Skip to content

chore(deps): update all non-major dependencies#1710

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#1710
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 25, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@nuxt/ui (source) 4.7.1 → 4.8.0 age confidence devDependencies minor
@nuxtjs/i18n (source) 10.3.0 → 10.4.0 age confidence devDependencies minor
actions/stale v10.2.0 → v10.3.0 age confidence action minor
idb-keyval ^6.2.2 → ^6.2.4 age confidence dependencies patch
knip (source) 6.14.1 → 6.14.2 age confidence devDependencies patch
local-pkg ^1.1.2 → ^1.2.1 age confidence dependencies minor
pkg-pr-new (source) 0.0.74 → 0.0.75 age confidence devDependencies patch
pnpm (source) 11.1.3 → 11.3.0 age confidence packageManager minor
semver 7.8.0 → 7.8.1 age confidence devDependencies patch
tinyexec ^1.1.2 → ^1.2.2 age confidence dependencies minor
ts-jest (source) 29.4.9 → 29.4.11 age confidence devDependencies patch
vite (source) 8.0.13 → 8.0.14 age confidence pnpm-workspace.overrides patch
vite (source) 8.0.13 → 8.0.14 age confidence devDependencies patch
vue-tsc (source) 3.3.0 → 3.3.1 age confidence devDependencies patch 3.3.2

Release Notes

nuxt/ui (@​nuxt/ui)

v4.8.0

Compare Source

⚠ BREAKING CHANGES
  • InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474)
Features
  • Avatar/AvatarGroup: add color prop (#​6405) (6f2396f)
  • Breadcrumb: add color prop (#​6406) (955dac1)
  • ChatMessage: add body slot and improve actions alignment (#​6460) (48685b6)
  • ChatMessage: add color prop and header slot (#​6407) (c6ce8ca)
  • ChatPrompt: add submitOnEnter prop to control Enter behavior (b597f90), closes #​6177
  • Checkbox/RadioGroup/Switch: add highlight prop for error ring styling (a0deee4)
  • CommandPalette: search and highlight description field (524c34d)
  • ContentSearch/DashboardSearch: enable Fuse.js token search by default (ba08220)
  • ContentSearch: add async search support via useSearchCollection (#​6432) (a1bef8b)
  • DashboardGroup: add storageOptions prop (8f0101b), closes #​6170
  • Error: add icon prop and leading slot (e6ea707), closes #​6119
  • Separator: add position prop (#​6415) (844660a)
  • Theme: override component prop defaults (#​6031) (71c008e)
Bug Fixes
  • ChatMessage: add wrap-break-word to content slot (#​6476) (eb468e6)
  • CommandPalette: only split tokens in highlight when useTokenSearch is enabled (898fbce)
  • CommandPalette: preserve relative order of ignoreFilter groups (e4c1787)
  • CommandPalette: re-highlight first item after debounced results render (efd7b8e)
  • CommandPalette: update default fuse keys in docs and search components (0d9cc0d)
  • components: apply theme.prefix to hardcoded utility classes (f51b1e8)
  • components: constrain popper content to available viewport height (007b136), closes #​6449
  • ContentSearch: preserve intermediate ancestors in breadcrumb prefix (#​6466) (f639b19)
  • ContentToc: apply ui.trigger prop to trigger elements (252b906), closes #​6428
  • defineShortcuts: use e.code for alt shortcuts to handle macOS key remapping (231f156), closes #​6444
  • FileUpload: pass disabled attribute to button variant (2890c83), closes #​6420
  • Form: improve errors type (#​6208) (c1090ab)
  • InputMenu/Select/SelectMenu: respect trailing: false over default trailingIcon (#​6457) (65b47ce)
  • InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474) (2799fa6)
  • module: don't require @nuxtjs/mdc when using content option (89f7778)
  • module: pass computed ref directly to useHead innerHTML (00b7476)
  • module: ship stripped [#build](https://redirect.github.com/nuxt/ui/issues/build)/ui.css fallback for tooling (083c2a9), closes #​5504
  • ProseKbd: add default slot and make value optional (f317c7f)
  • Textarea: autoresize on mount with pre-filled value (e96a0b6), closes #​5962
  • useComponentProps: treat array-typed theme values as ClassValue leaves (cac3860)
nuxt-modules/i18n (@​nuxtjs/i18n)

v10.4.0

Compare Source

This changelog is generated by GitHub Releases

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
actions/stale (actions/stale)

v10.3.0

Compare Source

What's Changed

Bug Fix
Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.3.0

jakearchibald/idb-keyval (idb-keyval)

v6.2.4

Compare Source

v6.2.3

Compare Source

webpro-nl/knip (knip)

v6.14.2: Release 6.14.2

Compare Source

antfu-collective/local-pkg (local-pkg)

v1.2.1

Compare Source

   🚀 Features
    View changes on GitHub

v1.2.0

Compare Source

   🚀 Features
    View changes on GitHub
stackblitz-labs/pkg.pr.new (pkg-pr-new)

v0.0.75

Compare Source

pnpm/pnpm (pnpm)

v11.3.0

Compare Source

Minor Changes

  • Added pnpm stage with publish, list, view, approve, reject, and download subcommands for npm staged publishing.

  • Added a new setting trustLockfile. When true, pnpm install skips the supply-chain verification pass that re-applies minimumReleaseAge / trustPolicy='no-downgrade' to every entry in the loaded lockfile. The install treats the lockfile as already-trusted — useful for closed-source projects where every commit comes from a trusted author. Defaults to false; verification stays on by default. Set in pnpm-workspace.yaml.

    Also cut the memory footprint of the verification pass itself: the per-(registry, name) trust-meta cache previously retained the full packument — dependency graphs, scripts, README, and per-version manifests — for the entire install. On large workspaces (~4k lockfile entries with minimumReleaseAge + trustPolicy: no-downgrade enabled) this could OOM CI runners with a 2GB heap cap. The cache now stores only the fields the trust check actually reads (time, per-version _npmUser.trustedPublisher, dist.attestations.provenance). The abbreviated-metadata cache is similarly projected to just the package-level modified field and the set of currently-listed version names. Fixes #​11860.

  • Implemented pnpm pkg command natively, following npm pkg standards.

  • Implemented pnpm repo command natively, following npm repo standards.

  • Implemented pnpm set-script (alias ss) natively. Adds or updates an entry in the scripts field of the project manifest, supporting package.json, package.json5, and package.yaml formats.

  • Add a skip-manifest-obfuscation option for pnpm pack and pnpm publish. When enabled, the original packageManager field and publish lifecycle scripts are kept in the packed/published manifest instead of being stripped. The pnpm-specific pnpm field continues to be omitted.

Patch Changes
  • Fixed pnpm dlx failing with ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when the installed package's CAS slot is missing its package.json. Observed in the wild for pnpm dlx node@runtime:<version> when the GVS slot was populated without the synthesized manifest runtime archives need (they don't ship a package.json of their own, so the synthesized one is the only way it gets there; an existing slot from an earlier code path that skipped the synthesis stays incomplete). The bin link itself is wired up from the resolution and remains valid, so dlx now falls back to the scopeless package name when the slot's manifest is unreadable — for single-bin packages (the dlx common case, including every runtime: spec) this matches what manifest.bin would have named. Multi-bin packages already require --package=<spec> <bin> to disambiguate and don't enter this code path.
  • Fixed non-determinism in pnpm dedupe and pnpm install when a dependency graph contains packages with transitive peer dependencies on each other (e.g. @aws-sdk/client-sts and @aws-sdk/client-sso-oidc) and auto-install-peers is enabled. The lockfile no longer flips between two equally-valid forms across consecutive runs. The root cause was that resolveDependencies pushed onto its pkgAddresses / postponedResolutionsQueue arrays from inside Promise.all-spawned callbacks, so completion-order timing leaked into the array order and downstream cyclic-peer suffix assignment. Fixes #​8155.
  • Fixed a regression introduced by #​11711 where pnpm add <github-shorthand> (and any other wanted-dependency whose alias can't be parsed from the user-supplied spec, e.g. tarball URLs or pnpm/test-git-fetch#sha) was silently dropped from the manifest update and from pendingBuilds. The alias-keyed lookup added in that PR couldn't find a wantedDependency whose alias was undefined at parse time but resolved to a package name only after fetching, so the entry never made it into specsToUpsert. Restored the original index-based pairing between directDependencies and wantedDependencies; the catalog-protocol preservation that PR was originally fixing is unaffected because it's driven by rdd.catalogLookup.userSpecifiedBareSpecifier, not by the lookup. Fixes the three rebuilds dependencies / rebuilds specific dependencies / rebuild with pending option failures in building/commands/test/build/index.ts.
  • Fixed pnpm add --config leaving orphan entries in pnpm-lock.env.yaml (the optional subdependencies of the previously resolved version of the updated config dependency).

v11.2.2

Compare Source

Patch Changes
  • When the install engine is delegated to pacquet via configDependencies, the user's CLI flags passed to pnpm install (e.g. --no-runtime, --prod, --dev, --no-optional, --node-linker, --cpu/--os/--libc, --offline, --prefer-offline) are now forwarded to pacquet's install subcommand verbatim. Previously pacquet was invoked with a fixed argument list, so flags like --no-runtime were silently dropped. Flag forwarding is gated on the command being install/i; add, update, and dedupe still don't forward (their flag surface doesn't line up with pacquet's install).
  • Fixed pnpm up (and pnpm add / pnpm remove) failing with pacquet_package_manager::outdated_lockfile when pacquet is declared in configDependencies. pnpm now passes --ignore-manifest-check to pacquet so its --frozen-lockfile check doesn't fire against the (pre-mutation) package.json pnpm hasn't written yet #​11797. Requires a pacquet release that supports the flag — bump PACQUET_VERSION in the e2e tests once it ships.

v11.2.1

Compare Source

Patch Changes
  • Mark optional subdependency snapshots of config dependencies with optional: true in the env lockfile, matching how optional dependencies are recorded elsewhere in pnpm-lock.yaml. Previously, snapshots for the platform-specific subdeps pulled in via a config dep's optionalDependencies were written as empty objects, which was inconsistent with the rest of the lockfile and made it look like those non-host platform variants were required.
  • Fix pickRegistryForPackage returning the wrong registry for an unscoped npm: alias under a scoped local name. A manifest entry like "@&#8203;private/foo": "npm:lodash@^1" was routing the lodash fetch through registries["@&#8203;private"], even though lodash is unscoped and doesn't live on that registry. The npm-alias branch now returns the alias target's own scope (or null for an unscoped target, falling through to registries.default) instead of leaking into the local key's scope.
  • Don't print "Installing config dependencies..." when config dependencies are already installed and nothing needs to be fetched, re-linked, or removed.

v11.2.0

Compare Source

Minor Changes

  • Experimental: Adding @pnpm/pacquet (the Rust port of pnpm) to configDependencies in pnpm-workspace.yaml now delegates the materialization phase of pnpm install to the pacquet binary. pnpm still owns dependency resolution; pacquet only fetches and imports from the freshly-written lockfile. This is an opt-in preview of the Rust install engine #​11723.

    To configure pacquet in a project, run:

    pnpm add @&#8203;pnpm/pacquet --config

    You'll see changes in pnpm-workspace.yaml and pnpm-lock.yaml that should be committed. If you experience any issues with pacquet, please let us know by mentioning this in the GitHub issue you create.

  • configDependencies now resolve and install one level of optionalDependencies declared by the config dependency, with os/cpu/libc platform filtering applied at install time. This unlocks the esbuild/swc-style pattern where a package ships platform-specific binaries via optionalDependencies — a config dependency can now do the same and have the matching binary symlinked next to it in the global virtual store, so require('pkg-platform-arch') from inside the config dependency resolves correctly.

    The env lockfile records all platform variants regardless of host platform, so it remains portable across machines. Each entry in a config dependency's optionalDependencies must declare an exact version — ranges and tags are rejected to keep installs reproducible.

  • Implement the documented pnpm login --scope <scope> flag. The scope is normalized (a leading @ is added if missing; blank values are ignored) and an @<scope>:registry=<registry> mapping is written to the pnpm auth file alongside the auth token. Subsequent installs of @<scope>/* packages then route to the chosen registry. Previously pnpm login --scope foo errored with Unknown option: 'scope' despite the flag being listed in the online documentation #​11716.

  • pnpm outdated and pnpm update --interactive now report Node.js, Deno, and Bun runtimes installed as project dependencies (runtime: specifiers). Previously these were silently skipped.

Patch Changes

  • Fix cafile=<relative-path> in .npmrc being read from the wrong directory when pnpm is invoked from a different cwd (e.g. pnpm --dir <project> install from a CI wrapper or monorepo script). The path is now resolved against the directory of the .npmrc that declared it, not process.cwd(). Before this fix the CA file silently failed to load — the install proceeded without the configured CA and the user only saw TLS errors against a private registry, with no log line tying back to the wrongly resolved path #​11624.

  • Fix config.registry getting a trailing slash appended when registry is set in .npmrc and no registries.default is provided by pnpm-workspace.yaml. The sync from registries.default to config.registry introduced in #​11744 now only fires when the workspace manifest actually contributes a different default.

  • Fix global add/update to handle minimumReleaseAge policy violations instead of surfacing an internal resolver guardrail error.

  • Fix two crashes with injectWorkspacePackages: true when the lockfile has been pruned (e.g. by turbo prune --docker):

    • Cannot use 'in' operator to search for 'directory' in undefined: a peer-dependency-variant injected snapshot inherits its resolution from the base packages: entry; when a pruner drops that base entry the readers crash. convertToLockfileObject now reconstructs the directory resolution from the file: depPath at load time — a single normalization point, so every reader sees a fully-formed snapshot.
    • ERR_PNPM_ENOENT on node_modules/.bin/<tool>: after prepare/postinstall, runLifecycleHooksConcurrently re-imported each injected workspace package; the scanDir-into-filesMap workaround fed target-internal paths to the importer, which the makeEmptyDir fast path (#​11088) then wiped. Drop the workaround and pass keepModulesDir: true so the importer preserves the target's existing node_modules (bin links + transitive deps) and source files keep their hardlinks.

  • Fixed pnpm login and pnpm logout ignoring registries.default from pnpm-workspace.yaml #​10099.

  • Fix the minimumReleaseAge (publishedBy) maturity shortcut to be inclusive at the cutoff. Previously, abbreviated metadata whose modified field equalled the cutoff fell off the fast path and triggered a full-metadata re-fetch (or a MISSING_TIME error when full metadata wasn't permitted). Since modified is an upper bound on every version's publish time, modified == publishedBy already implies every version passes the per-version <= filter in filterPkgMetadataByPublishDate, so the shortcut now accepts the boundary case directly. Strictly > (was >=) at the rejection branch.

  • Honor publishConfig.access when publishing packages.

npm/node-semver (semver)

v7.8.1

Compare Source

Bug Fixes
tinylibs/tinyexec (tinyexec)

v1.2.2

Compare Source

What's Changed

Full Changelog: tinylibs/tinyexec@1.2.1...1.2.2

v1.2.1

Compare Source

What's Changed

Full Changelog: tinylibs/tinyexec@1.2.0...1.2.1

v1.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: tinylibs/tinyexec@1.1.2...1.2.0

kulshekhar/ts-jest (ts-jest)

v29.4.11

Compare Source

Bug Fixes
  • preserve Bundler on the CJS path under TypeScript >= 6 (3941818), closes #​4198

v29.4.10

Compare Source

Bug Fixes
  • pass resolutionMode to ts.resolveModuleName for hybrid module support (b557a85)
  • rebuild Program when consecutive compiles need different module kinds (a82a2b3), closes #​4774
  • respect tsconfig moduleResolution instead of forcing Node10 (1bffffc)
  • transformer: transpile mjs files from node_modules for CJS mode (96d025d)
  • transformer: use a consistent comparator in hoist-jest sortStatements (8a8fd2f)
vitejs/vite (vite)

v8.0.14

Compare Source

Features
Bug Fixes
Miscellaneous Chores
  • deps: update rolldown-related dependencies (#​22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)
Code Refactoring
Tests
vuejs/language-tools (vue-tsc)

v3.3.1

Compare Source

language-core
language-service
  • refactor: replace scanner-based missing props hints detection with AST traversal - Thanks to @​KazariEX!
typescript-plugin
  • fix: get component prop details from symbols - Thanks to @​KazariEX!
  • fix: skip unchecked JS identifiers in component props (#​6055) - Thanks to @​KazariEX!
vscode
  • fix: resolve typescript plugin path from resolved server path (#​6058) - Thanks to @​KazariEX!

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from danielroe as a code owner May 25, 2026 02:55
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​nuxtjs/​i18n@​10.4.0971009298100
Added@​nuxt/​ui@​4.8.09710010099100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented May 25, 2026 •
edited
Loading

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/test-utils@1710

npm i https://pkg.pr.new/vitest-environment-nuxt@1710

commit: d891559

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from b9d3b5f to 4faf99b Compare May 25, 2026 05:32
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 4faf99b to d891559 Compare May 25, 2026 11:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe Awaiting requested review from danielroe danielroe is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants