Skip to content

chore(deps): update all non-major dependencies#61

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#61
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Sep 8, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@nuxt/schema (source) ^4.4.2 → ^4.4.8 age confidence devDependencies patch
@types/node (source) ^25.6.0 → ^25.9.3 age confidence devDependencies minor
mocha (source) ^11.7.5 → ^11.7.6 age confidence devDependencies patch
oxlint (source) ^1.62.0 → ^1.69.0 age confidence devDependencies minor
pnpm (source) 11.2.2 → 11.6.0 age confidence packageManager minor
release-it ^20.0.1 → ^20.2.0 age confidence devDependencies minor
vitest (source) ^4.1.5 → ^4.1.8 age confidence devDependencies patch
vscode ^1.75.0 → ^1.124.2 age confidence engines minor
vue-component-meta (source) ^3.2.7 → ^3.3.4 age confidence devDependencies minor

Release Notes

nuxt/nuxt (@​nuxt/schema)

v4.4.8

Compare Source

4.4.8 is a hotfix release to address an issue running the dev server on MacOS.

👉 Changelog

compare changes

🩹 Fixes
  • vite: Shorter socket name for macOs with tmp fallback (#​35265)
  • kit: Respect type option in findPath (#​35272)
  • deps: Update nuxt/scripts presets (905621594)
  • nuxt: Revert unhead dependency back to v2 (e6d578fea)
📖 Documentation
  • Fix many typos (#​35266)
  • Explain static fallback pages (#​35277)
  • Change null to undefined in data-fetching docs to match actual types (#​35301)
  • Fix broken internal links, useAsyncData watch type, and NuxtError type (#​35303)
❤️ Contributors

v4.4.7

Compare Source

4.4.7 is a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes
  • nitro: Assign noSSR before deciding payload extraction (#​35108)
  • vite: Avoid filtering out dirs with shared prefix from allowDirs (#​35112)
  • nuxt: Use resolve from pathe for buildCache path boundary check (#​35111)
  • nuxt: Prevent sibling-directory traversal in test component wrapper (#​35110)
  • nitro: Pass event data to isValid in dev clipboard-copy listener (#​35109)
  • nuxt: Validate protocols in reloadNuxtApp path before reload (#​35115)
  • vite: Prefix public asset virtuals with null byte (9e303b438)
  • nuxt: Re-run getCachedData after initial fetch (#​35122)
  • nuxt: Propagate useFetch/useAsyncData factory types (#​35133)
  • vite: Close vite dev server on nuxt close (a10a68abc)
  • kit,nuxt: Handle cancelling prompts to install packages (e84813229)
  • kit: Avoid excluding node-context files in legacy tsconfig (#​35152)
  • nuxt: Handle missing payload in chunkError listener (#​35155)
  • nuxt: Await in-lifght template generation when closing nuxt (#​35181)
  • nuxt: Clarify page and layout usage warnings (#​35184)
  • webpack: Surface compilation errors when stats.toString is empty (073b07851)
  • nuxt: Reject prototype-chain keys in the island registry (#​35205)
  • nuxt: Apply isScriptProtocol guard to navigateTo open option (#​35206)
  • nuxt: Prevent server-only page island from recursing via <NuxtPage> (#​35198)
  • rspack,webpack: Require loopback host when missing same-origin signals (#​35200)
  • nitro: Gate chrome devtools workspace endpoint to local requests (#​35201)
  • nuxt: Escape props in <NuxtClientFallback> ssr output (#​35199)
  • kit: Improve TS extension stripping/substitutions (#​35233)
  • nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#​35235)
  • nuxt: Escape <NoScript> slot content (4b054e9d9)
  • nuxt: Match route rules case-insensitively to mirror vue-router (07e39cd6f)
  • nuxt: Reject script-capable protocols in <NuxtLink> href (0103ce06f)
  • nuxt: Block path-normalization open redirect in navigateTo (2cce6fb02)
  • nuxt: Reject cross-origin paths in reloadNuxtApp (e447a793c)
  • vite: Bind vite-node IPC to a permissioned filesystem socket (1f9f4767a)
💅 Refactors
  • kit,nuxt,vite: Use es2023 array methods (#​34980)
  • nuxt: Replace runInNewContext with AST walker (d72a89ef4)
📖 Documentation
  • Document vite client and server options (#​35090)
  • Add dedicated module dependencies page (#​35171)
  • Add nodeTsConfig and sharedTsConfig options (#​35231)
  • Edit for clarity and grammar (#​35214)
🏡 Chore
✅ Tests
  • Update test for js payload rendering (bdcb81536)
  • Cover add regression test for hmr in sibling local layers (#​35125)
  • Improve reliability of hmr test (1d709b3cc)
🤖 CI
  • Always run all tests for 4.x/3.x (0dc4665cf)
  • Migrate from tibdex (ded29dc0f)
  • Add zizmor github actions check (#​35089)
  • Update to agentscan v1.8.0 (#​35120)
  • Automatically close PRs from automated accounts (#​35161)
  • Disable provenance-change enforcement in dependency-review (a2cf43e68)
❤️ Contributors

v4.4.6

Compare Source

4.4.6 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes
  • vite: Use spa entry for vite-node fallback (#​35037)
  • vite: Invalidate SSR module cache when modules are invalidated via plugin hooks (a86657a0e)
  • nuxt: Match deduplicated resolveComponent calls in jsx blocks (#​35028)
  • nuxt: Prefer our own builder/server deps (#​35029)
  • nuxt: Update useFetch key even with watch: false (#​35002)
  • nitro: Mark @babel/plugin-syntax-typescript as optional peer dep (#​35041)
  • nitro: Add json extension to payload cache items (#​35043)
  • nuxt: Handle errors fetching app manifest (#​35050)
  • nuxt: Encode html-significant characters in external redirect body (#​35052)
  • nuxt: Preserve setPageLayout props on same-path navigation (#​35055)
  • vite: Don't strip buildAssetsDir from vite-node SSR ids (#​35040)
  • nuxt: Mark useLoadingIndicator properties as readonly (#​35062)
  • vite: Strip queries in css inline styles map (#​35067)
  • nitro: Validate island request hash matches props (#​35077)
  • nitro: Use regexp to strip query (163e18d4b)
  • nitro: Use statusCode for nitro v2 compatibility (952f6841e)
  • nitro-server: Re-export h3 named symbols statically (cd99001c8)
  • nuxt: Render component-less parent routes during client-side nav (#​35036)
  • kit: Respect tsConfig.exclude in legacy tsconfig.json (#​35079)
  • nuxt: Run middleware for page islands (#​35092)
💅 Refactors
  • rspack,webpack: Extract same-origin check for dev middleware (#​35051)
📖 Documentation
  • Remove CSB, set node 22 and use steps for clarity (#​35066)
🏡 Chore
✅ Tests
🤖 CI
❤️ Contributors

v4.4.5

Compare Source

4.4.5 is the next patch release.

👉 Changelog

compare changes

🔥 Performance
  • kit: Cache layer roots and short-circuit isIgnored relative (#​35015)
🩹 Fixes
  • vite: Resolve vite clientServer with ssr: false (#​34959)
  • nitro: Correct payload route rule for / + override ssr: true (#​34990)
  • nitro: Break recursive rendering deadlocks during prerender (#​34939)
  • vite: Drop redundant css link when entry styles are inlined (#​34950)
  • vite: Sort optimizeDeps.include in pre-bundle hint (#​34976)
  • nuxt: Only force suspense remount after first resolve (#​34949)
  • kit: Read .env before resolving nuxt schema (#​34958)
  • nitro: Preserve serverHandlers array after nitro:config (#​34985)
  • nuxt: Cast partial nitro handlers when prepending to server arrays (61dcde4db)
  • vite: Only consider CSS inlined when styles are actually emitted (#​35006)
  • nuxt: Dedupe getCachedData for concurrent callers sharing a key (#​34999)
  • nuxt: Respect factory fetch/baseURL options in server useFetch (#​35003)
  • nuxt: Handle string presets in auto-imports (#​35013)
  • nuxt: Correct island transform for server pages and 'deep' mode (#​35005)
  • vite: Inline css for non-island children of server components (#​35001)
  • nuxt: Defer head DOM updates until page transition finishes (#​35016)
  • nuxt: Explicitly freeze head during island plugin phase (#​35010)
  • vite: Inline css imported from non-vue js modules (#​35020)
📖 Documentation
  • Add warning about routing in server components (#​34994)
🏡 Chore
✅ Tests
  • Extract server components fixture + add some failing tests (#​34995)
  • Isolate buildDir per matrix project for shared fixtures (#​35007)
  • Remove tests for 5.x runtimeBaseURL fature (816c25487)
❤️ Contributors

v4.4.4

Compare Source

mochajs/mocha (mocha)

v11.7.6

Compare Source

🩹 Fixes
  • make describe().timeout() work (aafe6fd)
  • test: replace wmic usage with native Windows API (#​5694) (73ebdfa)
🧹 Chores
oxc-project/oxc (oxlint)

v1.69.0

Compare Source

🚀 Features
🐛 Bug Fixes
📚 Documentation
  • dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#​22965) (Boshen)

v1.68.0

Compare Source

🚀 Features
  • e4b1f46 linter/typescript: Implement method-signature-style rule (#​22679) (Mikhail Baev)
  • bc462ca linter/vue: Implement no-reserved-component-names rule (#​22741) (bab)
  • ef9e751 linter/vue: Implement component-definition-name-casing rule (#​22818) (bab)
  • d67f51a linter/vue: Implement require-prop-type-constructor rule (#​22708) (bab)
  • 8422e8b linter/jsdoc: Implement require-yields-description rule (#​22805) (Mikhail Baev)
  • fe93f97 linter/eslint: Implement prefer-named-capture-group rule (#​22759) (Sebastian Poxhofer)

v1.67.0

Compare Source

🚀 Features

v1.66.0

Compare Source

🚀 Features
  • 0440b0f linter/eslint: Implement id-match rule (#​22379) (Vladislav Sayapin)
  • 65bf119 linter: Implement react no-object-type-as-default-prop (#​22481) (uhyo)
  • 2a6ddce linter/eslint: Implement no-implied-eval rule (#​22391) (Vladislav Sayapin)
  • 625758a linter/vitest: Implement padding-around-after-all-blocks rule (#​21788) (kapobajza)
  • 37680b0 linter: Implement react no-unstable-nested-components (#​22248) (Jovi De Croock)
  • d8d9c74 linter: Implement import/newline-after-import rule (#​19142) (Ryuya Yanagi)

v1.65.0

Compare Source

🚀 Features
  • 5478fb5 linter/jsdoc: Implement require-throws-description rule (#​22386) (Mikhail Baev)
  • c73225e linter/eslint: Implement prefer-arrow-callback rule (#​22312) (박천(Cheon Park))
  • de82b59 linter: Add support for eslint-plugin-jsx-a11y-x (#​22356) (mehm8128)
  • f44b6c8 linter: Fill schemas DummyRuleMap with built-in rules (#​22288) (Sysix)

v1.64.0

Compare Source

🚀 Features
🐛 Bug Fixes

v1.63.0

Compare Source

📚 Documentation
pnpm/pnpm (pnpm)

v11.6.0

Compare Source

Minor Changes

  • pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.

  • 615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:

    npm_config_//registry.npmjs.org/:_authToken=<token>
pnpm_config_//registry.npmjs.org/:_authToken=<token>

    This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

  • Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
  • Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #​12324.
  • Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g. @nx/nx-win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them #​11702.

v11.5.3

Compare Source

Patch Changes

  • Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from .npmrc, and in workspace registry URLs from pnpm-workspace.yaml. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config.

  • Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution.

  • Avoid writing packageManagerDependencies to pnpm-lock.yaml when package manager policy is set to onFail: ignore or pmOnFail: ignore #​12228.

  • Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest.

  • Using the $ version reference syntax in overrides (e.g. "react": "$react") now prints a deprecation warning. The syntax still works, but catalogs are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with the catalog: protocol instead.

  • Fixed pnpm config get globalconfig to return the global config.yaml path again pnpm/pnpm#11962.

  • Fixed bare --color so it does not consume the following CLI flag, allowing command shorthands like --parallel to expand correctly and forms like pnpm --color with current <command> to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.

  • Fix pnpm install ignoring enableGlobalVirtualStore toggle by including it in the workspace state settings check #​12142.

  • Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.

    This covers two paths that select an executable from repository-controlled input:

    • pacquet install engine — declaring pacquet (or @pnpm/pacquet) in configDependencies opts in to pnpm's Rust install engine. pnpm now verifies that the installed pacquet shim and the host's @pacquet/<platform>-<arch> binary carry a valid npm registry signature for their exact name@version, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.
    • automatic version switch / self-update — the packageManager / devEngines.packageManager field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of pnpm, @pnpm/exe, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command.

    In both cases the signature is verified over the installed integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint.

  • Made peer-dependent deduplication deterministic. When a peer-suffixed package variant was a subset of two or more mutually incompatible larger variants, the variant it collapsed into depended on the order importers were resolved in, which varies between machines. This could resolve the same workspace to different lockfiles on different platforms and make pnpm dedupe --check alternate between passing and failing.

  • Reject invalid package names and versions from staged tarball manifests before deriving filenames for pnpm stage download.

  • Clarified in CLI help that the pnpm store is trusted shared state and store integrity checks are corruption detection, not a tamper boundary for untrusted store writers.

  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.

  • Require trusted package identity before package-name allowBuilds entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the allowBuilds key. Lockfile verification now rejects lockfiles where a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.

  • Security: pnpm now verifies the OpenPGP signature of a downloaded Node.js runtime's SHASUMS256.txt before trusting its integrity hashes.

    When a repository requests a Node.js runtime (e.g. via devEngines.runtime / useNodeVersion), the download mirror is repository-configurable through node-mirror:<channel>. The integrity of the downloaded binary was only checked against SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy by serving a tampered binary together with a matching SHASUMS256.txt. pnpm then executes the binary (for example to run lifecycle scripts).

    pnpm now fetches SHASUMS256.txt.sig and verifies the detached OpenPGP signature against the Node.js release team's public keys, which ship embedded in the pnpm CLI. A mirror that serves a tampered binary cannot also produce a valid signature, so the download fails to verify. The embedded keys are kept current by a release-time check against the canonical nodejs/release-keys list.

    The musl variants from the hardcoded unofficial-builds.nodejs.org mirror are not repository-configurable and are signed by a different key, so they continue to be trusted over TLS.

v11.5.2

Compare Source

Patch Changes

  • Peer dependency resolution now reuses the peer contexts already recorded in the lockfile when those providers are still present in the dependency graph and still satisfy the peer ranges. This avoids unnecessary peer-context rewrites during lockfile regeneration. Current manifest choices remain authoritative: a newly added, explicitly updated, or aliased direct provider, a changed nested provider, or a locked version that no longer satisfies the range still takes precedence.

  • The lockfile verifier now checks that a registry entry pinning an explicit tarball URL points at the artifact the registry's own metadata lists for that name@version. Previously a tampered lockfile could pair a trusted name@version with an attacker-chosen tarball URL (and a matching integrity for those bytes), so the install fetched the attacker's bytes. A mismatch — or any entry that can't be confirmed against the registry — is rejected with ERR_PNPM_TARBALL_URL_MISMATCH. Non-registry resolutions (file:, git-hosted, etc.) and registry entries without an explicit tarball URL (the URL is reconstructed from name+version+registry, so it is inherently bound) are unaffected; non-standard registry tarball URLs (npm Enterprise, GitHub Packages) still pass because they match the metadata.

  • Fix pnpm update --recursive --lockfile-only <pkg>@&#8203;<version> crashing with Invalid Version when the catalog entry for <pkg> is a version range (e.g. ^21.2.10) and catalogMode is strict or prefer. The catalog–version comparison now skips the equality check when either side is a range rather than passing a range to semver.eq(), so range specifiers fall through to the existing mismatch handling instead of throwing #​11570.

  • Avoided a Node.js crash when pnpm exits after network requests on Windows.

  • Fixed packages being materialized into the virtual store without their root-level files (package.json, LICENSE, README, root entrypoints) when multiple pnpm install processes ran against the same store/workspace concurrently. The fast import path used to destructively empty the shared target directory, so a concurrent importer could wipe files another importer had already written; if the surviving files included the package.json completion marker, every later install treated the broken directory as complete and never repaired it. The fast path now imports directly only when it can create the target directory exclusively, and otherwise builds the package in a private temp directory and atomically renames it into place #​12197.

  • Fix dependency build scripts not running under the global virtual store (enableGlobalVirtualStore).

    In a workspace install, dependency build scripts are deferred to a single rebuild pass (buildProjects). That pass resolved each package's location from the classic node_modules/.pnpm/<depPathToFilename> layout, which does not exist under the global virtual store — so native dependencies (e.g. packages using node-gyp / prebuild-install) were never built and failed to load at runtime (Cannot find module .../build/Release/*.node).

    buildProjects now resolves the global-virtual-store projection directory (<storeDir>/links/<hash>, computed with the same graph hash the installer uses) when enableGlobalVirtualStore is set, and serializes concurrent builds of the same shared projection so parallel workspace projects don't race on the same directory.

  • Don't promote a runtime: dependency (such as the Node.js version from devEngines.runtime or pnpm runtime set) into a catalog when catalogMode is strict or prefer. A runtime: dependency round-trips to devEngines.runtime, which only recognizes the runtime: protocol; cataloging it rewrote the manifest entry to catalog:, which broke that round-trip, stranded it in devDependencies, and left devEngines.runtime untouched.

  • Skip lockfile minimumReleaseAge/trustPolicy verification for non-registry tarball protocols (for example file:), so local tarball dependencies are not incorrectly checked against npm registry metadata.

v11.5.1

Compare Source

Patch Changes
  • Improve pnpm audit performance by pruning non-vulnerable lockfile subtrees and stopping path enumeration once vulnerable findings reach the path cap.
  • Avoid crashing when the workspace state cache is partially written or malformed.
  • Set npm_config_user_agent for root lifecycle scripts during headless installs.
  • Preserve the integrity field of a remote (non-registry) tarball dependency when its lockfile entry is rebuilt. Re-resolving such a dependency without re-fetching it (for example via pnpm update, or when another dependency changes) produced a resolution with no integrity — URL/tarball resolvers only learn the integrity after the tarball is downloaded — so the previously recorded integrity was dropped, making later installs fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY #​12067.
  • Normalize a string repository field into the { type, url } object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a string repository with a 500 Internal Server Error during pnpm publish #​12099.
  • Preserve compatible optional peer versions already present in the lockfile when resolving dependencies.
  • Fixed inconsistent resolution of a peer dependency that is shared through a diamond. When a package peer-depends on both another package and one of that package's own peer dependencies (for example @typescript-eslint/eslint-plugin peer-depends on both @typescript-eslint/parser and typescript, and `@typescript-es

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 0ce961c to 647e301 Compare September 18, 2025 05:34
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 31afad9 to e82d82a Compare October 2, 2025 01:49
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 95a8582 to edefacb Compare October 9, 2025 19:07
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from eae88ff to 633af8d Compare October 20, 2025 09:43
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 633af8d to 45ce248 Compare October 28, 2025 12:02
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from b178e20 to b9b1480 Compare November 10, 2025 17:12
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from b9b1480 to 42cf0fc Compare November 17, 2025 23:15
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 3bd18a5 to 57cb6a0 Compare December 9, 2025 18:11
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from ad77787 to 005b857 Compare January 6, 2026 12:56
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 537b10d to 746620e Compare January 23, 2026 00:44
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 746620e to f3e58a6 Compare February 4, 2026 10:57
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 7fd9f31 to 015a901 Compare February 26, 2026 22:08
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 4803dfe to 69827b9 Compare March 7, 2026 01:37
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 2dd39e6 to 472abdf Compare March 12, 2026 18:47
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 73cbf08 to 52746fd Compare March 18, 2026 17:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 64b33d4 to 0654f25 Compare March 25, 2026 13:56
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from b4f4303 to de1328b Compare April 3, 2026 13:23
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 25c12e3 to 33e2160 Compare April 10, 2026 05:52
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 4ac7bf8 to 50df7f1 Compare May 21, 2026 15:11
@renovate

renovate Bot commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
? Verifying lockfile against supply-chain policies (573 entries)...
✓ Lockfile passes supply-chain policies (573 entries in 4.9s)
Progress: resolved 1, reused 0, downloaded 0, added 0
[WARN] deprecated @types/glob@9.0.0: This is a stub types definition. glob provides its own type definitions, so you do not need this installed.
Progress: resolved 70, reused 0, downloaded 0, added 0
Progress: resolved 388, reused 0, downloaded 0, added 0
Progress: resolved 537, reused 0, downloaded 2, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 1 version does not meet the minimumReleaseAge constraint:
  @types/node@25.9.3 was published at 2026-06-10T22:15:10.607Z, within the minimumReleaseAge cutoff (2026-06-10T06:02:01.185Z)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants