chore(deps): update all non-major dependencies - #84
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
◈ PR Lens
Architecture 6 components touched across 5 lanes. Data flow No data-flow sequence changed in this PR. View
Tip The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change. 🪧 More tips
Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 13, 2026 07:56
19814b1 to
ca10a4c
Compare
commit: |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 13, 2026 17:51
ca10a4c to
abe505a
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 14, 2026 01:05
abe505a to
d18f0a3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^3.0.1→^3.0.2^1.0.0→^1.0.1^1.16.1→^1.16.2^3.2.1→^3.6.0^3.4.0→^3.6.03.1.0→3.1.2v2.1.1→v2.1.2^2.28.1→^2.29.06.34.0→6.35.10.66.0→0.67.01.81.0→1.82.012.3.1→12.4.1v6.0.10→v6.1.0^0.22.14→^0.23.0v0.6.3→v0.6.4Release Notes
changesets/changesets (@changesets/cli)
v3.0.2Compare Source
Patch Changes
a0a4dc6Thanks @bluwy! - Add review message on pre exit1f4eb61,059f70a]:changesets/changesets (@changesets/get-github-info)
v1.0.1Compare Source
Patch Changes
4d7b4fbThanks @bluwy! - Use consistent cache key when fetching the same commit or PR dataswc-project/swc (@swc/core)
v1.16.2Compare Source
Bug Fixes
(es/compat) Preserve for-of var binding scope (#12158) (f6d5bd1)
(es/decorators) Drop params from getter replacing decorated private method (#12161) (d56f594)
(es/flow) Preserve Flow component type semantics (#12090) (c8d5b49)
(es/minifier) Mark for update and test as executed multiple time (#12131) (1260e36)
(es/minifier) Report for loop var decl as assign (#12136) (783bbc2)
(es/minifier) Don't replace value-used console.*.bind() calls with undefined (#12138) (ed74223)
(es/minifier) Drop spans of cached
globalsvalues (#12129) (9a306b8)(es/minifier) Preserve effects of returned value calls (#12140) (c37b5a9)
(es/minifier) Avoid JSX sequence inlining loop (#12149) (4e79b94)
(es/minifier) Preserve bindings in copied inline arrows (#12141) (cf7b5c9)
(es/minifier) Preserve do-while control-flow targets (#12160) (f62c437)
(es/minifier) Preserve pure annotation ownership (#12180) (ec780f9)
(es/parser) Retry ambiguous Program parsing (#12142) (141a320)
(es/parser) Preserve await grammar boundaries (#12156) (c732683)
(es/quote) Restore await parsing (#12163) (918f517)
(es/typescript) Treat const variable references as enum constants (#12101) (c523551)
(swc) Key optimizer env cache by configured values (#12166) (c0b6f12)
(visit) Panic on invalid AST paths (#12154) (b4d11a9)
Features
(es/minifier) Evaluate Math.floor, Math.ceil, Math.round and Mat… (#12117) (e876e80)
(es/parser) Add opt-in parser-only TSRX lowering (#12120) (61ff097)
Miscellaneous Tasks
(deps) Upgrade reqwest to 0.12 (#12144) (8dd98e4)
(deps) Ignore unpatched Wasmtime advisory (#12170) (5dd7422)
Refactor
Testing
Ci
Only plan completed issues and merged PRs (#12133) (4d9aa8e)
Gate jobs with detected changes (#12147) (3802924)
Tag published misc npm packages (#12173) (a789691)
wolfstar-project/stars-components (@wolfstar/http-framework)
v3.6.0Compare Source
Minor Changes
#168
b516cad- feat: align the stars dev terminal UI with Nuxt's pinned panel and folded logsThe tsdown builder now leaves dependencies external with
deps.neverBundle, removing the deprecated option andkeeping shared dependencies external for dynamically loaded pieces. Its entry list, target and output-size table
are suppressed; warnings and errors remain available in the log browser and log file.
The bottom-aligned panel displays an animated Stars wordmark, aligned URLs, actual build-phase progress and elapsed
time, then readiness timing and diagnostic counts.
dev.banneraccepts custom text/lines orfalseto hide thewordmark. Log, help and session-info views use the alternate screen and restore the panel when closed. Logs support
search, source/level filters, selection, copying, and jumping to the last error with context. Stack frames are dimmed
and no longer counted as separate errors; Node warnings are classified as warnings rather than errors.
