Skip to content

chore(deps): update all non-major dependencies - #167

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#167
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@types/node (source) ^25.9.6 → ^25.9.9 age confidence
@vitest/coverage-v8 (source) ^5 → ^5.0.5 age confidence
hookable-prev ^6.1.1 → ^6.1.2 age confidence
obuild ^0.4.40 → ^0.4.45 age confidence
oxfmt (source) >=0.67.0 → >=0.73.0 age confidence
oxlint (source) ^1.82.0 → ^1.88.0 age confidence
pnpm (source) 11.26.0 → 11.28.6 age confidence
typescript (source) ^6 → ^6.0.3 age confidence
vite (source) ^8.3.0 → ^8.3.4 age confidence
vitest (source) ^5 → ^5.0.5 age confidence

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v5.0.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v5.0.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v5.0.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
oxc-project/oxc (oxfmt)

v0.73.0

Compare Source

🚀 Features
  • a495e82 oxfmt: Support associations config to specify language over filepath (#​27437) (leaysgur)
  • 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#​27386) (leaysgur)
📚 Documentation

v0.72.0: oxfmt v0.72.0

Compare Source

💥 BREAKING CHANGES
  • e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#​27256) (leaysgur)
🚀 Features
  • b538e3c formatter_css: Parse embedded CSS as a block's contents (#​27284) (leaysgur)
🐛 Bug Fixes
  • 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#​27334) (leaysgur)
  • 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#​27331) (leaysgur)
  • e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#​27326) (leaysgur)
  • df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#​27325) (leaysgur)
  • 7f65b75 formatter: Format assignment target property as assignment-like (#​27289) (leaysgur)
  • 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#​27288) (leaysgur)
  • 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#​27283) (leaysgur)
  • 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#​27278) (leaysgur)
  • dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#​27277) (leaysgur)
  • 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#​27275) (leaysgur)
  • fd4ddce formatter_json: Flatten block comment only array|object (#​27274) (leaysgur)
  • 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#​27241) (leaysgur)
  • 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#​27237) (Nicolas Le Cam)
  • c2de02b formatter: Decide embedded template layout from AST, not source shape (#​27218) (leaysgur)
  • c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#​27216) (leaysgur)
  • 36e14df formatter: Keep comments between callee and its opener on the callee side (#​27172) (leaysgur)
  • 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#​27130) (leaysgur)
  • e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#​27129) (leaysgur)
  • 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#​27128) (leaysgur)
⚡ Performance
  • 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#​27333) (leaysgur)
  • cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#​27211) (leaysgur)
  • 0aba566 oxfmt: Do not resolve root js config from nested context (#​27147) (leaysgur)
📚 Documentation
  • 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#​27327) (leaysgur)
  • 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#​27279) (leaysgur)
  • 66545bf formatter_markdown: Record setext heading wrap divergence (#​27221) (leaysgur)
  • af4b269 oxfmt: Document why format() API does not take cwd (#​27131) (leaysgur)

v0.71.0: oxfmt v0.71.0

Compare Source

🚀 Features
🐛 Bug Fixes
  • eeba1db formatter: Skip test-call layout when arguments have comments (#​27119) (leaysgur)
  • 1f7b8ad oxfmt: Allow repeated CLI calls in the same process (#​27051) (Liang)
  • 7bcb807 formatter_markdown: Keep blank line between HTML and nested list (#​27112) (leaysgur)
  • 10b10c5 formatter: Keep comments around = on their side and line (#​27041) (leaysgur)
  • 9aad365 formatter: Keep comments deferred before an assignment operator (#​26997) (waltu)
  • 8fbddb1 formatter/jsdoc: More alignment with original plugin (#​27039) (leaysgur)
  • 50be18e formatter: Keep trailing spaces on normal block comments (#​27037) (leaysgur)
  • 56d1880 formatter: Nestle adjacent block comments (#​27036) (leaysgur)
  • 3be5d94 formatter: Treat /*** comments as JSDoc (#​27035) (leaysgur)
  • cd45f71 formatter: Keep trailing double spaces on JSDoc lines (#​26861) (John Costa)
  • fd695f4 formatter_markdown: Fix more mismatches found in ecosystem-ci repos (#​27003) (leaysgur)
  • 4e77d59 formatter_markdown: Keep a math span after a kept line break from opening a block (#​27001) (leaysgur)
  • 584b8b0 formatter_markdown: Keep a shape line after a multi-line inline node or link title (#​27000) (leaysgur)
  • b939645 formatter_markdown: Keep a line break before an inline liquid tag under preserve (#​26998) (leaysgur)

v0.70.0: oxfmt v0.70.0

Compare Source

🚀 Features
  • 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#​26763) (leaysgur)

v0.69.0

Compare Source

oxc-project/oxc (oxlint)

v1.88.0

Compare Source

🚀 Features
  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#​27346) (Mikhail Baev)

v1.87.0: oxlint v1.87.0

Compare Source

🚀 Features
  • 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#​27292) (Mikhail Baev)
  • cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#​27245) (Mikhail Baev)
  • 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#​27181) (Mikhail Baev)
🐛 Bug Fixes
  • 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#​27302) (sama Pyb)
  • 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#​27306) (sama Pyb)
  • 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#​27304) (sama Pyb)
  • 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#​27207) (breken)
  • e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#​27206) (breken)
  • 3d61a59 parser: Validate TypeScript type member separators (#​27222) (camc314)
  • f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#​27150) (camc314)
  • 7d60ae3 linter/valid-title: Continue checks after allowed words (#​27146) (Cameron)
  • ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#​26925) (camc314)

v1.86.0

Compare Source

🚀 Features
  • 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#​27117) (Kuroda Kayn)
  • e05b155 linter: Add typescript/no-generated-empty-object-type (#​26958) (camc314)

v1.85.0: oxlint v1.85.0

Compare Source

🚀 Features
  • 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#​26763) (leaysgur)

v1.84.0

Compare Source

pnpm/pnpm (pnpm)

v11.28.6: pnpm 11.28.6

Compare Source

This release stops pnpm publish from sending a CI identity token to a registry it was not issued for. It also fixes installs that dropped a dependency also declared as an optional peer, and accepts empty httpProxy and httpsProxy settings again.

Patch Changes
Security

  • pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

  • The warning about renamed package files with invalid names no longer prints control characters from those file names.

Configuration

  • pnpm again accepts httpProxy and httpsProxy set to null or written with no value in pnpm-workspace.yaml and the global config file, and treats them as unset. Since 11.28.5 these values failed with ERR_PNPM_INVALID_SETTING.

  • pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an .npmrc file, _auth, or pnpm-workspace.yaml stopped every command, pnpm --version included.

  • A key under a registry URL in the _auth setting that does not start with @ is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds an authToken object but lacks its @, such as org for @org, is still an error.

Resolving dependencies

  • pnpm no longer drops a dependency that a package also declares as an optional peer dependency, for example ajv of ajv-formats. Since 11.28.0, in some dependency graphs the package got the dependency neither as a dependency nor as a peer, and failed to import it #​16901.

  • pnpm install no longer fails with ERR_PNPM_NO_MATCHING_VERSION after a change to overrides when the lockfile resolves an optional peer dependency to an npm alias of another package #​16654.

  • pnpm install and pnpm dedupe now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. Previously they installed the registry package with the same name and version #​16706.

  • Removal overrides such as "debug>supports-color": "-" now also apply to an optional peer that a package declares only in peerDependenciesMeta #​16681.

  • pnpm dedupe now preserves a hoisted workspace package when another package uses a separately installed peer with the same name #​16935.

  • pnpm install and pnpm add --config now apply minimumReleaseAge when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean pnpm install --frozen-lockfile accepts the lockfile #​16660.

  • pnpm install --fix-lockfile no longer removes the deprecated and hasBin fields from lockfile entries #​6600.

Workspaces and catalogs

  • A filtered install, such as pnpm install --filter <pkg>, now keeps the pnpm-lock.yaml entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #​16931.

  • catalogPrune no longer removes catalog entries that pnpm-lock.yaml still records for workspace projects missing from disk. This affected pnpm remove and installs that leave the lockfile unchanged, such as frozen installs. Before, a following frozen install failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH #​16679.

  • Sped up workspace discovery with subtree exclusions such as !generated/**.

Linking node_modules

  • pnpm install no longer fails on Windows with EPERM on rmdir node_modules/@scope when several workspace packages under one scope are hoisted, for example with nodeLinker: hoisted #​16690.

  • pnpm install hardlinks files from a group-writable or world-writable store again. Before this fix, pnpm copied every file from such a store into node_modules #​16677.

  • With enableGlobalVirtualStore, an install that updates node_modules now restores the dependency links of a package in the global virtual store that an interrupted install left without them. Before, such an install kept the incomplete package if the project's node_modules already recorded it #​16642.

  • Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

  • An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #​16929.

Injected workspace packages

  • With sharedWorkspaceLockfile: false, an injected workspace package installed in the same run as its dependent now holds only the files its files field selects. The copy used to also hold other files of the project, such as tsconfig.json #​16683.

  • A script listed in syncInjectedDepsAfterScripts no longer fails when it rewrites package.json while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest.

  • Sped up frozen installs of unchanged injected workspace packages that use hardlinks.

Deploying
  • pnpm deploy without injectWorkspacePackages now binds a peer dependency of a linked workspace package to the version its parent provides, as an injected in

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 1am and before 5am"
  • Automerge
    • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 45e5a6a9-0dbd-4410-8aa7-eec9a832e63d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from cc18e3d to ed5532e Compare September 24, 2026 20:55
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 7ba45ff to b48eacc Compare October 4, 2026 12:24
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 8b44255 to baa3eb5 Compare October 11, 2026 20:26
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from be26e74 to 492e1db Compare October 18, 2026 14:29
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 492e1db to 1995f41 Compare October 18, 2026 18:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants