fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #1244 · HarperFast/studio

renovate · 2026-06-15T06:06:11Z

This PR contains the following updates:

Package	Change	Age	Confidence
@ai-sdk/react (source)	`3.0.199` → `3.0.205`
@radix-ui/react-accordion (source)	`1.2.12` → `1.2.13`
@radix-ui/react-alert-dialog (source)	`1.1.15` → `1.1.16`
@radix-ui/react-dialog (source)	`1.1.15` → `1.1.16`
@radix-ui/react-dropdown-menu (source)	`2.1.16` → `2.1.17`
@radix-ui/react-label (source)	`2.1.8` → `2.1.9`
@radix-ui/react-navigation-menu (source)	`1.2.14` → `1.2.15`
@radix-ui/react-radio-group (source)	`1.3.8` → `1.4.0`
@radix-ui/react-scroll-area (source)	`1.2.10` → `1.2.11`
@radix-ui/react-select (source)	`2.2.6` → `2.3.0`
@radix-ui/react-separator (source)	`1.1.8` → `1.1.9`
@radix-ui/react-slot (source)	`1.2.4` → `1.2.5`
@radix-ui/react-switch (source)	`1.2.6` → `1.3.0`
@radix-ui/react-tabs (source)	`1.1.13` → `1.1.14`
@radix-ui/react-toggle (source)	`1.1.10` → `1.1.11`
@radix-ui/react-tooltip (source)	`1.2.8` → `1.2.9`
@stripe/stripe-js (source)	`9.7.0` → `9.8.0`
@tanstack/react-router (source)	`1.170.11` → `1.170.15`
@types/node (source)	`24.13.0` → `24.13.2`
@types/react (source)	`19.2.16` → `19.2.17`
ai (source)	`6.0.197` → `6.0.203`
happy-dom	`20.10.1` → `20.10.2`
harper (source)	`5.0.28` → `5.0.31`
lucide-react (source)	`1.17.0` → `1.18.0`
oxlint (source)	`1.68.0` → `1.69.0`
pnpm (source)	`11.5.2` → `11.6.0`
react-hook-form (source)	`7.77.0` → `7.78.0`
semantic-release	`25.0.3` → `25.0.5`

Release Notes

vercel/ai (@ai-sdk/react)

`v3.0.205`

Patch Changes

Updated dependencies [bfa5864]
Updated dependencies [f42aa79]
Updated dependencies [5291f7e]
Updated dependencies [b4b575a]
- @ai-sdk/provider-utils@4.0.29
- ai@6.0.203

`v3.0.203`

Compare Source

Patch Changes

Updated dependencies [0c8c0ed]
- ai@6.0.201

`v3.0.202`

Compare Source

Patch Changes

Updated dependencies [14098e7]
Updated dependencies [2cabe9c]
- ai@6.0.200

`v3.0.201`

Compare Source

Patch Changes

Updated dependencies [49d9364]
- ai@6.0.199

`v3.0.200`

Compare Source

Patch Changes

ai@6.0.198

radix-ui/primitives (@radix-ui/react-accordion)

`v1.2.13`

Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-collapsible@1.1.13, @radix-ui/react-collection@1.1.9, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

radix-ui/primitives (@radix-ui/react-alert-dialog)

`v1.1.16`

Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-dialog@1.1.16, @radix-ui/react-slot@1.2.5, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5

radix-ui/primitives (@radix-ui/react-dialog)

`v1.1.16`

Fixed disabled pointer events in closed dialogs
Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @dodomorandi for the original PR)
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

radix-ui/primitives (@radix-ui/react-dropdown-menu)

`v2.1.17`

Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-menu@2.1.17, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

radix-ui/primitives (@radix-ui/react-label)

`v2.1.9`

Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-primitive@2.1.5

radix-ui/primitives (@radix-ui/react-navigation-menu)

`v1.2.15`

Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @dodomorandi for the original PR)
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/react-collection@1.1.9, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-visually-hidden@1.2.5

radix-ui/primitives (@radix-ui/react-radio-group)

`v1.4.0`

Added unstable RadioGroupItemProvider, RadioGroupItemTrigger and RadioGroupItemBubbleInput parts. These expose the previously internal composition of a radio item (context provider, the interactive control, and the hidden form input) so consumers can directly access and recompose them. The RadioGroupItem component continues to render them by default.
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

radix-ui/primitives (@radix-ui/react-scroll-area)

`v1.2.11`

Fixed missing data-state attribute for Scroll Area scrollbars
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2

radix-ui/primitives (@radix-ui/react-select)

`v2.3.0`

Added unstable Provider and BubbleInput parts to Select. Select.unstable_Provider sets up Select's context and state without implicitly rendering the hidden native select, and Select.unstable_BubbleInput exposes that previously internal native select so consumers can recompose it explicitly. Select continues to render both by default.
Added support for presence-based exit animations in Select
Fixed Select hidden input so it submits empty string when no value is selected
Fixed placeholder rendering when a controlled Select is reset to an empty value
Added missing __selectScope prop to PopperContent component
Fixed Select closing unexpectedly after touch-scrolling its content when rendered inside an open shadow DOM
Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @dodomorandi for the original PR)
Fixed SelectValue logging invalid prop errors when used with both asChild and a placeholder
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/react-collection@1.1.9, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-visually-hidden@1.2.5

radix-ui/primitives (@radix-ui/react-separator)

`v1.1.9`

Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-primitive@2.1.5

radix-ui/primitives (@radix-ui/react-slot)

`v1.2.5`

Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render
Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it
Added repository.directory to all package.json files
Improved error messages for invalid slot children
Updated dependencies: @radix-ui/react-compose-refs@1.1.3

radix-ui/primitives (@radix-ui/react-switch)

`v1.3.0`

Added unstable Provider, Trigger and BubbleInput parts to Switch. These expose the previously internal composition (context provider, the interactive control, and the hidden form input) so consumers can directly access and recompose them. The Switch component continues to render them by default.
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

radix-ui/primitives (@radix-ui/react-tabs)

`v1.1.14`

Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @dodomorandi for the original PR)
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-use-controllable-state@1.2.3

radix-ui/primitives (@radix-ui/react-toggle)

`v1.1.11`

Added repository.directory to all package.json files
Updated dependencies: @radix-ui/primitive@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

radix-ui/primitives (@radix-ui/react-tooltip)

`v1.2.9`

Fixed runtime error when event target is non-Node
Fixed a Tooltip bug so that skipDelayDuration={0} works as expected. Previously, the open delay could still be skipped when moving between triggers.
Added repository.directory to all package.json files
Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-visually-hidden@1.2.5

stripe/stripe-js (@stripe/stripe-js)

`v9.8.0`

Compare Source

Changed

Add CurrencySelector element definitions for getElement and create (#930)
Add new appearance API variable types (#931)
add unit label to checkout.d.ts (#929)

TanStack/router (@tanstack/react-router)

`v1.170.15`

Compare Source

Patch Changes

Updated dependencies [776d8ef]:
- @tanstack/router-core@1.171.13

`v1.170.14`

Compare Source

Patch Changes

Updated dependencies [df1076c]:
- @tanstack/router-core@1.171.12

`v1.170.13`

Compare Source

Patch Changes

#7555 ac10815 - Fix search middleware composition so retainSearchParams does not restore search params that a downstream stripSearchParams removed.
Updated dependencies [ac10815]:
- @tanstack/router-core@1.171.11

`v1.170.12`

Compare Source

Patch Changes

Updated dependencies [2cca73c, 7a83e67, 76b3d3b]:
- @tanstack/router-core@1.171.10

capricorn86/happy-dom (happy-dom)

`v20.10.2`

Compare Source

👷‍♂️ Patch fixes

Updates external dependencies - By @capricorn86 in task #2163

harperfast/harper (harper)

`v5.0.31`

Compare Source

What's Changed

chore(deps): bump @harperfast/rocksdb-js 1.4.2 → 1.5.0 on v5.0 (#1232)

Full Changelog: HarperFast/harper@v5.0.30...v5.0.31

`v5.0.30`

Compare Source

What's Changed

fix: bump msgpackr to 1.12.1 (two-byte over-cap record corruption + recovery)

Full Changelog: HarperFast/harper@v5.0.29...v5.0.30

`v5.0.29`

Compare Source

What's Changed

Merge pull request #1169 from HarperFast/kris/v5.0-randomaccessfields
Merge remote-tracking branch 'origin/v5.0' into kris/v5.0-randomaccessfields
feat: add storage.randomAccessFields config to disable typed structures on v5.0
style: apply prettier formatting to resources/databases.ts
fix: only record structure update after txn commits
fix: report a non-committed shared-structure save as not-saved

Full Changelog: HarperFast/harper@v5.0.28...v5.0.29

lucide-icons/lucide (lucide-react)

`v1.18.0`: Version 1.18.0

Compare Source

What's Changed

chore(site): Remove survey from site by @ericfennis in #4417
feat(icons): added play-off icon by @Ahmed-Dghaies in #4412
fix(metadata): add missing use-cases prop on play-off.json by @karsa-mistmere in #4423
fix(docs): force hide #bb-banner, if html.has-bb-banner is missing by @karsa-mistmere in #4422
fix(docs): Remove @next from installation instructions for@lucide/svelte by @alecglassford in #4432
feat(packages/angular): add support for Angular v22 and onwards by @karsa-mistmere in #4450
fix(ci): add check to skip release if latest tag was created today by @ericfennis in #4085
feat(icons): added webcam-off icon by @jordan-burnett in #4242

New Contributors

@alecglassford made their first contribution in #4432
@jordan-burnett made their first contribution in #4242

Full Changelog: lucide-icons/lucide@1.17.0...1.18.0

oxc-project/oxc (oxlint)

`v1.69.0`

Compare Source

🚀 Features

e805174 linter: Add schema for jest/vitest/max-expects (#23105) (Sysix)
7850577 linter: Add schema for jest/vitest/expect-expect (#23104) (Sysix)
75f641a linter: Add schema for jest/vitest/consistent-test-it (#23103) (Sysix)
5125f89 linter/unicorn: Support no-null checkArguments option (#23098) (camc314)
b8b9797 linter: Add schema for import-max-dependencies (#23096) (Sysix)
65cb47a linter/eslint: Support no-unused-expressions ignoreDirectives option (#23097) (camc314)
f6c36d5 linter: Add schema for import/prefer-default-export (#23091) (Sysix)
0d4a5d1 linter: Add schema for eslint/sort-vars (#23090) (Sysix)
fdb5bf5 linter: Add schema for eslint/radix (#23082) (Sysix)
05b4dcf linter: Add schema for eslint/prefer-const (#23081) (Sysix)
5a06c4d linter/vue: Implement next-tick-style rule (#23041) (Alex Peshkov)
e38a36a linter: Add schema for eslint/operator-assignment (#23080) (Sysix)
907cee7 linter: Add schema for eslint/no-warning-comments (#23075) (Sysix)
9470bb2 linter: Add schema for eslint/no-unused-vars (#23073) (Sysix)
234b5cf linter: Add schema for eslint/no-shadow (#23072) (Sysix)
de0dd8b linter: Add schema for eslint/no-restricted-exports (#23020) (Sysix)
faa3e0d linter: Add schema for eslint/no-param-reassign (#23018) (Sysix)
dbc9c27 linter: Add schema for eslint/no-magic-numbers (#23017) (Sysix)
38d3569 linter: Add schema for eslint/no-inner-declarations (#23016) (Sysix)
008fa41 linter: Add schema for eslint/no-constant-condition (#22991) (Sysix)
ca44623 linter: Add schema for eslint/no-empty-function (#22988) (Sysix)
43eb04d linter: Add schema for eslint/id-match (#22987) (Sysix)
a800f27 linter: Add schema for eslint/capitalized-comments (#22984) (Sysix)
96e2d32 linter: Add schema for eslint/id-length (#22963) (Sysix)
545493f linter: Add schema for eslint/complexity (#22960) (Sysix)
5f0b558 linter: Add schema for eslint/class-methods-use-this (#22959) (Sysix)
719b720 linter: Add schema for simple rule configurations (#22948) (Sysix)
fd00966 linter: Add right schema for eslint/max-* rules (#22923) (Sysix)
1226d78 linter: Fill schema with rule configurations (#22907) (Sysix)
8f423c1 linter/vue: Implement require-direct-export rule (#17623) (yefan)
78e915b linter/vue: Implement no-reserved-props rule (#22914) (bab)
0f200a9 linter/vue: Implement require-prop-types rule (#22083) (Alex Peshkov)
5da9da9 linter/vue: Implement no-reserved-keys rule (#21780) (bab)
75e14a8 linter/vue: Implement prop-name-casing rule (#22892) (bab)

🐛 Bug Fixes

0383e61 linter: Fix schema for rules without a config (#22946) (Sysix)

📚 Documentation

dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)

pnpm/pnpm (pnpm)

`v11.6.0`

Compare Source

Minor Changes

pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.
615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:
```
npm_config_//registry.npmjs.org/:_authToken=<token>
pnpm_config_//registry.npmjs.org/:_authToken=<token>
```
This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.
Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes

Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #12324.
Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g. @nx/nx-win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them #11702.

`v11.5.3`

Compare Source

Patch Changes

Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from .npmrc, and in workspace registry URLs from pnpm-workspace.yaml. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config.
Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution.
Avoid writing packageManagerDependencies to pnpm-lock.yaml when package manager policy is set to onFail: ignore or pmOnFail: ignore #12228.
Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest.
Using the $ version reference syntax in overrides (e.g. "react": "$react") now prints a deprecation warning. The syntax still works, but catalogs are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with the catalog: protocol instead.
Fixed pnpm config get globalconfig to return the global config.yaml path again pnpm/pnpm#11962.
Fixed bare --color so it does not consume the following CLI flag, allowing command shorthands like --parallel to expand correctly and forms like pnpm --color with current <command> to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
Fix pnpm install ignoring enableGlobalVirtualStore toggle by including it in the workspace state settings check #12142.
Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.

This covers two paths that select an executable from repository-controlled input:
- pacquet install engine — declaring pacquet (or @pnpm/pacquet) in configDependencies opts in to pnpm's Rust install engine. pnpm now verifies that the installed pacquet shim and the host's @pacquet/<platform>-<arch> binary carry a valid npm registry signature for their exact name@version, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.
- automatic version switch / self-update — the packageManager / devEngines.packageManager field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of pnpm, @pnpm/exe, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command.
In both cases the signature is verified over the installed integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint.
Made peer-dependent deduplication deterministic. When a peer-suffixed package variant was a subset of two or more mutually incompatible larger variants, the variant it collapsed into depended on the order importers were resolved in, which varies between machines. This could resolve the same workspace to different lockfiles on different platforms and make pnpm dedupe --check alternate between passing and failing.
Reject invalid package names and versions from staged tarball manifests before deriving filenames for pnpm stage download.
Clarified in CLI help that the pnpm store is trusted shared state and store integrity checks are corruption detection, not a tamper boundary for untrusted store writers.
Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
Require trusted package identity before package-name allowBuilds entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the allowBuilds key. Lockfile verification now rejects lockfiles where a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
Security: pnpm now verifies the OpenPGP signature of a downloaded Node.js runtime's SHASUMS256.txt before trusting its integrity hashes.

When a repository requests a Node.js runtime (e.g. via devEngines.runtime / useNodeVersion), the download mirror is repository-configurable through node-mirror:<channel>. The integrity of the downloaded binary was only checked against SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy by serving a tampered binary together with a matching SHASUMS256.txt. pnpm then executes the binary (for example to run lifecycle scripts).

pnpm now fetches SHASUMS256.txt.sig and verifies the detached OpenPGP signature against the Node.js release team's public keys, which ship embedded in the pnpm CLI. A mirror that serves a tampered binary cannot also produce a valid signature, so the download fails to verify. The embedded keys are kept current by a release-time check against the canonical nodejs/release-keys list.

The musl variants from the hardcoded unofficial-builds.nodejs.org mirror are not repository-configurable and are signed by a different key, so they continue to be trusted over TLS.

react-hook-form/react-hook-form (react-hook-form)

`v7.78.0`

Compare Source

semantic-release/semantic-release (semantic-release)

`v25.0.5`

Compare Source

Bug Fixes

revert: next (#4200) (db8ffaa)

`v25.0.4`

Compare Source

Bug Fixes

code-quality: add missing comma in context object for consistency (493d6cd)

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "before 9am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot requested a review from a team as a code owner June 15, 2026 06:06

renovate Bot requested a review from dawsontoth June 15, 2026 06:06

renovate Bot force-pushed the renovate/all-minor-patch branch from ac139ac to 1965827 Compare June 15, 2026 14:13

dawsontoth approved these changes Jun 15, 2026

View reviewed changes

fix(deps): update all non-major dependencies

174b536

renovate Bot force-pushed the renovate/all-minor-patch branch from 1965827 to 174b536 Compare June 15, 2026 16:04

dawsontoth added this pull request to the merge queue Jun 15, 2026

Merged via the queue into stage with commit 8a5d64d Jun 15, 2026
4 checks passed

dawsontoth deleted the renovate/all-minor-patch branch June 15, 2026 16:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all non-major dependencies#1244

fix(deps): update all non-major dependencies#1244
dawsontoth merged 1 commit into
stagefrom
renovate/all-minor-patch

renovate Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Changed

Patch Changes

Patch Changes

Patch Changes

Patch Changes

👷‍♂️ Patch fixes

What's Changed

What's Changed

What's Changed

v1.18.0: Version 1.18.0

What's Changed

New Contributors

🚀 Features

🐛 Bug Fixes

📚 Documentation

Minor Changes

Patch Changes

Patch Changes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jun 15, 2026 •

edited

Loading

`v1.18.0`: Version 1.18.0