Skip to content

chore(deps): update all non-major dependencies - #1865

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 13, 2026 •

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@babel/plugin-transform-typescript (source) ^7.29.7 → ^7.29.9 age confidence dependencies patch
@vitejs/plugin-legacy (source) ^8.0.2 → ^8.2.3 age confidence dependencies minor
@vue/reactivity (source) ^3.5.38 → ^3.5.43 age confidence devDependencies patch
MatteoGabriele/agentscan-action v2.0.1 → v2.5.0 age confidence action minor
acorn ^8.17.0 → ^8.19.0 age confidence dependencies minor
actions/checkout v7.0.0 → v7.0.1 age confidence action patch
danielroe/provenance-action v0.1.1 → v0.2.0 age confidence action minor
devalue 6.0.0 → 6.0.2 age confidence devDependencies patch
enhanced-resolve ^5.24.0 → ^5.26.0 age confidence dependencies minor
eslint (source) 9.39.4 → 9.39.5 age confidence devDependencies patch
eslint-plugin-import-x ^4.16.2 → ^4.17.1 age confidence devDependencies minor
eslint-plugin-vue (source) ^10.9.2 → ^10.11.1 age confidence devDependencies minor
exsolve ^1.0.8 → ^1.1.3 age confidence dependencies patch
globals ^17.6.0 → ^17.13.0 age confidence devDependencies patch
globby 16.2.0 → 16.2.4 age confidence devDependencies patch
happy-dom ^20.10.6 → ^20.14.5 age confidence devDependencies minor
knip (source) 6.17.1 → 6.39.0 age confidence devDependencies minor 6.40.0
magic-string ^1.1.0 → ^1.4.3 age confidence dependencies patch
nypm ^0.6.7 → ^0.6.10 age confidence dependencies patch
ohash ^2.0.11 → ^2.0.12 age confidence dependencies patch
pkg-types ^2.3.1 → ^2.3.3 age confidence dependencies patch
playwright-core (source) 1.61.0 → 1.63.0 age confidence devDependencies minor
pnpm (source) 10.34.4 → 10.34.6 age confidence packageManager patch
rollup (source) ^4.62.2 → ^4.64.0 age confidence devDependencies minor 4.64.1
std-env ^4.1.0 → ^4.3.0 age confidence dependencies minor
std-env 4.1.0 → 4.3.0 age confidence devDependencies minor
terser (source) ^5.48.0 → ^5.51.2 age confidence dependencies minor
typescript-eslint (source) ^8.61.1 → ^8.71.1 age confidence devDependencies minor
vite (source) ~7.3.5 → ~7.3.7 age confidence dependencies patch
vite (source) ~7.3.5 → ~7.3.7 age confidence devDependencies patch
vue-bundle-renderer ^2.2.0 → ^2.4.0 age confidence dependencies minor

Release Notes

babel/babel (@​babel/plugin-transform-typescript)

v7.29.9

Compare Source

v7.29.9 (2026-09-18)

🐛 Bug Fix
🏠 Internal
Committers: 4
vitejs/vite (@​vitejs/plugin-legacy)

v8.2.3

Bug Fixes

v8.2.2

Compare Source

Features
  • update rolldown-related dependencies and use client-side HMR in bundled-dev (#​22961) (960e9ef)
Bug Fixes

v8.2.1

Compare Source

Bug Fixes

v8.2.0

Compare Source

Features
Bug Fixes
Code Refactoring

v8.1.0

Compare Source

Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
Beta Changelogs
8.1.0-beta.0 (2026-06-15)

See 8.1.0-beta.0 changelog

vuejs/core (@​vue/reactivity)

v3.5.43

Compare Source

Bug Fixes

v3.5.42

Compare Source

Bug Fixes

v3.5.41

Compare Source

Bug Fixes

v3.5.40

Compare Source

Bug Fixes

v3.5.39

Compare Source

Bug Fixes
MatteoGabriele/agentscan-action (MatteoGabriele/agentscan-action)

v2.5.0

Compare Source

Identity update:

  • fix(detectors): branch pr automation flag

Full Changelog: MatteoGabriele/agentscan-action@v2.4.0...v2.5.0

v2.4.0

Compare Source

What's Changed

New Contributors

Full Changelog: MatteoGabriele/agentscan-action@v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed

Full Changelog: MatteoGabriele/agentscan-action@v2.2.0...v2.3.0

v2.2.0

Compare Source

What's Changed

Full Changelog: MatteoGabriele/agentscan-action@v2.1.0...v2.2.0

v2.1.0

Compare Source

What's Changed

Full Changelog: MatteoGabriele/agentscan-action@v2.0.1...v2.1.0

acornjs/acorn (acorn)

v8.19.0

Compare Source

v8.18.0

Compare Source

actions/checkout (actions/checkout)

v7.0.1

Compare Source

danielroe/provenance-action (danielroe/provenance-action)

v0.2.0

Compare Source

compare changes

🚀 Enhancements
  • Respect pnpm's trustPolicyExclude (2f0f52d)
  • Detect loss of npm staged publishing approval (fc86c9a)
📖 Documentation
  • Update action description (e78b179)
  • Add link to pnpm v10.21 trustPolicy 🎉 (fd8dd3c)
🏡 Chore
  • Add licence (cafd196)
  • Revert pnpm trust policy and restore provenance action (4320fb9)
  • Release v0.0.2 (194cad5)
  • Migrate to pnpm v11 (#​99)
✅ Tests
  • Improve coverage of lockfile parsing utils (a9d6553)
  • Migrate to vitest (07fa732)
  • Add api responses as fixtures + test provenance utils (fd6ed30)
🤖 CI
  • Pin github actions to full-length commit shas (9426311)
  • Add agent-scan workflow to flag bot-authored PRs (81568f7)
❤️ Contributors
sveltejs/devalue (devalue)

v6.0.2

Compare Source

Patch Changes

v6.0.1

Compare Source

Patch Changes
  • c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
  • 6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
  • e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
  • 6156b2e: perf: only format path when an error is raised
  • 6156b2e: perf: cache quoted property names
  • 9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element
webpack/enhanced-resolve (enhanced-resolve)

v5.26.0

Compare Source

Minor Changes
  • Add experimental support for Node.js package maps through a new packageMap option, which takes the path of the configuration file (or a file: URL) or an already-parsed packages object. When it is set, a bare specifier is resolved through the importing package's dependencies table and the target package's location is handed to the regular pipeline, instead of walking node_modules; relative and absolute requests and node: builtins are unaffected. Because several package entries may share one url, the package a request resolved into is exposed as packageId on the result and can be passed back in as context.packageId to resolve from that package unambiguously. Package maps are stability 1 (experimental) in Node.js, and this option tracks that specification and may change with it. (by @​alexander-akait in #​667)

  • Explain an exports/imports field whose conditions wrap subpaths, instead of failing with a message that points at the request. A field shaped like { "import": { ".": "./esm/index.js", "./*": "./esm/*.js" }, "require": "./build/bundle.js" } is not supported by Node.js: the subpaths inside a condition are read as condition names, so they match nothing, and every request into the package failed as "./foo" is not exported under the conditions [...] — which reads as though the package forgot to export ./foo. Such a failure now names the offending keys and shows the arrangement that works, with the subpaths at the top level and the conditions nested inside them. Resolution itself is unchanged: the diagnosis runs only on a request that has already failed, so nothing that resolves today starts failing, and a successful resolve does no extra work. Errors raised while processing either field also name the package.json they came from, which previously only appeared in the resolver log. (by @​alexander-akait in #​676)

  • Generate the published type declarations with TypeScript instead of webpack/tooling, which is no longer a dependency. Every name the package exported before is still exported, and types.d.ts is still the entry point, but the declarations themselves now live in types/ and are emitted by tsc from the JSDoc in lib/. Two shapes follow the sources more closely than the previous generator did: the object form of Plugin no longer declares this: Resolver on apply (it is called as plugin.apply(resolver), so this is the plugin), and the entries of ResolveContext.stack declare name: string | undefined rather than an optional name. Class fields that the old generator dropped, such as the cache backends on CachedInputFileSystem, are now part of the declarations. (by @​alexander-akait in #​675)

Patch Changes
  • Size the ancestor path and segment arrays that getPathsCached keeps to what they actually hold: a push-built store keeps room for 17 entries while a path has a handful, and the cache holds these for the filesystem's lifetime. (by @​alexander-akait in #​681)

v5.25.1

Compare Source

Patch Changes

v5.25.0

Compare Source

Minor Changes

v5.24.5

Compare Source

Patch Changes
  • Soft-fail when auto tsconfig discovery loads a broken config, and keep relative extends paths relative. (by @​xiaoxiaojx in #​645)

v5.24.4

Compare Source

Patch Changes
  • Keep the original request resolvable when extensionAlias lists its own extension. (by @​alexander-akait in #​641)

  • Fix string restrictions boundary checks: a restriction ending with a separator no longer rejects everything inside it, restrictions are normalized before they are compared, and a Windows path now matches the way path.win32 does, treating / and \ as interchangeable and comparing case-insensitively, while \ stays a filename character in a posix path. The same comparison backs tsconfig path matching. (by @​alexander-akait in #​643)

  • Treat a UNC path (\\server\share\…) as a Windows path, so it normalizes, joins and walks up with path.win32 semantics instead of being taken for a bare module request. (by @​alexander-akait in #​644)

v5.24.3

Compare Source

Patch Changes
  • Resolve tsconfig extends package specifiers from ancestor node_modules directories (workspace hoisting). (by @​alexander-akait in #​631)

v5.24.2

Compare Source

Patch Changes

v5.24.1

Compare Source

Patch Changes
eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

Documentation

Chores

  • 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
  • 202117b chore: package.json update for @​eslint/js release (Jenkins)
  • d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
  • 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
  • daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
  • daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
  • 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)
un-ts/eslint-plugin-import-x (eslint-plugin-import-x)

v4.17.1

Compare Source

Patch Changes

❗ Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from wattanx as a code owner July 13, 2026 13:34
@socket-security

socket-security Bot commented Jul 13, 2026 •

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@pkg-pr-new

pkg-pr-new Bot commented Jul 13, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/bridge@1865
npm i https://pkg.pr.new/@nuxt/bridge-schema@1865

commit: b4ae22f

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 232aecb to 49015bf Compare July 19, 2026 20:13
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 4da8fab to 01cba3e Compare July 27, 2026 23:52
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 1fc29b1 to b48d04c Compare July 30, 2026 07:13
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from bb3f0cd to 99e0ed3 Compare August 12, 2026 04:51
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from b49c770 to c35bde9 Compare August 19, 2026 21:40
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 8e21c06 to fbbaa48 Compare August 26, 2026 22:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants