fix(deps): update all non-major dependencies#2592
Open
renovate-bot wants to merge 1 commit into
Open
Conversation
forking-renovate
Bot
added
📦 dependencies
renovate-bot
added
📦 dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2592 +/- ##
=======================================
Coverage 100.0% 100.0%
=======================================
Files 199 199
Lines 25168 25168
Branches 8908 8908
=======================================
Hits 25168 25168
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
angular-slickgrid
aurelia-slickgrid
slickgrid-react
slickgrid-vue
@slickgrid-universal/angular-row-detail-plugin
@slickgrid-universal/aurelia-row-detail-plugin
@slickgrid-universal/react-row-detail-plugin
@slickgrid-universal/vue-row-detail-plugin
@slickgrid-universal/binding
@slickgrid-universal/common
@slickgrid-universal/composite-editor-component
@slickgrid-universal/custom-footer-component
@slickgrid-universal/custom-tooltip-plugin
@slickgrid-universal/empty-warning-component
@slickgrid-universal/event-pub-sub
@slickgrid-universal/excel-export
@slickgrid-universal/graphql
@slickgrid-universal/odata
@slickgrid-universal/pagination-component
@slickgrid-universal/pdf-export
@slickgrid-universal/row-detail-view-plugin
@slickgrid-universal/rxjs-observable
@slickgrid-universal/sql
@slickgrid-universal/text-export
@slickgrid-universal/utils
@slickgrid-universal/vanilla-bundle
@slickgrid-universal/vanilla-force-bundle
commit: |
renovate-bot
force-pushed
the
renovate/all-minor-patch
branch
from
38d0f54 to
f114847
Compare
renovate-bot
changed the title
renovate-bot
force-pushed
the
renovate/all-minor-patch
branch
12 times, most recently
from
70e84aa to
d01099d
Compare
renovate-bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
0319f9a to
1e6d25a
Compare
renovate-bot
force-pushed
the
renovate/all-minor-patch
branch
from
1e6d25a to
69336cf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^7.29.0→^7.29.7^5.0.0→^5.0.1^9.73.8→^9.74.1^2.0.326→^2.0.328^2.0.2→^2.0.4^5.2.1→^5.2.2^5.2.1→^5.2.2^5.2.1→^5.2.2^19.2.14→^19.2.15^6.0.1→^6.0.2^6.0.6→^6.0.7^5.0.0-beta.2→^5.0.0-beta.3^5.0.0-beta.2→^5.0.0-beta.3^3.2.9→^3.3.2^15.15.0→^15.16.0^3.4.3→^3.4.7^5.0.0→^5.0.1^2.76.0→^2.84.0^0.8.2→^0.8.3^4.12.18→^4.12.23^1.65.0→^1.67.0^8.5.14→^8.5.15^1.99.0→^1.100.0^8.0.13→^8.0.14^5.0.0→^5.0.1^5.0.0-beta.2→^5.0.0-beta.3^3.5.34→^3.5.35^5.0.7→^5.1.0^3.2.9→^3.3.2Release Notes
babel/babel (@babel/plugin-proposal-decorators)
v7.29.7Compare Source
v7.29.7 (2026-05-25)
Re-release all packages with npm provenance attestations
ghiscoding/excel-builder-vanilla (@excel-builder-vanilla/types)
v5.0.1Compare Source
Bug Fixes
microsoft/fluentui (@fluentui/react-components)
v9.74.1Compare Source
v9.74.0: @fluentui/react-components v9.74.0Compare Source
Minor changes
Patches
microsoft/fluentui-system-icons (@fluentui/react-icons)
v2.0.328Compare Source
v2.0.327Compare Source
honojs/node-server (@hono/node-server)
v2.0.4Compare Source
What's Changed
Full Changelog: honojs/node-server@v2.0.3...v2.0.4
v2.0.3Compare Source
What's Changed
ServeStaticOptionscomment with the current spec by @kakkokari-gtyih in #356New Contributors
Full Changelog: honojs/node-server@v2.0.2...v2.0.3
lerna-lite/lerna-lite (@lerna-lite/cli)
v5.2.2Compare Source
Note: Version bump only for package @lerna-lite/cli
lerna-lite/lerna-lite (@lerna-lite/publish)
v5.2.2Compare Source
Bug Fixes
columnifywith native implementation (#1330) (1887f43) - by @ghiscodinglerna-lite/lerna-lite (@lerna-lite/watch)
v5.2.2Compare Source
Note: Version bump only for package @lerna-lite/watch
vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.0.2Compare Source
Allow all options in reactCompilerPreset (#1189)
This is a type only change. Only
compilationModeandtargetoptions were available forreactCompilerPreset.vitejs/vite-plugin-vue (@vitejs/plugin-vue)
v6.0.7Features
@rolldown/pluginutilsversion (#776) (941b651)Bug Fixes
vitest-dev/vitest (@vitest/coverage-v8)
v5.0.0-beta.3Compare Source
🚨 Breaking Changes
expect.pollwhen function didn't resolve in time - by @hi-ogawa and Codex in #10233 (4df04)🚀 Features
kindinpage.mark- by @AriPerkkio in #10302 (053e8)context.markfor custom command tracing - by @AriPerkkio in #10329 (aa514)🐞 Bug Fixes
attachmentsDirroot only config - by @hi-ogawa and Codex in #10334 (fab1b)__esModule- by @hi-ogawa in #10363 (2b135)wrapDynamicImporttransform on ssr environment - by @hi-ogawa in #10355 (d3c96)FORCE_COLORover agent detection - by @dokson in #10272 (7e66b)excludeto not inherit negation globs fromtest.include- by @AriPerkkio in #10299 (28685)toNotFake- by @BPScott, @hi-ogawa and Codex in #10043 (bbf2f)summaryto intercept logger's streams even when they are notprocess.std*streams - by @AriPerkkio in #10340 (f79e7)testModulesinonTestRunEndwhen merging blobs from different root directory test runs - by @hi-ogawa and Codex in #10348 (745b3)🏎 Performance
View changes on GitHub
vuejs/language-tools (@vue/language-core)
v3.3.2Compare Source
language-core
v-forsources (#6067) - Thanks to @kkesidis!v-bindshorthand identifier skipping with interpolation - Thanks to @KazariEX!vscode
v3.3.1Compare Source
language-core
language-service
typescript-plugin
vscode
v3.3.0Compare Source
language-core
v-ifbranch fragments when collecting single root nodes - Thanks to @KazariEX!SfcAPIs toIR- Thanks to @KazariEX!language-service
html.customData(#5910) - Thanks to @Bomberus!=""only for plain boolean props completion edits - Thanks to @KazariEX!typescript-plugin
vscode
extraFileExtensionsin tsserverconfigurerequest payload (#6048) - Thanks to @KazariEX!cypress-io/cypress (cypress)
v15.16.0Compare Source
Changelog: https://docs.cypress.io/app/references/changelog#15-16-0
cure53/DOMPurify (dompurify)
v3.4.7Compare Source
v3.4.6: DOMPurify 3.4.6Compare Source
IN_PLACEmode, thanks @offset & @BankdeIN_PLACEand Shadow DOM sanitization, thanks @offset & @BankdeIN_PLACEand general DOM Clobbering attacksv3.4.5Compare Source
v3.4.4: DOMPurify 3.4.4Compare Source
selectedcontentelement to default allow-list, thanks @lukewarlowcommandandcommandforattributes to default allowed-list, thanks @lukewarlowIN_PLACEoperations, thanks @DEMON1Aghiscoding/excel-builder-vanilla (excel-builder-vanilla)
v5.0.1Compare Source
Note: Version bump only for package excel-builder-vanilla
fallow-rs/fallow (fallow)
v2.84.0Compare Source
Fixed
@sanity/pkg-utilsbuild configs no longer report as unused. Projects built with@sanity/pkg-utilskeep theirpackage.config.{ts,js,mts,mjs,cts,cjs}andpackage.bundle.{ts,js,mts,mjs,cts,cjs}build configs reachable automatically, at the repo root and in every workspace package. The tool discovers these files by filename rather than importing them from source, so previously each one surfaced as anunused-fileand had to be listed manually inentry. A newpkg-utilsplugin (activated only by an exact@sanity/pkg-utilsdependency, so plain@sanity/clientconsumers are unaffected) marks them always-used and credits@sanity/pkg-utilsas a tooling dependency. pkg-utils monorepos can now drop thepackage.config.ts/package.bundle.tslines from theirentryconfig.v2.83.0Compare Source
Added
GitHub Action artifacts can now be written outside the workspace root. The action now accepts
artifacts-dir, a workspace-relative directory for generated files such asfallow-results.json,fallow-results.sarif,fallow-stderr.log, andfallow-analysis-args.sh. Before, those files always appeared at the repository root and could be picked up by later formatter or linter steps. After, workflows can use a generated directory such as.var/fallow, whileoutputs.resultsandoutputs.sarifcontinue to expose the resolved paths for downstream steps. Thanks @Guria for the report. (Closes #735.)Runtime coverage now uses a cross-surface function identity to join evidence and key baselines. Fallow adopts the
fallow-cov-protocolv2FunctionIdentity(afallow:fn:<hash>join key derived from file, name, and start line). The static inventory uploaded byfallow coverage upload-inventoryand the sidecar request now carry this identity;fallow coverage analyze --cloudand runtime-coverage ingestion prefer it over(path, name, line)when joining runtime evidence to local analysis; and runtime-coverage JSON exposes astable_idfield on findings, hot paths, blast-radius, and importance entries (alongside the existing per-findingid). The same function shares ONEstable_idacross findings, hot paths, blast-radius, and importance entries (the per-findingiduses a per-surface salt and differs), and across V8, Istanbul, and oxc producers (columns are excluded from the hash). The identity hash is computed over the repo-relative path, so--path-prefix(used for containerized runtime paths) does not affect the join. Old coverage artifacts without an identity continue to work via the existing path/name/line fallback, andfallow ... --explaindocuments the fallback order plus the suppression-key vs join-key distinction. Baselines preferstable_idwhen present and the grace-window reader accepts both the newfallow:fn:and the legacyfallow:prod:keys, so existing baselines keep suppressing. Like the legacyid,stable_idhashes the function's start line, so a function that moves to a different line gets a new key under either; the value ofstable_idis cross-surface and cross-producer joinability, not line-move immunity (the newsource_hashcontent digest provides line-move-tolerant matching separately, see below). (Closes #506.)Runtime-coverage baselines now survive line moves. Each function identity can carry an optional
source_hash: a content digest of the function body that excludes position, so a function that moves to a different line but is otherwise unedited keeps the samesource_hash. The static analyzer computes it during extraction, thefallow-covsidecar carries it through from the uploaded static index, and runtime-coverage baselines match on(file, name, source_hash)in addition tostable_idand the legacyfallow:prod:id. A baselined finding therefore stays suppressed across a pure line shift, while editing the function body re-surfaces it for review. Findings with nosource_hashfall back to the existing keys, so behavior is unchanged where it is absent. (Closes #742.)Nuxt components referenced only by template tag are now tracked in the module graph. Frameworks like Nuxt expose components to templates by filesystem convention (
<Card001 />resolving tocomponents/Card001.vue) with noimportstatement, so fallow previously kept whole convention directories alive as entry points and could never report a genuinely-unreferenced component as unused. A new first-classauto_importsplugin capability now synthesizes a real graph edge from each<Card001 />-style template tag to its component file, covering Nuxt's directory-prefixed PascalCase naming (components/base/Button.vueto<BaseButton>), the implicit<Lazy...>variant, and.client/.server/.globalpaired files. By default this is additive: components stay registered as entry points (no newunused-filereports) while their default export is credited when consumed via a tag under--include-entry-exports. Opt into the newautoImports: trueconfig field to drop the Nuxt component entry patterns so a genuinely-unreferenced component is reported asunused-file; the flag is conservative (acomponents:key innuxt.configkeeps the entry patterns, since customprefix/pathPrefix/dirsare not yet modeled) and stays off by default. Composable, util, and Pinia store auto-imports are tracked separately (#739, #740). Thanks @Hal-Spidernight for the detailed proposal. (Closes #704.)Public Fallow config corpus tooling makes recurring workaround mining repeatable. Maintainers can now run
scripts/public-config-corpus.pyto search public.fallowrc.json,.fallowrc.jsonc, andfallow.tomlfiles withgh, cache pinned config snapshots under.fallow/public-config-corpus/, and write a deterministic markdown report plus manifest. The manifest records repo/path identity, blob URL, raw URL, blob SHA, URL ref fallback, byte count,sha256, parse status, search query, cap, fetch time,ghversion, and fetch failures, so a report can be reviewed instead of trusted as an ad hoc scrape.docs/public-config-corpus.mddocuments the maintainer workflow, privacy boundaries, and the first seeded public-config research pass that led to #546, #586, #588, #589, #590, #600, #601, and #602. The fixture harnessscripts/test-public-config-corpus.shverifies deterministic offline output without GitHub access. (Closes #603.)Fixed
tsdown
.mtsand.ctsconfig files are now treated as entry points. Before, projects usingtsdown.config.mtsortsdown.config.ctscould see the config file reported as unused even though tsdown loads those extensions. After, the tsdown plugin recognizes the same config extension family as neighboring bundler plugins, keeps those config files alive, and still extracts theirentryarrays as source entry points. Thanks @eojoel for the report. (Closes #744.)Expected unresolved import specifiers can now be ignored from config. Before, generated or runtime-provided imports such as
@example/icons,@example/icons/metadata, or../generated/clientrequired line comments becauseignoreDependenciesintentionally does not apply tounresolved-import. After,ignoreUnresolvedImportsaccepts raw import-specifier glob patterns, validates glob syntax without filesystem traversal checks, and suppresses only matchingunresolved-importfindings. Exact specifiers and subpath globs stay explicit (["@​example/icons", "@​example/icons/**"]), and JSON actions now suggest adding the reported specifier to this config field. Thanks @OmerGronich for the report. (Closes #726.)fallow auditno longer emits spurious Nuxt/Astro prerequisite warnings on its base pass. Before, the audit base worktree was created withgit worktree add --detach, which omits the gitignored.nuxt/and.astro/generated directories, so meta-framework projects sawmissing .nuxt/tsconfig.json/missing .astro/ typeswarnings and a broken tsconfigreferenceschain that dropped affected files into resolver-less resolution on the baseline comparison. After, the base worktree symlinks.nuxt/and.astro/from the host checkout alongside the existingnode_modulessymlink, driven by a sharedMATERIALIZED_CONTEXT_DIRSconstant that stays aligned with the plugin registry's meta-framework prerequisite list. (#705.)Workspace packages without
exportsnow resolve missing prebuild output back to source. Before, a sibling workspace package that omittedexportsbut pointedmoduleortypesat missingdist/files could surface as both an unresolved import and an unused dependency before the package was built. After, bare workspace package imports without anexportsmap use the same source fallback as prebuild package-map targets, so@example/libresolves topackages/lib/src/index.tsand dependency usage is credited. (Closes #725.)Contentlayer configs, content roots, and generated output are no longer reported as unused. Before, Contentlayer and Contentlayer2 projects commonly needed manual entries for
contentlayer.config.*,data/**/*.mdx, generated.contentlayer/**files, and remark or rehype packages loaded only through the config. After, a built-in Contentlayer plugin activates fromcontentlayer,contentlayer2,next-contentlayer,next-contentlayer2, or a root config file; keepscontentlayer.config.{ts,js,mts,mjs}and generated.contentlayer/**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}files reachable; traverses.contentlayeronly for active projects; credits packages imported by the config; and extracts staticcontentDirPathplus same-filedefineDocumentTypefilePathPatternliterals as content roots. Dynamic config and cross-file document type evaluation remain out of scope. (Closes #610.)File health scores now surface high CRAP-risk files even when their Maintainability Index is not the lowest. Before,
--file-scoressorted only by Maintainability Index, so an untested, very high-CRAP file could appear below a lower-MI file whose tested complexity made it less urgent. After, file scores are sorted by risk-aware triage concern: the larger of low-MI concern and a CRAP risk curve aligned to the low/moderate/high CRAP bands, with equal-concern ties broken by raw CRAP so the displayed Risk column reads top-down. The human table tags each rowriskorstructureto show which signal placed it. JSON, markdown, compact, MCP, grouped health, and API consumers receive the same order. (Closes #554.)Obsidian plugin entry files and lifecycle overrides are no longer reported as unused. Before, Obsidian plugins commonly needed manual config for
src/main.ts,styles.css,cdp.js, and framework-called lifecycle methods such asPlugin.onload,Plugin.onunload,Modal.onOpen, andItemView.onOpen. After, a built-inobsidianplugin activates from theobsidiandependency or a conservative Obsidian-shapedmanifest.json, treatssrc/main.{ts,js},main.{ts,js}, and rootcdp.jsas runtime entrypoints, keepsmanifest.jsonandstyles.cssreachable, and credits documented lifecycle overrides only on directPlugin,Modal,ItemView, andViewsubclasses. Ordinary classes and aliased or transitive local base classes still report unused methods. (Closes #617.)POSIX-rooted paths from Linux tooling stay absolute on Windows. Before, several path resolvers used host-specific
Path::is_absolute, so values such as/ci/workspace/...from Linux-generated coverage data, config inheritance, or plugin setup-file paths could be treated as relative on Windows and joined under the project root. After, the sharedConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.