chore(deps): update all non-major dependencies - #253
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
December 8, 2025 10:57
e4e0b28 to
2fe1e8d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
December 8, 2025 16:00
2fe1e8d to
bcd19fb
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
December 11, 2025 07:25
bcd19fb to
6495303
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
10 times, most recently
from
December 22, 2025 03:14
601e104 to
e7a6686
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
December 30, 2025 10:46
7084dcc to
357ee30
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
January 6, 2026 18:54
3a33f11 to
7771a82
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
11 times, most recently
from
January 20, 2026 02:39
63a96c8 to
a40b851
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
January 26, 2026 04:54
11be3a3 to
25ede0e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
January 26, 2026 15:41
25ede0e to
f77ba97
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
January 28, 2026 01:44
274b12c to
ea39603
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
January 28, 2026 07:01
ea39603 to
875bc3f
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
January 30, 2026 18:34
9456403 to
d0352f2
Compare
commit: |
📦 Package Size
All tracked output (10)
Runtime dependencies (10)
Baseline: main_@_1998e6d___2026-08-10 · gzip is the comparison metric · changes below 16 B gzip are ignored |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.0.0-alpha.7→4.0.0-alpha.104.0.0-alpha.7→4.0.0-alpha.9^10.8.0→^10.8.1^20.11.1→^20.11.2^4.2.0→^4.2.1^5.3.10→^5.3.12^5.3.11→^5.3.1211.20.0→11.21.0>=3→>=3.25.76Release Notes
nuxt/devtools (@nuxt/devtools-kit)
v4.0.0-alpha.10Compare Source
🚨 Breaking Changes
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v4.0.0-alpha.9Compare Source
🚨 Breaking Changes
🚀 Features
View changes on GitHub
v4.0.0-alpha.8Compare Source
🚨 Breaking Changes
🚀 Features
🐞 Bug Fixes
View changes on GitHub
eslint/eslint (eslint)
v10.8.1Compare Source
Bug Fixes
18eb0a7fix: prevent ASI hazard inno-unused-labelsautofix (#21173) (dongkyu lee)151ba3ffix: false positives ingetter-returnandaccessor-pairs(#21163) (Grit)6898df9fix: ignore meta-property names inid-denylist(#21166) (Pixel)4d7db66fix: ignore meta-property names inid-match(#21167) (Pixel)677214efix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)Documentation
7d0cbf8docs: Update README (GitHub Actions Bot)0a05812docs: add missing backticks tono-duplicate-imports.js(#21183) (Lee Daeun)678c90bdocs: Update README (GitHub Actions Bot)8a10424docs: Update README (GitHub Actions Bot)69bb948docs: Update README (GitHub Actions Bot)Chores
0a14800chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])05adcb1test: fix failing ecosystem test foreslint-plugin-unicorn(#21191) (Lazizbek Ergashev)5611035test: add error locations info tono-void(#21185) (Lee Daeun)ee47333ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])f131c03chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)1f6eddechore: update ecosystem plugins (#21182) (ESLint Bot)d3266fbchore: unpinwebpackdependency (#21172) (Francesco Trotta)65a6519chore: add allowScripts field to package.json (#21092) (GiHoon Noh)22e5256ci: addtriage:nolabel to Dependabot PRs (#21141) (lumir)55c9038ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])7280e78chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])eddbad6test: fix failing ecosystem test foreslint-plugin-unicorn(#21156) (Francesco Trotta)60a178dchore: update ecosystem plugins (#21150) (ESLint Bot)f9f61dctest: add error locations tono-unreachable(#21151) (JIYEON)d086293test: add error locations tono-undef(#21147) (JIYEON)cc01b67test: add error locations tono-useless-catch(#21144) (devoil)688e75echore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)7c1e175test: add error locations torequire-await(#21145) (Grit)588a26dtest: add error locations tono-extra-label(#21139) (dongkyu lee)059aa89test: add error locations tono-useless-concat(#21140) (dongkyu lee)5a452a8test: add error locations tono-const-assign(#21138) (dongkyu lee)capricorn86/happy-dom (happy-dom)
v20.11.2Compare Source
👷♂️ Patch fixes
harlan-zw/nuxt-site-config (nuxt-site-config)
v4.2.1Compare Source
🐞 Bug Fixes
View changes on GitHub
harlan-zw/nuxt-seo (nuxtseo-layer-devtools)
v5.3.12Compare Source
🐞 Bug Fixes
View changes on GitHub
v5.3.11Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
pnpm/pnpm (pnpm)
v11.21.0: pnpm 11.21Compare Source
Minor Changes
Added interactive group selection to
pnpm update --global --interactive.Running
pnpm setup,pnpm self-update, or a command that modifies the global installation (such aspnpm add --global) throughsudonow prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail withERR_PNPM_SUDO_NOT_SUPPORTEDin pnpm v12. Read-only global commands (such aspnpm bin --global) are unaffected.Patch Changes
Fixed pnpm failing to start under asynchronous Node.js module loaders when no
.pnpmfile.mjsexists pnpm/pnpm#11701.Fixed
minimumReleaseAgefallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.Removing a dependency from
package.jsonand reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped frompnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in
pnpm-lock.yamldirectly, reusing the same check thepnpm.overridesfast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.Fixed a CI regression where
github:owner/repodependencies (and other shorthand Git specifiers) would fail to install withPermission denied (publickey)on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g.git+ssh://orgit@host:...):429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.git ls-remoteaccess is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.codeload.github.com, which would fail to download for a private repository); it stays a regulargitresolution so installs can use ambient Git credentials such as credential helpers and tokens.Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.
Fixes pnpm/pnpm#13276.
ng buildandnuxt buildnow work under the global virtual store: pnpm's built-in compatibility extensions add thetslibdependency that@angular/builduses without declaring and theunplugindependency that@nuxt/vite-builderv4 uses without declaring.Fixed
link:dependencies underenableGlobalVirtualStoreso linked children are materialized and slots remain isolated by their resolved link targets.An install that skips resolution because
pnpm-lock.yamlis already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, andpendingBuildsentries for removed packages are dropped instead of staying pending forever.The held-back-update warning printed by
pnpm updateno longer fires whenminimumReleaseAgeis the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #13071.Checking whether
ignoredOptionalDependenciesis up to date no longer reorders the configured patterns. The check sorted them in place, which could move an!exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.Changing
autoInstallPeers,dedupePeers,peersSuffixMaxLength,excludeLinksFromLockfile, orinjectWorkspacePackagesno longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded inpnpm-lock.yamland the install proceeds from the existing resolution. Every other case still falls back to a full resolution.Adding, editing, or removing an entry in
patchedDependenciesno longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries inpnpm-lock.yamland materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused whileallowUnusedPatchesis off, soERR_PNPM_UNUSED_PATCHis still reported.Resolving a private git repository no longer blocks on an interactive credential prompt:
git ls-remotenow fails fast with an authentication error when git has no credentials for the repository #13522.Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same
ERR_PNPM_NO_OFFLINE_METAcondition used by offline resolution.POSIX shell shims now follow symbolic links before computing
basedir, preventing execution failures when a shim is invoked via an external symlink onPATH#13405.The automatic
packageManagerversion switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command #13619.Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip
dist.signatures) no longer break the automaticpackageManagerversion switch andpnpm self-update#13147. When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature fromregistry.npmjs.organd verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only ashasum), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.pnpm fetch, and any install run withvirtualStoreOnly, no longer writes a.pnp.cjsloader undernodeLinker: pnp. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links andnode_modules/.package-map.jsonwere already skipped; the PnP loader now follows the same rule.Prevent pnpm from removing project files when
modulesDirresolves to the project root.Speed up installs after adding
ignoredOptionalDependenciespatterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again.When a failed install re-copies a bin script from the store, rerunning
pnpm installnow reapplies the executable bit to the bin instead of leaving it non-executable #12742.pnpm root -gandpnpm bin -gnow print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with--globalin a project that pins a package manager (e.g. via thepackageManagerfield) printed a warning like[WARN] Using --global skips the package manager check for this projectahead of the path, breaking programs that capture the output as a path #13672.In pnpm 12,
pnpm root -gandpnpm prefix -gare now supported (they previously failed withERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED/ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED), and the reporter output ofdlx,create,config,sbom,with,store,prefix,root, andbingoes to stderr, matching pnpm 11.pnpm setupno longer makes Node.js print aMODULE_TYPELESS_PACKAGE_JSONwarning aboutdist/worker.json every command. Thepackage.jsonit writes next to a standalone executable now declares"type": "module".pnpm updatewithout saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or--latestresolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the nextpnpm install --frozen-lockfilerejected withERR_PNPM_OUTDATED_LOCKFILE#12764.pnpm version -r --jsonnow outputs[]instead of human-readable text when no pending changes existpnpm/pnpm#13217.Platinum Sponsors
Gold Sponsors
colinhacks/zod (zod)
v3.25.76Compare Source
Commits:
91c9ca6fix: cleanup _idmap of $ZodRegistry (#4837)9cce1c5docs: fix typo in flattenError example on error-formatting page (#4819) (#4833)a3560aev3.25.76 (#4838)5060661Release 3.25.767baee4eUpdate index.mdx (#4831)v3.25.75Compare Source
Commits:
c5f349bFix z.undefined() behavior in toJSONSchemav3.25.74Compare Source
Commits:
ae0dbe1Partial record39c5f713.25.74v3.25.73Compare Source
Commits:
1021d3cv3.25.73 (#4822)v3.25.72Compare Source
Commits:
4a4dac7Warn about id uniqueness check on Metadata page (#4782)7a5838dfeat(locale): Add Esperanto (eo) locale (#4743)36fe14eFix optionality of schemas (#4769)20c8c4bFix re-export bug8b0df103.25.72v3.25.71Compare Source
Commits:
66a0f34Move source to/src(#4808)2a15f443.25.71v3.25.70Compare Source
Commits:
bd81c7cAdd ecosystem listing to homepage1ddb971Add Mobb to sponsors30ba440Clean up ecosystem.mdx0ef1b85Addsvelte-jsonschema-formto form integrations (#4784)14715f1docs: fix Lambda spelling (#4804)f6da030Add back src (#4806)364200aRevert "Add back src (#4806)"16e1b67v3.25.70 (#4807)v3.25.69Compare Source
Commits:
f46946cImprove release workflowb6fe831Do not clobber defaults in7f986d0Skip attw test if Zod isn't built5576182Addexacttotoo_big/too_smallissue formats (#4802)8fd2fc33.25.69v3.25.68Compare Source
Commits:
d3e0f86feat: add zod-xlsx back to the ecosystem.tsx (#4718)86112d9chore: update lint-staged from v12 to v16 (#4703)218a267chore: remove unused octokit (#4708)a7cb6edfix(v4): add exact to length check issue (#4617)b888170Close #40355879bafFix fmtbd1bddaFix buildddadfb8Simplify basics, document reportInputd5e2368Addz.stringFormat()(#4737)ee5615dDrop example and examples entirely4080fd9Add treeshaking discussion to docscf6157aDocs39947acUse import star everywhere7e296aeWIPbb42be4Update treeshake target0a49fa3Improve mini docs1b0a5e5Add dep90fa0cdSwitch tozshy(#4777)af3841bRename play.tscf12ccf3.25.6834ae421Update snapshotv3.25.67Compare Source
Commits:
7afe790Make $ZodLiteralDef generic91274c33.25.67c22944bFix race conditionv3.25.66Compare Source
Commits:
2b3e87bUpdate api.ts (#4724)100e9aachore: include zod-validation-error to Ecosystem page (#4722)de3517efix(docs): prevent FOUC on website homepage logo (#4716)222a663Change ZodObject default to $strip. Set inst.shape in zod minifb006183.25.66v3.25.65Compare Source
Commits:
6530994Clean up ecosystem131fdbdfix(docs): Use array as argument of templateLiteral (#4701)ed648b1chore: remove deprecated @types/chalk (#4685)12dd489Add catchall to zod-minifcb722aAdd uuid to changelog8c740353.25.65v3.25.64Compare Source
Commits:
b142ea8Fix $stripb6e59c3Check for existence of Error.captureStackTrace0c686afRemove type from mime issue pathaf88d74Fix testv3.25.63Compare Source
Commits:
7ed0c36Allow hours-only offsets. Normalize. (#4676)112fff6Fix iso tests6176dcbImprove ISO second handling (#4680)8e20a20Use consistent variable names for IP examples (#4679)29e4973refactor: remove unnecessary assertion (#4672)c626fe1chore: update husky from v7 to v9 (#4682)f350a693.25.63v3.25.62Compare Source
Commits:
c568deaDrop | undefined from json schema types1614fd83.25.62v3.25.61Compare Source
Commits:
1c2ad87Loose signature for index signature shapesafa7e673.25.6182b43faFix testv3.25.60Compare Source
v3.25.59Compare Source
Commits:
aec5c4aFix formattingd3389cbrefactor: change if in else to else if (#4664)ffc41bdImprove JSON Schema typingv3.25.58Compare Source
Commits:
21ee3f6Add Zod Sockets to Ecosystem (#4655)6707ebbv4: Preserve function types in.meta()(#4636)3cecd98Added Superforms for SvelteKit (#4635)305399f](https://redirect.github.com/colinhacks/zod/commit/305399f878450cf3f0a2b05975b58774d52262Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.