chore(deps): update all non-major dependencies - #476
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
commit: |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
March 31, 2026 08:58
19bb6c4 to
aea8810
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
April 1, 2026 16:46
aea8810 to
26d8a91
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
8 times, most recently
from
April 8, 2026 13:15
15ebb37 to
58bed64
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
April 10, 2026 10:39
9a8dee0 to
bd30b0d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
April 23, 2026 13:41
eba4501 to
13e213b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
April 29, 2026 15:38
4ad542d to
ea58d4b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
May 18, 2026 16:56
665a065 to
0b881bb
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
14 times, most recently
from
May 25, 2026 09:54
3f916d6 to
2a68d42
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
9 times, most recently
from
May 31, 2026 13:32
4d61988 to
44c6bd1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.2.121→^1.2.1261.2.127^3.4.1→^3.4.2^1.16.0→^1.17.01.0.2→1.0.3^4.1.0→^4.2.0^4.10.0→^4.11.0^4.4.2→^4.4.3^4.4.2→^4.4.3^4.4.2→^4.4.3^4.4.2→^4.4.3^4.4.2→^4.4.3^26.1.2→^26.4.0^3.5.41→^3.5.42^10.8.0→^10.9.12.3.0→2.4.124→24.20.011.20.0→11.24.0^20.2.0→^20.2.1^4.4.2→^4.4.3^0.5.3→^0.6.0^4.1.10→^4.1.11^3.3.9→^3.3.11Release Notes
nuxt/devtools (@nuxt/devtools)
v3.4.2Compare Source
🐞 Bug Fixes
View changes on GitHub
nuxt/eslint (@nuxt/eslint-config)
v1.17.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
nuxt/module-builder (@nuxt/module-builder)
v1.0.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
📦 Build
🏡 Chore
resolutions/pnpm.overridestopnpm-workspace.yaml(cfb45fb)afcf2fa)aeb1d38)92eb2af)✅ Tests
809c89f)9412c91)#appornuxt/appin generated declarations (#727)🤖 CI
604d5b3)4442a14)f7be1a6)reproduction(57e7ce9)c3c8e72)d87d217)54c5f13)🎉 New Contributors
❤️ Contributors
nuxt/test-utils (@nuxt/test-utils)
v4.2.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
🩹 Fixes
mockNuxtImportsourcemap mapped position (#1787)setupTimeoutin playwright + surface server logs (#1785)includeSourcein both projects indefineVitestConfig(#1763)taskkillto kill processes on windows (#1760)🏡 Chore
latestranges with caret ranges (#1773)✅ Tests
🤖 CI
🎉 New Contributors
❤️ Contributors
nuxt/ui (@nuxt/ui)
v4.11.0Compare Source
Features
iconin items (#6726) (07f3fe8)experimental.componentDetection(#6731) (3a568b5)Bug Fixes
scrollable(#6786) (5afbd5c)baseinapplyUnstyled(#6825) (3e89ea7)classfrompropswith the component class (#6842) (731ff26)prefers-reduced-motion(#6742) (735b264)Performance Improvements
shikijs/shiki (@shikijs/core)
v4.4.3Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
vuejs/core (@vue/compiler-core)
v3.5.42Compare Source
Bug Fixes
eslint/eslint (eslint)
v10.9.1Compare Source
v10.9.0Compare Source
v10.8.1Compare Source
Bug Fixes
18eb0a7fix: prevent ASI hazard inno-unused-labelsautofix (#21173) (dongkyu lee)151ba3ffix: false positives ingetter-returnandaccessor-pairs(#21163) (Grit)6898df9fix: ignore meta-property names inid-denylist(#21166) (Pixel)4d7db66fix: ignore meta-property names inid-match(#21167) (Pixel)677214efix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)Documentation
7d0cbf8docs: Update README (GitHub Actions Bot)0a05812docs: add missing backticks tono-duplicate-imports.js(#21183) (Lee Daeun)678c90bdocs: Update README (GitHub Actions Bot)8a10424docs: Update README (GitHub Actions Bot)69bb948docs: Update README (GitHub Actions Bot)Chores
0a14800chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])05adcb1test: fix failing ecosystem test foreslint-plugin-unicorn(#21191) (Lazizbek Ergashev)5611035test: add error locations info tono-void(#21185) (Lee Daeun)ee47333ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])f131c03chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)1f6eddechore: update ecosystem plugins (#21182) (ESLint Bot)d3266fbchore: unpinwebpackdependency (#21172) (Francesco Trotta)65a6519chore: add allowScripts field to package.json (#21092) (GiHoon Noh)22e5256ci: addtriage:nolabel to Dependabot PRs (#21141) (lumir)55c9038ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])7280e78chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])eddbad6test: fix failing ecosystem test foreslint-plugin-unicorn(#21156) (Francesco Trotta)60a178dchore: update ecosystem plugins (#21150) (ESLint Bot)f9f61dctest: add error locations tono-unreachable(#21151) (JIYEON)d086293test: add error locations tono-undef(#21147) (JIYEON)cc01b67test: add error locations tono-useless-catch(#21144) (devoil)688e75echore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)7c1e175test: add error locations torequire-await(#21145) (Grit)588a26dtest: add error locations tono-extra-label(#21139) (dongkyu lee)059aa89test: add error locations tono-useless-concat(#21140) (dongkyu lee)5a452a8test: add error locations tono-const-assign(#21138) (dongkyu lee)unjs/mkdist (mkdist)
v2.4.1Compare Source
compare changes
🩹 Fixes
❤️ Contributors
v2.4.0Compare Source
compare changes
🚀 Enhancements
.d.vue.tsas type declaration of.vuefiles (#301)🤖 CI
❤️ Contributors
actions/node-versions (node)
v24.20.0: 24.20.0Compare Source
Node.js 24.20.0
v24.19.0: 24.19.0Compare Source
Node.js 24.19.0
v24.18.1: 24.18.1Compare Source
Node.js 24.18.1
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
v24.17.0: 24.17.0Compare Source
Node.js 24.17.0
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
pnpm/pnpm (pnpm)
v11.24.0: pnpm 11.24Compare Source
Minor Changes
Patch Changes
Fixed pnpm v11 incorrectly reporting
confirmModulesPurgeas unrecognized when set inpnpm-workspace.yaml. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting.pnpm install --frozen-lockfileno longer fails withERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILEwhen the pinned pnpm version recorded inpnpm-lock.yamlhas to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged #14124.Under
nodeLinker: hoisted, peer-resolution variants of an injected directory dependency (afile:snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this.Fixed
pnpm install --merge-git-branch-lockfiles --frozen-lockfilefailing withERR_PNPM_OUTDATED_LOCKFILEwhen a branch lockfile predates the removal of a dependency, or its move to another dependency group #13966. A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it.Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the
publishandpostpublishscripts after each completed registry group pnpm/pnpm#14101.The Rust CLI now honors five settings it recognized but ignored:
updateNotifier,legacyDirFiltering,initAuthorName/initAuthorEmail/initAuthorUrl,initLicense, andinitVersion.pnpm installandpnpm addcheck once a day for a newer pnpm and print how to get it (turn it off withupdateNotifier: false); a{<dir>}filter selector can go back to matching the subtree below the directory withlegacyDirFiltering: true; andpnpm initwrites the configured author, license, and version into thepackage.jsonit scaffolds.PNPM_CONFIG_INIT_VERSIONis now read as well.maxsockets, npm's spelling ofmaxSockets, is no longer ignored: both spellings are read frompnpm-workspace.yaml, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently.A
lastUpdateChecktimestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around.legacyDirFilteringno longer reaches the workspace-root selectors pnpm generates for itself: the!{<workspace-root>}exclusion a recursiverun/exec/add/testappends, and the{<workspace-root>}inclusion--workspace-rootappends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and--workspace-rootpulled in every project below the root instead of the root alone #14101.pnpm install --frozen-lockfileno longer fails whenpnpm-lock.yamlrecords the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block #14124.v11.23.0: pnpm 11.23Compare Source
Minor Changes
pnpm config getandpnpm config listnow show the settings pnpm acts on under their documented names:registriesshows the registries pnpm resolves from, merged across every source (.npmrc,pnpm-workspace.yaml, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare@scope. Built-in routes are included — the@jsrscope and thenpmjsandghprefixes — unless pointed elsewhere. Previouslypnpm config get registriesprintedundefined.updateandauditshow the effective sections, whichever spelling set them. The deprecated internal spellings (updateConfig,auditConfig,auditLevel) are no longer listed.catalogsshows the complete resolved catalog set — the singularcatalogblock is itsdefaultentry — whichever spelling declared it.registryand@scope:registryentries show the merged routes rather than raw.npmrcvalues, so they always agree with theregistriesview.Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level
pnpm-workspace.yaml(where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example,globalShimsis a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project'spnpm-workspace.yaml, previously ignored silently, are now reported the same way.pnpm config get <key>andpnpm get <key>no longer print config-load warnings, so a script capturing the value gets the value alone.The
importPackagepnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on #14101.node_modules/.modules.yamlno longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it.It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use:
pnpm list,pnpm why, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one.They now use the configured registries, like every other command already did.
When
enableGlobalVirtualStoreis on, every process pnpm spawns for the project (pnpm run,pnpm exec, lifecycle scripts) now receives aNODE_PATHpointing at the project's hoistednode_modules, plus aNODE_OPTIONS--importflag that registers a resolve hook restoringNODE_PATHlookups for ESM imports. Dependencies that import undeclared ("phantom") packages keep resolving under the global virtual store — for both CommonJS and ESM — without installing the@pnpm/plugin-esm-node-pathconfig dependency pnpm/pnpm#9618. Tools run bypnpm dlxresolve such dependencies too: the JS CLI passes them the same environment, while the Rust CLI's dlx cache is self-contained, so its layout already exposes them.A registry can now declare that its abbreviated metadata carries the
timefield, soresolutionMode: time-basedreads the full metadata document only from the registries that need it:registry.npmjs.orgomitstimefrom abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing:registrySupportsTimeFieldanswered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed atimefield npmjs does not serve. The answer is now per registry, andregistrySupportsTimeFieldremains the answer for every registry that does not declare one.The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf.
A pnpr resolve request now carries the client's registries the way the
registriessetting declares them — keyed by URL, with the scopes routed to each, the bare-specifier prefix each answers to, and each one'sserverType— in place of the prefix map it used to send.The server routes them through the same inversion the config reader runs, so a pnpr-served install resolves a scoped dependency from the registry that scope is routed to, which it previously could not: only the default registry and the prefix-addressed ones reached the server. A declared
serverTypereaches it too, so the tarball URLs pnpr omits from the lockfile match the ones the client reconstructs.Built-in scope routes the project has not pointed elsewhere are not declared, so a pnpr server's allowlist is not asked about
npm.jsr.ioon requests that resolve no JSR package.A registry a request only declares is no longer refused up front for being off the server's allowlist — a client describes its whole configuration, including scopes a given resolve never reaches, so a stray
@scope:registryin a developer's~/.npmrcno longer fails every install against a pnpr server that does not serve it. The boundary moves to the fetch itself: an origin the resolve does reach is refused before the request leaves the server, with the same message.This changes the resolve and verify-lockfile request bodies. A pnpr server and its clients have to be on matching versions; the protocol is still experimental and unversioned.
The
registriessetting now declares a registry once, keyed by its URL, with everything about that registry in the entry: how it lays out tarball URLs, the scopes routed to it, and the bare-specifier prefix it answers to.serverTypetells pnpm how the registry lays out its tarball URLs, which decides whether a URL can be omitted frompnpm-lock.yaml:npm— the registry behaves likeregistry.npmjs.org, which also serves a scoped package from its percent-encoded path. Declare this for a faithful mirror or caching proxy of the public registry so its tarball URLs can be omitted too.artifactory— JFrog Artifactory repeats the scope in a scoped package's tarball filename (@acme/widget/-/@acme/widget-1.0.0.tgz) where the npm registry strips it (@acme/widget/-/widget-1.0.0.tgz). Declaring it lets pnpm rebuild that URL, so it is omitted frompnpm-lock.yamlinstead of being written out for every scoped package pnpm/get-npm-tarball-url#16.scopeslists the@-prefixed scopes that resolve from this registry. A bare'@'is the scope-less default registry, the one theregistrysetting names.prefixis the alias a dependency addresses this registry by, as in"foo": "work:^1.0.0".The layout is never inferred from the registry URL, so nothing changes unless you declare it;
registry.npmjs.orgcontinues to behave asnpmwithout being declared. Because the lockfile depends onserverType, it is read frompnpm-workspace.yamlonly — aserverTypein the globalconfig.yamlis ignored, so one developer's machine cannot shape a lockfile their collaborators read back with a different layout. Credentials are rejected in this setting, in a key as well as in a field, and still belong in.npmrc. An entry that routes nothing to itself and matches no configured registry is reported as a warning rather than silently ignored.Migrating
The older
registriesshape, a map of<scope>: <url>strings, still works and needs no change:`namedRegistrie
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.