Skip to content

fix(deps): update all non-major dependencies#231

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch
Jun 14, 2026
Merged

fix(deps): update all non-major dependencies#231
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@microsoft/api-extractor (source) ^7.58.7 → ^7.58.9 age confidence
@module-federation/runtime-tools (source) ^2.5.0 → ^2.5.1 age confidence
@rslib/core (source) ^0.22.0 → ^0.22.1 age confidence
@rslint/core ^0.5.3 → ^0.6.1 age confidence
@rspack/dev-middleware ^2.0.2 → ^2.0.3 age confidence
@rspack/plugin-react-refresh 2.0.1 → 2.0.2 age confidence
@rstest/core (source) ^0.10.3 → ^0.10.4 age confidence
@types/node (source) ^24.12.4 → ^24.13.2 age confidence
connect-next ^4.0.2 → ^4.0.3 age confidence
hono (source) ^4.12.23 → ^4.12.25 age confidence
http-proxy-middleware 4.0.0 → 4.1.0 age confidence
pnpm (source) 11.5.1 → 11.6.0 age confidence
prettier (source) 3.8.3 → 3.8.4 age confidence

Release Notes

microsoft/rushstack (@​microsoft/api-extractor)

v7.58.9

Compare Source

Sat, 13 Jun 2026 00:16:18 GMT

Version update only

v7.58.8

Compare Source

Mon, 08 Jun 2026 15:15:49 GMT

Patches
  • Add support for new d.ts extension format when using TS moduleResolution 'bundler' or 'nodenext'.
module-federation/core (@​module-federation/runtime-tools)

v2.5.1

Compare Source

Patch Changes
web-infra-dev/rslib (@​rslib/core)

v0.22.1

Compare Source

What's Changed

Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rslib@v0.22.0...v0.22.1

web-infra-dev/rslint (@​rslint/core)

v0.6.1

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rslint@v0.6.0...v0.6.1

v0.6.0

Compare Source

Highlights

ESLint Plugin Compatibility

rslint can now run community ESLint plugins' rules alongside its built-in native rules. Import the plugin and mount it in a JS/TS config under a prefix of your choice — plugin diagnostics merge into the same report, autofixes apply through --fix and the editor's source.fixAll, and it works the same way in the CLI and the VS Code extension. See the ESLint plugin compatibility guide for details and current limitations.

import examplePlugin from 'eslint-plugin-example';

export default [
  {
    files: ['**/*.ts'],
    plugins: { example: examplePlugin },
    rules: {
      'example/some-rule': 'error',
    },
  },
];
40+ New Rules

This release ports over 40 new rules across @typescript-eslint, eslint-plugin-jest, eslint-plugin-jsx-a11y, eslint-plugin-promise, and eslint-plugin-react, and enables the implemented rules in the javascript, typescript, and jsx-a11y recommended presets.

What's Changed

New Features 🎉
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rslint@v0.5.3...v0.6.0

rstackjs/rspack-dev-middleware (@​rspack/dev-middleware)

v2.0.3

Compare Source

What's Changed

Full Changelog: rstackjs/rspack-dev-middleware@v2.0.2...v2.0.3

rstackjs/rspack-plugin-react-refresh (@​rspack/plugin-react-refresh)

v2.0.2

Compare Source

What's Changed

Full Changelog: rstackjs/rspack-plugin-react-refresh@v2.0.1...v2.0.2

web-infra-dev/rstest (@​rstest/core)

v0.10.4

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Refactor 🔨
  • refactor(core): single-source RSTEST_* env-var names by @​fi3ework in #​1387
  • refactor(core, adapters): single-source adapter cache-key & target→env logic by @​fi3ework in #​1384
  • refactor(coverage): single-source provider contract and align collect error handling by @​fi3ework in #​1385
  • refactor(core): single-source reporter map and GitHub Actions detection by @​fi3ework in #​1383
  • refactor(core): single-source test-execution runtime contracts by @​fi3ework in #​1381
  • refactor(browser): deepen core↔browser seam and close browser-mode drift hazards by @​fi3ework in #​1382
  • refactor(core): consolidate runtime primitives (file task-id, env-loader registry, scoped-restore LIFO) by @​fi3ework in #​1379
  • refactor(browser): single-source the runner dispatch method vocabulary by @​fi3ework in #​1380
  • refactor(browser): single-source the snapshot RPC method/args contract by @​fi3ework in #​1377
  • refactor(core): single-source reporter run-count derivation and CLI/init owners by @​fi3ework in #​1374
  • refactor(core): gate global setup once and co-locate run verdict by @​fi3ework in #​1371
  • refactor(core): derive hook registration signatures from RunnerAPI by @​fi3ework in #​1370
  • refactor(core): own runtime-contract grammar for chunk names and worker import hooks by @​fi3ework in #​1366
  • refactor(core, browser): deepen core↔browser seams and dedupe shared primitives by @​fi3ework in #​1362
  • refactor(core): unify dynamic-import resolver across CJS/ESM worker loaders by @​fi3ework in #​1359
  • refactor(browser): drop unused internal browser surface by @​fi3ework in #​1360
  • refactor(core): move internal browser host subpaths under ./internal by @​fi3ework in #​1358
Document 📖
Other Changes

Full Changelog: web-infra-dev/rstest@v0.10.3...v0.10.4

rstackjs/connect-next (connect-next)

v4.0.3

Compare Source

What's Changed

Full Changelog: rstackjs/connect-next@v4.0.2...v4.0.3

honojs/hono (hono)

v4.12.25

Compare Source

v4.12.24

Compare Source

chimurai/http-proxy-middleware (http-proxy-middleware)

v4.1.0

Compare Source

  • feat(definePlugin): helper function to create plugins
  • chore(package.json): update to httpxy@​0.5.3
  • fix(ipv6): preserve credentials when normalizing bracketed IPv6 target string
  • fix(ipv6): unspecified IPv6 target hostname (::)
  • fix(response-interceptor): reduce responseInterceptor buffer churn
  • fix(ws): handle multi-server upgrade subscription and safe proxy shutdown
  • feat(router): add 'res' and 'options' to router function
  • feat(pathRewrite): add 'res' and 'options' to custom pathRewrite function
  • fix(responseInterceptor): prevent trailer/content-length conflict
  • feat(zstd): support zstd compression in responseInterceptor and fixRequestBody
  • fix(responseInterceptor): handle bodyless responses (HEAD/1xx/204/304) with content-encoding
  • fix(router): harden proxy-table matching
pnpm/pnpm (pnpm)

v11.6.0

Compare Source

Minor Changes

  • pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.

  • 615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:

    npm_config_//registry.npmjs.org/:_authToken=<token>
pnpm_config_//registry.npmjs.org/:_authToken=<token>

    This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

  • Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
  • Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #​12324.
  • Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lock

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot enabled auto-merge (squash) June 14, 2026 18:04
@coderabbitai

coderabbitai Bot commented Jun 14, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ff24615c-194a-4ab8-97c7-e2eff2921f4e

📥 Commits

Reviewing files that changed from the base of the PR and between 4e34025 and ca6ad8b.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (2)
  • package.json
  • tests/package.json
📝 Walkthrough

Walkthrough

Dependency versions in package.json are bumped: @rspack/dev-middleware from ^2.0.2 to ^2.0.3, http-proxy-middleware from 4.0.0 to 4.1.0, and several devDependencies (@microsoft/api-extractor, @rslib/core, @rslint/core, @rspack/plugin-react-refresh, @rstest/core, @types/node, hono, http-proxy-middleware, prettier). The packageManager field is updated from pnpm@11.5.1 to pnpm@11.6.0. In tests/package.json, @module-federation/runtime-tools is bumped from ^2.5.0 to ^2.5.1.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main change: updating non-major dependencies across the project as specified in the PR objectives.
Description check ✅ Passed The description is related to the changeset, detailing the dependency updates and their versions with a comprehensive table of changes and release notes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate Bot merged commit 07b7253 into main Jun 14, 2026
3 of 4 checks passed
@renovate renovate Bot deleted the renovate/all-minor-patch branch June 14, 2026 18:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants