chore(deps): update non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@kong/kongponents (source)	9.56.1 → 9.57.0			dependencies	minor
axios (source)	1.16.1 → 1.17.0			dependencies	minor
axios (source)	1.16.1 → 1.17.0			resolutions	minor
instantsearch.css	8.16.2 → 8.17.0			dependencies	minor
liquid-c (source)	4.0.1 → 4.2.0				minor
ruby (source)	3.4.4 → 3.4.9				patch
semver	7.8.1 → 7.8.2			dependencies	patch
shiki (source)	4.1.0 → 4.2.0			dependencies	minor
undici (source)	7.27.0 → 7.27.2			dependencies	patch
vite (source)	8.0.15 → 8.0.16			devDependencies	patch
vue-instantsearch	4.26.5 → 4.26.7			dependencies	patch
yarn (source)	4.15.0 → 4.16.0			packageManager	minor

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Kong/kongponents (@​kong/kongponents)

v9.57.0

Compare Source

Features

• kpop: implement popover delay prop (#​3224) (1e78f6f)

9.56.2 (2026-06-02)

Bug Fixes

• tokens: enforce token css var usage (#​3223) (616f1cd)

9.56.1 (2026-05-28)

Bug Fixes

• project: pnpm audit blockage (#​3221) (49bd0c1)

v9.56.2

Compare Source

Bug Fixes

• tokens: enforce token css var usage (#​3223) (616f1cd)

axios/axios (axios)

v1.17.0

Compare Source

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

• Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#​10901, #​10922)
• Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#​10926)

🚀 New Features

• HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#​6792, #​10920)

🐛 Bug Fixes

• Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#​10929, #​10896)
• Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#​10957)
• React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#​10898)
• Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#​10875)
• Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#​10812)
• Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#​10891)
• Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#​10956, #​10952)
• Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#​10931)

🔧 Maintenance & Chores

• HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#​10861)
• Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#​10939)
• CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#​10907, #​10911, #​10916, #​10927, #​10935, #​10983)
• Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#​10925, #​10914, #​10958)
• Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#​10890, #​10889, #​10921, #​10945, #​10905, #​10933, #​10915, #​10887, #​10955)
• Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#​10871, #​10879, #​10918, #​10919, #​10934, #​10947, #​10954, #​10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​BasixKOR (#​6792)
• @​carladams1299-lab (#​10861)
• @​LaplaceYoung (#​10812)
• @​JamieMagee (#​10939)
• @​RonGamzu (#​10905)
• @​sapirbaruch (#​10891)
• @​nezukoagent (#​10901)
• @​devareddy05 (#​10929)
• @​Mohammad-Faiz-Cloud-Engineer (#​10922)
• @​azandabot (#​10931)
• @​niksy (#​10896)

Full Changelog

algolia/instantsearch (instantsearch.css)

v8.17.0

Compare Source

Features

• chat: split chat trigger widget (#​6966) (379084c)

npm/node-semver (semver)

v7.8.2

Compare Source

Bug Fixes

• bea6028 #​870 increment dotted prerelease identifiers (#​870) (@​liuzemei, @​SheldonNeo)

shikijs/shiki (shiki)

v4.2.0

Compare Source

   🚀 Features

• Add @​shikijs/stream and @​shikijs/magic-move packages  -  by @​antfu in #​1283 (d031f)

   🐞 Bug Fixes

• transformers: Handle YAML comment prefixes correctly for v3  -  by @​AkaHarshit in #​1266 (f694a)
• vitepress-twoslash: Scroll blocking on mobile viewports  -  by @​micaiguai in #​1262 (9e0e8)

    View changes on GitHub

nodejs/undici (undici)

v7.27.2

Compare Source

v7.27.1

Compare Source

What's Changed

• fix: preserve raw headers in dispatch handler bridge by @​mcollina in #​5345

Full Changelog: nodejs/undici@v7.27.0...v7.27.1

vitejs/vite (vite)

v8.0.16

Compare Source

Bug Fixes

• deps: reject UNC paths for launch-editor-middleware (#​22571) (50b9512)
• reject windows alternate paths (#​22572) (dc245c7)

yarnpkg/berry (yarn)

v4.16.0: v4.16.0

Compare Source

What's Changed

• PnP: Include Node 22.22.3 in fstat workaround by @​junjuny0227 in #​7141
• Implements yarn npm stage by @​arcanis in #​7147
• fix: Stop using EBADF workaround for Node 24.16.0+ by @​MJDSys in #​7152
• Bumps eslint-plugin-arca by @​arcanis in #​7163
• Enables staged publishing by @​arcanis in #​7164
• feat: Add editor SDK support for oxc (oxfmt & oxlint) by @​slainless in #​7078
• docs: fix npmMinimalAgeGate default value. by @​ryanfox1985 in #​7125

New Contributors

• @​junjuny0227 made their first contribution in #​7141
• @​MJDSys made their first contribution in #​7152
• @​slainless made their first contribution in #​7078
• @​ryanfox1985 made their first contribution in #​7125

Full Changelog: https://github.com/yarnpkg/berry/compare/@yarnpkg/cli/4.15.0...@​yarnpkg/cli/4.16.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for kongdeveloper ready!

Name	Link
🔨 Latest commit	c1e356e
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/6a23fb4523aa6c0008ba80b2
😎 Deploy Preview	https://deploy-preview-5484--kongdeveloper.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.