deps: sku 16.1.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sku (source)	16.0.0 → 16.1.1

---

Release Notes

seek-oss/sku (sku)

v16.1.1

Compare Source

Patch Changes

• Unpin and update webpack dependency to ^5.109.0 (#​1683)

  sku's webpack dependency was pinned to 5.108.1 in the v16 release to prevent a bug in a newer webpack version from affecting sku consumers. The fix for this bug was released in 5.109.0, so the webpack dependency has now been unpinned.

• build|start (vite): --convert-loadable now converts loadable imports for dependencies that ship .mjs, .cjs or aliased imports (#​1694)

• build|start (vite): Handle Vanilla Extract styles from packages that ship source code (#​1694)

  If you were using dangerouslySetViteConfig to exclude packages from optimizeDeps to work around this, you can now remove that configuration along with any of its CommonJS dependencies listed in optimizeDeps.include.

• start (vite): Pollyfill files are scanned for dependancy optimization on cold-start to reduce app reloads (#​1694)

v16.1.0

Compare Source

Minor Changes

• csp: Add support for report-only Content Security Policy. (#​1631)

  Two new configuration options, cspReportOnlyEnabled and cspReportOnlyExtraScriptSrcHosts, allow the generation of a "report-only" CSP delivered via the Content-Security-Policy-Report-Only header.

  See the Content Security Policy section of the sku docs for more details.

• csp: Add cspDelivery config option. (#​1630)

  A new configuration option, cspDelivery, allows control of how the Content Security Policy is delivered and can be set to one of two values:

  • tag: The CSP is embedded directly in the rendered HTML content via a <meta http-equiv="Content-Security-Policy" …> tag. This is the default and matches the previous behaviour.
  • header: The CSP is written to a JSON metadata file alongside the rendered HTML content. This metadata can be used at deployment and/or request time to include a Content-Security-Policy header in the response for the rendered HTML content.

  See the Content Security Policy section of the sku docs for more details.

• csp: Add support for reporting Content Security Policy violations. (#​1675)

  Two new configuration options, cspReportTo and cspReportOnlyReportTo, allow the reporting of CSP violations via the browser Reporting API.

  See the Content Security Policy section of the sku docs for more details.

• storybook: Add viteFinal API to the sku/config/storybook entrypoint (#​1676)

  This API is the Vite equivalent to the existing webpack-specific APIs already available via the sku/config/storybook entrypoint.
  It injects sku-specific configuration into Storybook's Vite config, helping to ensure your Storybook works correctly with Braid and Vanilla Extract.
  Please read the sku Storybook docs for more information.

Patch Changes

• Missing *.localhost hosts no longer trigger hosts-file warnings (#​1679)

• configure: Always add .ssl to .gitignore (#​1668)

  sku now always adds .ssl to .gitignore, rather than only when httpsDevServer is enabled.

• Improve package manager detection (#​1674)

  Package manager detection has been improved, and should now correctly detect the package manager your project uses, even when running from a coding agent.

---

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

• Branch creation
  • "after 3:00 am and before 6:00 am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 16a6057

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR