Skip to content

chore(deps): update all non-major dependencies #529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update all non-major dependencies #529

wants to merge 1 commit into from
+1,426 −1,219

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jul 27, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update
@antfu/eslint-config ^5.2.1 -> ^5.4.1 age confidence pnpm.catalog.default minor
@iconify-json/ri ^1.2.5 -> ^1.2.6 age confidence pnpm.catalog.docs patch
@shikijs/vitepress-twoslash (source) ^3.11.0 -> ^3.13.0 age confidence pnpm.catalog.docs minor
@types/node (source) ^24.3.0 -> ^24.8.0 age confidence pnpm.catalog.default minor
ansis ^4.1.0 -> ^4.2.0 age confidence pnpm.catalog.default minor
bumpp ^10.2.3 -> ^10.3.1 age confidence pnpm.catalog.default minor
dotenv ^17.2.1 -> ^17.2.3 age confidence pnpm.catalog.docs patch
esbuild ^0.25.9 -> ^0.25.11 age confidence pnpm.catalog.default patch
eslint (source) ^9.33.0 -> ^9.37.0 age confidence pnpm.catalog.default minor
eslint-plugin-format ^1.0.1 -> ^1.0.2 age confidence pnpm.catalog.default patch
fs-extra ^11.3.1 -> ^11.3.2 age confidence pnpm.catalog.default patch
jiti ^2.5.1 -> ^2.6.1 age confidence pnpm.catalog.default minor
lint-staged ^16.1.5 -> ^16.2.4 age confidence pnpm.catalog.default minor
magic-string ^0.30.17 -> ^0.30.19 age confidence pnpm.catalog.default patch
pnpm (source) 10.15.0 -> 10.18.3 age confidence packageManager minor
pnpm/action-setup v4.1.0 -> v4.2.0 age confidence action minor
rolldown (source) ^1.0.0-beta.33 -> ^1.0.0-beta.43 age confidence pnpm.catalog.default patch
rollup (source) ^4.46.4 -> ^4.52.4 age confidence pnpm.catalog.default minor
tsdown ^0.14.1 -> ^0.15.7 age confidence pnpm.catalog.default minor
tsx (source) ^4.20.4 -> ^4.20.6 age confidence pnpm.catalog.docs patch
unocss (source) ^66.4.2 -> ^66.5.4 age confidence pnpm.catalog.docs minor
unplugin-icons ^22.2.0 -> ^22.4.2 age confidence pnpm.catalog.docs minor
unplugin-unused ^0.5.2 -> ^0.5.4 age confidence pnpm.catalog.default patch
unplugin-vue-components ^29.0.0 -> ^29.1.0 age confidence pnpm.catalog.docs minor
vitepress (source) 2.0.0-alpha.10 -> 2.0.0-alpha.12 age confidence pnpm.catalog.docs patch
vitepress-plugin-group-icons ^1.6.3 -> ^1.6.4 age confidence pnpm.catalog.docs patch
vue (source) ^3.5.18 -> ^3.5.22 age confidence pnpm.catalog.docs patch
vue-tsc (source) ^3.0.6 -> ^3.1.1 age confidence pnpm.catalog.docs minor

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v5.4.1

Compare Source

No significant changes

    View changes on GitHub

v5.4.0

Compare Source

No significant changes

    View changes on GitHub

v5.3.0

Compare Source

   🐞 Bug Fixes
  • Use ecmaVersion 'latest' per eslint's docs recommendation. fixes support for import attributes  -  by @​romansp in #​756 (2031b)
    View changes on GitHub

v5.2.2

Compare Source

   🚀 Features
    View changes on GitHub
shikijs/shiki (@​shikijs/vitepress-twoslash)

v3.13.0

Compare Source

   🚀 Features
    View changes on GitHub

v3.12.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v3.12.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v3.12.1

Compare Source

No significant changes

    View changes on GitHub

v3.12.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
webdiscus/ansis (ansis)

v4.2.0

Compare Source

  • feat: add support named truecolor via ansis.extend().
    Foreground methods are created from the provided color names, and matching background methods bg* are generated automatically.
    Example: 
    import ansis from 'ansis';
import colorNames from 'css-color-names';

const color = ansis.extend(colorNames);

console.log(color.orange('Orange foreground'));
console.log(color.bgOrange('Orange background')); // auto-generated from "orange"
    This release removes the last barrier for projects migrating from Chalk v4 that used named truecolor, e.g.
    chalk.keyword('orange')('text'). Ansis now provides this feature with a simpler, more intuitive API.
antfu-collective/bumpp (bumpp)

v10.3.1

Compare Source

No significant changes

    View changes on GitHub

v10.3.0

Compare Source

   🚀 Features
    View changes on GitHub
motdotla/dotenv (dotenv)

v17.2.3

Compare Source

Changed
  • Fixed typescript error definition (#​912)

v17.2.2

Compare Source

Added
  • 🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.
evanw/esbuild (esbuild)

v0.25.11

Compare Source

  • Add support for with { type: 'bytes' } imports (#​4292)

    The import bytes proposal has reached stage 2.7 in the TC39 process, which means that although it isn't quite recommended for implementation, it's generally approved and ready for validation. Furthermore it has already been implemented by Deno and Webpack. So with this release, esbuild will also add support for this. It behaves exactly the same as esbuild's existing binary loader. Here's an example:

    import data from './image.png' with { type: 'bytes' }
const view = new DataView(data.buffer, 0, 24)
const width = view.getInt32(16)
const height = view.getInt32(20)
console.log('size:', width + '\xD7' + height)

  • Lower CSS media query range syntax (#​3748, #​4293)

    With this release, esbuild will now transform CSS media query range syntax into equivalent syntax using min-/max- prefixes for older browsers. For example, the following CSS:

    @&#8203;media (640px <= width <= 960px) {
  main {
    display: flex;
  }
}

    will be transformed like this with a target such as --target=chrome100 (or more specifically with --supported:media-range=false if desired):

    @&#8203;media (min-width: 640px) and (max-width: 960px) {
  main {
    display: flex;
  }
}

v0.25.10

Compare Source

  • Fix a panic in a minification edge case (#​4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
identity({ y: identity(123) })

  • Fix @supports nested inside pseudo-element (#​4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
::placeholder {
  color: red;
  body & { color: green }
  @&#8203;supports (color: blue) { color: blue }
}

/* Old output (with --supported:nesting=false) */
::placeholder {
  color: red;
}
body :is() {
  color: green;
}
@&#8203;supports (color: blue) {
   {
    color: blue;
  }
}

/* New output (with --supported:nesting=false) */
::placeholder {
  color: red;
}
body :is() {
  color: green;
}
@&#8203;supports (color: blue) {
  ::placeholder {
    color: blue;
  }
}
eslint/eslint (eslint)

v9.37.0

Compare Source

v9.36.0

Compare Source

v9.35.0

Compare Source

v9.34.0

Compare Source

antfu/eslint-plugin-format (eslint-plugin-format)

v1.0.2

Compare Source

No significant changes

    View changes on GitHub
jprichardson/node-fs-extra (fs-extra)

v11.3.2

Compare Source

  • Fix spurrious UnhandledPromiseRejectionWarning that could occur when calling .copy() in some cases (#​1056, #​1058)
unjs/jiti (jiti)

v2.6.1

Compare Source

compare changes

🩹 Fixes
  • interop: Only passthrough default if it is not a promise (#​408)
📦 Build
  • Revert to terser-webpack-plugin (#​407)
🏡 Chore
❤️ Contributors

v2.6.0

Compare Source

compare changes

🔥 Performance
  • Lazy load babel transform (#​405)
🩹 Fixes
  • cjs-interop: Handle function default exports (#​396)
  • Always use native for node: specifiers (#​392)
📦 Build
🏡 Chore
✅ Tests
  • Update deno and bun native test ignores (df844f8)
  • New bench script (6404427)
❤️ Contributors
  • Pooya Parsa (@​pi0)
  • Volodymyr Kolesnykov (@​sjinks)
  • Jungwoo LEE <jungwoo3490@​naver.com>
lint-staged/lint-staged (lint-staged)

v16.2.4

Compare Source

Patch Changes

v16.2.3

Compare Source

Patch Changes
  • #​1669 27cd541 Thanks @​iiroj! - When using --fail-on-changes, automatically hidden (partially) unstaged changes are no longer counted to make lint-staged fail.

v16.2.2

Compare Source

Patch Changes

  • #​1667 699f95d Thanks @​iiroj! - The backup stash will not be dropped when using --fail-on-changes and there are errors. When reverting to original state is disabled (via --no-revert or --fail-on-changes), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually.

    Additionally, the example for using the backup stash manually now uses the correct backup hash, if available:

    % npx lint-staged --fail-on-changes
✔ Backed up original state in git stash (c18d55a3)
✔ Running tasks for staged files...
✖ Tasks modified files and --fail-on-changes was used!
↓ Cleaning up temporary files...

✖ lint-staged failed because `--fail-on-changes` was used.

Any lost modifications can be restored from a git stash:

  > git stash list --format="%h %s"
  c18d55a3 On main: lint-staged automatic backup
  > git apply --index c18d55a3

v16.2.1

Compare Source

Patch Changes

  • #​1664 8277b3b Thanks @​iiroj! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is readonly string[] and can't be mutated. Thanks @​outslept!

    export default {
---  "*": (files: string[]) => void console.log('staged files', files)
+++  "*": (files: readonly string[]) => void console.log('staged files', files)
}

  • #​1654 70b9af3 Thanks @​iiroj! - This version has been published from GitHub Actions using Trusted Publishing for npm packages.

  • #​1659 4996817 Thanks @​iiroj! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are package.json files in the working directory. This situation might happen when running lint-staged for a single package in a monorepo.

  • #​1654 7021f0a Thanks @​iiroj! - Return the caret semver range (^) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to lint-staged. This was changed in 16.2.0 after the vulnerability issues with chalk and debug, which were also removed in the same version.

    Given the recent vulnerabilities in the npm ecosystem, it's best to be very careful when updating dependencies.

v16.2.0

Compare Source

Minor Changes

  • #​1615 99eb742 Thanks @​iiroj! - Added a new option --fail-on-changes to make lint-staged exit with code 1 when tasks modify any files, making the precommit hook fail. This is similar to the git diff --exit-code option. Using this flag also implies the --no-revert flag which means any changes made my tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.

  • #​1611 cd05fd3 Thanks @​rlorenzo! - Added a new option --continue-on-error so that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.

  • #​1637 82fcc07 Thanks @​iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.

  • #​1647 a5ecc06 Thanks @​iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, the DEBUG environment variable is no longer supported — use the --debug to enable debugging

  • #​1636 8db2717 Thanks @​iiroj! - Added a new option --hide-unstaged so that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags --hide-unstaged --no-hide-partially-staged isn't meaningful and behaves the same as just --hide-unstaged.

    Thanks to @​ItsNickBarry for the idea and initial implementation in #​1552.

  • #​1648 7900b3b Thanks @​iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.

Patch Changes

v16.1.6

Compare Source

Patch Changes
  • #​1610 e93578e Thanks @​iiroj! - Try to improve terminating of subprocess of tasks by using SIGKILL, and only calling pidtree when the the main task process has a known pid.
rich-harris/magic-string (magic-string)

v0.30.19

Compare Source

Bug Fixes
Features
  • replace(All) support replacement for functions when the first parameter is a string (#​304) (fd1d887)

v0.30.18

Compare Source

Bug Fixes
pnpm/pnpm (pnpm)

v10.18.3

Compare Source

Patch Changes
  • Fix a bug where pnpm would infinitely recurse when using verifyDepsBeforeInstall: install and pre/post install scripts that called other pnpm scripts #​10060.
  • Fixed scoped registry keys (e.g., @scope:registry) being parsed as property paths in pnpm config get when --location=project is used #​9362.
  • Remove pnpm-specific CLI options before passing to npm publish to prevent "Unknown cli config" warnings #​9646.
  • Fixed EISDIR error when bin field points to a directory #​9441.
  • Preserve version and hasBin for variations packages #​10022.
  • Fixed pnpm config set --location=project incorrectly handling keys with slashes (auth tokens, registry settings) #​9884.
  • When both pnpm-workspace.yaml and .npmrc exist, pnpm config set --location=project now writes to pnpm-workspace.yaml (matching read priority) #​10072.
  • Prevent a table width error in pnpm outdated --long #​10040.
  • Sync bin links after injected dependencies are updated by build scripts. This ensures that binaries created during build processes are properly linked and accessible to consuming projects #​10057.

v10.18.2

Compare Source

Patch Changes
  • pnpm outdated --long should work #​10040.
  • Replace ndjson with split2. Reduce the bundle size of pnpm CLI #​10054.
  • pnpm dlx should request the full metadata of packages, when minimumReleaseAge is set #​9963.
  • pnpm version switching should work when the pnpm home directory is in a symlinked directory #​9715.
  • Fix EPIPE errors when piping output to other commands #​10027.

v10.18.1

Compare Source

Patch Changes
  • Don't print a warning, when --lockfile-only is used #​8320.
  • pnpm setup creates a command shim to the pnpm executable. This is needed to be able to run pnpm self-update on Windows #​5700.
  • When using pnpm catalogs and running a normal pnpm install, pnpm produced false positive warnings for "skip adding to the default catalog because it already exists". This warning now only prints when using pnpm add --save-catalog as originally intended.

v10.18.0

Compare Source

Minor Changes

  • Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.

    Added configuration options for warning thresholds: fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time thresholds or fall below speed minimums

    Related PR: #​10025.

Patch Changes
  • Retry filesystem operations on EAGAIN errors #​9959.
  • Outdated command respects minimumReleaseAge configuration #​10030.
  • Correctly apply the cleanupUnusedCatalogs configuration when removing dependent packages.
  • Don't fail with a meaningless error when scriptShell is set to false #​8748.
  • pnpm dlx should not fail when minimumReleaseAge is set #​10037.

v10.17.1

Compare Source

Patch Changes
  • When a version specifier cannot be resolved because the versions don't satisfy the minimumReleaseAge setting, print this information out in the error message #​9974.
  • Fix state.json creation path when executing pnpm patch in a workspace project #​9733.
  • When minimumReleaseAge is set and the latest tag is not mature enough, prefer a non-deprecated version as the new latest #​9987.

v10.17.0

Compare Source

Minor Changes

  • The minimumReleaseAgeExclude setting now supports patterns. For instance:

    minimumReleaseAge: 1440
minimumReleaseAgeExclude:
  - "@&#8203;eslint/*"

    Related PR: #​9984.

Patch Changes
  • Don't ignore the minimumReleaseAge check, when the package is requested by exact version and the packument is loaded from cache #​9978.
  • When minimumReleaseAge is set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #​9979.

v10.16.1

Compare Source

Patch Changes
  • The full metadata cache should be stored not at the same location as the abbreviated metadata. This fixes a bug where pnpm was loading the abbreviated metadata from cache and couldn't find the "time" field as a result #​9963.
  • Forcibly disable ANSI color codes when generating patch diff #​9914.

v10.16.0

Compare Source

Minor Changes

  • There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.

    The new setting is called minimumReleaseAge. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, setting minimumReleaseAge: 1440 ensures that only packages released at least one day ago can be installed.

    If you set minimumReleaseAge but need to disable this restriction for certain dependencies, you can list them under the minimumReleaseAgeExclude setting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:

    minimumReleaseAgeExclude:
  - webpack

    Related issue: #​9921.

  • Added support for finders #​9946.

    In the past, pnpm list and pnpm why could only search for dependencies by name (and optionally version). For example:

    pnpm why minimist

    prints the chain of dependencies to any installed instance of minimist:

    verdaccio 5.20.1
├─┬ handlebars 4.7.7
│ └── minimist 1.2.8
└─┬ mv 2.1.1
  └─┬ mkdirp 0.5.6
    └── minimist 1.2.8

    What if we want to search by other properties of a dependency, not just its name? For instance, find all packages that have react@17 in their peer dependencies?

    This is now possible with "finder functions". Finder functions can be declared in .pnpmfile.cjs and invoked with the --find-by=<function name> flag when running pnpm list or pnpm why.

    Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our .pnpmfile.cjs:

    module.exports = {
  finders: {
    react17: (ctx) => {
      return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    },
  },
};

    Now we can use this finder function by running:

    pnpm why --find-by=react17

    pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph.

    @&#8203;apollo/client 4.0.4
├── @&#8203;graphql-typed-document-node/core 3.2.0
└── graphql-tag 2.12.6

    It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder:

    module.exports = {
  finders: {
    react17: (ctx) => {
      const manifest = ctx.readManifest();
      if (manifest.peerDependencies?.react === "^17.0.0") {
        return `license: ${manifest.license}`;
      }
      return false;
    },
  },
};

    Every matched package will also print out the license from its package.json:

    @&#8203;apollo/client 4.0.4
├── @&#8203;graphql-typed-document-node/core 3.2.0
│   license: MIT
└── graphql-tag 2.12.6
    license: MIT
Patch Changes
  • Fix deprecation warning printed when executing pnpm with Node.js 24 #​9529.
  • Throw an error if nodeVersion is not set to an exact semver version #​9934.
  • pnpm publish should be able to publish a .tar.gz file #​9927.
  • Canceling a running process with Ctrl-C should make pnpm run return a non-zero exit code #​9626.

v10.15.1

Compare Source

Patch Changes
  • Fix .pnp.cjs crash when importing subpath #​9904.
  • When resolving peer dependencies, pnpm looks whether the peer dependency is present in the root workspace project's dependencies. This change makes it so that the peer dependency is correctly resolved even from aliased npm-hosted dependencies or other types of dependencies #​9913.
pnpm/action-setup (pnpm/action-setup)

v4.2.0

Compare Source

When there's a .npmrc file at the root of the repository, pnpm will be fetched from the registry that is specified in that .npmrc file #​179

rolldown/rolldown (rolldown)

v1.0.0-beta.43

Compare Source

🚀 Features

Configuration

📅 Schedule: Branch creation - "after 2am and before 3am" (UTC), Automerge - "after 1am and before 2am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@pkg-pr-new pkg.pr.new
Copy link

pkg-pr-new bot commented Jul 27, 2025 •
edited
Loading

Open in StackBlitz

npm i https://pkg.pr.new/unjs/unplugin@529

commit: c4b3ddc

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 15 times, most recently from ea20cd5 to e97dd0a Compare August 2, 2025 20:15
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 14 times, most recently from 5fe85da to a1a2d36 Compare August 9, 2025 21:38
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 15 times, most recently from 24a0ea0 to 798aab8 Compare October 7, 2025 03:11
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 5386f14 to 7b5d83a Compare October 15, 2025 11:38
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 7b5d83a to c4b3ddc Compare October 16, 2025 19:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants