chore(deps): update all non-major dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@types/node (source)	20.17.11 -> 20.17.21
@vitest/coverage-v8 (source)	2.1.8 -> 2.1.9
eslint-plugin-prettier	5.2.1 -> 5.2.3
publint (source)	0.3.4 -> 0.3.7
vite (source)	5.4.12 -> 5.4.14

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v2.1.9

Compare Source

This release includes security patches for:

• Browser mode serves arbitrary files | CVE-2025-24963
• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

   🐞 Bug Fixes

• backport https://github.com/vitest-dev/vitest/issues/7317 to v2 - by @​hi-ogawa in https://github.com/vitest-dev/vitest/pull/7318
• (backport #​7340 to v2) restrict served files from /__screenshot-error - by @​hi-ogawa in https://github.com/vitest-dev/vitest/pull/7343

    View changes on GitHub

prettier/eslint-plugin-prettier (eslint-plugin-prettier)

v5.2.3

Compare Source

Patch Changes

• #​703 9c6141f Thanks @​BPScott! - Add name field to recommended flat config

v5.2.2

Compare Source

Patch Changes

• #​700 aa5b59f Thanks @​ntnyq! - fix: report node when loc not found

publint/publint (publint)

v0.3.7

Compare Source

Patch Changes

• The "imports" field is now linted with the following rules: (#​162)

  • IMPORTS_KEY_INVALID: Ensure the imports key starts with a #
  • IMPORTS_VALUE_INVALID: Ensure the imports value is a valid path that starts with a ./
  • IMPORTS_GLOB_NO_MATCHED_FILES: Ensure the imports glob matches at least one file
  • IMPORTS_DEFAULT_SHOULD_BE_LAST: Ensure the "default" condition is last in an entrypoint's object
  • IMPORTS_MODULE_SHOULD_BE_ESM: Ensure the "module" condition file is ESM
  • IMPORTS_MODULE_SHOULD_PRECEDE_REQUIRE: Ensure the "module" condition precedes the "require" condition in an entrypoint's object

• Improve SSH git URL detection when checking the "repository" field. Values like "[email protected]:user/project.git" is now detected as a valid git URL, but will be suggested to use a full git URL instead, like "git+ssh://[email protected]/user/project.git" (28da844)

• Fix exports types message when the "require" or "import" condition already exists but the dts file format is still invalid (a731ec3)

v0.3.6

Compare Source

Patch Changes

• Fix checking bin field file path that omits .js or /index.js (04f289e)

v0.3.5

Compare Source

Patch Changes

• Check the "bin" field if the referenced file exists, has the correct JS format, and can be executed (#​150)

• Deprecate the deps command. The command has been tricky to maintain and incomplete (e.g. doesn't lint recursively). A separate tool can be used to run publint on dependencies instead, e.g. npx renoma --filter-rules "publint". (#​149)

vitejs/vite (vite)

v5.4.14

Compare Source

Please refer to CHANGELOG.md for details.

v5.4.13

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: Branch creation - "* 0-3 1 * *" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8381501

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR