Pin dependencies - #47
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
commit: |
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
9 times, most recently
from
April 27, 2026 01:20
a3f7ab2 to
3397dcc
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
April 27, 2026 22:43
3397dcc to
6e55a0c
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
9 times, most recently
from
May 5, 2026 05:57
776bc34 to
182ff50
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
9 times, most recently
from
May 11, 2026 20:50
3c72440 to
f046ef6
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
9 times, most recently
from
May 25, 2026 01:52
6e533f5 to
48210c3
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
7 times, most recently
from
June 4, 2026 21:55
d218f61 to
0c4b8af
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
4 times, most recently
from
June 11, 2026 17:04
57e0d66 to
a1080e0
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
9 times, most recently
from
June 18, 2026 21:03
1822d05 to
d1785ff
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^2.0.0→2.0.03.3.5→3.3.69.39.4→9.39.54.2.2→4.3.320.19.39→20.19.4319.2.14→19.2.1819.2.3→19.2.46.0.1→6.0.5de0fac2→d23441a93cb6ef→fbc6f3953b8394→24997071.35.1→1.43.01.44.00.1.114→0.1.1220.1.1230.0.48→0.0.559.39.4→9.39.57.0.1→7.1.10.5.2→0.5.417.5.0→17.11.07.0.0→7.4.00.0.66→0.0.870.0.883.8.3→3.9.6v2.1.2→v2.2.019.2.5→19.2.819.2.5→19.2.83.5.0→3.6.04.2.2→4.3.38.58.2→8.67.08.0.16→8.2.14.1.4→4.1.10v0.5.6→v0.6.2Add the preset
:preserveSemverRangesto your config if you don't want to pin your dependencies.Release Notes
eslint/eslintrc (@eslint/eslintrc)
v3.3.6Compare Source
Bug Fixes
js-yamlto 4.3.0 to address security vulnerability (#235) (0c5de74)eslint/eslint (@eslint/js)
v9.39.5Compare Source
Bug Fixes
253be16fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)Documentation
74930eddocs: switch build to Node.js 24 (#20894) (Milos Djermanovic)eaec8bbdocs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)Chores
458205fchore: update@eslint/eslintrcand@eslint/jsfor v9.39.5 (#21077) (Francesco Trotta)202117bchore: package.json update for @eslint/js release (Jenkins)d9eb6edtest: disable warning forvm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER(#21074) (Francesco Trotta)7b431a7chore: overridere2dependency for@metascraper/helpers(#21068) (Milos Djermanovic)daf7791chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)daee8baci: use pnpm ineslint-flat-config-utilstype integration test (#20829) (Milos Djermanovic)116d4beci: unpin Node.js 25.x in CI (#20619) (Copilot)tailwindlabs/tailwindcss (@tailwindcss/vite)
v4.3.3Compare Source
Fixed
--watch --poll[=ms]in@tailwindcss/cliwhen filesystem events are unreliable or unavailable (#20297)bg-[#fff]andbg-[#FFF]→bg-white) (#20298)iframe:focus-visibleoutline styles (#20292)theme('colors.foo')in JS plugins resolves correctly when both--color-fooand--color-foo-barexist (#20299)shadow-sm/12.5,text-shadow-sm/12.5,drop-shadow-sm/12.5, andinset-shadow-sm/12.5(#20302)[data-foo]divas two selectors instead of one (#20303)@tailwindcss/postcssrebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)@tailwindcss/browserand Tailwind Play (#20124)oklch(#20314)--spacing(0)is optimized to0pxinstead of0so it remains a<length>when used incalc(…)(#20319)@parcel/watcheronly when needed in@tailwindcss/cli --watchmode, so one-off builds and--watch --pollwork when@parcel/watchercan't be loaded (#20325)system-uiandui-sans-serifso CJK text respects the page'slangattribute on Windows (#20318)@tailwindcss/upgradefrom rewriting ignored files when run from a subdirectory (#20329)@sourcerules pointing to nested files are scanned when later@sourcerules point to files in parent folders (#20335)@tailwindcss/vitefrom triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)v4.3.2Compare Source
Fixed
auto-rows-*andauto-cols-*utilities (e.g.auto-rows-12andauto-cols-16) (#20229)@tailwindcss/cliin--watchmode from crashing on Windows when@sourcepoints to a directory that doesn't exist (#20242)@tailwindcss/vitefrom crashing in Deno v2.8.x whencontext.parentURLis not a valid URL (#20245)@tailwindcss/cliin--watchmode rebuilds when the input CSS file changes in an ignored directory (#20246)@variantrules used inaddBase(…)to use custom variants defined later (#20247)@tailwindcss/vitefrom crashing during HMR when scanned files or directories are deleted (#20259)font-sizeinstead ofcolordeclarations fortext-[--spacing(…)](#20260)@sourcepatterns from scanning unrelated sibling files and folders (#20263)%]…[%in.tt,.tt2, and.txfiles (#20269)p.text-black[condition](#20269)@position-tryrules from triggering unknown at-rule warnings when optimizing CSS (#20277)--opacitytheme values (#20287)@tailwindcss/postcsswhen used with newer PostCSS patch releases (#20289)v4.3.1Compare Source
Added
--silentoption to suppress output in@tailwindcss/cli(#20100)Fixed
Module#registerHooksinstead ofModule#registeron Node 26+ (#20028)@applyto be used with CSS mixins (#19427)not-*correctly negates@containerqueries, includingstyle(…)queries (#20059)drop-shadow-*color utilities work with custom shadow values containingcalc(…)(#20080)@tailwindcss/vite(#20103)@tailwindcss/webpackcan be installed in Rspack projects without requiringwebpackas a peer dependency (#20027)calc(…)expressions (e.g.px-[calc(1rem+0px)]→px-[calc(1rem+0)]) (#20127)left-[99999px]→left-[99999px], notleft-24999.75) (#20130)@tailwindcss/cliin--watchmode recovers when a tracked dependency is deleted and restored (#20137)@tailwindcss/clibinaries are ignored when scanning for class candidates (#20139)addClass(…)andremoveClass(…)calls (#20198)@variantto be used insideaddBase(#19480)@sourceglobs with symlinks are preserved (#20203)@sourcerules can re-include files excluded by earlier@source notrules (#20203)@utilityrules (#20205)inset-shadow-noneand other inset shadows work correctly (#20208)@sourcedirectories are scanned even when ignored by git (#20214)@sourceglobs ending in**/*preserve dynamic path segments to avoid scanning too many files (#20217)calc(…)divisions when the result would require high precision (e.g.w-[calc(100%/3.5)]→w-[calc(100%/3.5)], notw-[28.571428571428573%]) (#20221)@tailwindcss/postcss(#20228)Changed
0instead ofcalc(var(--spacing) * 0)for spacing utilities likem-0andleft-0(#20196)var(--spacing)instead ofcalc(var(--spacing) * 1)for spacing utilities likem-1andleft-1(#20196)v4.3.0Compare Source
Added
@container-sizeutility (#18901)scrollbar-{auto,thin,none}utilities forscrollbar-width, andscrollbar-thumb-*/scrollbar-track-*color utilities forscrollbar-color(#19981, #20019)scrollbar-gutter-*utilities (#20018)zoom-*utilities (#20020)tab-*utilities (#20022)@variantwith stacked variants (e.g.@variant hover:focus { … }) (#19996)@variantwith compound variants (e.g.@variant hover, focus { … }) (#19996)--default(…)in--value(…)and--modifier(…)for functional@utilitydefinitions (#19989)Fixed
@pluginresolves package JavaScript entries instead of browser CSS entries when using@tailwindcss/vite(#19949)@importand@pluginpaths resolving from the wrong directory when using@tailwindcss/vite(#19965)@variantare processed by@tailwindcss/vite(#19966)basewhenresult.opts.fromis not provided when using@tailwindcss/postcss(#19980)_whitespace in arbitrary values (#19986)w-[calc(100%---spacing(60))]→w-[calc(100%-(--spacing(60)))]) (#19986)-mt-[20in]→mt-[-20in], notmt-[-1920px]) (#19988):has()variants from[&:has(…)]tohas-[…](#19991)styleattributes (e.g.style="flex-grow: 1"→style="flex-grow: 1", notstyle="grow: 1") (#19918)@utilitydefinitions with the same name but different value types (#19777)PluginWithConfigtype fromtailwindcss/pluginto fix errors when inferring plugin config types (#19707)startandendlegacy utilities without values do not generate CSS (#20003)--value(…)is required in functional@utilitydefinitions (#20005)-left-[(var(--a)+var(--b))]) (#20011)v4.2.4Compare Source
Fixed
@importand@pluginstill resolve correctly when using Vite aliases in@tailwindcss/vite(#19947)v4.2.3Compare Source
Fixed
tracking-*utilities by preferring non-negative utilities (e.g.-tracking-tighter→tracking-wider) (#19827)@tailwindcss/webpack(#19723)px-[1.2rem] py-[1.2rem]→p-[1.2rem]) (#19837)border-{t,b}-*intoborder-y-*,border-{l,r}-*intoborder-x-*, andborder-{t,r,b,l}-*intoborder-*(#19842)scroll-m{t,b}-*intoscroll-my-*,scroll-m{l,r}-*intoscroll-mx-*, andscroll-m{t,r,b,l}-*intoscroll-m-*(#19842)scroll-p{t,b}-*intoscroll-py-*,scroll-p{l,r}-*intoscroll-px-*, andscroll-p{t,r,b,l}-*intoscroll-p-*(#19842)overflow-{x,y}-*intooverflow-*(#19842)overscroll-{x,y}-*intooverscroll-*(#19842)--placeholder-colorinstead of--background-colorforplaceholder-*utilities (#19843)config.contentwhen migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846).envand.env.*to default ignored content files (#19846)overflow-ellipsisintotext-ellipsis(#19849)start-full→inset-s-full,start-auto→inset-s-auto,start-px→inset-s-px, andstart-<number>→inset-s-<number>as well as negative versions (#19849)end-full→inset-e-full,end-auto→inset-e-auto,end-px→inset-e-px, andend-<number>→inset-e-<number>as well as negative versions (#19849)-sign inside the arbitrary value-left-[9rem]→left-[-9rem](#19858)-sign outside the arbitrary valueml-[calc(-1*var(--width))]→-ml-(--width)(#19858)NODE_PATHenvironment variable in standalone CLI (#19617)vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.0.5Compare Source
Fixed the react compiler preset filter to be linear (#1353)
The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.
v6.0.4Compare Source
Fixed
$RefreshSig$ is not definederror when runningvite devwithNODE_ENV=productionWhen running
vite devwithNODE_ENV=production, the app errored with$RefreshSig$ is not defined.This error is now fixed.
v6.0.3Compare Source
v6.0.2Compare Source
Allow all options in reactCompilerPreset (#1189)
This is a type only change. Only
compilationModeandtargetoptions were available forreactCompilerPreset.get-convex/convex-backend (convex)
v1.43.0npx convex deployment usageandnpx convex deployment usage-limitsCLI commands toview a deployment’s current resource usage, and
view or edit deployment usage limits.
minuteUTCparameter. When omitted, Convex will automaticallychoose a stable start time within the scheduled hour,
avoiding concentrating jobs at the top of the hour.
commit timestamp
with
ctx.db.vars.commitTs. While the mutation is running,ctx.db.vars.commitTsis a placeholder symbol that isreplaced with a Int64 value at commit time that is guaranteed
to strictly follow commit order, unlike the
_creationTimesystem field.This low-level primitive is helpful for advanced use cases such as implementing
efficient FIFO queues.
v.commitTs()validator that accepts either theupcoming commit timestamp placeholder, or a Int64 commit timestamp.
when using side-by-side TypeScript 6 and 7 installation.
(This setup is used in codebases that want to use the native TypeScript 7
compiler but still need access to the TypeScript compiler JavaScript API.)
typescriptCompilerparameter inconvex.json.This parameter was only necessary when using the TypeScript Native Preview
(@typescript/native-preview). With TypeScript 7, Convex
automatically picks the right binary.
it’s now possible to omit the
envargument fromapp.use(component, { … }).app.use()failed to requirea second argument when a component has required environment variables
(e.g.
app.use(component, { env: { REQUIRED_VAR: "value" } })).usePaginatedQuery_experimentalwhere page splits were handled incorrectly.
v1.42.3an order consistent with other platforms when running
on Windows. This completes a fix that was only partially
applied in 1.42.2.
v1.42.2token used in the request by accessing
authTokeninctx.meta.getRequestMetadata().convex/browserthat caused issueswhen using the
ConvexHttpClientin some JavaScriptenvironments.
ConvexProviderWithClerkthat causedthe Convex client to ignore session changes in some situations.
an order consistent with other platforms when running
on Windows.
npx convex devoutside a Convex project,the CLI now returns an error message immediately instead of
first asking the user to select a project and then failing
later.
v1.42.1tsgobinary innewer versions of
@typescript/native-preview.initialAuthTokenReuseoption toConvexReactClientthatprevents extra function calls when users re-authenticate.
v1.42.0npx convex project createcommand that can be usedto create new projects programmatically.
--names-onlyflag tonpx convex env list(and
npx convex env default list). This flag shows the names ofthe env vars that are set, without the values. It can be useful
to let AI coding agents know the variables that are set on a deployment,
without giving them the actual values.
useStaleSnapshotoption to the arguments forrunQuery.This is an advanced feature that can be used to allow mutations
to avoid optimistic concurrency control (OCC) conflicts in some cases
where they can commit even though they depend on conflicting reads.
This change allows us to improve the performance of some of the
official Convex components, including Workpool.
db.*methods to more clearly explainthe difference between the old APIs without table names
(e.g.
db.get(userId)) and the new APIs with table names(e.g.
db.get("users", userId)).correctly when the user or token doesn’t have permission to do something.
scheduledFunctionIdinctx.meta.getRequestMetadata().npx convex insightshas a new--jsonflag that makes the commandoutput easier to parse programmatically.
convex/serveras@deprecated(
FileMetadata,FileStorageId,StorageId). These types are usedonly by file storage APIs that were deprecated in
convex@1.6.0,so we also marked them as
@deprecatedfor clarity.wspeer dependency to avoid a vulnerable range.v1.41.0with the new
transactionLimitsoption inrunQuery/runMutation.npx convex ai-filesnow installs skills with separate copies ofeach skill for each coding agent instead of using symlinks.
We made this change to avoid known issues with symlinks on Windows.
npx convex devnow starts a different dashboard server for eachdeployment. This ensures the dashboard always connects to the
right deployment when multiple deployments are running at the same time.
v1.40.0npx convex deployment create team-slug:project-slug:local.using
npx convex deployment select team-slug:project-slug:local. This command warnswhen it moves the deployment to another project.
such as
npx convex devandnpx convex deploy.<AuthRefreshing />helper component, used to show indicators whenfunction calls are paused because the authentication token is refreshing.
--localand--cloudflags fromnpx convex dev. The behavior of these flagswas misleading when a deployment was already selected. Instead, use
npx convex deployment select localto use a local deployment, andnpx convex deployment select devto use your personal cloud dev deployment.npx convex logs:--tailis now accepted as an alias for the--historyflag.from the Convex cloud project if you don’t have permission to view the default environment
variables instead of crashing.
v1.39.1binentrypoint bug in 1.39.0.v1.39.0defineAppand
defineComponentnow accept anenvobject with string keys and validator values.Declared environment variables must be present and match the validators before deployment.
--local-cloud-port,--local-site-port,--local-backend-versionand--local-force-upgradeoptions tonpx convex devto be used whenever using a local deployment.AsyncLocalStorageandAsyncResourceAPIs fromnode:async_hooksare now availablein the standard Convex runtime. Note that stored values will not be threaded through calls to
ctx.runQuery/ctx.runMutation/ctx.runAction.v1.38.0ctx.meta.getRequestMetadata()to access request metadata in mutations and actions:request ID, client IP, and client User-Agent.
npx convex deployment select local.--expiryand--expiresaliases for--expirationinnpx convex deployment create.import "server-only"to mark files as server-only.npx convex disable-local-deploymentscommand.usePaginatedQuery_experimentaloverload that has an object-based API similarto
useQuery_experimental.v1.37.0useQuery_experimental, which accepts object-based args and returns anobject with status, data, and error that doesn't throw errors by default.
npx convex deployment token create my-token --save-env, enablingscripts to configure agent environments with access only to develop and deploy
against their own cloud deployment. e.g.
VisibilityPropertiestype to allow types likeRegisteredQueryto be more easily extended without losing covariance.
ctx.meta.getDeploymentMetadata()function.v1.36.1npx convex login --vercelto ask before joining a Convex team through the Vercel Marketplace.v1.36.0npx convex runnow supports--inline-queryfor evaluating readonly querieswithout creating a named function first, for example:
npx convex run --inline-query 'await ctx.db.query("messages").take(5)'.ctx.metato access extra metadata at runtime:ctx.meta.getFunctionMetadata(): the current function's name, component,visibility, and whether it's a query, mutation, or action.
ctx.meta.getTransactionMetrics(): how much capacity remains in the currenttransaction. Only available in queries and mutations.
npx convex env defaultcommand for getting and setting defaultenvironment variables for a project.
npx convex deploynow supports a--messageoption that allows you towrite details in the deployment’s audit log. When running
npx convex deployon CI runners on popular platforms (including GitHub Actions,Vercel, and Netlify), a default message will be provided if you don’t provide one
(e.g. “Deployed from GitHub Actions •
e83c516”).instead of creating a new one by using
--preview-nameinstead of--preview-create.This behavior is also used when deploying to preview deployments from the CI
without specifying
--preview-createexplictly, but you canspecify
--preview-createexplicitly to restore the old behavior. When using the--preview-runflag, the function only runs when a new deployment is created.npx convex codegencan now automatically start a local backend when necessary.with
CONVEX_LOCAL_BACKEND_STARTUP_TIMEOUT_SECS; this can be useful when usinglarge local databases.
npx convex ai-files removewould also remove skill files thatwere not installed by
npx convex ai-filesin inconsistent order across platforms.
npx convex dev --startwhere, in some cases, the--startcommandwould continue to run after closing the Convex dev server with Ctrl+C.
get-convex/convex-helpers (convex-helpers)
v0.1.122Compare Source
v0.1.121Compare Source
db.vars.commitTsvariable andv.commitTs()validator added inconvex 1.43.0.
convex-helpers/server/compareis deprecated and now re-exportscompareValuesfromconvex/values. There may be small differences in behavior inuncommon cases (NaNs, negative zero, etc.) compared with the previous implementation.
v0.1.120Compare Source
zodToConvex/zodOutputToConvexwhen using branded types (includingzid)v0.1.119Compare Source
zodToConvexandzodOutputToConvexnow return the expected type when enabling the
exactOptionalPropertyTypesTypeScript setting.v0.1.118Compare Source
with filters. Previously it would aggressively split pages whenever
more items were scanned than requested. Now it only splits when
the page grows to be larger than the number of requested items or
so many documents are being scanned that the limits are close to being
hit.
v0.1.117Compare Source
convexToZodwhen the input type is a non-tuple array type.
v0.1.116Compare Source
HonoWithConvexandHttpRouterWithHononow accept an optionalVariablestype parameter, so consumers using middleware-driven typed context state
(
c.var/c.set/c.get) no longer need to cast theirHonoapp.v0.1.115Compare Source
get-convex/convex-test (convex-test)
v0.0.55Compare Source
db.vars.commitTsandv.commitTs().finishAllScheduledFunctionswould drop functionsscheduled under real timers.
v0.0.54Compare Source
transactionLimitsoption on nestedctx.runQuery/ctx.runMutationcalls (Convex 1.41). The nested call is enforced againstits own limits, capped at the global transaction limits so they can only be
lowered, never raised.
nested call's usage folds into its parent only when it commits, so the writes
of a rolled-back nested
ctx.runMutationno longer count against thetransaction's limits.
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* * * * 1-5)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.