Rebuild state and duration now reset on Rolldown's per-build hook, including recovery from a failed build. Reduced
motion preserves the elapsed clock, and redirected input, dumb terminals and small panes get a safe plain fallback. Thanks @RedStar071!
Patch Changes
4f27ebe- fix(deps): update dependency chokidar to v5 Thanks @renovate!v3.5.0Compare Source
Minor Changes
#164
05fca34- feat(config): configure thetsdownbuild fromstars.configThe
tsdownblock is now the project's build configuration rather than a bag of options merged into a separatetsdown.config.ts, and it is typed with the options a bot actually reaches for (entry,format,unbundle,plugins,alias,define,deps,hooks, …) instead ofRecord<string, unknown>. Whatstars.configalreadysays — the entry's directory,
build.outDir,build.tsconfig, the extensionbuild.outputimplies — fills in therest, so most projects need nothing in it at all.
build.tsconfigis now resolved fortsdownbuilds too, not onlytscones (src/tsconfig.json, elsetsconfig.json):tsdownalone looks only next to the project root, so a bot keeping its sources' tsconfig insrc/— the layout the scaffold and the examples use — silently built without its paths and target.build.configFileon the resolved configuration reports which file the build tool is configured from(
tsdown.config.*,package.json#tsdown,vite.config.*), ornullwhenstars.configis the only one.Two options are also validated against the build tool they belong to: a non-empty
tsdownblock with another toolraises
TSDOWN_OPTIONS_REQUIRE_TSDOWN, andvitelikewise raisesVITE_OPTIONS_REQUIRE_VITE. A project that onlydeclares
tsdown: {}now resolvesbuild.tool: 'auto'totsdown, the way depending on it already did. Thanks @RedStar071!#164
05fca34- feat(config): addfuture.compatibilityVersion, with auto imports on from 4futurecarries the defaults of the next major, the way Nuxt's ownfuture.compatibilityVersiondoes: a projectopts into them one major early, and they become the default when that major ships. Where
experimentalguards workthat is still landing, everything in
futureis already decided.future: { compatibilityVersion: 4 }changes three things:tsdownbuild tool, andstarswires theautoImports()plugin into the builditself — until now the default said
truebut nothing injected the transform unless the project's owntsdown.config.tsdid. At3they stay off unless asked for, so the promise matches what the build does.tsdownis configured fromstars.configalone. Atsdown.config.*(or apackage.json#tsdownfield) raisesTSDOWN_CONFIG_FILE_UNSUPPORTEDnaming the file, rather than being silently ignored and quietly dropping theplugins it declares.
build.tool: 'auto'resolves totsdownfor any TypeScript entry, without looking for atsdown.config.*or atsdowndependency first.tscstays available as an explicit choice.3is the default and keeps today's behaviour, including loading atsdown.config.*and merging thetsdownblockover it. An unknown version raises
INVALID_COMPATIBILITY_VERSION. Thanks @RedStar071!wolfstar-project/stars-components (@wolfstar/i18next-type-generator)
v3.1.2Compare Source
Patch Changes
f9bc134- fix(deps): update all non-major dependencies Thanks @renovate!v3.1.1Compare Source
Patch Changes
a697108- Enable npm provenance for published releases (publishConfig.provenance), matching every other package in this workspace. Thanks @RedStar071!changesets/action (changesets/action)
v2.1.2Compare Source
Patch Changes
#735
8833883Thanks @bluwy! - Handle error when pushing git tags with the git CLI#724
36f529fThanks @bluwy! - Improve log messages#724
36f529fThanks @bluwy! - Fix root action double error logs#729
ca85897Thanks @bluwy! - Always switch and reset branch when generating version commits, similar to ifpush-with-git-cliis enabledevloghq/evlog (evlog)
v2.29.0Compare Source
What's Changed
Features 🚀
Bug Fixes 🐞
Documentation 📚
Dependency Updates 📦
Full Changelog: https://github.com/evloghq/evlog/compare/evlog@2.28.1...evlog@2.29.0
webpro-nl/knip (knip)
v6.35.1: Release 6.35.1Compare Source
37b2642) - thanks @WooWan!0d9cf34)2659063)7be11aa)v6.35.0: Release 6.35.0Compare Source
c6497a1) - thanks @gioboa!9ce68ed) - thanks @gioboa!2e7d498) - thanks @devYRPauli!a21f972) - thanks @gioboa!3178940) - thanks @s-h-a-d-o-w!aaab35a) - thanks @gioboa!6c27aab) - thanks @gioboa!a092e40) - thanks @gioboa!pnpm.overridesis read from the root manifest only (f69a7f6)3662c95)90b384d) - thanks @renovate[bot]!16d03f7) - thanks @bytedoe!a4c7a93)cwdif its missing at therootlevel (#2020) (f66c9f1) - thanks @JayaKrishnaNamburu!75d5628) - thanks @gioboa!cyclesissue type/reporter (resolve #2021) (f1e690b)e2bd3fc)1cc979b)db6d891)4afbbcf)oxc-project/oxc (oxfmt)
v0.67.0Compare Source
🛡️ Security
9a612d5deps: Update npm packages (#26178) (renovate[bot])oxc-project/oxc (oxlint)
v1.82.0Compare Source
🚀 Features
6a0e19clinter/eslint/no-unmodified-loop-condition: SupportcheckConditionalExpressionsoption (#26249) (camc314)pnpm/pnpm (pnpm)
v12.4.1: pnpm 12.4.1Compare Source
pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under
nodeLinker: hoisted. Repeat installs are faster.Patch Changes
Installing packages
pnpm installno longer fails withOperation not permittedwhen the filesystem refuses a hard link or a copy-on-write clone #14722. UnderpackageImportMethod: autoandclone-or-copy, pnpm copies the file instead. EdenFS checkouts, which have no hard links, and rootless containers, which refuse the clone syscall, both hit this. An explicitpackageImportMethod: hardlinkorclonestill reports the error.pnpm also copies a package file whose store entry has reached the filesystem's limit on names for one file, 1024 on NTFS and 65000 on ext4. Such a file failed the install under
packageImportMethod: hardlink, and underautoit stopped pnpm hard linking for the rest of the install.pnpm installno longer writes a package file through a symlink left at the path it is importing to. Copying such a file overwrote whatever the link pointed at, and created that file when the link pointed nowhere. An executable package file also made the link's target executable.Fixed
pnpm installandpnpm dlxon Android. Registry requests crashed because pnpm found no system CA certificates, so pnpm uses bundled ones there #14777. Imports also failed with "Permission denied" on filesystems that deny hard links and reflinks, and now fall back to copying #14780.pnpm installno longer fails with "Invalid cross-device link" while preserving a package's nestednode_modulesdirectory during a Docker build #14758.pnpm installno longer fails on a package tarball that carries a file at the archive root, such as the._*entries macOStaradds #14701. The file is installed at the root of the package.A
file:tarball packed without the usualpackage/directory is now recorded under the name and version from its ownpackage.json. It was recorded under the alias the dependency was given, at version 0.0.0.Under
nodeLinker: hoisted,pnpm installno longer re-imports packages that are already in place. A repeat install replaced the wholenode_modulestree and reportedPackages: +N. A package is still imported when its directory is missing, when itspackage.jsonno longer carries the installed version, when it is afile:dependency, and when it is patched. Lifecycle scripts no longer run again for a package left in place, andpnpm rebuildand a change toallowBuildsstill reach it.pnpm installnow runs a dependency's build scripts again when its side-effects cache entry has no files to restore #14717. Such builds were skipped and nothing was put in their place, so a script whose whole effect lands outside its own package directory, such as a git hook installer, never took effect. pnpm no longer publishes empty artifacts to the shared side-effects cache either.Resolving and linking dependencies
pnpm install,pnpm add, andpnpm dedupenow applyignoredOptionalDependencies#14729. Matching optional dependencies are left out of the lockfile and are not installed. pnpm 12 installed them whenever it resolved dependencies from scratch.pnpm installno longer links a transitive dependency to a workspace package whenlinkWorkspacePackagesistrueand the dependency is declared with a plain version range #14781. EnablingpreferWorkspacePackagesdoes not change this. SetlinkWorkspacePackages: deepto link them.pnpm installno longer leaves dangling dependency links in workspace packages located above the workspace root #14726.pnpm installandpnpm addno longer leave a dangling symlink innode_moduleswhen a project starts depending directly on a package that the lockfile holds only as a transitive dependency with resolved peer dependencies #14714.pnpm dedupenow keeps a compatible auto-installed peer when another workspace project depends on a newer major #14697. Repeated runs alternated between compatible and incompatible peer versions.pnpm peers checkno longer reports a peer dependency declared asworkspace:^,workspace:~, or a bareworkspace:as unmet #14770. pnpm reported these as unmet whatever version the linked workspace project supplied.Performance
Sped up repeat installs #14540. pnpm checks the store's files only for the packages it links into
node_modules, instead of every package in the lockfile. Creating the command shims innode_modules/.binmakes about 1,500 fewer filesystem calls in a 76 project workspace. Installs that use the global virtual store read their slot paths from the cache directory instead of deriving them every time. Verifying a large lockfile also allocates less memory.Sped up
pnpm installin Cargo workspaces with many member crates. Repeated installs reuse verified Cargo checksum metadata.Installing several packages from the same Git repository and commit now downloads the source once per install #14725. Each package still runs its prepare scripts in its own copy of the checkout.
Running scripts and tasks
pnpm now passes Ctrl+C on to the script or command it started and waits for it to shut down #14723. pnpm exited first, so a script that was still writing landed on the shell prompt.
pnpm run "/pattern/" --no-bailnow lets every matched script finish after one of them fails #14718. The command exits withERR_PNPM_RUN_FAILED, and its message lists the scripts that failed in the order they were selected.pnpm pipelineno longer fails on a project that tracks a symlink, such as aCLAUDE.mdpointing atAGENTS.md#14692. Changing a symlinked input's target invalidates that task's cache, andpnpm pipeline --no-cacheno longer hashes task inputs.Commands
pnpm add -g,pnpm update -g, andpnpm remove -gno longer change global bins or install directories after reading only part of an installed package group #13796. If any declared package manifest is missing, malformed, or unreadable, pnpm now fails before it activates or removes anything and leaves the existing global installation intact.pnpm dedupenow processes every workspace project by default, including workspaces that keep a separate lockfile per project #14732. Workspace filters select which projects it processes, and--fail-if-no-matchexits with an error when no project matches.pnpm update <name>@<version>now keeps the range operator the manifest declares #14745. Runningpnpm update react@19.3.0on"react": "^19.2.8"writes"react": "^19.3.0". Ajsr:entry keeps itsjsr:prefix, and a plainpnpm updatenow moves ajsr:range the way it moves an npm range.pnpm --filterdirectory selectors now support?wildcards and character classes such as[ab]. A*or?wildcard no longer selects a directory whose name starts with a dot, as on pnpm 11.pnpm deploy --legacynow prefers the dependency versions pinned in the source workspace lockfile when they still satisfy the deployed project's range #13857.pnpm sbomnow leaves out a package's author field when the manifest author name is empty or contains only whitespace #14685. In a filtered or split workspace run, only a project with noauthorfield inherits the workspace root's author.pnpm sbom --sbom-format spdxnow writescreationInfo.createdwith whole seconds, such as2026-09-08T10:38:21Z#14684. The fractional seconds it carried were rejected by strict SPDX consumers.Configuration
The
updateConfigpnpmfile hook now receives the resolved configuration, including settings that came from.npmrc, the command line, or a default #14676. Scoped registries are reported underregistriesByScope, and a hook may rewrite that map to change where packages are fetched from. Registry credentials are reported underconfigByUri, as pnpm 11 reports them. An unset setting is left out rather than reported asnull.pnpm audit --fixand theminimumReleaseAgeStrictapproval prompt now keep the comments inminimumReleaseAgeExcludewhen they append an entry to it inpnpm-workspace.yaml. The rest of the list is left as written, and thetrustPolicyExcludePruneandminimumReleaseAgeExcludePrunecleanups keep the comments of the entries they retain.pnpm installandpnpm dedupenow run those cleanups too #14759. Onlypnpm add,pnpm update, andpnpm removepruned the entries that the freshly written lockfile no longer resolves.pnpm config set --global node-download-mirrorsno longer rejects the key #13611. The global config file already acceptednodeDownloadMirrors, but the command refused to write it.NO_PROXYentries that start with a dot, such as.npmjs.org, now bypass the proxy for the domain and its subdomains #14686.pnpm no longer creates a project
pnpm-lock.yamlwhendevEngines.packageManager.onFailisdownloadand lockfile writing is off throughlockfile: falseor--no-lockfile#14728. pnpm still switches to the pinned version.pnpm now writes
node_modules/.package-map.jsononly whennodeExperimentalPackageMapis enabled. Nothing reads the file without that setting, and an install that stops writing the map removes the one a previous install left.Windows
pnpm pipelineno longer fails with intermittent access denied errors when concurrent tasks save their cache entries on Windows.Windows filesystem operations now retry permission errors for up to one second #14682. A permanent permission error delayed the failure by a minute. Sharing and lock violations keep their one minute retry budget.
Messages and output
pnpm now warns when the root
package.jsondeclares a non-emptyworkspacesarray and the project has nopnpm-workspace.yaml#2255. Such an install linked no project and said nothing about why.ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIRnow names the file or directory innode_modulesthat pnpm could not clean up. It reported only the underlying OS error, such as "Access is denied (os error 5)".pnpm --helpno longer describes pnpm as experimental.Platinum Sponsors
Gold Sponsors
v12.4.0: pnpm 12.4Compare Source
Minor Changes
pnpm can now manage npm, Python, and Cargo dependencies in the same workspace. Enable
python.enabledorcargo.enabledinpnpm-workspace.yaml, then usepnpm installto install them together.pnpm add pypi:<package>. pnpm usespyproject.toml,pylock.toml, and a managed.venv. Frozen and offline installs are supported, andpnpm runandpnpm execmake the environment's executables available #14566.pnpm add crate:<package>. pnpm supports crates.io and custom sparse registries configured withcargo.indexUrl. Registry authentication supports pnpm credentials and, for crates.io,CARGO_REGISTRY_TOKENor$CARGO_HOME/credentials.toml.Both ecosystems support faster dependency resolution through
pnprServer, with local resolution as a fallback when the server does not support it.Added
pnpm pipeline [name]to install frozen dependencies and run workspace tasks declared inpipelines. It selects affected projects, runs their task graph, and continues running tasks after a task fails.Tasks support
inputs,outputs,env, andcachesettings. Cached results restore task outputs and replay logs. Cargo tasks can reuse local build state between worktrees withtasks.<name>.cargoTargetDir. SetincludeWorkspaceRoot: trueto include root tasks.Use
pnpm pipeline --dry-runto preview the task graph without installing configuration dependencies or running workspace hooks.Added support for Android on arm64 and x64, FreeBSD on x64, and Linux on ppc64le, s390x, and RISC-V (riscv64 with glibc) #14431, #14597, #7582.
Added
trustPolicyExcludePruneto automatically remove unused versions and packages fromtrustPolicyExcludewhen runningpnpm add,pnpm update, orpnpm remove. It is disabled by default. Package name patterns such as@scope/*are kept, and cleanup is skipped whensharedWorkspaceLockfileisfalse.Added
pnpm change checkfor CI validation of package versions against theversioning.epicsbands andversioning.fixedgroups inpnpm-workspace.yaml. It reports all violations, including packages that are not part of the current release.Patch Changes
Registry metadata is now kept separate for registries with different URL paths or schemes. This prevents installs from using another registry's package versions or tarball URLs, and keeps metadata fetched over HTTP from being reused for HTTPS #13558.
The first install after upgrading refetches registry metadata. The package store is unchanged.
pnpm cache viewnow shows full registry URLs. Scripts that parse the directory names frompnpm cache list-registriesorpnpm cache listneed updating.Patches that add build scripts or a
binding.gypnow trigger a build, subject to build approval. Unapproved builds appear under "Ignored build scripts" #14648.Build scripts can now be rejected before installing a package with
pnpm add --allow-build=!<pkg>, including global installs.pnpm approve-builds <pkg>andpnpm approve-builds !<pkg>also save decisions when no packages are awaiting approval. They warn if the named package is not awaiting approval #14067.A registry configured in
.npmrcnow takes precedence over registry settings saved bypnpm loginin the globalconfig.yaml. This fixes installs using the wrong registry after login #14614.Large downloads over slow connections no longer time out while data is still arriving.
fetch-timeoutnow limits how long a request can go without making progress #14604.Sped up installs in workspaces with many projects when reusing a warm global virtual store #14540.
pnpm deployis faster in large workspaces and no longer fails withERR_PNPM_LOCKFILE_CONFIG_MISMATCHwhen the project includes a.pnpmfile.mjs#14539, #14671.pnpm add --workspace <pkg>works again. It saves the dependency with theworkspace:protocol and links it from the workspace. The command fails if no workspace project provides the package #14602.pnpm addandpnpm installnow accept protocol-prefixed selectors such asjsr:@scope/pkg,npm:pkg@^1.0.0, andworkspace:pkg@*#14590. Installs with JSR dependencies in the lockfile alsConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.