Skip to content

fix(deps): update all non-major dependencies#93

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#93
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented May 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
fast-xml-parser ^5.8.0 → ^5.9.0 age confidence
knip (source) ^6.14.2 → ^6.17.1 age confidence
oxlint (source) ^1.67.0 → ^1.70.0 age confidence
pnpm (source) 11.5.0 → 11.7.0 age confidence
shiki (source) ^4.1.0 → ^4.2.0 age confidence
tsdown (source) ^0.22.1 → ^0.22.2 age confidence

Release Notes

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.9.0

Compare Source

webpro-nl/knip (knip)

v6.17.1: Release 6.17.1

Compare Source

  • Remove ignoreBinaries w/ tar (b13d0ca)
  • Wrap up docs/refs (29f3e46)
  • Update dependencies (7b2f345)
  • Fix up vscode-languageclient imports (820c233)

v6.17.0: Release 6.17.0

Compare Source

v6.16.1: Release 6.16.1

Compare Source

v6.16.0: Release 6.16.0

Compare Source

  • Update sponsors data + fix sponsors layout on narrow screen (fadf13a)
  • Detect binaries and entry files in node:child_process calls (fc3598c)
  • It works™ (2d9ce84)
  • Extend known issues doc w/ workaround (close #​1763) (fcd444b)
  • Support ignoreExportsUsedInFile per workspace (close #​1495) (4b898a9)
  • feat(vscode): add workspaceRoot config option to enable use in a VSCode workspace that does not have package.json at the workspace root (#​1667) (7c1ebef) - thanks @​anmilleriii!
  • Replace minimist with node:util.parseArgs (resolve #​1492) (b360c5c)
  • Preserve minimist numeric coercion and --no-x negation (c12153c)
  • Simplify parseArgs adapter (ba15e41)
  • Detect and credit registered custom elements (resolve #​1394) (62dcda5)
  • Add Lit and FAST plugins to detect @​customElement classes (348d2c9)
  • Add new testimonials (77fd7ed)
  • Scope custom path aliases per workspace (resolve #​1775) (d908099)
  • Restructure tests (ec4c779)
  • Simplify boolean check in parseArgs adapter (ba6865d)
  • Scope static custom-element define detection to the FAST plugin (94632cd)
  • Add Custom Elements feature docs page (230bd73)
  • Update known-issues.md (f1f4c1b)
  • Fix crash on backtick string literals in plugin config (resolve #​1776) (f1adc7f)
  • Format (e4720ca)
  • Fix backtick string literals in require() and plugin-name config arrays (#​1776) (d14eb05)
  • Credit custom elements via aliases, scoped registries, and static blocks (d7cbe12)
  • Improve Stencil plugin: credit @​Component and recognize test files (152d730)
  • Add Catalyst plugin to credit bare @​controller custom elements (8a37f8c)
  • Document Stencil, Catalyst, static-block custom el reg. (105fba3)
  • Auto-format md (f4fcf4e)

v6.15.0: Release 6.15.0

Compare Source

oxc-project/oxc (oxlint)

v1.70.0

Compare Source

🚀 Features
  • 2e8bda4 linter/vue: Implement no-dupe-keys rule (#​23350) (bab)
  • 1490a0a linter/react: Implement react-compiler rule (#​23202) (Boshen)
  • dd560ae linter/unicorn: Implement no-array-fill-with-reference-type rule (#​23397) (Mikhail Baev)
  • af36c2f linter: Add schema for react/jsx-curly-brace-presence (#​23400) (WaterWhisperer)
  • 47d34a3 linter: Add schema for react/jsx-handler-names (#​23393) (WaterWhisperer)
  • f4250d0 linter: Add schema for unicorn/import-style (#​23386) (WaterWhisperer)
  • 30c74ce linter: Add schema for jsx_a11y/no-noninteractive-element-to-interactive-role (#​23384) (Sysix)
  • cfbe8dc linter: Add schema for jsx_a11y/no-interactive-element-to-noninteractive-role (#​23382) (WaterWhisperer)
  • d15b7ff linter: Add schema for typescript/no-restricted-types (#​23381) (WaterWhisperer)
  • 028a811 linter: Add schema for jsx-a11y/media-has-caption (#​23377) (Sysix)
  • b3b1038 linter: Add schema for jsx-a11y/label-has-associated-control (#​23376) (Sysix)
  • 7ada6b2 linter: Add schema for jsx_a11y/no-distracting-elements (#​23379) (WaterWhisperer)
  • ee3dd49 linter: Add schema for jsx-a11y/img-redundant-alt (#​23374) (Sysix)
  • df5f8dd linter: Add short descriptions to most lint rules. (#​23365) (Connor Shea)
  • e3fd735 linter: Add schema for jsx_a11y/alt-text (#​23369) (Sysix)
  • 0f2fff4 linter: Add schema for react/exhaustive-deps (#​23372) (Mikhail Baev)
  • e3e4e10 linter: Add schema for react_perf/jsx-no-new-object-as-prop (#​23368) (Mikhail Baev)
  • 9366d44 linter: Add schema for unicorn/prefer-at (#​23366) (WaterWhisperer)
  • f57b55d linter: Add schema for typescript/array-type (#​23355) (Sysix)
  • 0dcf912 linter: Add schema for typescript/ban-ts-comment (#​23354) (Sysix)
  • 51fa83e linter: Add schema for react/no-did-update-set-state (#​23357) (Mikhail Baev)
  • 59db0bd linter: Add schema for consistent-generic-constructors (#​23353) (Sysix)
  • c4775c0 linter: Add schema for typescript/consistent-type-assertions (#​23349) (Sysix)
  • 6e516f7 linter: Add schema for typescript/consistent-type-imports (#​23348) (Sysix)
  • 012134d linter: Add schema for react/jsx-no-target-blank (#​23345) (WaterWhisperer)
  • 0806aae linter: Add schema for jsx_a11y/no-noninteractive-tabindex (#​23337) (Mikhail Baev)
  • 0708b5a linter: Add schema for react/jsx-filename-extension (#​23315) (Mikhail Baev)
  • 150bce1 linter: Add schema for typescript/no-empty-object-type (#​23309) (Sysix)
  • f9e36f1 linter: Add schema for typescript/no-duplicate-type-constituents (#​23308) (Sysix)
  • 937accf linter: Add schema for typescript/no-invalid-void-type (#​23307) (Sysix)
  • 3e042b9 linter: Add schema for typescript/no-misused-promises (#​23306) (Sysix)
  • da212d1 linter: Add schema for typescript/no-unnecessary-condition (#​23305) (Sysix)
  • f8f0d38 linter: Add schema for typescript/parameter-properties (#​23304) (Sysix)
  • 2275fc7 linter: Add schema for typescript/prefer-nullish-coalescing (#​23302) (Sysix)
  • d353858 linter: Add schema for typescript/prefer-string-starts-ends-with (#​23301) (Sysix)
  • 03060f5 linter: Add schema for typescript/triple-slash-reference (#​23300) (Sysix)
  • 6619cee linter: Add schema for promise/param-names (#​23298) (Sysix)
  • 8bf108e linter: Add schema for promise/catch-or-return (#​23297) (Sysix)
  • 48158d0 linter: Add schema for vitest/consistent-each-for (#​23294) (Sysix)
  • 7e74c98 linter: Add schema for vitest/consistent-test-filename (#​23293) (Sysix)
  • ff94d4a linter: Add schema for vitest/consistent-vitest-vi (#​23292) (Sysix)
  • 2409a10 linter: Add schema for vitest/prefer-import-in-mock (#​23291) (Sysix)
  • 3d782b7 linter: Add schema for react/no-unstable-nested-components (#​23287) (Mikhail Baev)
  • 0a0bc2f linter/jsx-a11y: Add allowedRedundantRoles option to no-redundant-roles (#​22820) (bab)
  • 80758a5 linter/vue: Implement no-side-effects-in-computed-properties rule (#​23282) (bab)
  • e3869ac linter: Add schema for react/no-object-type-as-default-prop (#​23279) (Mikhail Baev)
  • 4480609 linter: Add schema for react/jsx-props-no-spreading (#​23276) (Mikhail Baev)
  • 08d68a5 linter/react: Implement jsx-no-literals rule (#​23145) (kapobajza)
  • 9a2788b linter/unicorn: Implement prefer-export-from rule (#​22935) (AliceLanniste)
  • bdb723c linter/unicorn: Implement prefer-single-call rule (#​23235) (Yuzhe Shi)
  • 31543ed linter: Add schema for vue/define-props-destructuring (#​23252) (Sysix)
  • 21b6c3d linter: Add schema for oxc/no-async-endpoint-handlers (#​23251) (Sysix)
  • e77ff81 linter: Add schema for unicorn/prefer-object-from-entries (#​23249) (Mikhail Baev)
  • bcac2d6 linter: Add schema for jest/vitest/no-restricted-matchers (#​23247) (Sysix)
  • 539f036 linter: Add schema for jest/vitest/no-restricted-*-methods (#​23246) (Sysix)
  • dd1b927 linter/vue: Implement require-default-prop rule (#​22951) (bab)
  • 3f018e7 linter: Add schema for unicorn/no-instanceof-builtins (#​23225) (Mikhail Baev)
  • e0d0f78 linter: Verify promise/no-callback-in-promise schema (#​23141) (beanscg)
  • 123d4f4 linter: Add schema for jest/vitest/valid-expect (#​23185) (Sysix)
  • 46c8a21 linter: Add schema for jest/vitest/require-top-level-describe (#​23184) (Sysix)
  • 41465cf linter: Add schema for jest/vitest/prefer-snapshot-hint (#​23183) (Sysix)
  • d068b9b linter: Add schema for jest/vitest/prefer-expect-assertions (#​23181) (Sysix)
  • 064a1ee linter: Add schema for jest/prefer-ending-with-an-expect (#​23180) (Sysix)
  • d046797 linter: Add schema for jest/vitest/no-standalone-expect (#​23179) (Sysix)
  • 137b9a6 linter: Add schema for jest/vitest/no-large-snapshots (#​23178) (Sysix)
  • 0f3e4a5 linter: Add schema for jest/vitest/no-hooks (#​23177) (Sysix)
  • cd0b384 linter: Add schema for unicorn/explicit-length-check (#​23155) (Mikhail Baev)
  • 01b74c4 linter: Add schema for jest/no-deprecated-functions (#​23136) (Sysix)
  • 9d6a387 linter: Add schema for unicorn/catch-error-name (#​23137) (Mikhail Baev)
  • 0da8efa linter: Add schema for jest/vitest/max-nested-describe (#​23131) (Sysix)
  • d71c9fd linter: Add schema for eslint/no-use-before-define (#​23129) (Sysix)
🐛 Bug Fixes
  • 26ddac6 linter: Avoid config schema generation for jsx_a11y/no-noninteractive-element-interactions (#​23385) (Sysix)
  • 40556ad linter: Parse jsx-a11y/control-has-associated-label config with DefaultRuleConfig (#​23373) (Sysix)
  • 71e9648 linter: Expose no-noninteractive-element-interactions schema (#​23283) (camc314)
  • 6c86d1c linter/react-perf: Correct nativeAllowList all schema (#​23229) (camc314)
  • 4dd52de linter/react-perf: Re-generate stale snapshots (#​23228) (camc314)
  • 8f3db61 linter: Allow options for eslint/capitalized-comments (#​23139) (Sysix)
⚡ Performance
  • f09707e linter: jest/no-deprecated-functions store config version as usize (#​23138) (Sysix)
📚 Documentation
  • f682e25 linter: Remove manually written options doc for eslint/prefer-arrow-callback (#​23438) (Mikhail Baev)
  • 64c942c linter: Remove manually written options doc for eslint/no-sequences (#​23420) (Mikhail Baev)
  • 14abf32 linter/react-perf: Use autogenerated docs (#​23227) (camc314)

v1.69.0

Compare Source

🚀 Features
🐛 Bug Fixes
📚 Documentation
  • dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#​22965) (Boshen)

v1.68.0

Compare Source

🚀 Features
  • e4b1f46 linter/typescript: Implement method-signature-style rule (#​22679) (Mikhail Baev)
  • bc462ca linter/vue: Implement no-reserved-component-names rule (#​22741) (bab)
  • ef9e751 linter/vue: Implement component-definition-name-casing rule (#​22818) (bab)
  • d67f51a linter/vue: Implement require-prop-type-constructor rule (#​22708) (bab)
  • 8422e8b linter/jsdoc: Implement require-yields-description rule (#​22805) (Mikhail Baev)
  • fe93f97 linter/eslint: Implement prefer-named-capture-group rule (#​22759) (Sebastian Poxhofer)
pnpm/pnpm (pnpm)

v11.7.0

Compare Source

Minor Changes

  • Added a new setting frozenStore (--frozen-store) that lets pnpm install run against a package store on a read-only filesystem (e.g. a Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm opens the store's SQLite index.db through the immutable=1 URI — bypassing the WAL/-shm sidecar creation that otherwise fails on a read-only directory — and suppresses every store-write path (the index.db writer and the project-registry write). Pair it with --offline --frozen-lockfile against a fully-populated store. Under the global virtual store, package directories live inside the store, so if the store is missing the build output of a package whose lifecycle scripts are approved (or that has a patch), pnpm fails up front with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD rather than crashing mid-build on a read-only write — seed the store with those builds first. Incompatible with --force and with a configured pnpr server, since both write into the store; the side-effects cache is likewise not written under frozenStore. If the store is missing its content directory, the install fails fast with ERR_PNPM_FROZEN_STORE_INCOMPLETE rather than attempting to initialize it. The read-only immutable=1 open requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes --frozen-store fails with a clear ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE error. Bin-linking also tolerates a read-only store: under the global virtual store a package's bin source lives inside the store, so the chmod that makes it executable would be refused — with EPERM/EACCES, or with EROFS on a genuinely read-only filesystem. That chmod is redundant when the seed already ships its bins executable with a normalized shebang, so it is now skipped in that case, while a non-executable bin (or one still carrying a Windows CRLF shebang) on a read-only store still errors.

  • When pacquet (the Rust port of pnpm) is declared in configDependencies, pnpm now delegates dependency resolution to it too — not just materialization — provided the installed pacquet is new enough to support full resolving installs (>= 0.11.7).

    Previously pacquet only ran in frozen-install mode: pnpm always resolved the dependency graph itself (writing pnpm-lock.yaml) and handed pacquet a finished lockfile to fetch / import / link. With pacquet >= 0.11.7, a non-frozen pnpm install (default isolated nodeLinker, plain install) is delegated to pacquet end-to-end in a single pass — pacquet resolves the manifests, writes the lockfile, and materializes node_modules. pnpm detects the capability from the installed pacquet's version; older pacquet releases keep the resolve-then-materialize split, and add / update / remove still resolve in pnpm (it has to mutate the manifests first). This remains an opt-in preview of the Rust install engine #​11723.

  • Added a new opt-in --batch flag to pnpm publish --recursive that sends all selected packages to the registry in a single PUT /-/pnpm/v1/publish request instead of one request per package. The target registry has to implement the batch publish endpoint (pnpr does); registries that don't are reported with a clear ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED error. The batch is processed all-or-nothing by pnpr: if any package in the batch fails validation, none of the packages are published.

Patch Changes

  • Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

    The fix adds two layers:

    • The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests.
    • The lockfile verification gate (verifyLockfileResolutions) now runs an always-on, policy-independent check that rejects any importer or snapshot dependency alias that is not a valid package name, failing the install early — before any fetch or filesystem work — for every node linker at once.

  • Made shared package child resolution deterministic when the same package is reached through multiple contexts. pnpm now chooses the shallowest occurrence, then importer order, then parent path, instead of letting request timing decide the child context and missing-peer report pnpm/pnpm#12358.

  • Fix garbled summary line after submitting pnpm update -i and pnpm audit --fix -i. The interactive checkbox prompt previously printed every selected choice's full table row (label, current/target versions, workspace, URL) joined by commas, producing a wall of text after pressing Enter. The summary now lists only the selected package names (or vulnerability keys) by setting an explicit short per choice; the in-progress selection UI is unchanged.

  • Prevent pnpm patch-remove from removing files outside the configured patches directory.

  • Fixed pnpm publish ignoring strictSsl: false when publishing to registries with self-signed certificates. The strictSSL option is now forwarded to libnpmpublish / npm-registry-fetch so that strict-ssl=false in .npmrc or strictSsl: false in pnpm-workspace.yaml is respected during publish, the same way it is for pnpm install pnpm/pnpm#12012.

  • Fixed Cannot destructure property 'manifest' of 'manifestsByPath[rootDir]' as it is undefined regression introduced in 11.6.0 when running pnpm add <pkg> outside a workspace on Windows. selectProjectByDir was keying the resulting ProjectsGraph by opts.dir instead of project.rootDir, so downstream manifestsByPath lookups missed when the two paths normalized differently (typically drive-letter casing). pnpm/pnpm#12379

  • Git dependencies that point to a subdirectory of a repository (repo#commit&path:/sub/dir) keep their path in the lockfile again. Since the integrity of git-hosted tarballs started being pinned in the lockfile, any install that actually downloaded the tarball rebuilt the lockfile resolution as { integrity, tarball, gitHosted } and dropped the path field, while installs served from the store kept it — so the field disappeared seemingly at random. Without path, later installs from that lockfile silently unpacked the repository root instead of the subdirectory #​12304.

  • Fixed nondeterministic lockfile output that made pnpm dedupe --check fail intermittently in CI. When a locked peer provider was pinned for a dependency that has no child dependencies of its own, the pinned provider leaked into the shared parent scope, so siblings resolved after it could pick up an optional peer they should not see. Which siblings were affected depended on resolution order, which varies with network timing.

  • Sped up pnpm install with a frozen lockfile by running lockfile verification (the policy revalidation gate added for minimumReleaseAge/trustPolicy and the tarball-URL anti-tamper check) concurrently with fetching and linking instead of blocking the whole install on it. Dependency lifecycle scripts are still held back until verification succeeds, so no script runs on an unverified lockfile: if verification fails the install aborts before any dependency build, and if linking finishes first the install waits for the verification verdict before completing.

  • User-defined npm_config_* environment variables are now preserved during lifecycle script execution. Previously, all npm_-prefixed env vars were stripped, which caused user-set variables like npm_config_platform_arch to be lost pnpm/pnpm#12399.

  • pnpm can now use different auth tokens for different package scopes, even when those scopes use the same registry URL.

    Previously, auth was selected only by registry URL. If @org-a and @org-b both used https://npm.pkg.github.com/, they had to share the same token. This caused problems for registries that issue tokens per organization or per scope.

    Configure a scope-specific token by adding the package scope after the registry URL in the auth key:

    @&#8203;org-a:registry=https://npm.pkg.github.com/
@&#8203;org-b:registry=https://npm.pkg.github.com/

//npm.pkg.github.com/:@&#8203;org-a:_authToken=${ORG_A_TOKEN}
//npm.pkg.github.com/:@&#8203;org-b:_authToken=${ORG_B_TOKEN}

//npm.pkg.github.com/:_authToken=${FALLBACK_TOKEN}

    pnpm login --registry=https://npm.pkg.github.com --scope=@&#8203;org-a writes the token to the same scope-specific auth key.

    When installing or publishing @org-a/*, pnpm uses ORG_A_TOKEN. For @org-b/*, pnpm uses ORG_B_TOKEN. Packages without a matching scope continue to use the registry-wide fallback token.

  • pnpm setup no longer prompts to approve build scripts for @pnpm/exe when installing the standalone executable. pnpm links the platform-specific binary itself, so the package's install scripts are skipped during the global self-install #​12377.

  • Close lockfile reads deterministically before rewriting lockfiles and keep pacquet's virtual store directory length aligned with pnpm on Windows.

  • A 304 Not Modified answer from the registry now renews the cached metadata file's mtime, so the minimumReleaseAge freshness shortcut keeps serving resolutions from the cache. Previously, once a cached packument grew older than minimumReleaseAge, every subsequent install re-validated it against the registry forever, because a 304 never rewrites the file.

  • Updated dependency ranges. Notably:

    • @pnpm/logger peer dependency range moved to ^1100.0.0.
    • msgpackr 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
    • open ^7.4.2 → ^11.0.0, memoize ^10 → ^11, cli-truncate ^5 → ^6, pidtree ^0.6 → ^1.
    • @yarnpkg/core 4.5.0 → 4.8.0, @rushstack/worker-pool 0.7.7 → 0.7.18, @cyclonedx/cyclonedx-library 10.0.0 → 10.1.0, @pnpm/config.nerf-dart ^1 → ^2, @pnpm/log.group 3.0.2 → 4.0.1, @pnpm/util.lex-comparator ^3 → ^4.

  • Updated @zkochan/cmd-shim to v9.0.6.

  • Fixed a Windows-only hang where a failed command could take 20–46 seconds to exit. On error, pnpm enumerates descendant processes (via pidtree) to terminate them, which on Windows shells out to wmic/PowerShell Get-CimInstance Win32_Process — a lookup that is extremely slow on some machines. The lookup is now bounded by a short timeout so it can no longer stall the process exit.

v11.6.0

Compare Source

Minor Changes
  • pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the r

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

  • Branch creation
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title chore(deps): update dependency knip to ^6.15.0 chore(deps): update all non-major dependencies Jun 1, 2026
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 4115181 to 5bbfa78 Compare June 8, 2026 16:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from cfec9c3 to 047100a Compare June 15, 2026 07:05
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies fix(deps): update all non-major dependencies Jun 15, 2026
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from ec6b9ad to b7a85ce Compare June 15, 2026 23:09
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from b7a85ce to 292e638 Compare June 16, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants