Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	24.10.4 → 24.13.3			devDependencies	minor
autoprefixer	10.4.23 → 10.5.2			devDependencies	minor
babel-loader	10.0.0 → 10.1.1			devDependencies	minor
better-sqlite3	12.5.0 → 12.11.1			devDependencies	minor
canvas	3.2.0 → 3.2.3			devDependencies	patch
css-loader	7.1.2 → 7.1.4			devDependencies	patch
favicons	7.2.0 → 7.3.0			devDependencies	minor
html-webpack-plugin	5.6.5 → 5.6.7			devDependencies	patch
iconv-lite	0.7.2 → 0.7.3			devDependencies	patch
jimp	1.6.0 → 1.6.1			devDependencies	patch
jotai	2.16.1 → 2.20.1			devDependencies	minor
mini-css-extract-plugin	2.9.4 → 2.10.2			devDependencies	minor
modern-screenshot	4.6.7 → 4.7.0			devDependencies	minor
nanoid	5.1.6 → 5.1.16			devDependencies	patch
nginx	1.31.0-alpine → 1.31.2-alpine			final	patch
node (source)	24.12 → 24.18				minor
oxfmt (source)	^0.46.0 → ^0.58.0			devDependencies	minor
oxlint-tsgolint	^0.21.1 → ^0.24.0			devDependencies	minor
p-queue	9.0.1 → 9.3.1			devDependencies	minor
papaparse (source)	5.5.3 → 5.5.4			devDependencies	patch
postcss-loader	8.2.0 → 8.2.1			devDependencies	patch
react (source)	19.2.3 → 19.2.7			devDependencies	patch
react-dom (source)	19.2.3 → 19.2.7			devDependencies	patch
react-error-boundary (source)	6.0.1 → 6.1.2			devDependencies	minor
react-intl (source)	8.0.9 → 8.1.4			devDependencies	minor
sanitize-filename	1.6.3 → 1.6.4			devDependencies	patch
webpack	5.104.1 → 5.108.4			devDependencies	minor
webpack-sources	3.3.3 → 3.5.1			devDependencies	minor
yarn (source)	4.12.0 → 4.17.1			packageManager	minor
zustand	5.0.9 → 5.0.14			devDependencies	patch

---

Release Notes

postcss/autoprefixer (autoprefixer)

v10.5.2

Compare Source

• Moved -webkit-fill-available before -moz-available, so Firefox
  will use -webkit- version which is closer to stretch.

v10.5.1

Compare Source

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

v10.5.0

Compare Source

• Added mask-position-x and mask-position-y support (by @​toporek).

v10.4.27

Compare Source

• Removed development key from package.json.

v10.4.26

Compare Source

• Reduced package size.

v10.4.25

Compare Source

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

v10.4.24

Compare Source

• Made Autoprefixer a little faster (by @​Cherry).

babel/babel-loader (babel-loader)

v10.1.1

Compare Source

What's Changed

• Revert #​1055 ("use module.findPackageJSON API") by @​JLHwung in #​1066

Full Changelog: babel/babel-loader@v10.1.0...v10.1.1

v10.1.0

Compare Source

What's Changed

• refactor: use module.findPackageJSON API by @​JLHwung in #​1055
• Enable type checking and support Babel 8 by @​JLHwung in #​1056
• Bump js-yaml from 4.1.0 to 4.1.1 by @​dependabot[bot] in #​1059
• fix: mark webpack as optional peer dependency by @​chenjiahan in #​1061
• Bump webpack from 5.101.0 to 5.104.1 by @​dependabot[bot] in #​1062
• Bump glob from 10.4.5 to 10.5.0 by @​dependabot[bot] in #​1060
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​1063
• Pin Node.js on CI by @​nicolo-ribaudo in #​1064

New Contributors

• @​chenjiahan made their first contribution in #​1061

Full Changelog: babel/babel-loader@v10.0.0...v10.1.0

WiseLibs/better-sqlite3 (better-sqlite3)

v12.11.1

Compare Source

What's Changed

• Fix Electron v42 build errors on Windows by @​m4heshd in #​1488

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.10.1

Compare Source

What's Changed

• Bump the github-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​1451
• Fix V8 external API usage for Electron 42 by @​tstone-1 in #​1475

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

v12.10.0

Compare Source

What's Changed

• Update SQLite to version 3.53.1 by @​JoshuaWise in #​1467
• Add support for Node.js v26 prebuilds and remove EOL builds (Node.js v20, v23) by @​m4heshd in #​1468
• Temporarily rollback support for Electron v42 prebuilds by @​m4heshd in #​1470
• Enable percentile functions by @​Maxime-J in #​1447

Full Changelog: WiseLibs/better-sqlite3@v12.9.1...v12.10.0

v12.9.0

Compare Source

What's Changed

• Update SQLite to version 3.53.0 in #​1464

Full Changelog: WiseLibs/better-sqlite3@v12.8.0...v12.9.0

v12.8.0

Compare Source

What's Changed

• Readme: requires Node.js v20 or later by @​Prinzhorn in #​1443
• Update SQLite to version 3.51.3 in #​1460
• fix: use HolderV2() for PropertyCallbackInfo on V8 >= 12.5 by @​tstone-1 in #​1459

New Contributors

• @​tstone-1 made their first contribution in #​1459

Why SQLite v3.51.3 instead of v3.52.0

From the SQLite team:

Some important issues have been found with version 3.52.0. In order to give us time to deal with those issues, we plan to withdraw the 3.52.0 release. In its place, we will put up a new 3.51.3 patch release that includes a fix for the recently discovered WAL-reset bug as well as other patches. This will happen probably within about the next twelve hours.

Hence, if you were planning to upgrade to 3.52.0 tomorrow (Friday, 2026-03-14), perhaps it would be better to wait a day or so for 3.51.3.

At some point we will do version 3.52.1 which will hopefully resolve the issues that have arisen with the 3.52.0 release.

Full Changelog: WiseLibs/better-sqlite3@v12.7.1...v12.8.0

v12.6.2

Compare Source

What's Changed

• fix build: update node-abi version in package.json to ^4.25.0 by @​mceachen in #​1439

Full Changelog: WiseLibs/better-sqlite3@v12.6.1...v12.6.2

v12.6.0

Compare Source

What's Changed

• Update SQLite to version 3.51.2 in #​1436

Full Changelog: WiseLibs/better-sqlite3@v12.5.0...v12.6.0

Automattic/node-canvas (canvas)

v3.2.3

Compare Source

==================

Fixed

• Fix building with gcc (#​2559)

v3.2.2

Compare Source

==================

Fixed

• Fix dangling env pointer in image MIME data cleanup (#​2550)
• Fix ctx.direction not affected by ctx.save and ctx.restore
• Preserve rest of PDF pages when changing width and height (#​2538)
• Several security fixes for untrusted inputs to getImageData and putImageData. Thanks to Ethan Kim for the report.

v3.2.1

Compare Source

==================

• Fix error message HTTP response status code in image src setter
• roundRect() shape incorrect when radii were large relative to rectangle size (#​2400)
• Reject loadImage when src is null or invalid (#​2304)
• Fix compilation on GCC 15 by including (#​2545)

webpack/css-loader (css-loader)

v7.1.4

Compare Source

v7.1.3

Compare Source

itgalaxy/favicons (favicons)

v7.3.0

Compare Source

jantimon/html-webpack-plugin (html-webpack-plugin)

v5.6.7

Compare Source

v5.6.6

Compare Source

pillarjs/iconv-lite (iconv-lite)

v0.7.3: 0.7.3

Compare Source

🚀 Improvements

• Add iso-8859-8-i and iso-8859-8-e charset aliases - by @​baptistejamin in #​394

🐞 Bug fixes

• Fix UTF-32 streaming across chunk boundaries - by @​spokodev and @​bjohansebas in #​393

  When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer decode/encode were unaffected.

New Contributors

• @​baptistejamin made their first contribution in #​394
• @​spokodev made their first contribution in #​393

Full Changelog: pillarjs/iconv-lite@v0.7.2...v0.7.3

jimp-dev/jimp (jimp)

v1.6.1

Compare Source

🎉 This release contains work from new contributors! 🎉

Thanks for all your work!

❤️ Denys Kashkovskyi (@​Kashkovsky)

❤️ Viki (@​vikiboss)

🐛 Bug Fix

• fix docs imports (@​hipstersmoothie)
• @jimp/core, @jimp/plugin-quantize, @jimp/wasm-avif, @jimp/wasm-jpeg, @jimp/wasm-png, @jimp/wasm-webp
  • Update file-type from ^16 to ^21.3.3 in @​jimp/core #​1400 (@​Kashkovsky @​hipstersmoothie)

⚠️ Pushed to main

• @jimp/core
  • Doc updates (closes #​1342) (@​hipstersmoothie)

📝 Documentation

• docs: correct GitHub repo link #​1340 (@​vikiboss)

Authors: 3

• Andrew Lisowski (@​hipstersmoothie)
• Denys Kashkovskyi (@​Kashkovsky)
• Viki (@​vikiboss)

pmndrs/jotai (jotai)

v2.20.1

Compare Source

This release includes a few small fixes.

What's Changed

• fix(vanilla/utils/atomWithStorage): apply reviver when parsing subscription updates by @​chatman-media in #​3326
• fix(internals): throw stackoverflow errors synchronously by @​dai-shi in #​3330

New Contributors

• @​15MariamS made their first contribution in #​3321
• @​sapphi-red made their first contribution in #​3327
• @​DucMinhNe made their first contribution in #​3331
• @​chatman-media made their first contribution in #​3326

Full Changelog: pmndrs/jotai@v2.20.0...v2.20.1

v2.20.0

Compare Source

This release improves performance in high-throughput scenarios. Huge kudos to @​dmaskasky!

What's Changed

• breaking(internals): avoid getInternalBuildingBlock function by @​dai-shi in #​3293
• refactor(internals): Rev3 type narrowing for onMount hooks by @​dmaskasky in #​3311
• fix(internals): guard atomOnInit hook with hasOnInit by @​dmaskasky in #​3312
• refactor(internals): lazy hooks in ensureAtomState for new atom state by @​dmaskasky in #​3313

Full Changelog: pmndrs/jotai@v2.19.1...v2.20.0

v2.19.1

Compare Source

This release includes several small refactors to improve performance.

What's Changed

• fix(vanilla/utils/atomWithObservable): use symbol index signature to avoid 'Symbol.observable' type reference by @​sukvvon in #​3274
• refactor(internals): replace nextDeps with prevDeps by @​dmaskasky in #​3278
• refactor(internals): reduce recomputeInvalidatedAtoms overhead (performance) by @​dmaskasky in #​3284
• refactor(internals): reduce flushPending overhead (performance) by @​dmaskasky in #​3285
• fix(internals): check if atom has dependencies before doing mountDependencies work (performance) by @​dmaskasky in #​3290
• fix(internals): check if atom has onMount property before queueing processOnMount callback (performance) by @​dmaskasky in #​3291
• refactor(types): prefer no-any by @​dai-shi in #​3304

New Contributors

• @​aio39 made their first contribution in #​3277

Full Changelog: pmndrs/jotai@v2.19.0...v2.19.1

v2.19.0

Compare Source

We improved the core to enable atom caching for performance for some cases.

What's Changed

• fix(react): deprecate delay option by @​dai-shi in #​3264
• feat: improve store.get performance when atoms are not mutated by @​dmaskasky in #​3265 thanks to @​edkimmel

New Contributors

• @​composite made their first contribution in #​3268

Full Changelog: pmndrs/jotai@v2.18.1...v2.19.0

v2.18.1

Compare Source

This release fixes a regression introduced in v2.12.1, which affects an uncommon edge case.

What's Changed

• fix(vanilla): subscriber not notified when derived read calls store.set by @​dmaskasky in #​3245
• fix(vanilla/utils/atomWithObservable): add 'Symbol.observable' type support to 'ObservableLike' by @​sukvvon in #​3253
• refactor(vanilla/utils/atomWithStorage): use optional chaining for 'storage.subscribe' by @​sukvvon in #​3260

Full Changelog: pmndrs/jotai@v2.18.0...v2.18.1

v2.18.0

Compare Source

We moved jotai/babel to jotai-babel.

Migration Guide

If you use the preset:

  {
-   "presets": ["jotai/babel/preset"]
+   "presets": ["jotai-babel/preset"]
  }

If you use a plugin:

  {
-   "plugins": ["jotai/babel/plugin-debug-label"]
+   "plugins": ["jotai-babel/plugin-debug-label"]
  }

What's Changed

• refactor(internals): simplify promise handing by @​dai-shi in #​3232
• feat: deprecate jotai/babel in favor of jotai-babel by @​dai-shi in #​3236
• fix: keep reactivity if get is called in a different atom by @​dai-shi in #​3241

New Contributors

• @​pavan-sh made their first contribution in #​3238

Full Changelog: pmndrs/jotai@v2.17.1...v2.18.0

v2.17.1

Compare Source

Small typing improvements. If you are using v2.16 or earlier, we recommend upgrading to the latest version.

What's Changed

• fix(core/types): Wrong variance on the WritableAtom Result type parameter by @​atomanyih in #​3135
• chore: leftover with #​3219 by @​dai-shi in #​3231

New Contributors

• @​atomanyih made their first contribution in #​3135

Full Changelog: pmndrs/jotai@v2.17.0...v2.17.1

v2.17.0

Compare Source

This release deprecates some features, which will be dropped in v3.

What's Changed

• deprecate loadable util by @​dai-shi in #​3217
• breaking: remove unstable_onInit by @​dai-shi in #​3219
• deprecate setSelf in the atom read function by @​dai-shi in #​3220

Full Changelog: pmndrs/jotai@v2.16.2...v2.17.0

v2.16.2

Compare Source

Fixes unwrap and loadable, resolving a regression introduced in v2.15.2.

What's Changed

• fix(utils): unwrap should not violate the store mutation rule by @​dai-shi in #​3213

New Contributors

• @​dev-itsheng made their first contribution in #​3206

Full Changelog: pmndrs/jotai@v2.16.1...v2.16.2

webpack/mini-css-extract-plugin (mini-css-extract-plugin)

v2.10.2

Compare Source

v2.10.1

Compare Source

v2.10.0

Compare Source

Features

• respect output.cssFilename and output.cssChunkFilename (#​1151) (54f775d)

Bug Fixes

• prevent generation of a contentHash for a chunk when the set of css modules is of size 0 (#​1154) (4e4a95d)

2.9.4 (2025-08-11)

Bug Fixes

• hmr crash in some situations (#​1140) (f67c05a)

2.9.3 (2025-08-04)

Bug Fixes

• should update initial chunks correctly with filename (dab023f)

2.9.2 (2024-11-01)

Bug Fixes

• prefetch and preload runtime generation (#​1116) (58c6b74)

2.9.1 (2024-08-19)

Bug Fixes

• add export default {} when CSS modules enabled and a file is empty for the defaultExport option (8f77e19)

qq15725/modern-screenshot (modern-screenshot)

v4.7.0

Compare Source

Bug Fixes

• clone documentElement instead of body for same-origin iframes (0c3871a)
• delete position when copy root element styles (328379d)
• use detached document for @​import rule processing (719fb4e)

4.6.8 (2026-01-26)

Features

• add support for fonts in @​layers (e4624bb)

4.6.7 (2025-11-18)

Bug Fixes

• ensure WebKit scrollbar pseudo-classes are cloned correctly (1d10f48)

4.6.6 (2025-08-19)

4.6.5 (2025-07-05)

Features

• Add the onCloneEachNode callback to execute when each node is cloned. (f9fe0db)

4.6.4 (2025-06-12)

Bug Fixes

• use HTMLIFrameElement.srcdoc replace HTMLIFrameElement.contentWindow.document.write remove browser warning (closes #​136) (ea2ddf4)

4.6.3 (2025-06-12)

Bug Fixes

• rollback previous commit. fix SVG use in shadowDOM (closes #​140) (9be4f5e)

4.6.2 (2025-06-09)

Bug Fixes

• skip copying styles for SVG Defs and their children (c043f34)
• skip copying styles for SVG Defs and their children (824ab63)

4.6.1 (2025-06-09)

Bug Fixes

• skip copying styles for SVG Defs and their children (14fc8b3)

v4.6.8

Compare Source

Bug Fixes

• clone documentElement instead of body for same-origin iframes (0c3871a)
• delete position when copy root element styles (328379d)
• use detached document for @​import rule processing (719fb4e)

4.6.8 (2026-01-26)

Features

• add support for fonts in @​layers (e4624bb)

4.6.7 (2025-11-18)

Bug Fixes

• ensure WebKit scrollbar pseudo-classes are cloned correctly (1d10f48)

4.6.6 (2025-08-19)

4.6.5 (2025-07-05)

Features

• Add the onCloneEachNode callback to execute when each node is cloned. (f9fe0db)

4.6.4 (2025-06-12)

Bug Fixes

• use HTMLIFrameElement.srcdoc replace HTMLIFrameElement.contentWindow.document.write remove browser warning (closes #​136) (ea2ddf4)

4.6.3 (2025-06-12)

Bug Fixes

• rollback previous commit. fix SVG use in shadowDOM (closes #​140) (9be4f5e)

4.6.2 (2025-06-09)

Bug Fixes

• skip copying styles for SVG Defs and their children (c043f34)
• skip copying styles for SVG Defs and their children (824ab63)

4.6.1 (2025-06-09)

Bug Fixes

• skip copying styles for SVG Defs and their children (14fc8b3)

ai/nanoid (nanoid)

v5.1.16

Compare Source

• Fixed forever loop on negative size (by @​spokodev).

v5.1.15

Compare Source

• Fixed random pool corruption on big ID sizes.

v5.1.14

Compare Source

• Fixed npm package size regression.

v5.1.13

Compare Source

• Fixed npm package size regression.

v5.1.12

Compare Source

• Moved to npm Provenance and Staged Publishing.

v5.1.11

Compare Source

• Fixed breaking Nano ID by requesting big ID.

v5.1.10

Compare Source

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

v5.1.9

Compare Source

• Fixed npm package size regression.

v5.1.8

Compare Source

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

v5.1.7

Compare Source

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

nodejs/node (node)

v24.18.0: 2026-06-23, Version 24.18.0 'Krypton' (LTS), @​richardlau prepared by @​sxa

Compare Source

Notable Changes

• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #​63527
• [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #​64004
• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #​63597
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #​62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #​62527
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #​62183
• [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #​63155
• [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #​63079
• [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #​63834

Commits

• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #​63597
• [9ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #​62755
• [7c22ee23aa] - build: def NODE_USE_NODE_CODE_CACHE only used in node_mksnapshot (Chengzhong Wu) #​63588
• [2551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #​62761
• [e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #​62763
• [ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #​63363
• [3d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #​63363
• [f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #​63363
• [e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #​63363
• [56e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #​63255
• [3bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #​63255
• [1bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #​63255
• [4433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #​63111
• [b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #​63111
• [ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #​62883
• [26781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #​62905
• [aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key typ

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ddr-tools	Ready	Preview	Jul 12, 2026 11:53am