
     if (isPathMatching("/organization")) {
         return "organization";
     }
@@ -20,7 +24,7 @@ export function getApplicationScopeFromPath(path) {
  * does not contain a workspace id.
  */
 export function getWorkspaceIdFromPath(pathname) {
-    return WORKSPACE_PATH_PATTERN.exec(pathname ?? "")?.groups?.["workspaceId"];
+    return WORKSPACE_PATH_PATTERN.exec(stripEmbedPrefix(pathname ?? ""))?.groups?.["workspaceId"];
 }
 function ensureLeadingSlash(path) {
     return path.startsWith("/") ? path : `/${path}`;
@@ -79,7 +83,7 @@ export function isInternalAppRouteActive(app, ctx, pathname) {
         return false;
     }
     const basePath = normalizePath(getApplicationHref(app, ctx, pathname));
-    const normalizedPathname = normalizePath(pathname);
+    const normalizedPathname = normalizePath(stripEmbedPrefix(pathname));
     return normalizedPathname === basePath || normalizedPathname.startsWith(`${basePath}/`);
 }
 export function getActiveInternalApplication(apps, ctx, pathname) {

package/esm/platformContext/loadPlatformContext.js

@@ -45,6 +45,6 @@ export async function loadPlatformContext(options = {}) {
         whiteLabeling: bootstrap.whiteLabeling,
         pantherTier: bootstrap.pantherTier,
         theme: bootstrap.theme,
-        embeddingMode: "none",
+        embeddingMode: window.location.pathname.startsWith("/embedded/") ? "iframe" : "none",
     };
 }

package/esm/platformContext/types.d.ts

@@ -10,7 +10,7 @@ export interface IPlatformContextErrorResult {
     state: "error";
     error: string;
 }
-type RoutePlatformContextFields = "currentWorkspaceId" | "currentApplicationScope" | "workspacePermissions" | "workspaceSettings" | "settings" | "preferredLocale";
+type RoutePlatformContextFields = "currentWorkspaceId" | "currentApplicationScope" | "workspacePermissions" | "workspaceSettings" | "colorPalette" | "settings" | "preferredLocale";
 export type IRoutePlatformContext = Pick<IPlatformContext, RoutePlatformContextFields>;
 export type IBackendPlatformContext = Omit<IPlatformContext, RoutePlatformContextFields>;
 export type IPlatformContextLoadResult<TContext> = IPlatformContextLoadingResult | IPlatformContextReadyResult<TContext> | IPlatformContextErrorResult;

package/esm/platformContext/useLoadPlatformContext.js

@@ -6,8 +6,11 @@ import { isProduction } from "../lib/isProduction.js";
 import { getApplicationScopeFromPath, getWorkspaceIdFromPath } from "../loader/routing.js";
 import { getBackend } from "./backend.js";
 import { HostApplicationDisabledError, loadPlatformContext, } from "./loadPlatformContext.js";
+import { useWorkspaceColorPalette } from "./useWorkspaceColorPalette.js";
 import { useWorkspacePermissions } from "./useWorkspacePermissions.js";
 import { useWorkspaceSettings } from "./useWorkspaceSettings.js";
+import { useWorkspaceTheme } from "./useWorkspaceTheme.js";
+import { shouldWaitForInjectedApiToken, waitForInjectedApiToken } from "./waitForInjectedApiToken.js";
 function redirectToAppRoot() {
     const rootUrl = new URL("/", window.location.origin).toString();
     window.location.assign(rootUrl);
@@ -28,6 +31,8 @@ export function useLoadPlatformContext() {
     const backend = backendContext.state === "ready" ? getBackend() : undefined;
     const workspacePermissionsState = useWorkspacePermissions(backend, workspaceId);
     const workspaceSettingsState = useWorkspaceSettings(backend, workspaceId);
+    const workspaceColorPaletteState = useWorkspaceColorPalette(backend, workspaceId);
+    const workspaceThemeState = useWorkspaceTheme(backend, workspaceId);
     return useMemo(() => {
         if (backendContext.state !== "ready") {
             return backendContext;
@@ -47,6 +52,11 @@ export function useLoadPlatformContext() {
         }
         const workspacePermissions = workspacePermissionsState.state === "ready" ? workspacePermissionsState.permissions : undefined;
         const workspaceSettings = workspaceSettingsState.state === "ready" ? workspaceSettingsState.settings : undefined;
+        const colorPalette = workspaceColorPaletteState.state === "ready"
+            ? workspaceColorPaletteState.colorPalette
+            : undefined;
+        const workspaceTheme = workspaceThemeState.state === "ready" ? workspaceThemeState.theme : undefined;
+        const effectiveTheme = workspaceTheme ?? backendContext.ctx.theme;
         const settings = workspaceSettings ?? backendContext.ctx.userSettings;
         const preferredLocale = isLocale(settings.locale) ? settings.locale : undefined;
         const routeCtx = {
@@ -54,11 +64,20 @@ export function useLoadPlatformContext() {
             currentWorkspaceId: workspaceId,
             workspacePermissions,
             workspaceSettings,
+            colorPalette,
             settings,
             preferredLocale,
         };
-        return { state: "ready", ctx: { ...backendContext.ctx, ...routeCtx } };
-    }, [backendContext, applicationScope, workspaceId, workspacePermissionsState, workspaceSettingsState]);
+        return { state: "ready", ctx: { ...backendContext.ctx, ...routeCtx, theme: effectiveTheme } };
+    }, [
+        backendContext,
+        applicationScope,
+        workspaceId,
+        workspacePermissionsState,
+        workspaceSettingsState,
+        workspaceColorPaletteState,
+        workspaceThemeState,
+    ]);
 }
 class BackendPlatformContextProviderClass {
     _loadingStateMemo = { state: "loading" };
@@ -87,6 +106,9 @@ class BackendPlatformContextProviderClass {
         }
         this._abortController = new AbortController();
         try {
+            if (shouldWaitForInjectedApiToken()) {
+                await waitForInjectedApiToken(this._abortController.signal);
+            }
             const ctx = await loadPlatformContext({
                 signal: this._abortController.signal,
                 callbacks: this._callbacks,

package/esm/platformContext/useWorkspaceColorPalette.d.ts

@@ -0,0 +1,17 @@
+import { type IAnalyticalBackend } from "@gooddata/sdk-backend-spi";
+import { type IColorPalette } from "@gooddata/sdk-model";
+type WorkspaceColorPaletteState = {
+    state: "idle";
+} | {
+    state: "loading";
+} | {
+    state: "ready";
+    colorPalette: IColorPalette | undefined;
+} | {
+    state: "forbidden";
+} | {
+    state: "error";
+    error: string;
+};
+export declare function useWorkspaceColorPalette(backend: IAnalyticalBackend | undefined, workspaceId: string | undefined): WorkspaceColorPaletteState;
+export {};

package/esm/platformContext/useWorkspaceColorPalette.js

@@ -0,0 +1,37 @@
+// (C) 2026 GoodData Corporation
+import { useEffect, useState } from "react";
+import { UnexpectedResponseError } from "@gooddata/sdk-backend-spi";
+export function useWorkspaceColorPalette(backend, workspaceId) {
+    const [paletteState, setPaletteState] = useState({ state: "idle" });
+    useEffect(() => {
+        if (!backend || !workspaceId) {
+            setPaletteState((prev) => (prev.state === "idle" ? prev : { state: "idle" }));
+            return;
+        }
+        let cancelled = false;
+        setPaletteState({ state: "loading" });
+        backend
+            .workspace(workspaceId)
+            .styling()
+            .getColorPalette()
+            .then((colorPalette) => {
+            if (!cancelled) {
+                setPaletteState({ state: "ready", colorPalette });
+            }
+        })
+            .catch((e) => {
+            if (cancelled)
+                return;
+            if (e instanceof UnexpectedResponseError && (e.httpStatus === 403 || e.httpStatus === 404)) {
+                setPaletteState({ state: "forbidden" });
+                return;
+            }
+            const error = e instanceof Error ? e.message : "Unknown error loading workspace color palette.";
+            setPaletteState({ state: "error", error });
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [backend, workspaceId]);
+    return paletteState;
+}

package/esm/platformContext/useWorkspaceTheme.d.ts

@@ -0,0 +1,17 @@
+import { type IAnalyticalBackend } from "@gooddata/sdk-backend-spi";
+import { type ITheme } from "@gooddata/sdk-model";
+type WorkspaceThemeState = {
+    state: "idle";
+} | {
+    state: "loading";
+} | {
+    state: "ready";
+    theme: ITheme | undefined;
+} | {
+    state: "forbidden";
+} | {
+    state: "error";
+    error: string;
+};
+export declare function useWorkspaceTheme(backend: IAnalyticalBackend | undefined, workspaceId: string | undefined): WorkspaceThemeState;
+export {};

package/esm/platformContext/useWorkspaceTheme.js

@@ -0,0 +1,37 @@
+// (C) 2026 GoodData Corporation
+import { useEffect, useState } from "react";
+import { UnexpectedResponseError } from "@gooddata/sdk-backend-spi";
+export function useWorkspaceTheme(backend, workspaceId) {
+    const [themeState, setThemeState] = useState({ state: "idle" });
+    useEffect(() => {
+        if (!backend || !workspaceId) {
+            setThemeState((prev) => (prev.state === "idle" ? prev : { state: "idle" }));
+            return;
+        }
+        let cancelled = false;
+        setThemeState({ state: "loading" });
+        backend
+            .workspace(workspaceId)
+            .styling()
+            .getTheme()
+            .then((theme) => {
+            if (!cancelled) {
+                setThemeState({ state: "ready", theme });
+            }
+        })
+            .catch((e) => {
+            if (cancelled)
+                return;
+            if (e instanceof UnexpectedResponseError && (e.httpStatus === 403 || e.httpStatus === 404)) {
+                setThemeState({ state: "forbidden" });
+                return;
+            }
+            const error = e instanceof Error ? e.message : "Unknown error loading workspace theme.";
+            setThemeState({ state: "error", error });
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [backend, workspaceId]);
+    return themeState;
+}

package/esm/platformContext/waitForInjectedApiToken.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Tells the host whether the iframe URL asks for postMessage-based auth injection.
+ *
+ * When this returns true, the host MUST defer `backend.bootstrap()` until a
+ * `SetApiToken` postMessage from the parent has been applied via `setApiToken`
+ * / `setJwt`. The flag may live in either `window.location.search` (modern
+ * pluggable URLs) or in the hash query (legacy AD iframe URLs).
+ */
+export declare function shouldWaitForInjectedApiToken(): boolean;
+/**
+ * Performs the pre-bootstrap auth handshake AD has historically owned, but
+ * lifted to the host so that pluggable AD can keep the customer-side wire
+ * contract unchanged.
+ *
+ * Sequence:
+ *   1. Configure messagingUtils to accept only `SetApiToken` from the
+ *      "analyticalDesigner" product.
+ *   2. Register a one-shot listener for that command.
+ *   3. Emit `listeningForApiToken` to the parent frame.
+ *   4. Await the parent's `SetApiToken`, apply it to the host backend, then
+ *      tear the listener down so AD can register its full command set when it
+ *      mounts.
+ *
+ * Resolves once a valid token has been applied. Rejects if `signal` aborts.
+ */
+export declare function waitForInjectedApiToken(signal?: AbortSignal): Promise<void>;

package/esm/platformContext/waitForInjectedApiToken.js

@@ -0,0 +1,104 @@
+// (C) 2026 GoodData Corporation
+import { GdcAdCommandType as GdcAdCommandTypeValues, GdcAdEventType, GdcProductName, isAdSetApiTokenCommandData, } from "@gooddata/sdk-embedding";
+import { messagingUtils } from "@gooddata/sdk-embedding/internal";
+import { setApiToken, setJwt } from "./backend.js";
+const API_TOKEN_AUTHENTICATION_PARAM = "apiTokenAuthentication";
+const EMBEDDED_PATH_PREFIX = "/embedded/";
+function hasFlagInQuery(query) {
+    return new URLSearchParams(query).get(API_TOKEN_AUTHENTICATION_PARAM) === "true";
+}
+// Extracts the query portion from a hash like "#/<route>?<query>". Standalone AD
+// uses hash-based routing and the legacy iframe URL keeps the flag inside the
+// hash, so the host has to look there as well as in `window.location.search`.
+function getHashQuery(hash) {
+    const idx = hash.indexOf("?");
+    return idx >= 0 ? hash.slice(idx + 1) : "";
+}
+/**
+ * Tells the host whether the iframe URL asks for postMessage-based auth injection.
+ *
+ * When this returns true, the host MUST defer `backend.bootstrap()` until a
+ * `SetApiToken` postMessage from the parent has been applied via `setApiToken`
+ * / `setJwt`. The flag may live in either `window.location.search` (modern
+ * pluggable URLs) or in the hash query (legacy AD iframe URLs).
+ */
+export function shouldWaitForInjectedApiToken() {
+    if (!window.location.pathname.startsWith(EMBEDDED_PATH_PREFIX)) {
+        return false;
+    }
+    return (hasFlagInQuery(window.location.search.replace(/^\?/, "")) ||
+        hasFlagInQuery(getHashQuery(window.location.hash)));
+}
+/**
+ * Performs the pre-bootstrap auth handshake AD has historically owned, but
+ * lifted to the host so that pluggable AD can keep the customer-side wire
+ * contract unchanged.
+ *
+ * Sequence:
+ *   1. Configure messagingUtils to accept only `SetApiToken` from the
+ *      "analyticalDesigner" product.
+ *   2. Register a one-shot listener for that command.
+ *   3. Emit `listeningForApiToken` to the parent frame.
+ *   4. Await the parent's `SetApiToken`, apply it to the host backend, then
+ *      tear the listener down so AD can register its full command set when it
+ *      mounts.
+ *
+ * Resolves once a valid token has been applied. Rejects if `signal` aborts.
+ */
+export async function waitForInjectedApiToken(signal) {
+    return new Promise((resolve, reject) => {
+        let listener;
+        const cleanup = () => {
+            if (listener) {
+                messagingUtils.removeListener(listener);
+                listener = undefined;
+            }
+            signal?.removeEventListener("abort", onAbort);
+        };
+        const onAbort = () => {
+            cleanup();
+            reject(new DOMException("Aborted", "AbortError"));
+        };
+        if (signal?.aborted) {
+            onAbort();
+            return;
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+        listener = (command) => {
+            if (!isAdSetApiTokenCommandData(command.data)) {
+                return false;
+            }
+            const payload = command.data.gdc.event.data;
+            if (!payload) {
+                return false;
+            }
+            const token = payload.token;
+            const tokenType = payload.type ?? "gooddata";
+            if (typeof token !== "string" || token.length === 0) {
+                return false;
+            }
+            if (tokenType === "jwt" && !/^[\w-]+\.[\w-]+\.[\w-]+$/.test(token)) {
+                return false;
+            }
+            try {
+                if (tokenType === "jwt") {
+                    setJwt(token, payload.secondsBeforeTokenExpirationToEmitReminder ?? 60);
+                }
+                else {
+                    setApiToken(token);
+                }
+            }
+            catch (e) {
+                cleanup();
+                reject(e);
+                return true;
+            }
+            cleanup();
+            resolve();
+            return true;
+        };
+        messagingUtils.setConfig(GdcProductName.ANALYTICAL_DESIGNER, [GdcAdCommandTypeValues.SetApiToken]);
+        messagingUtils.addListener(listener);
+        messagingUtils.postEvent(GdcProductName.ANALYTICAL_DESIGNER, GdcAdEventType.ListeningForApiToken, {});
+    });
+}

package/esm/ui/HostChrome.js

@@ -106,10 +106,11 @@ export function HostChrome({ ctx, resolvedApplications, pathname, onNavigate, on
     const headerColor = ctx.theme?.header?.backgroundColor ?? defaultHeaderTheme.backgroundColor;
     const headerTextColor = ctx.theme?.header?.color ?? defaultHeaderTheme.color;
     const activeColor = ctx.theme?.header?.activeColor ?? defaultHeaderTheme.activeColor;
-    return (_jsx(HostIntlProvider, { locale: locale, additionalMessages: appMessages, children: _jsx(BackendProvider, { backend: getBackend(), children: _jsx(ToastsCenterContextProvider, { children: _jsxs("div", { className: b(), children: [
-                        _jsx("div", { className: e("header"), onMouseOver: handleHeaderMouseOver, children: _jsx(AppHeader, { logoUrl: ctx.whiteLabeling?.logoUrl || defaultLogoUrl, logoHref: "/organization" // switch the host scope to organization, the first org app will be chosen
+    const isEmbedded = ctx.embeddingMode === "iframe";
+    return (_jsx(HostIntlProvider, { locale: locale, additionalMessages: appMessages, children: _jsx(BackendProvider, { backend: getBackend(), children: _jsx(ToastsCenterContextProvider, { children: _jsxs("div", { className: b(), children: [isEmbedded ? null : (_jsx("div", { className: e("header"), onMouseOver: handleHeaderMouseOver, children: _jsx(AppHeader, { logoUrl: ctx.whiteLabeling?.logoUrl || defaultLogoUrl, logoHref: "/organization" // switch the host scope to organization, the first org app will be chosen
                                 , logoTitle: logoTitle, headerColor: headerColor, headerTextColor: headerTextColor, activeColor: activeColor, userName: userName, organizationName: ctx.organization?.title, isAccessibilityCompliant: true, workspacePicker: workspacePicker, menuItemsGroups: menuItemsGroups, helpMenuItems: helpMenuItems, accountMenuItems: accountMenuItems, onMenuItemClick: handleMenuItemClick, showUpsellButton: pricing.isTrial, onUpsellButtonClick: pricing.onUpsellButtonClick, expiredDate: pricing.isTrial ? pricing.expiredDate : undefined, search: search.element, showChatItem: chat.showChatItem, onChatItemClick: chat.open, notificationsPanel: ctx.userSettings.enableInPlatformNotifications
-                                    ? ({ isMobile, closeNotificationsOverlay }) => (_jsx(AppHeaderNotifications, { locale: locale, isMobile: isMobile, closeNotificationsOverlay: closeNotificationsOverlay, useAsOfDateParam: ctx.userSettings.enableExecutionTimestamp ?? false, enableExportToDocumentStorage: ctx.userSettings.enableExportToDocumentStorage ?? false }))
-                                    : undefined }) }), _jsx("main", { className: e("content"), children: children }), chat.element, pricing.element, _jsx(HostNotificationDispatcher, { notification: notification })
+                                    ? ({ isMobile, closeNotificationsOverlay }) => (_jsx(AppHeaderNotifications, { locale: locale, isMobile: isMobile, closeNotificationsOverlay: closeNotificationsOverlay, useAsOfDateParam: ctx.userSettings.enableExecutionTimestamp ?? false, enableExportToDocumentStorage: ctx.userSettings.enableExportToDocumentStorage ??
+                                            false }))
+                                    : undefined }) })), _jsx("main", { className: e("content"), children: children }), chat.element, pricing.element, _jsx(HostNotificationDispatcher, { notification: notification })
                     ] }) }) }) }));
 }

package/esm/ui/PluggableApplicationRenderer.js

@@ -17,7 +17,8 @@ export function PluggableApplicationRenderer({ app, ctx, pathname, onHeaderChang
     const containerRef = useRef(null);
     const mountHandleRef = useRef(undefined);
     const [viewState, setViewState] = useState({ state: "loading" });
-    const appBasePath = getApplicationHref(app, ctx, pathname);
+    const baseHref = getApplicationHref(app, ctx, pathname);
+    const appBasePath = ctx.embeddingMode === "iframe" ? `/embedded${baseHref}` : baseHref;
     const lifecycle = getAppLifecycleCallbacks();
     const onTelemetryEvent = useMemo(() => lifecycle?.createTelemetryCallbacks?.(app.id), [lifecycle, app.id]);
     // onEvent is intentionally stable (empty deps) — pluggable apps capture it at mount time

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gooddata/sdk-ui-pluggable-host",
-  "version": "11.40.0-alpha.3",
+  "version": "11.40.0-alpha.4",
   "description": "GoodData SDK runtime for hosting pluggable applications — registry, loader, routing, platform context, default UI chrome",
   "license": "MIT",
   "author": "GoodData Corporation",
@@ -29,19 +29,20 @@
   "dependencies": {
     "@module-federation/runtime": "2.3.1",
     "lodash-es": "^4.17.23",
-    "@gooddata/sdk-backend-base": "11.40.0-alpha.3",
-    "@gooddata/sdk-backend-spi": "11.40.0-alpha.3",
-    "@gooddata/sdk-backend-tiger": "11.40.0-alpha.3",
-    "@gooddata/sdk-model": "11.40.0-alpha.3",
-    "@gooddata/sdk-pluggable-application-model": "11.40.0-alpha.3",
-    "@gooddata/sdk-ui-application-header": "11.40.0-alpha.3",
-    "@gooddata/sdk-ui": "11.40.0-alpha.3",
-    "@gooddata/sdk-ui-ext": "11.40.0-alpha.3",
-    "@gooddata/sdk-ui-gen-ai": "11.40.0-alpha.3",
-    "@gooddata/sdk-ui-kit": "11.40.0-alpha.3",
-    "@gooddata/sdk-ui-semantic-search": "11.40.0-alpha.3",
-    "@gooddata/sdk-ui-theme-provider": "11.40.0-alpha.3",
-    "@gooddata/util": "11.40.0-alpha.3"
+    "@gooddata/sdk-backend-base": "11.40.0-alpha.4",
+    "@gooddata/sdk-backend-spi": "11.40.0-alpha.4",
+    "@gooddata/sdk-backend-tiger": "11.40.0-alpha.4",
+    "@gooddata/sdk-embedding": "11.40.0-alpha.4",
+    "@gooddata/sdk-model": "11.40.0-alpha.4",
+    "@gooddata/sdk-pluggable-application-model": "11.40.0-alpha.4",
+    "@gooddata/sdk-ui": "11.40.0-alpha.4",
+    "@gooddata/sdk-ui-application-header": "11.40.0-alpha.4",
+    "@gooddata/sdk-ui-ext": "11.40.0-alpha.4",
+    "@gooddata/sdk-ui-gen-ai": "11.40.0-alpha.4",
+    "@gooddata/sdk-ui-kit": "11.40.0-alpha.4",
+    "@gooddata/sdk-ui-semantic-search": "11.40.0-alpha.4",
+    "@gooddata/sdk-ui-theme-provider": "11.40.0-alpha.4",
+    "@gooddata/util": "11.40.0-alpha.4"
   },
   "devDependencies": {
     "@microsoft/api-documenter": "^7.17.0",
@@ -55,7 +56,7 @@
     "@typescript-eslint/eslint-plugin": "8.58.0",
     "@typescript-eslint/parser": "8.58.0",
     "@typescript/native-preview": "7.0.0-dev.20260202.1",
-    "@vitest/coverage-v8": "4.1.0",
+    "@vitest/coverage-v8": "4.1.8",
     "@vitest/eslint-plugin": "1.6.6",
     "eslint": "^9.39.2",
     "eslint-import-resolver-typescript": "4.4.4",
@@ -70,22 +71,22 @@
     "happy-dom": "18.0.1",
     "jiti": "2.6.1",
     "npm-run-all": "^4.1.5",
-    "oxfmt": "0.45.0",
-    "oxlint": "^1.43.0",
-    "oxlint-tsgolint": "0.11.4",
+    "oxfmt": "0.52.0",
+    "oxlint": "1.51.0",
+    "oxlint-tsgolint": "0.15.0",
     "react": "19.1.1",
     "react-dom": "19.1.1",
     "react-intl": "7.1.11",
     "react-router": "7.13.1",
-    "rolldown": "1.0.0-rc.9",
+    "rolldown": "1.0.3",
     "sass": "1.70.0",
     "tslib": "2.8.1",
     "typescript": "5.9.3",
-    "vite": "8.0.0",
-    "vitest": "4.1.0",
+    "vite": "8.0.16",
+    "vitest": "4.1.8",
     "vitest-dom": "0.1.1",
-    "@gooddata/eslint-config": "11.40.0-alpha.3",
-    "@gooddata/oxlint-config": "11.40.0-alpha.3"
+    "@gooddata/eslint-config": "11.40.0-alpha.4",
+    "@gooddata/oxlint-config": "11.40.0-alpha.4"
   },
   "peerDependencies": {
     "react": ">=18.3.1",