build: update all non-major dependencies - #3970
Open
angular-robot wants to merge 1 commit into
Open
Conversation
angular-robot
added
action: merge
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates various dependencies across the repository, including core packages such as renovate, firebase-tools, zod, and several @opentelemetry and @InQuirer packages to their latest versions. No review comments were provided for this pull request.
angular-robot
force-pushed
the
ng-renovate/all-non-major-dependencies
branch
26 times, most recently
from
September 11, 2026 17:31
0555f3e to
06d86aa
Compare
angular-robot
force-pushed
the
ng-renovate/all-non-major-dependencies
branch
13 times, most recently
from
September 13, 2026 15:29
d05d851 to
b7d23b7
Compare
See associated pull request for more information.
angular-robot
force-pushed
the
ng-renovate/all-non-major-dependencies
branch
from
September 13, 2026 21:29
b7d23b7 to
a29f494
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.20.0→2.22.08.7.0→8.7.24.1.0→4.1.17.59.0→7.59.13.2.1→3.2.224.13.3→24.13.412.18.0→12.19.014.3.0→14.4.015.28.2→15.30.01.2.3→1.3.111.25.0→11.27.044.57.1→44.82.44.48.0→4.49.02.9.0→2.9.10.16.2→0.16.3Release Notes
googleapis/js-genai (@google/genai)
v2.22.0Compare Source
Features
Bug Fixes
v2.21.0Compare Source
Features
SBoudrias/Inquirer.js (@inquirer/prompts)
v8.7.2Compare Source
@inquirer/prompts@8.7.2
What's new
@inquirer/core, #2255, closes #1816).confirm()now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).Included
@inquirer/checkbox@^5.2.5@inquirer/confirm@^6.3.2@inquirer/editor@^5.3.3@inquirer/expand@^5.1.5@inquirer/input@^5.1.6@inquirer/number@^4.2.3@inquirer/password@^5.2.2@inquirer/rawlist@^5.3.5@inquirer/search@^4.3.3@inquirer/select@^5.2.5v8.7.1Compare Source
@inquirer/prompts@8.7.1
What's new
@inquirer/typeto an exact version in their published manifests. Since these type definitions leak into consumers'tscruns, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).Included
@inquirer/checkbox@^5.2.4@inquirer/confirm@^6.3.1@inquirer/editor@^5.3.2@inquirer/expand@^5.1.4@inquirer/input@^5.1.5@inquirer/number@^4.2.2@inquirer/password@^5.2.1@inquirer/rawlist@^5.3.4@inquirer/search@^4.3.2@inquirer/select@^5.2.4microsoft/rushstack (@microsoft/api-extractor)
v7.59.1Sat, 05 Sep 2026 00:15:08 GMT
Version update only
puppeteer/puppeteer (@puppeteer/browsers)
v3.2.2Compare Source
Miscellaneous Chores
Dependencies
Bug Fixes
firebase/firebase-js-sdk (firebase)
v12.19.0Compare Source
For more detailed release notes, see Firebase JavaScript SDK Release Notes.
What's Changed
@firebase/ai@2.16.0
Minor Changes
6b17ef5#10319 - Fixed the issue where the SDK hardcodes invalid 'function' role, causing 400 errors during function calling on gemini-3.6-flashPatch Changes
6f86596#10320 - Fixed a client-side validation guardrail that incorrectly blockedtext/x.enumwhenresponseSchemaorresponseJsonSchemawas provided. The SDK now correctly accepts bothapplication/jsonandtext/x.enumfor structured outputs.firebase@12.19.0
Minor Changes
6b17ef5#10319 - Fixed the issue where the SDK hardcodes invalid 'function' role, causing 400 errors during function calling on gemini-3.6-flashPatch Changes
8676365,8316986,b74b53c,0e8554b,50213a1,6b17ef5,392bce0,6f86596]:@firebase/analytics@0.10.25
Patch Changes
50213a1#10233 - Update api-extractor and documentation pipeline. Includes some fixes to documentation comments and links.@firebase/analytics-compat@0.2.31
Patch Changes
50213a1]:@firebase/app@0.16.2
Patch Changes
@firebase/app-compat@0.5.18
Patch Changes
@firebase/auth@1.13.6
Patch Changes
8676365#10325 (fixes #10318) - Allow IndexedDB persistence reconnection on demand afterpagehideevents, fixingDatabase is closingerrors duringsignInWithPopupauthentication on iPadOS and iOS Safari.8316986#10326 (fixes #10311) - Gracefully fall back to in-memory persistence when persistence initialization fails or storage is inaccessible, preventing initialization deadlocks and ensuringauthStateReady()resolves.b74b53c#10335 - Wrap storage and persistence errors inFirebaseError(auth/internal-error) during current user updates, ensuringerror.codeis always defined and attaching the underlying exception undererror.customData.originalError.50213a1#10233 - Update api-extractor and documentation pipeline. Includes some fixes to documentation comments and links.@firebase/auth-compat@0.6.11
Patch Changes
8676365,8316986,b74b53c,50213a1]:@firebase/firestore@4.17.2
Patch Changes
0e8554b#10301 - feat(firestore): support conversion and serialization for Temporal.Instant to Firestore's Timestamp50213a1#10233 - Update api-extractor and documentation pipeline. Includes some fixes to documentation comments and links.392bce0#10340 - Fixes fetch connection error messages that were undefined.@firebase/firestore-compat@0.4.14
Patch Changes
0e8554b,50213a1,392bce0]:@firebase/messaging@0.13.3
Patch Changes
50213a1#10233 - Update api-extractor and documentation pipeline. Includes some fixes to documentation comments and links.@firebase/messaging-compat@0.2.30
Patch Changes
50213a1]:firebase/firebase-admin-node (firebase-admin)
v14.4.0: Firebase Admin Node.js SDK v14.4.0Compare Source
New Features
Miscellaneous
@excludeFromDocstag to filter generated docs (#3206)firebase/firebase-tools (firebase-tools)
v15.30.0Compare Source
dataconnect_executetool asdataconnect_execute_in_emulatorto run GraphQL queries and mutations on the local SQL Connect emulator.ONEMCP_SERVERSwith a selection of remote tools.Mcp-Param-RegionHTTP header workaround inOneMcpServerfor MCP routing support.v15.29.0Compare Source
FIREBASE_DEBUG_PATHenvironment variable to customize the debug log output location.humanReadableDescriptionfield to MCP tools and use it in--generate-tool-listoutput.TypeErrorabout stream chunk types, hiding why the runtime became unreachable (#10876).firebase ext:migrate.firebase ext:migrateRich-Harris/magic-string (magic-string)
v1.3.1Compare Source
pnpm/pnpm (pnpm)
v11.27.0: pnpm 11.27Compare Source
Minor Changes
nodeDownloadMirrorscan now be set in the global config file (config.yaml) and through thePNPM_CONFIG_NODE_DOWNLOAD_MIRRORSenvironment variable, so a Node.js download mirror can be configured once for a machine instead of in every workspace #12124, #13611.PNPM_CONFIG_NODE_DOWNLOAD_MIRRORS='{"release":"https://npmmirror.com/mirrors/node/"}'Added a new setting
trustPolicyExcludePrune(default:false). When enabled,pnpm add,pnpm update, andpnpm removeprune the entries oftrustPolicyExcludeinpnpm-workspace.yamlthat the freshly written lockfile no longer resolves: versions that are gone are dropped (an entry is removed once none of its versions remain), and entries for packages that are no longer in the lockfile are removed too. Name patterns (@scope/*) are always kept. The cleanup is skipped when the install's lockfile does not cover the whole workspace (sharedWorkspaceLockfile: false), since entries another project still needs would look stale.Patch Changes
pnpm now reads the
packageManager,devEngines.packageManagerand runtime pins from the workspace root'spackage.jsonwhenlockfileDiris set. A project that moved its lockfile lost the pins it declared there #14633.Fixed
pnpm add -g,pnpm update -g, andpnpm remove -gmutating global bins or install directories after only partially reading an installed package group. If any declared package manifest is missing, malformed, or unreadable, pnpm now fails before activation or removal and leaves the existing global installation intact pnpm/pnpm#13796.fetch-timeoutnow limits how long a request may make no progress. The timer restarts on every chunk that arrives. A large download over a slow connection is no longer aborted while data is still coming in. A connection that stops delivering data still fails afterfetch-timeout#14604.pnpm peers checkno longer reports a peer dependency declared asworkspace:^,workspace:~, or a bareworkspace:as unmet. pnpm reported these as unmet whatever version the linked workspace project supplied #14770.A
readPackagehook that edits its argument in place no longer changes what a later install in the same command resolves. Adeprecatednotice read from the lockfile no longer carries over to another install either #13988.pnpm installnow auto-installs missing transitive peers when workspace projects share a dependency at different depths. This also removes incomplete duplicate peer contexts from the lockfile. Fixes pnpm/pnpm#14840.GitHub Actions updates now stop if an action reference changes while its versions are being resolved. Unrelated workflow edits are preserved.
GitHub Actions homepage links no longer expose server credentials. GitHub server URLs now require HTTPS, with HTTP allowed only for loopback hosts.
pnpm licenses listnow reports the runtime downloaded throughdevEngines.runtimewithonFail: "download". The command previously failed withERR_PNPM_UNSUPPORTED_PACKAGE_TYPE#14172.pnpm no longer creates a project
pnpm-lock.yamlwhendevEngines.packageManager.onFailisdownloadand lockfile writing is turned off withlockfile: falseor--no-lockfile. pnpm still switches to the pinned version #14728.A
registryor@scope:registryset in an.npmrcnow wins over the registry apnpm logincredential stored in the globalconfig.yamlpoints at. Previously, after logging in to one registry, installs in a project whose.npmrcnamed a private registry went to the logged-in registry instead. They now go to the registry the.npmrcnames #14614.A patch that gives a dependency a
preinstall,install, orpostinstallscript, or abinding.gyp, now runs that build. pnpm asks for build approval first, so the package is listed under "Ignored build scripts" until it is allowed to build. pnpm 12 ran nothing, and pnpm 11 ran it without asking #14648.Registries that share a host but differ by URL path — one JFrog Artifactory, Nexus, AWS CodeArtifact or GitLab Packages instance serving several repositories — now get a metadata cache directory each. Previously they shared one, so resolving a package from one of them could answer with another's versions, integrity hashes and tarball URLs and fail with
ERR_PNPM_TARBALL_URL_MISMATCH#13558.The URL scheme is part of the cache directory name too, so an
httpregistry can no longer hand its metadata — which can be rewritten in transit — to a resolution configured forhttpsat the same host.The first install after upgrading refetches registry metadata once. The package store is untouched.
pnpm cache viewnow labels each entry with the full registry URL. It printedregistry.npmjs.orgbefore and printshttps://registry.npmjs.org/now.pnpm cache list-registriesandpnpm cache listprint the new directory names. Scripts that parse either command need updating.Updated the embedded Node.js release keys to the current canonical
nodejs/release-keyslist.pnpm sbomnow omits package author fields when the manifest author name is empty or contains only whitespace pnpm/pnpm#14685. In a filtered or split workspace run, only a project with noauthorfield inherits the workspace root's author.pnpm sbom --sbom-format spdxnow writescreationInfo.createdwith whole seconds, such as2026-09-08T10:38:21Z. The timestamp carried fractional seconds, which strict SPDX consumers rejected #14684.Windows filesystem operations now retry permission errors for up to one second. Permanent permission errors previously delayed failure by a minute. Sharing and lock violations retain their one-minute retry budget pnpm/pnpm#14682.
pnpm now writes
node_modules/.package-map.jsononly whennodeExperimentalPackageMapis enabled. Nothing reads the file without that setting. An install that stops writing the map removes the one a previous install left.pnpm now unpacks a downloaded runtime archive into a randomly named directory inside the store. It previously used a predictable path, where another user of a shared store could plant a symlink and redirect the write outside the store (GHSA-vwc7-r8mq-g2x9).
Platinum Sponsors
Gold Sponsors
v11.26.0: pnpm 11.26Compare Source
Minor Changes
Catalogs can now resolve workspace dependencies through the
workspace:protocol.pnpm removeandpnpm updatenow accept--trust-lockfile,--no-trust-lockfile,--trust-policy,--trust-policy-exclude, and--trust-policy-ignore-after.pnpm removechecks the whole lockfile against the active policies unless--trust-lockfileis set.Added
pnpm change checkfor CI validation of package versions against theversioning.epicsbands andversioning.fixedgroups inpnpm-workspace.yaml.Patch Changes
Fetch and tarball errors and retry logs now hide URL credentials, query strings, and fragments that could expose secrets.
Fixed a race during config dependency updates that could redirect a lockfile write through a symlink #14322.
pnpm add --allow-build=!<pkg>now correctly denies builds, including in global installs.pnpm approve-builds <pkg>andpnpm approve-builds !<pkg>now save decisions even when the package is not awaiting approval, with a warning #14067.Fixed
pnpm audit --fixfailing without a value or when followed by another flag.pnpm audit --fix=overridenow respectssaveExactandsavePrefixwhen writing overrides #13261, #11523.pnpm auditnow excludes ignored advisories from vulnerability totals and severity counts, and reports them separately #14535.pnpm deployno longer requiresinjectWorkspacePackages. If a workspace dependency's peer has multiple possible versions, deployment reportsERR_PNPM_DEPLOY_AMBIGUOUS_PEERwith the conflicting versions. Pin the peer withoverridesto deploy without injection #9386.Fixed concurrent installs sharing a store occasionally failing with an
ENOENTerror while importing a package file #14353.Fixed installation failures when a linked local dependency provides a peer dependency also provided by an ancestor, including with
pnpm deploy --legacy.pnpm install --node-linker=hoistedno longer downloads skipped optional dependencies whennode_modulesalready exists #14139.Fixed
pnpm installrejecting a symlinked lockfile when config dependencies are unchanged. Updates to config dependencies also preserve lockfiles with a byte order mark. Writes through symlinked lockfiles remain blocked #14372.pnpm installnow relinks workspace packages whenpublishConfig.linkDirectorychanges. Frozen installs require the lockfile to be regenerated #14488.Auto-installed optional peers now satisfy their declared range even when the workspace root uses a version outside that range #13867.
Fixed global virtual store paths for dependency cycles to consistently account for the runtime engine when dependencies have allowed builds #14341.
Standalone installations now preserve the bundled
node-gypfiles needed to build native dependencies.Downloaded runtimes are now available to dependency lifecycle scripts during installation.
Node.js downloads from
nodeDownloadMirrorsnow use URL-scoped npm credentials, including bearer tokens, basic auth, andtokenHelper#14334.Fixed
globalDirandglobalBinDirhandling in global configuration and environment variables, including~/expansion. This fixespnpm add -gfailing afterpnpm config set -g global-bin-dir#14336.The JavaScript pnpm can again switch to the project's pinned pnpm version on hosts without a matching native binary. If the requested version requires an unavailable native binary, the error now identifies the unsupported host #13622.
Global
pnpm configcommands now skip project package manager version switching, allowing authentication to be configured before downloading the pinned version #14463.pnpm self-update,pnpm with, and automatic version switching no longer wait through registry retries when a configured registry has no signatures andregistry.npmjs.orgis unavailable #14483.Fixed argument forwarding on Windows with
shellEmulatorenabled. Trailing backslashes, line breaks, and literal shell expressions are preserved #14548.Relative
scriptShellpaths now resolve from the workspace root. Bare command names such asbashstill usePATH#14422.pnpm importnow preserves the project-local lockfile whenlockfileDirpoints elsewhere and restores the destination lockfile on failure. Branch lockfile imports leave the shared lockfile unchanged #14563.catalogModeand--save-catalogno longer move local paths, tarballs, orworkspace:<path>specifiers into catalogs #14437.--side-effects-cache,--no-side-effects-cache, andPNPM_CONFIG_SIDE_EFFECTS_CACHEnow toggle only the local cache, preserving any remote cache configured insideEffectsCache.pnpm unpublishnow handles registry two-factor authentication challenges through web authentication or a one-time password prompt #14464.pnpm outdatedandpnpm updatenow follow GitHub Actions references using self-repository syntax, such asuses: $/.github/actions/setup.pnpm removenow accepts--unsafe-perm.Platinum Sponsors
Gold Sponsors
renovatebot/renovate (renovate)
v44.82.4Compare Source
Bug Fixes
<details>block (#45902) (65f8036)Documentation
v44.82.3Compare Source
Bug Fixes
v44.82.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.82.1Compare Source
Bug Fixes