Skip to content

chore(deps): update all non-major dependencies#390

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#390
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@arethetypeswrong/core (source) ^0.18.2 → ^0.18.3 age confidence pnpm.catalog.default patch
@tanstack/query-core (source) ^5.100.10 → ^5.101.0 age confidence pnpm.catalog.default minor
@types/react (source) ^19.2.14 → ^19.2.17 age confidence pnpm.catalog.default patch
@vitejs/plugin-react (source) ^6.0.1 → ^6.0.2 age confidence pnpm.catalog.default patch
@vitejs/plugin-vue (source) ^6.0.6 → ^6.0.7 age confidence pnpm.catalog.default patch
actions/checkout v6.0.2 → v6.0.3 age confidence action patch
changesets/action v1.8.0 → v1.9.0 age confidence action minor
eslint (source) ^10.3.0 → ^10.5.0 age confidence pnpm.catalog.default minor
nx (source) 22.7.1 → 22.7.5 age confidence pnpm.catalog.default patch
pnpm (source) 11.1.1 → 11.7.0 age confidence packageManager minor
pnpm (source) >=11.0.0 → >=11.7.0 age confidence engines minor
pnpm/action-setup v6.0.7 → v6.0.8 age confidence action patch
prettier (source) ^3.8.3 → ^3.8.4 age confidence pnpm.catalog.default patch
publint (source) ^0.3.20 → ^0.3.21 age confidence pnpm.catalog.default patch
react (source) ^19.2.6 → ^19.2.7 age confidence pnpm.catalog.default patch
react-dom (source) ^19.2.6 → ^19.2.7 age confidence pnpm.catalog.default patch
semver ^7.8.0 → ^7.8.4 age confidence pnpm.catalog.default patch
tinyglobby (source) ^0.2.16 → ^0.2.17 age confidence pnpm.catalog.default patch
tsdown (source) ^0.22.0 → ^0.22.2 age confidence pnpm.catalog.default patch
type-fest ^5.6.0 → ^5.7.0 age confidence pnpm.catalog.default minor
typescript-eslint (source) ^8.59.3 → ^8.61.0 age confidence pnpm.catalog.default minor
vite (source) ^8.0.12 → ^8.0.16 age confidence pnpm.catalog.default patch
vitest (source) ^4.1.6 → ^4.1.9 age confidence pnpm.catalog.default patch
vue (source) ^3.5.34 → ^3.5.38 age confidence pnpm.catalog.default patch
vue-eslint-parser ^10.4.0 → ^10.4.1 age confidence pnpm.catalog.default patch
zizmorcore/zizmor-action v0.5.3 → v0.5.6 age confidence action patch

Release Notes

arethetypeswrong/arethetypeswrong.github.io (@​arethetypeswrong/core)

v0.18.3

Patch Changes
TanStack/query (@​tanstack/query-core)

v5.101.0

Compare Source

v5.100.14

Compare Source

v5.100.13

Compare Source

Patch Changes
  • fix(query-core): drop the custom NoInfer<T> re-export and rely on TypeScript's built-in NoInfer (TS ≥ 5.4) so NoInfer<X[K]> stays assignable to X[K] in generic contexts (fixes #​9937) (#​10593)

v5.100.12

Compare Source

v5.100.11

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.2

Compare Source

Allow all options in reactCompilerPreset (#​1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.7

Features
Bug Fixes
actions/checkout (actions/checkout)

v6.0.3

Compare Source

changesets/action (changesets/action)

v1.9.0

Compare Source

Minor Changes
Patch Changes

  • #​535 34f64f6 Thanks @​Andarist! - Fixed an issue with GitHub releases not being created for successfully published packages when some packages failed to be published to the registry.

  • #​632 1d54b9e Thanks @​bluwy! - Simplify internal implementation to get changelog entries for a package version

  • #​629 e0c90aa Thanks @​bluwy! - Fix custom version and publish command argument parsing

  • #​645 f9585d9 Thanks @​Andarist! - Improved force-push handling when using commitMode: "github-api" so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.

eslint/eslint (eslint)

v10.5.0

Compare Source

v10.4.1

Compare Source

Bug Fixes

  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#​20930) (Francesco Trotta)
  • d4ce898 fix: propagate failures from delegated commands (#​20917) (Minh Vu)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#​20916) (kuldeep kumar)
  • c5bc78b fix: false positive for reference in finally block (#​20655) (Tanuj Kanti)
  • 27538c0 fix: add missing CodePath and CodePathSegment types (#​20853) (Pixel998)

Documentation

  • 61b0add docs: remove deprecated rule from related rules of max-params (#​20921) (Tanuj Kanti)
  • 305d5b9 docs: remove deprecated rules from related rules section (#​20911) (Tanuj Kanti)
  • 49b0202 docs: fix display: none of ad (#​20901) (Tanuj Kanti)
  • 9067f94 docs: switch build to Node.js 24 (#​20893) (Milos Djermanovic)
  • c91b041 docs: Update README (GitHub Actions Bot)
  • e349265 docs: clarify semver strings in rule deprecation objects (#​20885) (Milos Djermanovic)

Chores

v10.4.0

Compare Source

nrwl/nx (nx)

v22.7.5

Compare Source

22.7.5 (2026-05-27)
🩹 Fixes
❤️ Thank You

v22.7.4

Compare Source

22.7.4 (2026-05-25)
🩹 Fixes
  • core: update brace-expansion and yaml (#​35790)
❤️ Thank You

v22.7.3

Compare Source

22.7.3 (2026-05-22)

🚀 Features
🩹 Fixes
  • angular: only add @​oxc-project/runtime on the vitest-analog path (#​35734)
  • angular-rspack: exclude eslint config from tailwind v4 source scan (#​35663)
  • core: warn before installing unknown npm packages as preset (#​35644)
  • core: preserve input order in createNodes plugin results (#​35595)
  • core: resolve local plugin subpath imports from source (#​35631)
  • core: treat undefined task parallelism as parallel when scheduling (#​35736)
  • core: handle object form of bin field in getPrettierPath (#​35680)
  • core: detect vscode copilot ai agent (#​35757)
  • core: allow local plugin subpath imports without custom conditions (#​35751, #​35631)
  • dotnet: include Directory.. files in inputs (#​35738)
  • gradle: add transitive:true to all tasks (#​35677)
  • gradle: pin generated e2e project toolchain to installed JDK (#​35703)
  • js: fall back to npm publish when bun publish fails with auth error (#​35756)
  • linter: improve convert-to-flat-config output fidelity (#​35330)
  • linter: only rewrite workspace-package peer deps to workspace:* (#​35423, #​35318, #​33417)
  • misc: stop inferring projects: 'self' in dependsOn entries (#​35686)
  • misc: skip $ escaping in file paths on windows (#​35692)
  • repo: run dotnet restore before publish (#​35771)
  • repo: run dotnet restore before macos e2e job (#​35774)
  • rsbuild: infer build outputs from distPath.root directly (#​35707)
  • rsbuild: lazy-require @​rsbuild/core in plugin so spec mocks work after jest.resetModules (#​35707)
  • testing: correct yargs-parser import in getJestProjectsAsync (#​35672, #​35654)
❤️ Thank You

v22.7.2

Compare Source

22.7.2 (2026-05-14)

