Skip to content

fix(deps): update all non-major dependencies - #151

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies
Open

fix(deps): update all non-major dependencies#151
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@figma/plugin-typings ^1.130.0 → ^1.132.0 age confidence
@modelcontextprotocol/sdk (source) ^1.29.0 → ^1.30.0 age confidence
@vitejs/plugin-vue (source) ^6.0.7 → ^6.0.8 age confidence
@vitejs/plugin-vue (source) 6.0.7 → 6.0.8 age confidence
@vueuse/core (source) ^14.3.0 → ^14.4.0 age confidence
eslint (source) ^10.7.0 → ^10.8.0 age confidence
eslint-plugin-vue (source) ~10.9.2 → ~10.10.0 age confidence
eslint-plugin-vue (source) ^10.9.2 → ^10.10.0 age confidence
marked (source) ^18.0.6 → ^18.0.7 age confidence
nanoid ^6.0.0 → ^6.0.1 age confidence
oxfmt (source) ^0.58.0 → ^0.62.0 age confidence
p-limit ^7.3.0 → ^7.3.1 age confidence
playwright (source) ^1.61.1 → ^1.62.1 age confidence
pnpm (source) 11.11.0 → 11.20.0 age confidence
tsdown (source) ^0.22.7 → ^0.22.14 age confidence
tsx (source) ^4.23.1 → ^4.23.5 age confidence
vite (source) 8.1.4 → 8.2.0 age confidence
vite-plugin-css-injected-by-js ^5.0.1 → ^5.0.2 age confidence
vue (source) ^3.5.39 → ^3.5.40 age confidence
vue-tsc (source) ^3.3.7 → ^3.3.9 age confidence
ws ^8.21.0 → ^8.21.2 age confidence
wxt (source) ^0.20.27 → ^0.21.3 age confidence

Release Notes

figma/plugin-typings (@​figma/plugin-typings)

v1.132.0

Compare Source

v1.131.0

Compare Source

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.30.0

Compare Source

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features
Bug Fixes
vueuse/vueuse (@​vueuse/core)

v14.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
eslint/eslint (eslint)

v10.8.0

Compare Source

Features

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)
vuejs/eslint-plugin-vue (eslint-plugin-vue)

v10.10.0

Compare Source

markedjs/marked (marked)

v18.0.7

Compare Source

ai/nanoid (nanoid)

v6.0.1

Compare Source

  • Fixed docs.
oxc-project/oxc (oxfmt)

v0.62.0

Compare Source

🐛 Bug Fixes

v0.61.0

Compare Source

v0.60.0

Compare Source

v0.59.0

Compare Source

🐛 Bug Fixes
  • 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#​24286) (leaysgur)
sindresorhus/p-limit (p-limit)

v7.3.1

Compare Source

microsoft/playwright (playwright)

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}
🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});
New APIs
Browser and Context
  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.
Network
Evaluation
Command line & MCP
Reporters
  • The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:
// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});
Announcements
  • ⚠️ Debian 11 is not supported anymore.
Browser Versions
  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151
  • Microsoft Edge 151
pnpm/pnpm (pnpm)

v11.20.0: pnpm 11.20

Compare Source

Minor Changes

  • Security fix. Affects projects using namedRegistries on pnpm 11.1.0–11.19.x. It is semi-breaking for those projects — see "If you use named registries" below.

    The lockfile recorded no marker for which registry a package came from. Packages were keyed by name@version alone, and entry lookup went through refToRelative(ref, name), so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single packages: entry and whichever resolved first decided the tarball every consumer got.

    That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.

    Packages resolved from a named registry are now recorded under registry-qualified keys (<name>@<registryName>:<version>, e.g. foo@work:1.0.0), so each registry gets its own entry and the lockfile pins which one a dependency came from.

    The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use namedRegistries sees no difference, and older pnpm versions keep reading the file.

If you use named registries

Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.

Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it.

There is no setting to keep the old behavior: the old shape is the vulnerability.

Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the namedRegistries setting on demand.

To use named registries, map your aliases in pnpm-workspace.yaml:

namedRegistries:
  work: https://npm.enterprise.example.com/
New built-in npmjs: alias

npmjs: now resolves to https://registry.npmjs.org/ with no configuration, alongside the existing gh: alias for GitHub Packages. It pins a dependency to the public registry even when registry points elsewhere, such as an internal proxy:

{ "dependencies": { "left-pad": "npmjs:^1.3.0" } }

npm: cannot do this — it is the alias protocol (npm:<name>@<range>) and resolves through whatever registry points at.

If you mirror or proxy npmjs, point the alias at your mirror:

namedRegistries:
  npmjs: https://npm.internal.example.com/

Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on registry.npmjs.org is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, minimumReleaseAge, or trustPolicy check runs. Overriding the alias is the same escape hatch GHES users already have for gh.

Every alias the lockfile references must stay in namedRegistries: reading an entry whose alias is gone fails with ERR_PNPM_MISSING_NAMED_REGISTRY rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it.

Named registry aliases that shadow a reserved dependency specifier prefix (file, link, workspace, runtime, npm, jsr, ...) are now rejected with ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME instead of being silently shadowed by the corresponding resolver.

pnpm licenses and pnpm sbom now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl repository_url qualifier.

Patch Changes

  • An empty http-proxy, https-proxy, proxy, or no-proxy value — from the .npmrc, pnpm-workspace.yaml, the CLI, or the HTTP_PROXY / HTTPS_PROXY / PROXY / NO_PROXY environment variables — no longer fails the install with ERR_PNPM_INVALID_PROXY. Empty settings read as unset, so a shell exporting HTTP_PROXY= disables the proxy, and an empty proxy= in the .npmrc no longer suppresses HTTPS_PROXY #​13533.

    proxy=false in the .npmrc or proxy: false in pnpm-workspace.yaml now turns proxying off instead of being read as a proxy host named false. false and null on https-proxy / http-proxy / no-proxy read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim.

  • The env lockfile no longer pins @pnpm/exe alongside pnpm when the wanted pnpm version is 12 or newer. From v12 the unscoped pnpm package is itself the native executable, so @pnpm/exe is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it.

  • lexCompare and nerfDart are now published as @pnpm/text.ordinal-comparator and @pnpm/config.registry-auth-key. Use these instead of @pnpm/util.lex-comparator and @pnpm/config.nerf-dart.

  • Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs.

  • Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when minimumReleaseAge is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison.

  • Security: pnpm rebuild now refuses a lockfile whose packages key carries a path traversal in the package name (e.g. ../../../escaped@1.0.0), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with ERR_PNPM_INVALID_DEPENDENCY_NAME.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.19.0: pnpm 11.19

Compare Source

Minor Changes

  • pnpm login no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with ERR_PNPM_LOGIN_NON_INTERACTIVE in a non-interactive terminal.

  • The save-prefix setting now accepts =: newly added dependencies are saved with an explicit = operator (=1.2.3) instead of the setting being silently treated as the default ^.

Patch Changes

  • allowBuilds entries can now approve git-hosted packages that pnpm downloads as a tarball, such as github: dependencies (which are fetched from codeload.github.com rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless git+ matching already supported for cloned git dependencies. For example:

    allowBuilds:
  "foo@git+https://github.com/org/foo.git": true

    This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work.

  • pnpm outdated --include-github-actions no longer blocks on an interactive git credential prompt when a workflow uses a private action repo.

  • Prevented minimumReleaseAge from replacing latest with a SemVer-greater version than the registry tag target #​13034.

  • Fixed empty bundledDependencies and bundleDependencies arrays causing nondeterministic lockfile changes. See #​13123.

  • The install summary no longer prints (X is available) when the registry's dist-tags.latest is still held back by the active minimumReleaseAge policy. The hint only ever names the actual latest tag, so an immature latest suppresses the hint instead of advertising the version pnpm just refused to install #​11698.

  • pnpm update keeps the explicit = operator of an exact version pin: a dependency saved as =3.5.1 now updates to =3.5.2 instead of the bare 3.5.2. See #​13168.

  • Preserve a workspace dependency's link: entry when a run does not target it — e.g. pnpm update <other-pkg> (with or without --recursive), or a plain install after a root/catalog dependency change — with injectWorkspacePackages, instead of spuriously rewriting it to a peer-suffixed file: protocol. See #​10433.

  • Workspace dependencies declared with a relative path (e.g. "foo": "workspace:../foo") are no longer silently dropped from the workspace projects graph, so --filter selection and the topological order of recursive commands take them into account.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
tempad-dev-site Ready Ready Preview Aug 10, 2026 11:03pm

Request Review

@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from f0db71c to eccd02b Compare July 21, 2026 21:07
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies fix(deps): update all non-major dependencies Jul 21, 2026
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from eccd02b to 677f26e Compare July 22, 2026 07:33
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 677f26e to 3012659 Compare July 23, 2026 03:08
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 3012659 to ba73a52 Compare July 23, 2026 05:57
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from ba73a52 to 2c53bc2 Compare July 23, 2026 11:10
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 2c53bc2 to e73896e Compare July 23, 2026 19:08
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from e73896e to efe5893 Compare July 24, 2026 13:44
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from efe5893 to 7fa711d Compare July 25, 2026 02:33
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 7fa711d to e424402 Compare July 25, 2026 12:34
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from e424402 to f8f6f8b Compare July 26, 2026 16:59
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from f8f6f8b to 925af60 Compare July 26, 2026 20:33
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 925af60 to 3205b3a Compare July 27, 2026 00:31
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 3205b3a to 9427127 Compare July 27, 2026 10:48
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 9427127 to 64c38e6 Compare July 27, 2026 20:33
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 9169115 to 37c1e0e Compare July 30, 2026 21:15
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 37c1e0e to 58df25f Compare July 31, 2026 21:38
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 58df25f to 33200da Compare August 1, 2026 02:00
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 33200da to f279a47 Compare August 3, 2026 01:50
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from f279a47 to fabf8f7 Compare August 3, 2026 16:02
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from fabf8f7 to 69500de Compare August 3, 2026 18:56
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 69500de to cf78429 Compare August 4, 2026 14:53
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from cf78429 to 9d5f93c Compare August 5, 2026 02:40
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 9d5f93c to 77b4bef Compare August 5, 2026 10:00
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 77b4bef to 59d4d5d Compare August 5, 2026 17:39
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 59d4d5d to 985fa09 Compare August 6, 2026 16:56
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 985fa09 to a1b88ba Compare August 7, 2026 10:58
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from a1b88ba to 45b1549 Compare August 7, 2026 18:40
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 45b1549 to bb25281 Compare August 9, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants