Skip to content

chore(deps): update all non-major dependencies#132

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#132
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 20, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@types/node (source) ^25.0.3 → ^25.2.1 age confidence
@vitest/coverage-v8 (source) ^4.0.16 → ^4.0.18 age confidence
esbuild ^0.27.2 → ^0.27.3 age confidence
eslint-config-unjs ^0.5.0 → ^0.6.2 age confidence
obuild ^0.4.9 → ^0.4.24 age confidence
pnpm (source) 10.26.0 → 10.28.2 age confidence
prettier (source) ^3.7.4 → ^3.8.1 age confidence
vite (source) ^7.3.0 → ^7.3.1 age confidence
vitest (source) ^4.0.16 → ^4.0.18 age confidence

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.0.18

Compare Source

   🚀 Experimental Features
   🐞 Bug Fixes
    View changes on GitHub

v4.0.17

Compare Source

   🚀 Experimental Features
   🐞 Bug Fixes
    View changes on GitHub
evanw/esbuild (esbuild)

v0.27.3

Compare Source

  • Preserve URL fragments in data URLs (#​4370)

    Consider the following HTML, CSS, and SVG:

    • index.html:

      <!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>

    • icons.css:

      .triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}

    • triangle.svg:

      <svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>

    The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:

    /* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

  • Parse and print CSS @scope rules (#​4322)

    This release includes dedicated support for parsing @scope rules in CSS. These rules include optional "start" and "end" selector lists. One important consequence of this is that the local/global status of names in selector lists is now respected, which improves the correctness of esbuild's support for CSS modules. Minification of selectors inside @scope rules has also improved slightly.

    Here's an example:

    /* Original code */
@&#8203;scope (:global(.foo)) to (:local(.bar)) {
  .bar {
    color: red;
  }
}

/* Old output (with --loader=local-css --minify) */
@&#8203;scope (:global(.foo)) to (:local(.bar)){.o{color:red}}

/* New output (with --loader=local-css --minify) */
@&#8203;scope(.foo)to (.o){.o{color:red}}

  • Fix a minification bug with lowering of for await (#​4378, #​4385)

    This release fixes a bug where the minifier would incorrectly strip the variable in the automatically-generated catch clause of lowered for await loops. The code that generated the loop previously failed to mark the internal variable references as used.

  • Update the Go compiler from v1.25.5 to v1.25.7 (#​4383, #​4388)

    This PR was contributed by @​MikeWillCook.

unjs/eslint-config (eslint-config-unjs)

v0.6.2

Compare Source

compare changes

🩹 Fixes
  • Disable array immutation rules for now (3cde73a)
❤️ Contributors

v0.6.1

Compare Source

compare changes

💅 Refactors
  • Migrate to @eslint/markdown (2f92a53)
  • Update default rules (84cdbad)
📦 Build
🏡 Chore
❤️ Contributors

v0.6.0

Compare Source

compare changes

💅 Refactors
  • Migrate to @eslint/markdown (2f92a53)
📦 Build
🏡 Chore
❤️ Contributors
unjs/obuild (obuild)

v0.4.24

Compare Source

compare changes

🩹 Fixes
  • Windows compatibility for reading package.json (#​71)
❤️ Contributors

v0.4.23

Compare Source

compare changes

🏡 Chore
❤️ Contributors

v0.4.22

Compare Source

compare changes

💅 Refactors
  • Silent build logs from analyze step (2f7ec85)
  • Silent EVAL warns (73668e4)
🏡 Chore
❤️ Contributors

v0.4.21

Compare Source

compare changes

🔥 Performance
  • Default minify to dce-only (823f72f)
🏡 Chore
❤️ Contributors

v0.4.20

Compare Source

compare changes

🩹 Fixes
  • Avoid analyze in stub mode (c840ae9)
💅 Refactors
  • Update inlineDynamicImports to codeSplitting (334eab9)
  • Multi-column layout for transform items (8df3220)
  • Improve cli formatting (e28cbd4)
🏡 Chore
❤️ Contributors

v0.4.19

Compare Source

compare changes

🏡 Chore
❤️ Contributors

v0.4.18

Compare Source

compare changes

🩹 Fixes
  • Add .d suffix to type chunk groups (e55c9f4)
💅 Refactors
  • Update rollup to latest (74786e4)
📦 Build
🤖 CI
  • Setup nightly releases (a74933a)
  • Build before nightly release (2144b6e)
❤️ Contributors

v0.4.17

Compare Source

compare changes

🩹 Fixes
  • Rollback rolldown to 59 (345aadf)
  • Rollback rolldown config (070a2f4)
❤️ Contributors

v0.4.16

Compare Source

compare changes

💅 Refactors
  • rolldown: Use new codeSplitting option (1c68bd9)
❤️ Contributors

v0.4.15

Compare Source

compare changes

📦 Build
  • Import oxc utils from rolldown/experimental (cf5f16e)
🏡 Chore
❤️ Contributors

v0.4.14

Compare Source

compare changes

🏡 Chore
  • Update rolldown to 1.0.0-beta.59 (51bd7d2)
❤️ Contributors

v0.4.13

Compare Source

compare changes

🩹 Fixes
  • rolldown: Revert includeDependenciesRecursively (7325ddd)
❤️ Contributors

v0.4.12

Compare Source

compare changes

🩹 Fixes
  • rolldown: Enable includeDependenciesRecursively (6974fb5)
  • bundle: Avoid recursion on resolveDeps (2bba5b9)
❤️ Contributors

v0.4.11

Compare Source

compare changes

🏡 Chore
❤️ Contributors

v0.4.10

Compare Source

compare changes

🏡 Chore
pnpm/pnpm (pnpm)

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

  • Security fix: prevent path traversal in directories.bin field.

  • When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

    This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

    Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

  • Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.28.1

Compare Source

v10.28.0

Compare Source

v10.27.0

Compare Source

v10.26.2: pnpm 10.26.2

Compare Source

Patch Changes

  • Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #​10307.

  • Fix installation of Git dependencies using annotated tags #​10335.

    Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out commit hash didn't match the stored tag object hash.

  • Binaries of runtime engines (Node.js, Deno, Bun) are written to node_modules/.bin before lifecycle scripts (install, postinstall, prepare) are executed #​10244.

  • Try to avoid making network calls with preferOffline #​10334.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.26.1: pnpm 10.26.1

Compare Source

Patch Changes

  • Don't fail on pnpm add, when blockExoticSubdeps is set to true #​10324.
  • Always resolve git references to full commits and ensure HEAD points to the commit after checkout #​10310.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite
prettier/prettier (prettier)

v3.8.1

Compare Source

v3.8.0

Compare Source

diff

🔗 Release note

vitejs/vite (vite)

v7.3.1

Compare Source

Please refer to CHANGELOG.md for details.

Configuration

📅 Schedule: Branch creation - "after 2am and before 3am" (UTC), Automerge - "after 1am and before 2am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 81483bb to 1a9cf75 Compare December 23, 2025 14:44
@renovate renovate bot changed the title chore(deps): update pnpm to v10.26.1 chore(deps): update pnpm to v10.26.2 Dec 23, 2025
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 1a9cf75 to 368fe6b Compare December 30, 2025 22:48
@renovate renovate bot changed the title chore(deps): update pnpm to v10.26.2 chore(deps): update pnpm to v10.27.0 Dec 30, 2025
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 368fe6b to e200bcf Compare January 2, 2026 14:53
@renovate renovate bot changed the title chore(deps): update pnpm to v10.27.0 chore(deps): update all non-major dependencies Jan 2, 2026
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from 03baa01 to 0a4550f Compare January 13, 2026 02:58
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 8355dd1 to cd6a820 Compare January 20, 2026 11:01
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from b8f8f38 to 864df84 Compare January 27, 2026 23:01
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from e06d4ab to eac0961 Compare February 1, 2026 18:29
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from ecaf05d to 51423d5 Compare February 5, 2026 22:59
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 51423d5 to d4103d6 Compare February 6, 2026 02:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants