chore(deps): update all non-major dependencies - #474
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
July 20, 2025 07:08
dd2e90b to
9a52ef0
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
9 times, most recently
from
July 29, 2025 07:15
1b5f6ac to
3c1e478
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
8 times, most recently
from
August 6, 2025 09:56
29396ca to
b8bada3
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
8 times, most recently
from
August 14, 2025 15:39
3ededfa to
8c8bb06
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
September 5, 2025 15:02
932634c to
743e283
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
September 14, 2025 00:55
4d8e7f1 to
4aedd8f
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
September 17, 2025 00:58
6bba7a9 to
4b1e819
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
September 23, 2025 15:39
8242b55 to
d4116e8
Compare
commit: |
📦 Package Size
All tracked output (11)
Runtime dependencies (13)
Baseline: main_@_86d63b2___2026-08-22 · gzip is the comparison metric · changes below 16 B gzip are ignored |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.3.0→^9.5.1^0.1.3→^0.1.5^3.15.2→^3.16.04.0.0-alpha.12→4.0.0-alpha.17^4.1.0→^4.2.0^4.10.0→^4.11.0^6.1.5→^6.2.0^2.4.11→^2.5.0^12.2.1→^12.3.0^10.8.1→^10.10.0^0.20.0→^0.21.1^5.11.0→^5.11.1^20.11.6→^20.14.0^3.28.0→^3.28.4^2.3.1→^2.3.211.22.0→11.25.0^3.5.41→^3.5.42^3.3.10→^3.3.11^4.4.3→^4.5.4>=3→>=3.25.76Release Notes
antfu/eslint-config (@antfu/eslint-config)
v9.5.1Compare Source
🐞 Bug Fixes
antislopplugins composition, refactor - by @antfu (a213d)View changes on GitHub
v9.5.0Compare Source
🚀 Features
View changes on GitHub
v9.4.1Compare Source
🚀 Features
View changes on GitHub
v9.4.0Compare Source
🚀 Features
jsdoc v64unicorn v74e18e v0.8solid v0.17- by @antfu (33a41)minimumReleaseAgeExcludePruneby default - by @antfu (9526c)View changes on GitHub
nuxt/content (@nuxt/content)
v3.16.0Compare Source
Bug Fixes
hub.db(#3822) (8841abc)#content/adapterto prevent prerender failure (#3830) (400390a)nuxt/devtools (@nuxt/devtools-kit)
v4.0.0-alpha.17Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.0.0-alpha.16Compare Source
🚀 Features
View changes on GitHub
v4.0.0-alpha.15Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v4.0.0-alpha.14Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.0.0-alpha.13Compare Source
🚀 Features
__connection.jsonto hub in standalone dev - by @antfubot in #1070 (4449f)🐞 Bug Fixes
View changes on GitHub
nuxt/test-utils (@nuxt/test-utils)
v4.2.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
🩹 Fixes
mockNuxtImportsourcemap mapped position (#1787)setupTimeoutin playwright + surface server logs (#1785)includeSourcein both projects indefineVitestConfig(#1763)taskkillto kill processes on windows (#1760)🏡 Chore
latestranges with caret ranges (#1773)✅ Tests
🤖 CI
🎉 New Contributors
❤️ Contributors
nuxt/ui (@nuxt/ui)
v4.11.0Compare Source
Features
iconin items (#6726) (07f3fe8)experimental.componentDetection(#6731) (3a568b5)Bug Fixes
scrollable(#6786) (5afbd5c)baseinapplyUnstyled(#6825) (3e89ea7)classfrompropswith the component class (#6842) (731ff26)prefers-reduced-motion(#6742) (735b264)Performance Improvements
nuxt-modules/robots (@nuxtjs/robots)
v6.2.0Compare Source
🚀 Features
View changes on GitHub
vuejs/test-utils (@vue/test-utils)
v2.5.0Compare Source
antfu-collective/bumpp (bumpp)
v12.3.0Compare Source
🚀 Features
View changes on GitHub
v12.2.3Compare Source
🐞 Bug Fixes
allis set - by @antfu (016c8)View changes on GitHub
v12.2.2Compare Source
🐞 Bug Fixes
View changes on GitHub
eslint/eslint (eslint)
v10.10.0Compare Source
v10.9.1Compare Source
v10.9.0Compare Source
harlan-zw/eslint-plugin-harlanzw (eslint-plugin-harlanzw)
v0.21.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.21.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
NaturalIntelligence/fast-xml-parser (fast-xml-parser)
v5.11.1Compare Source
capricorn86/happy-dom (happy-dom)
v20.14.0Compare Source
🎨 Features
v20.13.2Compare Source
👷♂️ Patch fixes
v20.13.1Compare Source
v20.13.0Compare Source
🎨 Features
v20.12.2Compare Source
v20.12.1Compare Source
v20.12.0Compare Source
v20.11.15Compare Source
👷♂️ Patch fixes
v20.11.14Compare Source
v20.11.13Compare Source
👷♂️ Patch fixes
v20.11.12Compare Source
👷♂️ Patch fixes
v20.11.11Compare Source
v20.11.10Compare Source
v20.11.9Compare Source
v20.11.8Compare Source
👷♂️ Patch fixes
v20.11.7Compare Source
👷♂️ Patch fixes
s00d/nuxt-i18n-micro (nuxt-i18n-micro)
v3.28.4Compare Source
compare changes
🩹 Fixes
❤️ Contributors
v3.28.3Compare Source
compare changes
🩹 Fixes
❤️ Contributors
v3.28.2Compare Source
compare changes
🚀 Enhancements
🔥 Performance
🩹 Fixes
📖 Documentation
🏡 Chore
🎨 Styles
❤️ Contributors
v3.28.1Compare Source
compare changes
🚀 Enhancements
🩹 Fixes
📖 Documentation
🏡 Chore
✅ Tests
❤️ Contributors
pnpm/pnpm (pnpm)
v11.25.0: pnpm 11.25Compare Source
Minor Changes
Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.
Configure it with the new
remoteSideEffectsCachesetting. A workspace names the eligibleorganizationandpackages; everything describing the act of signing —publish,keyId,builderId,trustedKeys,privateKeyand the provenance fields — is refused inpnpm-workspace.yamland read from the global config file or the environment instead.Added macOS and Windows x64 and arm64 support to remote shared build artifacts pnpm/pnpm#13771.
Added the
audit.ignorePrunesetting. When set totrue,pnpm audit --fixremoves ignored GHSA entries that no longer appear in the audit report.Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects.
This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions.
pnpm initnow pins the latest pnpm version, instead of the version of pnpm that ran the command. A project scaffolded by an outdated pnpm therefore no longer inherits that staleness through its owndevEngines.packageManager/packageManagerpin #7490.The version is read from the
latesttag on the package-manager registries. When that lookup cannot answer — no network, an unreachable or slow registry,offline, or alatestthat theminimumReleaseAge/trustPolicysettings reject —pnpm initpins the running version as before, and never fails or hangs on the lookup. Alatestthat is older than the running pnpm is never pinned either.A
scopeset in a project'spnpm-workspace.yamlis now ignored, with a warning naming where to set it instead.pnpm loginrecords the scope as a@scope:registryroute in the machine-globalauth.ini, which outranks~/.npmrcin every project — so a repository-committed file could redirect a scope such as@acmefor all of a user's other projects after one routine login. Use--scope, thePNPM_CONFIG_SCOPEenvironment variable, or the global config file instead #13557.Verified remote build artifacts are persisted in the shared store with their signed origin metadata. Later installs reverify the artifact against current trust, policy, platform, and source before reuse, while invalid remote variants are quarantined per channel (pnpm/pnpm#13771).
Persist completed recursive tasks so
--resume-fromskips exactly the work that passed during a matching interrupted or failedpnpm -r run/pnpm -r execinvocation. When no compatible state exists, pnpm retains its graph-based resume behavior.Allowed
pnpm update --patchesto refresh registry revisions through a configured pnpr server while retaining locked package versions.Added explicit registry revision selection with
<version>+rNandpnpm update --patchesfor refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group.
pnpm stage approvenow approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and pnpm asks for a new one only once the registry stops accepting it. Inside a workspace, the selected packages are approved in dependency order, and a package whose workspace dependency could not be approved is skipped instead of being published against a dependency that never reached the registry.Added per-task concurrency limits to workspace task orchestration. Set
tasks.<name>.concurrencyinpnpm-workspace.yamlto limit how many instances of that task may run across workspace projects at once:Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the
registriessetting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.sideEffectsCachenow declares the whole of how a package's build output is reused — whether one is restored, whether one is saved, and the remote tier that shares it between machines:sideEffectsCache: true,sideEffectsCacheReadonly,remoteSideEffectsCache, and itsorganizationfield all keep working. Where a field is set under both spellings the one above wins; where it is set under only one, it is kept.Two behaviors change, both bringing this CLI in line with what the Rust one already did:
sideEffectsCacheReadonly: truenow blocks writing to the cache, and setting it alongsidesideEffectsCache: falsegives a read-only view rather than switching the cache off entirely. A cache can also be declared write-only now, to populate one the run does not read.Workspace task orchestration (pnpm/rfcs#23).
pnpm -r runandpnpm -r execnow schedule per task instead of in topological chunks: a task starts as soon as the tasks it depends on have finished, so a project no longer waits for unrelated projects that happen to share its chunk.A new
taskssection inpnpm-workspace.yamldeclares what a task depends on, using the^convention:^namemeans the named task in each of the project's workspace dependencies; a barenamemeans the task in the same project; an entry with nodependsOndeclares an empty dependency list. A task with no entry behaves asdependsOn: ['^<its own name>'], which is exactly what the previous chunked ordering implied — an unconfigured workspace gets the scheduler improvement and nothing else changes meaning. A project without the script is reported skipped and passes its edges through to its own dependencies, so a scriptless package does not sever a chain.Also part of this change:
ERR_PNPM_TASK_CYCLE) instead of silently running in an arbitrary order. SettingignoreWorkspaceCycles: truedowngrades the error to a warning: the cycle's tasks run in an arbitrary order relative to each other.--resume-fromnow skips exactly the transitive dependencies of the anchor package; work unrelated to the anchor still runs.--no-bail, tasks whose dependencies failed are reported as skipped, not failed, and do not add to the exit code.--bail(the default), the first failure still ends the run at once and nothing new is dispatched — including scripts already queued behind the concurrency limit.pnpm -r run --dry-run <script>prints the task graph that would execute without running anything (including skipping theverifyDepsBeforeRuncheck);--jsonemits the tasks and their resolved dependency edges.--workspace-concurrency=1, or the graph forces the scripts to run one after another).Patch Changes
An
_authentry in the global config file no longer decides which registry packages come from when something else says. Aregistryorregistriesdeclared inpnpm-workspace.yamlor the global config now wins over the route inferred from a stored credential, which still applies where nothing else declares one. Thepnpm_config__authenvironment variable is unchanged: it stays the way to point a CI runner at a mandated proxy, and still overrides what a repository declares.Prevent installs through a symlinked
node_modulesdirectory from rewriting the target checkout pnpm/pnpm#14286.Treat empty scripts selected by a regular expression as missing before running dependent tasks.
The options type of the
fetchcommand now declaresallowBuilds, a setting its handler already forwarded to the installer. Type-level only — whatpnpm fetchdoes is unchanged.Filter hidden scripts matched by a regular expression during recursive runs when a visible script also matches.
Fixed automatically switched pnpm versions forcing all descendant pnpm processes to use the same version pnpm/pnpm#14309.
Fixed
ERR_PNPM_UNUSED_PATCHvalidation during incremental installs pnpm/pnpm#13692.Fixed
pnpm deploy --prodfailing when an excluded dev dependency was also declared as an optional peer dependency pnpm/pnpm#14302.pnpm update -gno longer downgrades a global package.--latestresolves thelatestdist-tag, which can point at an older release than the one installed — afterpnpm add -g <pkg>@next, for instance #14270.pnpm update -galso no longer changes the pnpm version. pnpm's own global install belongs topnpm self-update#14270.Copying a built package to its other hoisted locations no longer replaces the destination directory. With
nodeLinker: hoisted, that replacement deleted the dependencies nested inside the destination'snode_modules, and made concurrent copies of the same build chunk fail withERR_PNPM_ENOENT: no such file or directory, rename '.../node_modules/_tmp_...'#12880.pnpm updateno longer replaces the specifier a project declares for a dependency that is also listed inoverrides. Acatalog:reference stays acatalog:reference, and a declared range stays as written, instead of being rewritten to the version the override resolved to #12115.pnpm updateno longer moves the range a project declares for a dependency thatoverridesalso lists, even when the override repeats that range verbatim. Previously the updatedpackage.jsondisagreed with the lockfile, so the nextpnpm install --frozen-lockfilefailed with a specifier mismatch #14224.Make
pnpm add --lockfile-onlyskip dependency linking pnpm/pnpm#14286.--productionis accepted again as an alias of--prodoninstall,fetch,prune,update,list,why, andsbom, and the install thatverifyDepsBeforeRunreproduces is now spelled with--prod.pnpm runno longer aborts with "unexpected argument '--production' found" after a production-only install #14147.The progress output no longer overwrites the lines above it once it grows taller than the terminal window #14270.
Restoring a dependency's build from the remote side-effects cache no longer downloads files the store already holds.
Forward
patchedDependencieshashes andpackageExtensionsto pnpr so server-side resolution preserves patches and package extensions in the lockfile and installed packages.Published the workspace task graph and scheduler as
@pnpm/workspace.task-schedulerso other workspConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.