chore(deps): update all non-major dependencies#58
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
7d3d77e to
69b15e9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^3.0.116→^3.0.120^3.0.185→^3.0.191^1.2.108→^1.2.109^1.2.82→^1.2.83^4.7.1→^4.8.0^4.0.2→^4.1.0^3.23.4→^3.23.6^3.23.4→^3.23.6^3.23.4→^3.23.6^3.23.4→^3.23.6^3.23.4→^3.23.6^3.23.4→^3.23.6^3.23.4→^3.23.6^3.23.4→^3.23.6^25.9.0→^25.9.1^6.0.185→^6.0.19111.1.3→11.3.0^4.0.2→^4.1.0^3.3.0→^3.3.14.2.4→4.2.5Release Notes
vercel/ai (@ai-sdk/gateway)
v3.0.120Compare Source
Patch Changes
27a1b22: AddserviceTier: 'flex' | 'priority'toGatewayProviderOptions.v3.0.119Compare Source
Patch Changes
33b10a2: Addqwen3.7-maxmodel ID to Alibaba and AI Gateway.f6e4146: Backport: chore(provider/gateway): update gateway model settings filesv3.0.118Compare Source
Patch Changes
6f4bb06: Backport: chore(provider/gateway): update gateway model settings filesnuxt/ui (@nuxt/ui)
v4.8.0Compare Source
⚠ BREAKING CHANGES
autocompleteprop tomodeto free up HTML attribute (#6474)Features
colorprop (#6405) (6f2396f)colorprop (#6406) (955dac1)bodyslot and improve actions alignment (#6460) (48685b6)colorprop andheaderslot (#6407) (c6ce8ca)submitOnEnterprop to control Enter behavior (b597f90), closes #6177highlightprop for error ring styling (a0deee4)useSearchCollection(#6432) (a1bef8b)storageOptionsprop (8f0101b), closes #6170iconprop andleadingslot (e6ea707), closes #6119positionprop (#6415) (844660a)Bug Fixes
wrap-break-wordto content slot (#6476) (eb468e6)useTokenSearchis enabled (898fbce)theme.prefixto hardcoded utility classes (f51b1e8)ui.triggerprop to trigger elements (252b906), closes #6428e.codefor alt shortcuts to handle macOS key remapping (231f156), closes #6444disabledattribute to button variant (2890c83), closes #6420trailing: falseover defaulttrailingIcon(#6457) (65b47ce)autocompleteprop tomodeto free up HTML attribute (#6474) (2799fa6)@nuxtjs/mdcwhen usingcontentoption (89f7778)[#build](https://redirect.github.com/nuxt/ui/issues/build)/ui.cssfallback for tooling (083c2a9), closes #5504valueoptional (f317c7f)ClassValueleaves (cac3860)shikijs/shiki (@shikijs/langs)
v4.1.0Compare Source
🐞 Bug Fixes
tsModuletocreateTwoslasher- by @arthurfiorette in #1271 (be89a)View changes on GitHub
ueberdosis/tiptap (@tiptap/core)
v3.23.6Compare Source
Patch Changes
d168376: Fix deleteSelection to properly handle inline nodes withtext*content. The selection is now expanded to include the entire inline node boundaries when deleting, preventing incorrect collapse of inline text nodes.v3.23.5Compare Source
Patch Changes
835caf5: Fix $pos() returning correct node for non-text atom nodes instead of doc node95e138c: fix(nodeview): eliminate unnecessary re-renders, add opt-in position trackingNodeViews no longer re-render when decorations or position change without
content changes. Added
trackNodeViewPositionoption — when enabled, thecomponent re-renders on every position shift so calls to
getPos()staycurrent in render output. Removed the internal
nodeViewPositionRegistry.Added shallow prop comparison in
ReactRenderer.updateProps().ueberdosis/tiptap (@tiptap/extension-details)
v3.23.6Compare Source
Patch Changes
d168376]v3.23.5Compare Source
Patch Changes
835caf5]95e138c]ueberdosis/tiptap (@tiptap/extension-emoji)
v3.23.6Compare Source
Patch Changes
d168376]v3.23.5Compare Source
Patch Changes
835caf5]95e138c]ueberdosis/tiptap (@tiptap/extension-list)
v3.23.6Compare Source
Patch Changes
d168376]v3.23.5Compare Source
Patch Changes
835caf5]95e138c]ueberdosis/tiptap (@tiptap/extension-mention)
v3.23.6Compare Source
Patch Changes
d168376]v3.23.5Compare Source
Patch Changes
835caf5]95e138c]ueberdosis/tiptap (@tiptap/extension-table)
v3.23.6Compare Source
Patch Changes
d168376]v3.23.5Compare Source
Patch Changes
835caf5]95e138c]ueberdosis/tiptap (@tiptap/pm)
v3.23.6Compare Source
v3.23.5Compare Source
ueberdosis/tiptap (@tiptap/vue-3)
v3.23.6Compare Source
Patch Changes
d168376]v3.23.5Compare Source
Patch Changes
95e138c: fix(nodeview): eliminate unnecessary re-renders, add opt-in position trackingNodeViews no longer re-render when decorations or position change without
content changes. Added
trackNodeViewPositionoption — when enabled, thecomponent re-renders on every position shift so calls to
getPos()staycurrent in render output. Removed the internal
nodeViewPositionRegistry.Added shallow prop comparison in
ReactRenderer.updateProps().Updated dependencies [
835caf5]Updated dependencies [
95e138c]pnpm/pnpm (pnpm)
v11.3.0Compare Source
Minor Changes
Added
pnpm stagewithpublish,list,view,approve,reject, anddownloadsubcommands for npm staged publishing.Added a new setting
trustLockfile. Whentrue,pnpm installskips the supply-chain verification pass that re-appliesminimumReleaseAge/trustPolicy='no-downgrade'to every entry in the loaded lockfile. The install treats the lockfile as already-trusted — useful for closed-source projects where every commit comes from a trusted author. Defaults tofalse; verification stays on by default. Set inpnpm-workspace.yaml.Also cut the memory footprint of the verification pass itself: the per-(registry, name) trust-meta cache previously retained the full packument — dependency graphs, scripts, README, and per-version manifests — for the entire install. On large workspaces (
~4klockfile entries withminimumReleaseAge+trustPolicy: no-downgradeenabled) this could OOM CI runners with a 2GB heap cap. The cache now stores only the fields the trust check actually reads (time, per-version_npmUser.trustedPublisher,dist.attestations.provenance). The abbreviated-metadata cache is similarly projected to just the package-levelmodifiedfield and the set of currently-listed version names. Fixes #11860.Implemented
pnpm pkgcommand natively, followingnpm pkgstandards.Implemented
pnpm repocommand natively, followingnpm repostandards.Implemented
pnpm set-script(aliasss) natively. Adds or updates an entry in thescriptsfield of the project manifest, supportingpackage.json,package.json5, andpackage.yamlformats.Add a
skip-manifest-obfuscationoption forpnpm packandpnpm publish. When enabled, the originalpackageManagerfield and publish lifecycle scripts are kept in the packed/published manifest instead of being stripped. The pnpm-specificpnpmfield continues to be omitted.Patch Changes
pnpm dlxfailing withERR_PNPM_NO_IMPORTER_MANIFEST_FOUNDwhen the installed package's CAS slot is missing itspackage.json. Observed in the wild forpnpm dlx node@runtime:<version>when the GVS slot was populated without the synthesized manifest runtime archives need (they don't ship apackage.jsonof their own, so the synthesized one is the only way it gets there; an existing slot from an earlier code path that skipped the synthesis stays incomplete). The bin link itself is wired up from the resolution and remains valid, sodlxnow falls back to the scopeless package name when the slot's manifest is unreadable — for single-bin packages (the dlx common case, including everyruntime:spec) this matches whatmanifest.binwould have named. Multi-bin packages already require--package=<spec> <bin>to disambiguate and don't enter this code path.pnpm dedupeandpnpm installwhen a dependency graph contains packages with transitive peer dependencies on each other (e.g.@aws-sdk/client-stsand@aws-sdk/client-sso-oidc) andauto-install-peersis enabled. The lockfile no longer flips between two equally-valid forms across consecutive runs. The root cause was thatresolveDependenciespushed onto itspkgAddresses/postponedResolutionsQueuearrays from insidePromise.all-spawned callbacks, so completion-order timing leaked into the array order and downstream cyclic-peer suffix assignment. Fixes #8155.pnpm add <github-shorthand>(and any other wanted-dependency whose alias can't be parsed from the user-supplied spec, e.g. tarball URLs orpnpm/test-git-fetch#sha) was silently dropped from the manifest update and frompendingBuilds. The alias-keyed lookup added in that PR couldn't find awantedDependencywhosealiaswasundefinedat parse time but resolved to a package name only after fetching, so the entry never made it intospecsToUpsert. Restored the original index-based pairing betweendirectDependenciesandwantedDependencies; the catalog-protocol preservation that PR was originally fixing is unaffected because it's driven byrdd.catalogLookup.userSpecifiedBareSpecifier, not by the lookup. Fixes the threerebuilds dependencies/rebuilds specific dependencies/rebuild with pending optionfailures inbuilding/commands/test/build/index.ts.pnpm add --configleaving orphan entries inpnpm-lock.env.yaml(the optional subdependencies of the previously resolved version of the updated config dependency).v11.2.2Compare Source
Patch Changes
configDependencies, the user's CLI flags passed topnpm install(e.g.--no-runtime,--prod,--dev,--no-optional,--node-linker,--cpu/--os/--libc,--offline,--prefer-offline) are now forwarded to pacquet'sinstallsubcommand verbatim. Previously pacquet was invoked with a fixed argument list, so flags like--no-runtimewere silently dropped. Flag forwarding is gated on the command beinginstall/i;add,update, anddedupestill don't forward (their flag surface doesn't line up with pacquet'sinstall).pnpm up(andpnpm add/pnpm remove) failing withpacquet_package_manager::outdated_lockfilewhen pacquet is declared inconfigDependencies. pnpm now passes--ignore-manifest-checkto pacquet so its--frozen-lockfilecheck doesn't fire against the (pre-mutation)package.jsonpnpm hasn't written yet #11797. Requires a pacquet release that supports the flag — bumpPACQUET_VERSIONin the e2e tests once it ships.v11.2.1Compare Source
Patch Changes
optional: truein the env lockfile, matching how optional dependencies are recorded elsewhere inpnpm-lock.yaml. Previously, snapshots for the platform-specific subdeps pulled in via a config dep'soptionalDependencieswere written as empty objects, which was inconsistent with the rest of the lockfile and made it look like those non-host platform variants were required.pickRegistryForPackagereturning the wrong registry for an unscopednpm:alias under a scoped local name. A manifest entry like"@​private/foo": "npm:lodash@^1"was routing thelodashfetch throughregistries["@​private"], even thoughlodashis unscoped and doesn't live on that registry. The npm-alias branch now returns the alias target's own scope (ornullfor an unscoped target, falling through toregistries.default) instead of leaking into the local key's scope.v11.2.0Compare Source
Minor Changes
Experimental: Adding
@pnpm/pacquet(the Rust port of pnpm) toconfigDependenciesinpnpm-workspace.yamlnow delegates the materialization phase ofpnpm installto the pacquet binary. pnpm still owns dependency resolution; pacquet only fetches and imports from the freshly-written lockfile. This is an opt-in preview of the Rust install engine #11723.To configure pacquet in a project, run:
You'll see changes in
pnpm-workspace.yamlandpnpm-lock.yamlthat should be committed. If you experience any issues with pacquet, please let us know by mentioning this in the GitHub issue you create.configDependenciesnow resolve and install one level ofoptionalDependenciesdeclared by the config dependency, withos/cpu/libcplatform filtering applied at install time. This unlocks the esbuild/swc-style pattern where a package ships platform-specific binaries viaoptionalDependencies— a config dependency can now do the same and have the matching binary symlinked next to it in the global virtual store, sorequire('pkg-platform-arch')from inside the config dependency resolves correctly.The env lockfile records all platform variants regardless of host platform, so it remains portable across machines. Each entry in a config dependency's
optionalDependenciesmust declare an exact version — ranges and tags are rejected to keep installs reproducible.Implement the documented
pnpm login --scope <scope>flag. The scope is normalized (a leading@is added if missing; blank values are ignored) and an@<scope>:registry=<registry>mapping is written to the pnpm auth file alongside the auth token. Subsequent installs of@<scope>/*packages then route to the chosen registry. Previouslypnpm login --scope fooerrored withUnknown option: 'scope'despite the flag being listed in the online documentation #11716.pnpm outdatedandpnpm update --interactivenow report Node.js, Deno, and Bun runtimes installed as project dependencies (runtime:specifiers). Previously these were silently skipped.Patch Changes
Fix
cafile=<relative-path>in.npmrcbeing read from the wrong directory when pnpm is invoked from a different cwd (e.g.pnpm --dir <project> installfrom a CI wrapper or monorepo script). The path is now resolved against the directory of the.npmrcthat declared it, notprocess.cwd(). Before this fix the CA file silently failed to load — the install proceeded without the configured CA and the user only saw TLS errors against a private registry, with no log line tying back to the wrongly resolved path #11624.Fix
config.registrygetting a trailing slash appended whenregistryis set in.npmrcand noregistries.defaultis provided bypnpm-workspace.yaml. The sync fromregistries.defaulttoconfig.registryintroduced in #11744 now only fires when the workspace manifest actually contributes a different default.Fix global add/update to handle minimumReleaseAge policy violations instead of surfacing an internal resolver guardrail error.
Fix two crashes with
injectWorkspacePackages: truewhen the lockfile has been pruned (e.g. byturbo prune --docker):Cannot use 'in' operator to search for 'directory' in undefined: a peer-dependency-variant injected snapshot inherits itsresolutionfrom the basepackages:entry; when a pruner drops that base entry the readers crash.convertToLockfileObjectnow reconstructs the directory resolution from thefile:depPath at load time — a single normalization point, so every reader sees a fully-formed snapshot.ERR_PNPM_ENOENTonnode_modules/.bin/<tool>: afterprepare/postinstall,runLifecycleHooksConcurrentlyre-imported each injected workspace package; thescanDir-into-filesMapworkaround fed target-internal paths to the importer, which themakeEmptyDirfast path (#11088) then wiped. Drop the workaround and passkeepModulesDir: trueso the importer preserves the target's existingnode_modules(bin links + transitive deps) and source files keep their hardlinks.Fixed
pnpm loginandpnpm logoutignoringregistries.defaultfrompnpm-workspace.yaml#10099.Fix the
minimumReleaseAge(publishedBy) maturity shortcut to be inclusive at the cutoff. Previously, abbreviated metadata whosemodifiedfield equalled the cutoff fell off the fast path and triggered a full-metadata re-fetch (or aMISSING_TIMEerror when full metadata wasn't permitted). Sincemodifiedis an upper bound on every version's publish time,modified == publishedByalready implies every version passes the per-version<=filter infilterPkgMetadataByPublishDate, so the shortcut now accepts the boundary case directly. Strictly>(was>=) at the rejection branch.Honor
publishConfig.accesswhen publishing packages.vuejs/language-tools (vue-tsc)
v3.3.1Compare Source
language-core
language-service
typescript-plugin
vscode
vercel/workflow (workflow)
v4.2.5Compare Source
@workflow/core@4.2.5
a434184@pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.8407c1e@pranaygp - Report corrupted event logs with a distinctCorruptedEventLogErrortype andCORRUPTED_EVENT_LOGrun error code.7487430@VaguelySerious - Fix spurious "Event cursor missing after initial load" warningc347509@pranaygp - Validate step, wait, and hook lifecycle events against replay ownership metadata.ca5f355@pranaygp - Record fatal world response contract failures as non-retryable workflow errors.16f2c23@pranaygp - Fix local workflow port detection, make generated health endpoints respond to HEAD requests, materialize manual webhook response bodies before returning them, wait for step return stream serialization before completing the step, bound Vercel stream and health-check operations so stuck writes or queue sends retry or time out instead of hanging, and stabilize remote Vercel e2e checks around CLI inspection, sleep timing, and hook registration/disposal.6aabd6f@TooTallNate - Preserve thethisbinding of bound step proxies across workflow serialization, so passinguseStep(...).bind(thisArg)as a step argument no longer loses the receiver.@workflow/world@4.1.2
a434184@pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.8407c1e@pranaygp - Report corrupted event logs with a distinctCorruptedEventLogErrortype andCORRUPTED_EVENT_LOGrun error code.15e44b3@ziyak97 - Fix compatibility with Zod 4.4.x inWorkflowRunSchemaby markingoutput,error, andcompletedAtas.optional()on non-final / cancelled / completed / failed run states.c347509@pranaygp - Validate step, wait, and hook lifecycle events against replay ownership metadata.@workflow/world-local@4.1.2
a434184@pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.76352f0@pranaygp - Improve the local queue error message when a Next.js proxy intercepts workflow routes.e428cdb@VaguelySerious - Fix local-world recovery isolation in Vitest and support custom test directories5f50bbc@TooTallNate - Fix path traversal via request-supplied IDs in theworld-localstorage backend.@workflow/world-postgres@4.1.2
a434184@pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.096adbf@pranaygp - Fix race inevents.create()where concurrentstep_created/hook_created/wait_createdwrites with the samecorrelationIdwould persist duplicate event rows. Adds a unique partial index and surfaces the violation asEntityConflictError.be506cc@VaguelySerious -workflow-postgres-setupnow also bootstraps thegraphile_workerschema, fixing potential race on setup when starting the app and a test runner at the same time@workflow/world-vercel@4.2.0
677867b@VaguelySerious - Switch the workflow-server Deployment Protection bypass to OIDC Trusted Sources. TheVERCEL_WORKFLOW_SERVER_PROTECTION_BYPASSenv var is no longer used; thex-vercel-trusted-oidc-idp-tokenheader is now sourced fromgetVercelOidcToken().a434184@pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.a350e8d@pranaygp - Release failed VQS workflow handler messages on the configured retry cadence.ca5f355@pranaygp - Record fatal world response contract failures as non-retryable workflow errors.16f2c23@pranaygp - Fix local workflow port detection, make generated health endpoints respond to HEAD requests, materialize manual webhook response bodies before returning them, wait for step return stream serialization before completing the step, bound Vercel stream and health-check operations so stuck writes or queue sends retry or time out instead of hanging, and stabilize remote Vercel e2e checks around CLI inspection, sleep timing, and hook registration/disposal.ecfccc3@karthikscale3 - Update to new queue client version@workflow/web@4.1.6
73e0c4d@mitul-s - Show hook name on trace viewer + no toast on decrypt@workflow/web-shared@4.1.6
73e0c4d@mitul-s - Show hook name on trace viewer + no toast on decrypt88070cf@VaguelySerious - Fix the "Queued for" duration shown in the events list for retried steps. It now measures fromstep_createdto the firststep_startedinstead of the last, so the displayed value reflects actual queue time rather than queue time plus all retry waits.01cfe19@mitul-s - Fix old trace viewer layout to be in a row rather than column@workflow/swc-plugin@4.1.1
a9cc1d5@TooTallNate - Fix three bugs affecting nested step functions that get hoisted out of an enclosing function (workflows in any declaration form, plus regular factory-style functions returning objects with step methods): 1. Module-level imports referenced only by hoisted step bodies were stripped by dead-code elimination, causing aReferenceErrorat runtime. 2. The step ID generated for nested anonymous steps inside a non-exported workflow declared asconst foo = async () => {}orconst foo = async function() {}was not namespaced under the workflow name in step mode, so it did not match the ID looked up by the workflow-mode proxy and caused a runtime "step not found" failure. Steps insideasync function foo()workflows were already namespaced correctly; this brings the const-arrow and const-fn-expression forms into agreement. 3. The__internal_workflowsmanifest comment reported nested anonymous step IDs without the workflow-name prefix even though the runtime registration and proxy lookup used the prefixed form, so downstream tooling (e.g. builders consuming the manifest) saw the wrong step ID.6aabd6f@TooTallNate - Fixargumentsbeing incorrectly captured as a closure variable in nestedfunction-form step bodies, which previously produced invalid output.6aabd6f@TooTallNate - Supportthisreferences inside nested arrow"use step"functions. Requires the enclosing class to have custom serialization.@workflow/builders@4.0.6
478a9c7@pranaygp - Write colocated.gitignorefiles for public workflow manifests generated byWORKFLOW_PUBLIC_MANIFEST=1066c157@ijjk - Bundle transitive local step dependencies for direct Nitro dev loading while keeping ordinary package dependencies external unless thConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.