🚀 Features
  • gradle: stream batch task results to nx as they finish (#​35487)
  • nx-dev: track docs analytics for code copy, LLM prompt, YouTube (#​35526)
  • testing: add migration for Jest 30 snapshot guide link (#​35629)
🩹 Fixes
  • angular: disable vitest watch by default (#​35493)
  • angular-rspack: keep root-scoped assets out of per-locale i18n emit (#​35621)
  • bundling: include tsconfig solution input for rollup (#​35476)
  • bundling: include tsconfig solution input for webpack (#​35477, #​35476)
  • core: bump axios to 1.16.0 for all packages (#​35568)
  • core: add provenance check in nx console status path (#​35485)
  • core: remove access control header from graph app (#​35494)
  • core: ensure verbose logs go to stderr and daemon logs are properly decorated (#​34358)
  • core: show flaky-task count in run summary (#​35491)
  • core: unique telemetry user_id; expose workspace_id dimension (#​35553)
  • core: update minimatch to 10.2.5 (#​35569, #​34660)
  • core: restore use-legacy-versioning shim for @​nx/js@​21 ensurePackage path (#​35574)
  • core: isolate NX_PARALLEL env var in parallel-related specs (#​35579)
  • core: skip handleimport miss path when nx key packages are absent (#​35596)
  • core: use gethostuuid(3) instead of ioreg on macOS (#​35599)
  • core: isolate cache env vars in splitArgs spec (#​35584)
  • core: enable node's native v8 compile cache support (#​35415, #​20454)
  • core: support skipped batch tasks end-to-end and fix TUI double logs (#​35617)
  • core: keep TUI task selection on the in-progress section (#​35640)
  • core: allow nx mcp to run outside of an Nx workspace (#​35655)
  • core: cast perf entries to PerformanceMeasure for detail access (43c0c821ba)
  • devkit: exclude dist from jest module path scan (#​35615)
  • devkit: expand @​nx/devkit/internal re-exports for cherry-picked v23 deep-import migration (#​35541)
  • dotnet: correct output paths for Web SDK and centralized dist setups (#​35398)
  • gradle: exclude batch-runner from jest haste-map crawl (#​35501)
  • gradle: exclude project-graph from jest module path scan (#​35609)
  • gradle: support Windows file paths (#​35184, #​34987)
  • js: strip glob from inferred outputs before resolving as path (#​35463, #​35452)
  • js: reference vitest.config in eslint dep-checks for vitest libs (#​35460, #​33670, #​35450)
  • js: include transitive workspace deps in pruned pnpm lockfile (#​35532, #​35347, #​34655)
  • linter: prevent ENOENT crash in getRelativeImportPath for unresolvable paths (#​35007, #​13872, #​34066, #​30491, #​16716, #​35006, #​21889, #​32190)
  • maven: skip attached artifacts that fail to materialize in batch record (#​35473)
  • maven: serialize Maven 4 build state recording (#​35555)
  • maven: widen runCLI timeout for --no-batch maven.test.ts cases (#​35589)
  • nx-dev: document nested CLI subcommands beyond two levels (#​35519)
  • nx-dev: short-circuit bot probes in framer rewrite edge function (#​35527)
  • react: withSvgr migration preserves other properties (#​35484)
  • repo: clear NX_INVOCATION_ROOT_PID in run-native-target to avoid recursion false-positive (443dee0b22)
  • repo: revert deep-import rewrites that targeted v23-only @​nx/devkit/internal entry (ac8187963d)
  • repo: unblock 22.7.x cargo tests and nx-build e2e (#​34285)
  • repo: expand "..." spread token in graph typecheck inputs (#​34285, #​35458)
  • testing: pin jest to ~30.3.0 to avoid jest-runtime 30.4 RN incompat (#​35618)
  • testing: handle absolute cypress screenshotsFolder/videosFolder paths (#​35624)
  • testing: exclude dist and out-tsc from default jest module path scan (#​35619)
  • testing: update remaining snapshot guide links missed by migration (cd350c1140)
❤️ Thank You
pnpm/pnpm (pnpm)

v11.7.0

Compare Source

Minor Changes

  • Added a new setting frozenStore (--frozen-store) that lets pnpm install run against a package store on a read-only filesystem (e.g. a Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm opens the store's SQLite index.db through the immutable=1 URI — bypassing the WAL/-shm sidecar creation that otherwise fails on a read-only directory — and suppresses every store-write path (the index.db writer and the project-registry write). Pair it with --offline --frozen-lockfile against a fully-populated store. Under the global virtual store, package directories live inside the store, so if the store is missing the build output of a package whose lifecycle scripts are approved (or that has a patch), pnpm fails up front with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD rather than crashing mid-build on a read-only write — seed the store with those builds first. Incompatible with --force and with a configured pnpr server, since both write into the store; the side-effects cache is likewise not written under frozenStore. If the store is missing its content directory, the install fails fast with ERR_PNPM_FROZEN_STORE_INCOMPLETE rather than attempting to initialize it. The read-only immutable=1 open requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes --frozen-store fails with a clear ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE error. Bin-linking also tolerates a read-only store: under the global virtual store a package's bin source lives inside the store, so the chmod that makes it executable would be refused — with EPERM/EACCES, or with EROFS on a genuinely read-only filesystem. That chmod is redundant when the seed already ships its bins executable with a normalized shebang, so it is now skipped in that case, while a non-executable bin (or one still carrying a Windows CRLF shebang) on a read-only store still errors.

  • When pacquet (the Rust port of pnpm) is declared in configDependencies, pnpm now delegates dependency resolution to it too — not just materialization — provided the installed pacquet is new enough to support full resolving installs (>= 0.11.7).

    Previously pacquet only ran in frozen-install mode: pnpm always resolved the dependency graph itself (writing pnpm-lock.yaml) and handed pacquet a finished lockfile to fetch / import / link. With pacquet >= 0.11.7, a non-frozen pnpm install (default isolated nodeLinker, plain install) is delegated to pacquet end-to-end in a single pass — pacquet resolves the manifests, writes the lockfile, and materializes node_modules. pnpm detects the capability from the installed pacquet's version; older pacquet releases keep the resolve-then-materialize split, and add / update / remove still resolve in pnpm (it has to mutate the manifests first). This remains an opt-in preview of the Rust install engine #​11723.

  • Added a new opt-in --batch flag to pnpm publish --recursive that sends all selected packages to the registry in a single PUT /-/pnpm/v1/publish request instead of one request per package. The target registry has to implement the batch publish endpoint (pnpr does); registries that don't are reported with a clear ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED error. The batch is processed all-or-nothing by pnpr: if any package in the batch fails validation, none of the packages are published.

Patch Changes

  • Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

    The fix adds two layers:

    • The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests.
    • The lockfile verification gate (verifyLockfileResolutions) now runs an always-on, policy-independent check that rejects any importer or snapshot dependency alias that is not a valid package name, failing the install early — before any fetch or filesystem work — for every node linker at once.

  • Made shared package child resolution deterministic when the same package is reached through multiple contexts. pnpm now chooses the shallowest occurrence, then importer order, then parent path, instead of letting request timing decide the child context and missing-peer report pnpm/pnpm#12358.

  • Fix garbled summary line after submitting pnpm update -i and pnpm audit --fix -i. The interactive checkbox prompt previously printed every selected choice's full table row (label, current/target versions, workspace, URL) joined by commas, producing a wall of text after pressing Enter. The summary now lists only the selected package names (or vulnerability keys) by setting an explicit short per choice; the in-progress selection UI is unchanged.

  • Prevent pnpm patch-remove from removing files outside the configured patches directory.

  • Fixed pnpm publish ignoring strictSsl: false when publishing to registries with self-signed certificates. The strictSSL option is now forwarded to libnpmpublish / npm-registry-fetch so that strict-ssl=false in .npmrc or strictSsl: false in pnpm-workspace.yaml is respected during publish, the same way it is for pnpm install pnpm/pnpm#12012.

  • Fixed Cannot destructure property 'manifest' of 'manifestsByPath[rootDir]' as it is undefined regression introduced in 11.6.0 when running pnpm add <pkg> outside a workspace on Windows. selectProjectByDir was keying the resulting ProjectsGraph by opts.dir instead of project.rootDir, so downstream manifestsByPath lookups missed when the two paths normalized differently (typically drive-letter casing). pnpm/pnpm#12379

  • Git dependencies that point to a subdirectory of a repository (repo#commit&path:/sub/dir) keep their path in the lockfile again. Since the integrity of git-hosted tarballs started being pinned in the lockfile, any install that actually downloaded the tarball rebuilt the lockfile resolution as { integrity, tarball, gitHosted } and dropped the path field, while installs served from the store kept it — so the field disappeared seemingly at random. Without path, later installs from that lockfile silently unpacked the repository root instead of the subdirectory #​12304.

  • Fixed nondeterministic lockfile output that made pnpm dedupe --check fail intermittently in CI. When a locked peer provider was pinned for a dependency that has no child dependencies of its own, the pinned provider leaked into the shared parent scope, so siblings resolved after it could pick up an optional peer they should not see. Which siblings were affected depended on resolution order, which varies with network timing.

  • Sped up pnpm install with a frozen lockfile by running lockfile verification (the policy revalidation gate added for minimumReleaseAge/trustPolicy and the tarball-URL anti-tamper check) concurrently with fetching and linking instead of blocking the whole install on it. Dependency lifecycle scripts are still held back until verification succeeds, so no script runs on an unverified lockfile: if verification fails the install aborts before any dependency build, and if linking finishes first the install waits for the verification verdict before completing.

  • User-defined npm_config_* environment variables are now preserved during lifecycle script execution. Previously, all npm_-prefixed env vars were stripped, which caused user-set variables like npm_config_platform_arch to be lost pnpm/pnpm#12399.

  • pnpm can now use different auth tokens for different package scopes, even when those scopes use the same registry URL.

    Previously, auth was selected only by registry URL. If @org-a and @org-b both used https://npm.pkg.github.com/, they had to share the same token. This caused problems for registries that issue tokens per organization or per scope.

    Configure a scope-specific token by adding the package scope after the registry URL in the auth key:

    @&#8203;org-a:registry=https://npm.pkg.github.com/
@&#8203;org-b:registry=https://npm.pkg.github.com/

//npm.pkg.github.com/:@&#8203;org-a:_authToken=${ORG_A_TOKEN}
//npm.pkg.github.com/:@&#8203;org-b:_authToken=${ORG_B_TOKEN}

//npm.pkg.github.com/:_authToken=${FALLBACK_TOKEN}

    pnpm login --registry=https://npm.pkg.github.com --scope=@&#8203;org-a writes the token to the same scope-specific auth key.

    When installing or publishing @org-a/*, pnpm uses ORG_A_TOKEN. For @org-b/*, pnpm uses ORG_B_TOKEN. Packages without a matching scope continue to use the registry-wide fallback token.

  • pnpm setup no longer prompts to approve build scripts for @pnpm/exe when installing the standalone executable. pnpm links the platform-specific binary itself, so the package's install scripts are skipped during the global self-install #​12377.

  • Close lockfile reads deterministically before rewriting lockfiles and keep pacquet's virtual store directory length aligned with pnpm on Windows.

  • A 304 Not Modified answer from the registry now renews the cached metadata file's mtime, so the minimumReleaseAge freshness shortcut keeps serving resolutions from the cache. Previously, once a cached packument grew older than minimumReleaseAge, every subsequent install re-validated it against the registry forever, because a 304 never rewrites the file.

  • Updated dependency ranges. Notably:

    • @pnpm/logger peer dependency range moved to ^1100.0.0.
    • msgpackr 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
    • open ^7.4.2 → ^11.0.0, memoize ^10 → ^11, cli-truncate ^5 → ^6, pidtree ^0.6 → ^1.
    • @yarnpkg/core 4.5.0 → 4.8.0, @rushstack/worker-pool 0.7.7 → 0.7.18, @cyclonedx/cyclonedx-library 10.0.0 → 10.1.0, @pnpm/config.nerf-dart ^1 → ^2, @pnpm/log.group 3.0.2 → 4.0.1, @pnpm/util.lex-comparator ^3 → ^4.

  • Updated @zkochan/cmd-shim to v9.0.6.

  • Fixed a Windows-only hang where a failed command could take 20–46 seconds to exit. On error, pnpm enumerates descendant processes (via pidtree) to terminate them, which on Windows shells out to wmic/PowerShell Get-CimInstance Win32_Process — a lookup that is extremely slow on some machines. The lookup is now bounded by a short timeout so it can no longer stall the process exit.

v11.6.0

Compare Source

Minor Changes

  • pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.

  • 615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:

    npm_config_//registry.npmjs.org/:_authToken=<token>
pnpm_config_//registry.npmjs.org/:_authToken=<token>

    This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

  • Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
  • Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #​12324.
  • Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g. @nx/nx-win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them #​11702.

v11.5.3

Compare Source

Patch Changes

  • Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from .npmrc, and in workspace registry URLs from pnpm-workspace.yaml. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config.

  • Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution.

  • Avoid writing packageManagerDependencies to pnpm-lock.yaml when package manager policy is set to onFail: ignore or pmOnFail: ignore #​12228.

  • Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest.

  • Using the $ version reference syntax in overrides (e.g. "react": "$react") now prints a deprecation warning. The syntax still works, but catalogs are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with the catalog: protocol instead.

  • Fixed pnpm config get globalconfig to return the global config.yaml path again pnpm/pnpm#11962.

  • Fixed bare --color so it does not consume the following CLI flag, allowing command shorthands like --parallel to expand correctly and forms like pnpm --color with current <command> to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.

  • Fix pnpm install ignoring enableGlobalVirtualStore toggle by including it in the workspace state settings check #​12142.

  • Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.

    This covers two paths that select an executable from repository-controlled input:

    • pacquet install engine — declaring pacquet (or @pnpm/pacquet) in configDependencies opts in to pnpm's Rust install engine. pnpm now verifies that the installed pacquet shim and the host's @pacquet/<platform>-<arch> binary carry a valid npm registry signature for their exact name@version, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.
    • automatic version switch / self-update — the packageManager / devEngines.packageManager field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of pnpm, @pnpm/exe, and the host platform binary before installing/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label May 18, 2026
@coderabbitai

coderabbitai Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Bump tooling and dependency pins: GitHub Actions tool pins updated (pnpm/action-setup → v6.0.8; zizmor-action pinned to a newer commit), root packageManager pnpm bumped to 11.1.3, and multiple pnpm-workspace catalog entries upgraded.

Changes

Dependency and Tool Version Updates

Layer / File(s) Summary
GitHub Actions tool versions
.github/setup/action.yml, .github/workflows/zizmor.yml		 pnpm/action-setup pin updated to v6.0.8; zizmorcore/zizmor-action pin updated to a newer commit (commented v0.5.6).
Project manager and workspace dependencies
package.json, pnpm-workspace.yaml		 Root packageManager bumped to pnpm@11.1.3; pnpm-workspace catalog entries for @tanstack/query-core, @types/react, @vitejs/plugin-react, @vitejs/plugin-vue, eslint, nx, publint, typescript-eslint, vite, and vitest updated to newer patch versions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

Possibly related PRs

Poem

🐰 I nudged the pins and hopped around,
Quiet bumps in configs, hardly a sound.
Actions and pnpm, versions align,
Workspace catalog patched just fine.
Tiny hops, tidy trail — all signed.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR description is auto-generated by Renovate and contains extensive dependency update information but does not follow the repository's PR template structure. Add a proper PR description following the template: include a '🎯 Changes' section explaining the updates, complete the '✅ Checklist' with required acknowledgments, and clearly indicate under '🚀 Release Impact' whether this is docs/CI/dev-only or if a changeset is needed.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title 'chore(deps): update all non-major dependencies' accurately and clearly summarizes the main change—dependency version updates across the project.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

@nx-cloud

nx-cloud Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.

View your CI Pipeline Execution ↗ for commit 95e18a2

Command Status Duration Result
nx affected --targets=test:sherif,test:docs,tes... ❌ Failed 24s View ↗
nx run-many --target=build ✅ Succeeded 9s View ↗

☁️ Nx Cloud last updated this comment at 2026-05-26 21:30:09 UTC

@pkg-pr-new

pkg-pr-new Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown 
npm i https://pkg.pr.new/@tanstack/eslint-config@390

npm i https://pkg.pr.new/@tanstack/publish-config@390

npm i https://pkg.pr.new/@tanstack/typedoc-config@390

npm i https://pkg.pr.new/@tanstack/vite-config@390

commit: 95e18a2

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 1ef6627 to e141ecb Compare May 24, 2026 07:31
@socket-security

socket-security Bot commented May 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/typescript-eslint@8.61.0 → npm/@typescript-eslint/eslint-plugin@8.61.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm nx is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/nx@22.7.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/nx@22.7.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from 1bc8a9a to 59e76cc Compare May 30, 2026 21:33
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from ef3c2ca to 8130abf Compare June 2, 2026 15:06
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 4461c35 to 43677bb Compare June 9, 2026 16:33
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 35e2fa4 to 9dd0f94 Compare June 11, 2026 15:58
@socket-security

socket-security Bot commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednx@​22.7.55910093100100
Addedtypescript-eslint@​8.61.01001007498100
Added@​arethetypeswrong/​core@​0.18.31001007586100
Added@​tanstack/​query-core@​5.101.0971007698100
Addedtinyglobby@​0.2.171001007786100
Added@​types/​react@​19.2.171001007995100
Addedpublint@​0.3.211001008190100
Addedvite@​8.0.16991008298100
Addedreact@​19.2.71001008497100
Addedtsdown@​0.22.2981008896100
Addedvue-eslint-parser@​10.4.19910010089100
Addedtype-fest@​5.7.010010010091100
Addedvue@​3.5.381001009197100
Added@​vitejs/​plugin-vue@​6.0.710010010092100
Added@​vitejs/​plugin-react@​6.0.210010010092100
Addedreact-dom@​19.2.71001009298100
Addedprettier@​3.8.4981009796100
Addedeslint@​10.5.09810010097100
Addedvitest@​4.1.9100100100100100

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from dbbcb2d to f347304 Compare June 12, 2026 20:09
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from f347304 to 0b6a05d Compare June 15, 2026 11:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants