chore(deps): update all non-major dependencies - #15
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
commit: |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
December 8, 2025 15:51
c76fb0a to
b5d1a53
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
December 11, 2025 09:02
fe10efb to
0780c87
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
December 15, 2025 13:00
9a16c2b to
d1e40fc
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
December 26, 2025 17:06
913fce8 to
39c2031
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
January 6, 2026 21:14
3cc65a0 to
b7ae555
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
January 15, 2026 21:12
1995b8b to
6f1334e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
8 times, most recently
from
February 12, 2026 22:04
5983b0c to
23f3da0
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
February 24, 2026 01:53
0b1ba9e to
81d3ed5
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
February 28, 2026 21:13
05f010c to
7303ac1
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
8 times, most recently
from
March 12, 2026 17:51
0ea3c07 to
2ba000e
Compare
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.12.1→^1.17.0^25.0.2→^25.9.5^3.3.2→^3.3.4^0.1.6→^0.2.2^9.39.2→^9.39.5^13.0.0→^13.0.6^0.40.0→^0.41.122→22.23.210.26.0→10.34.5^19.1.0→^19.2.4Release Notes
nuxt/eslint (@nuxt/eslint-config)
v1.17.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v1.16.0Compare Source
🚀 Features
View changes on GitHub
v1.15.2Compare Source
🐞 Bug Fixes
View changes on GitHub
v1.15.1Compare Source
🐞 Bug Fixes
@eslint/js, fix #647 - by @antfu in #647 (2c1c1)View changes on GitHub
v1.15.0Compare Source
🚀 Features
View changes on GitHub
v1.14.0Compare Source
🚀 Features
no-page-meta-runtime-values- by @danielroe in #641 (b74a0)View changes on GitHub
v1.13.0Compare Source
🚀 Features
eslint-flat-config-utilseslint-plugin-import-liteandeslint-plugin-jsdoc- by @antfu (10bf9)View changes on GitHub
unjs/citty (citty)
v0.2.2Compare Source
compare changes
🚀 Enhancements
🩹 Fixes
-h,--help,-v,--versionargs (#234)💅 Refactors
📖 Documentation
🏡 Chore
✅ Tests
=(#230)❤️ Contributors
v0.2.1Compare Source
compare changes
🩹 Fixes
🏡 Chore
❤️ Contributors
v0.2.0Compare Source
compare changes
🚀 Enhancements
hiddenmeta to hide command (#111)enumarg type (#83)numberarg type (#73)negativeDescriptionfor args (#40)🩹 Fixes
numberarg to be optional (#194)💅 Refactors
node:util.parseArgsfor arg parsing (#218)📦 Build
🏡 Chore
✅ Tests
node:util.parseArgsfor arg parsing (#218)❤️ Contributors
eslint/eslint (eslint)
v9.39.5Compare Source
Bug Fixes
253be16fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)Documentation
74930eddocs: switch build to Node.js 24 (#20894) (Milos Djermanovic)eaec8bbdocs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)Chores
458205fchore: update@eslint/eslintrcand@eslint/jsfor v9.39.5 (#21077) (Francesco Trotta)202117bchore: package.json update for @eslint/js release (Jenkins)d9eb6edtest: disable warning forvm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER(#21074) (Francesco Trotta)7b431a7chore: overridere2dependency for@metascraper/helpers(#21068) (Milos Djermanovic)daf7791chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)daee8baci: use pnpm ineslint-flat-config-utilstype integration test (#20829) (Milos Djermanovic)116d4beci: unpin Node.js 25.x in CI (#20619) (Copilot)v9.39.4Compare Source
Bug Fixes
f18f6c8fix: update dependency minimatch to ^3.1.5 (#20564) (Milos Djermanovic)a3c868ffix: update dependency @eslint/eslintrc to ^3.3.4 (#20554) (Milos Djermanovic)234d005fix: minimatch security vulnerability patch for v9.x (#20549) (Andrej Beles)b1b37eefix: updateajvto6.14.0to address security vulnerabilities (#20538) (루밀LuMir)Documentation
4675152docs: add deprecation notice partial (#20520) (Milos Djermanovic)Chores
b8b4eb1chore: update dependencies for ESLint v9.39.4 (#20596) (Francesco Trotta)71b2f6bchore: package.json update for @eslint/js release (Jenkins)1d16c2fci: pin Node.js 25.6.1 (#20563) (Milos Djermanovic)v9.39.3Compare Source
Bug Fixes
791bf8dfix: restore TypeScript 4.0 compatibility in types (#20504) (sethamus)Chores
8594a43chore: upgrade @eslint/js@9.39.3 (#20529) (Milos Djermanovic)9ceef92chore: package.json update for @eslint/js release (Jenkins)af498c6chore: ignore/docs/v9.xin link checker (#20453) (Milos Djermanovic)isaacs/node-glob (glob)
v13.0.6Compare Source
v13.0.5Compare Source
v13.0.4Compare Source
v13.0.3Compare Source
v13.0.2Compare Source
v13.0.1Compare Source
DavidAnson/markdownlint (markdownlint)
v0.41.1Compare Source
v0.41.0Compare Source
Options.resultVersion(breaking change)LintResults.toString(breaking change)actions/node-versions (node)
v22.23.2: 22.23.2Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0Compare Source
Node.js 22.22.0
v22.21.1: 22.21.1Compare Source
Node.js 22.21.1
v22.21.0: 22.21.0Compare Source
Node.js 22.21.0
v22.20.0: 22.20.0Compare Source
Node.js 22.20.0
v22.19.0: 22.19.0Compare Source
Node.js 22.19.0
v22.18.0: 22.18.0Compare Source
Node.js 22.18.0
v22.17.1: 22.17.1Compare Source
Node.js 22.17.1
v22.17.0: 22.17.0Compare Source
Node.js 22.17.0
v22.16.0: 22.16.0Compare Source
Node.js 22.16.0
v22.15.1: 22.15.1Compare Source
Node.js 22.15.1
v22.15.0: 22.15.0Compare Source
Node.js 22.15.0
v22.14.0: 22.14.0Compare Source
Node.js 22.14.0
v22.13.1: 22.13.1Compare Source
Node.js 22.13.1
v22.13.0: 22.13.0Compare Source
Node.js 22.13.0
v22.12.0: 22.12.0Compare Source
Node.js 22.12.0
v22.11.0: 22.11.0Compare Source
Node.js 22.11.0
v22.10.0: 22.10.0Compare Source
Node.js 22.10.0
v22.9.0: 22.9.0Compare Source
Node.js 22.9.0
v22.8.0: 22.8.0Compare Source
Node.js 22.8.0
v22.7.0: 22.7.0Compare Source
Node.js 22.7.0
v22.6.0: 22.6.0Compare Source
Node.js 22.6.0
v22.5.1: 22.5.1Compare Source
Node.js 22.5.1
v22.5.0: 22.5.0Compare Source
Node.js 22.5.0
v22.4.1: 22.4.1Compare Source
Node.js 22.4.1
v22.4.0: 22.4.0Compare Source
Node.js 22.4.0
v22.3.0: 22.3.0Compare Source
Node.js 22.3.0
v22.2.0: 22.2.0Compare Source
Node.js 22.2.0
v22.1.0: 22.1.0Compare Source
Node.js 22.1.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5Compare Source
Patch Changes
78e29fe: Prevent a craftedpnpm-lock.yamlfrom writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g.../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshotversion: "../../x") is now rejected atiterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.78e29fe: Fixed a path traversal vulnerability where a dependency whose manifestnamewas a scoped path traversal (e.g.@x/../../../<path>) could be written outsidenode_modulesto an attacker-controlled location duringpnpm install, even with--ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as thepnpmand@pnpm/exenpm packages whose bins are placeholders replaced at install time by the host's native binary from a@pnpm/exe.<platform>-<arch>[-musl]optional dependency. Because pnpm installs its own engine with--ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the nativepnpmpackage), and verifies the native binary's npm registry signature before running it.36928be:${...}environment-variable placeholders in thehttpProxy,httpsProxy,noProxy,proxy, andnoproxysettings are no longer expanded when these settings come from a project'spnpm-workspace.yaml. They now receive the same protection already applied toregistry.Platinum Sponsors
Gold Sponsors
v10.34.4: pnpm 10.34.4Compare Source
Patch Changes
352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. Apnpm-workspace.yamlwith a traversal-shapedconfigDependenciesname (such as../../PWNED) or version (such as../../../PWNED) could previously causepnpm installto create symlinks or write package files outsidenode_modules/.pnpm-configand the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.352ae48: Reject path-traversal and reserved dependency aliases (such as../../../escape,.bin,.pnpm, ornode_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoistednode_modulesdirectory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.The
nodeLinker: hoistedgraph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.352ae48: Preventpnpm patch-removefrom removing files outside the configured patches directory.217fbe0: Hardened the warning printed when a project.npmrcuses environment variables in registry/auth settings: the suggestedpnpm config setcommand is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled.npmrcand a shell expands$(...), backticks, and$VAReven inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.Platinum Sponsors
Gold Sponsors
v10.34.3: pnpm 10.34.3Compare Source
.npmrc(action may be required)Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands
${ENV_VAR}placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:.npmrc—registry,@scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken,_auth,_password,username,tokenHelper,cert,key);pnpm-workspace.yaml.This release also closes a bypass where a project
.npmrccould setuserconfig,globalconfig, orprefixto make pnpm load a repo-supplied file as trusted config (via@pnpm/npm-conf@3.0.3).Environment variables are still expanded in trusted config: your user-level
~/.npmrc, the global config, CLI options, and environment config.If your authentication broke after upgrading, move the token out of the committed
.npmrc:Or keep the
${NPM_TOKEN}line but put it in your user-level~/.npmrcinstead of the repo. In GitHub Actions,actions/setup-nodewithregistry-urlalready writes a user-level.npmrc, soNODE_AUTH_TOKENkeeps working. For other CI where editing each pipeline is hard, setNPM_CONFIG_USERCONFIG=.npmrcin the CI environment to declare the project.npmrctrusted.See https://pnpm.io/npmrc for full migration details.
Patch Changes
.npmrcuses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by runningpnpm config set "<key>" <value>to store it in the global config, or by keeping the${...}line in the user-level~/.npmrc— with a link to https://pnpm.io/npmrc..npmrccan no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could setuserconfig,globalconfig, orprefixto point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to settokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace.npmrcfiles are read. Fixed by upgrading@pnpm/npm-confto3.0.3.Platinum Sponsors
Gold Sponsors
v10.34.2: pnpm 10.34.2Compare Source
.npmrc(action may be required)Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands
${ENV_VAR}placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:.npmrc—registry,@scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken,_auth,_password,username,tokenHelper,cert,key);pnpm-workspace.yaml.This release also closes a bypass where a project
.npmrccould setuserconfig,globalconfig, orprefixto make pnpm load a repo-supplied file as trusted config (via@pnpm/npm-conf@3.0.3).Environment variables are still expanded in trusted config: your user-level
~/.npmrc, the global config, CLI options, and environment config.If your authentication broke after upgrading, move the token out of the committed
.npmrc:Or keep the
${NPM_TOKEN}line but put it in your user-level~/.npmrcinstead of the repo. In GitHub Actions,actions/setup-nodewithregistry-urlalready writes a user-level.npmrc, soNODE_AUTH_TOKENkeeps working. For other CI where editing each pipeline is hard, setNPM_CONFIG_USERCONFIG=.npmrcin the CI environment to declare the project.npmrctrusted.See https://pnpm.io/npmrc for full migration details.
Patch Changes
packageManagerfield, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global.npmrc— defaulting to the public npm registry, instead of the repository's project/workspace settings.packageManagerfield (orpnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exactname@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip..npmrcand `pnpm-workspaceConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.