chore(deps): update all non-major dependencies#1357
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
commit: |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Merging this PR will degrade performance by 46.76%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ❌ | makes requests to dev server |
56 ms | 105.2 ms | -46.76% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing renovate/all-minor-patch (5805d71) with main (49dd7f7)
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
d115cc0 to
0ed587c
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
0ed587c to
5805d71
Compare
This PR contains the following updates:
^9.0.0→^9.1.0^1.6.0→^1.7.0^1.6.0→^1.7.0^5.6.0→^5.7.1v4.17.6→v4.18.1^10.5.0→^10.6.063.0.7→63.0.11^1.0.8→^1.1.0^1.0.8→^1.1.00.5.3→0.5.4^6.17.1→^6.24.0^0.6.7→^0.6.8^0.6.7→^0.6.811.8.0→11.9.011.10.0^0.11.17→^0.11.21^0.11.17→^0.11.21^0.1.14→^0.1.15^0.1.14→^0.1.15^8.5.0→^8.7.0^3.5.38→^3.5.39^3.3.5→^3.3.6Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
antfu/eslint-config (@antfu/eslint-config)
v9.1.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
bombshell-dev/clack (@clack/prompts)
v1.7.0Compare Source
Minor Changes
8f1c380Thanks @dreyfus92! - AddshowInstructionsoption toselect,multiselect, andgroupMultiselect. Keyboard hints remain shown by default; passshowInstructions: falseto hide them.Patch Changes
#582
4b24953Thanks @43081j! - Handle empty arrays in various prompts and utilities.Updated dependencies [
4b24953]:CodSpeedHQ/codspeed-node (@codspeed/vitest-plugin)
v5.7.1Compare Source
What's Changed
Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1
v5.7.0Compare Source
Highlights
CODSPEED_WALLTIME_PROFILER=samplyenv variable in the codspeed action.What's Changed
Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0
CodSpeedHQ/action (CodSpeedHQ/action)
v4.18.1Compare Source
Release Notes
🚀 Features
Install codspeed-runner 4.18.1
Install prebuilt binaries via shell script
Download codspeed-runner 4.18.1
Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md
v4.18.0Compare Source
Release Notes
🚀 Features
🐛 Bug Fixes
Install codspeed-runner 4.18.0
Install prebuilt binaries via shell script
Download codspeed-runner 4.18.0
Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md
eslint/eslint (eslint)
v10.6.0Compare Source
Features
b1f9106feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)f291007feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)Bug Fixes
6b05784fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)bb9eb2afix: account for shadowedBooleaninno-extra-boolean-cast(#21013) (den$)8fd8741fix: don't report shadowed undefined inradixrule (#21011) (Pixel)5784980fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)9cd1e6dfix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)d4eb2dcfix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)2360464fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)63d52d2fix: restore max-classes-per-file report range (#21002) (Pixel)7feaff0fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)399a2ecfix: don't report inner non-callbacks inmax-nested-callbacks(#20995) (Milos Djermanovic)Documentation
a83683ddocs: Update README (GitHub Actions Bot)f5449f9docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)bea49f7docs: Update README (GitHub Actions Bot)e5f70f9docs: update code-path diagrams (#20984) (Tanuj Kanti)8890c2ddocs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)3eb3d9bdocs: Update README (GitHub Actions Bot)c5bb59cdocs: Update README (GitHub Actions Bot)eb3c97cdocs: fix grammar in prefer-const rule description (#20983) (lumir)Chores
6a42034ci: run ecosystem tests on main branch (#20891) (sethamus)3dbacdbci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])c3abfcachore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)a832320ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)27166e7chore: update ecosystem plugins (#21005) (ESLint Bot)865d76eci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])27a88c9chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)970cea6chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)b482120chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])6993fb3chore: update ecosystem plugins (#20985) (ESLint Bot)gajus/eslint-plugin-jsdoc (eslint-plugin-jsdoc)
v63.0.11Compare Source
Bug Fixes
require-jsdoc: skip overloads to find method comment blocks; fixes #1688 (7676b50)v63.0.10Compare Source
Bug Fixes
v63.0.9Compare Source
Bug Fixes
check-template-names,require-template,valid-types: keep commas inside@templatedefault values (0980b71)v63.0.8Compare Source
Bug Fixes
check-template-names: detect template usage in@augments/@extends/@implementstypes (208079f)unjs/exsolve (exsolve)
v1.1.0Compare Source
compare changes
🚀 Enhancements
🔥 Performance
🏡 Chore
❤️ Contributors
unjs/httpxy (httpxy)
v0.5.4Compare Source
compare changes
🩹 Fixes
ProxyTargetDetailed(#152)transfer-encodingon chunked DELETE/OPTIONS (#153)🏡 Chore
🤖 CI
http-proxy-middleware(#142)❤️ Contributors
webpro-nl/knip (knip)
v6.24.0: Release 6.24.0Compare Source
32bc844) - thanks @trueberryless!82a8d09) - thanks @trueberryless!d9ef038)aea7923)pnpm run lintto CI workflow (ec9aa1c)111f2e0) - thanks @trueberryless!dc2a640) - thanks @trueberryless!ffce88c) - thanks @trueberryless!6f090f9) - thanks @cyphercodes!7901abd)0d739be)5525759) - thanks @trueberryless!3c9d4ad)acba6b8) - thanks @johnjenkins!cf997b2) - thanks @morgan-coded!260f192)bb0eeb6)v6.23.0: Release 6.23.0Compare Source
f85d96f) - thanks @trueberryless!62e9753) - thanks @ghostdevv!94e2863) - thanks @trueberryless!8a6050e)849b5ac)v6.22.0: Release 6.22.0Compare Source
1dffe36) - thanks @patrik-csak!5095ae1) - thanks @gwagjiug!7759a98)11fe8bd) - thanks @serhalp!a5302b2) - thanks @serhalp!3e1b821) - thanks @trueberryless!76c92e2)v6.21.0: Release 6.21.0Compare Source
8754c43)3c8deac) - thanks @gwagjiug!9b8af2b)f89db41)f32c6ea)v6.20.0: Release 6.20.0Compare Source
6f08c68)2bc2f24)v6.19.0: Release 6.19.0Compare Source
3fee8bf) - thanks @fubits1!e30cfe7)71e71a7)v6.18.0: Release 6.18.0Compare Source
7dda4ec)3b71565)64865f8)ec93e20) - thanks @remcohaszing!203c31e)392835a)62d802b)d2caedd) - thanks @gwagjiug!9083c16) - thanks @WooWan!v6.17.2: Release 6.17.2Compare Source
63dbd65)vitest --coverageflag (#1800) (dc11d9f) - thanks @WooWan!8ce1ec8) - thanks @WooWan!27a1cae)630e152)pnpm/pnpm (pnpm)
v11.9.0Compare Source
Minor Changes
bae694f: Some registries generate tarballs on-demand and cannot provide an integrity checksum in their package metadata. In that case pnpm now computes the integrity from the downloaded tarball and stores it in the lockfile, so the entry is verifiable on subsequent installs instead of being written without an integrity (which would fail the next install). This also applies to--lockfile-only: the tarball is downloaded so its integrity can be computed. A lockfile entry that is still missing its integrity is rejected as aERR_PNPM_MISSING_TARBALL_INTEGRITYlockfile verification violation (the install fails closed) rather than being silently re-fetched.6c35a43: Added--exclude-peerstopnpm sbom. Withauto-install-peers(the default), peer dependencies resolve into the lockfile and are otherwise indistinguishable from the package's own dependencies. The flag drops peer dependencies (and any transitive subtree reachable only through them) from the SBOM. CycloneDX 1.7 has no scope or relationship that expresses "consumer-provided peer", so omission is the only spec-clean handling. The flag name matchespnpm list --exclude-peers; note the SBOM flag prunes a peer's exclusive subtree, which is stricter thanpnpm list(which only hides leaf peers).Patch Changes
25a829e:pnpm audit --fixnow writes a single combinedminimumReleaseAgeExcludeentry per package (e.g.axios@0.18.1 || 0.21.1) instead of one entry per version, matching the format documented for the setting. Existing per-version entries inpnpm-workspace.yamlare merged into the combined form rather than left as duplicates. Installs that auto-collect immature versions intominimumReleaseAgeExcludenow report the same combined entries, so the "Added N entries" message matches what is written to the manifest #12534.1cbb5f2: Fixed non-deterministic peer resolution that could add or remove an optional transitive peer — for example@babel/core, reached throughstyled-jsx— from a package's peer-dependency suffix across otherwise identical installs, churning the lockfile and causing intermittentpnpm dedupe --checkfailures in CI. When a package's children are resolved by one occurrence (the "owner") and reused by a deeper consumer, whether that consumer inherited the owner's missing peers depended on whether the owner's resolution had finished yet — a race under concurrent resolution. The decision is now a function of the dependency graph's structure rather than resolution-completion order.d577eea: Fixed a Windows flakiness inpnpm dlxwhere a failed install could surface a spuriousEBUSY: resource busy or lockederror. The cleanup of a partially-populated dlx cache is now best-effort with retries and no longer masks the original error.ec7cf70: Shortened thepnpm dlxcache path so deep dependency trees no longer overflow Windows'MAX_PATH, which could make a dependency's lifecycle script fail withspawn cmd.exe ENOENT.05b95ab: Fixedpnpmhanging (and crashing with an unhandled promise rejection) when a non-retryable network error such asSELF_SIGNED_CERT_IN_CHAINoccurs while fetching from a registry. The error is now rejected through the returned promise instead of being thrown inside the detached retry callback.d3f68e2: Fix apnpm auditperformance regression on lockfiles that contain dependency cycles. The reachable-vulnerability pruning added in pnpm 11.5.1 only memoized acyclic subtrees, so any node whose subtree touched a cycle — together with all of its ancestors — was recomputed on every query, making the path walk quadratic. Reachability is now computed once per node using Tarjan's strongly-connected-components algorithm, so cyclic graphs are handled in linear time #12212.The audit path walk also no longer recurses, so a deeply nested dependency graph can no longer overflow the call stack, and the install path to each finding is tracked without per-node copying, keeping memory linear in the graph depth.
322f88f: Fix failed optional dependency updates so they don't rewrite unrelated dependency specs #11267.1488db1: WhenenableGlobalVirtualStoreis toggled on for a project that was previously installed without it, stale hoisted symlinks undernode_modules/.pnpm/node_modulesare now replaced instead of being left pointing at the old per-project virtual store location #9739.6545793: Fixedpnpm install --ignore-workspaceoverwriting theallowBuildsmap inpnpm-workspace.yaml. The ignored builds of a package with a build script were auto-populated intoallowBuildseven though--ignore-workspacewas passed, clobbering committedtrue/falsevalues with theset this to true or falseplaceholder #12469.fbdc0eb: FixedminimumReleaseAgeExcludeandtrustPolicyExcludeso multiple exact-version entries for the same package behave the same as a single||disjunction entry. Previously only the first matching rule's versions were honored, so a config like[form-data@4.0.6, form-data@2.5.6]could still flagform-data@2.5.6as violatingminimumReleaseAge, while[form-data@4.0.6 || 2.5.6]worked as expected #12463.fa7004b: The in-memory package metadata cache is now populated on the exact-version disk fast path, so repeated resolutions of the same package within one install no longer re-read and re-parse the on-disk metadata. In large monorepos this brings the time for adding a new package down from minutes to seconds. The in-memory cache key now also includes the registry, so a package of the same name served by two different registries in a single install can no longer share a cache slot and resolve the wrong tarball.0a154b1: Fixedpnpm patchdropping the package name (and leaking internal option fields) when the patched dependency resolves to a single git-hosted version.4d3fe4b: The pnpr resolver endpoints moved under the reserved/-/pnprnamespace:POST /v1/resolveis nowPOST /-/pnpr/v0/resolveandPOST /v1/verify-lockfileis nowPOST /-/pnpr/v0/verify-lockfile. The capability handshake atGET /-/pnpradvertises protocol version0to match. This keeps every pnpr-proprietary route in npm's reserved namespace, so it can never collide with a package path.0ec878d: Removing a runtime dependency now removes the matchingdevEngines.runtimeorengines.runtimeentry that was materialized from it. Blank runtime selectors are normalized tolatest.17e7f2c:pnpm sbomnow emits a CycloneDXissue-trackerexternal reference for components (and the root) whosepackage.jsondeclares abugsURL. Email-onlybugsentries are skipped, since the reference requires a URL.a84d2a1: Add@pnpm/resolving.tarball-url, which builds and recognizes the canonical npm tarball URL of a package. It vendorsgetNpmTarballUrl(previously the externalget-npm-tarball-urlpackage) and addsisCanonicalRegistryTarballUrl, the predicate the lockfile writer uses to decide whether a tarball URL is derivable from name+version+registry (and can therefore be omitted frompnpm-lock.yaml).Exposing
isCanonicalRegistryTarballUrllets a custom resolver (pnpmfileresolvers) fronting a proxy that serves tarballs on a non-canonical path (e.g. an ephemerallocalhost:<port>) rewrite the resolved tarball to the canonical form, so nothing host-specific is persisted to the lockfile. Previously this logic was private to@pnpm/lockfile.utils.Two correctness fixes are included while consolidating the logic: the scoped-package unescape now handles uppercase
%2Fas well as%2f(percent-encoding is case-insensitive), and protocol-insensitive comparison strips only a leadinghttp(s)://scheme instead of splitting on the first://(which could truncate URLs containing a later://).852d537: Lockfile verification no longer reports a registry metadata fetch failure (for example a403/401on a private registry, or a network error) asERR_PNPM_TARBALL_URL_MISMATCH. When the registry can't be reached to verify an entry, the install now aborts with the registry's own fetch error (such asERR_PNPM_FETCH_403, which already explains the authentication situation) instead of mislabeling a transport failure as lockfile tampering. Registry fetch errors no longer leak basic-auth credentials embedded in the registry URL (https://user:pass@host/) into their message.h3js/srvx (srvx)
v0.11.21Compare Source
compare changes
🩹 Fixes
🏡 Chore
❤️ Contributors
v0.11.20Compare Source
compare changes
🔥 Performance
❤️ Contributors
v0.11.19Compare Source
compare changes
🚀 Enhancements
maxRequestBodySizeserver option (#216)🩹 Fixes
🏡 Chore
✅ Tests
❤️ Contributors
v0.11.18Compare Source
compare changes
🩹 Fixes
NodeResponse(b0dadda)🏡 Chore
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.