Skip to content

chore(deps): update all non-major dependencies#1326

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#1326
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 25, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@clack/prompts (source) ^1.4.0 → ^1.5.0 age confidence dependencies minor 1.5.1
@clack/prompts (source) ^1.4.0 → ^1.5.0 age confidence devDependencies minor 1.5.1
@codspeed/vitest-plugin (source) ^5.4.0 → ^5.5.0 age confidence devDependencies minor
@nuxt/nitro-server (source) ^4.4.6 → ^4.4.7 age confidence devDependencies patch
@vitest/coverage-v8 (source) ^4.1.6 → ^4.1.8 age confidence devDependencies patch
CodSpeedHQ/action v4.15.1 → v4.17.0 age confidence action minor
actions/checkout v6.0.2 → v6.0.3 age confidence action patch
eslint (source) ^10.4.0 → ^10.4.1 age confidence devDependencies patch
eslint-plugin-jsdoc 63.0.0 → 63.0.1 age confidence pnpm-workspace.overrides patch
fuse.js (source) ^7.3.0 → ^7.4.1 age confidence dependencies minor
fuse.js (source) ^7.3.0 → ^7.4.1 age confidence devDependencies minor
httpxy 0.5.1 → 0.5.3 age confidence pnpm-workspace.overrides patch
knip (source) ^6.14.1 → ^6.15.0 age confidence devDependencies minor
pkg-pr-new (source) ^0.0.74 → ^0.0.75 age confidence devDependencies patch
pnpm (source) 11.1.3 → 11.5.1 age confidence packageManager minor
rollup (source) ^4.60.4 → ^4.61.0 age confidence devDependencies minor
semver ^7.8.0 → ^7.8.1 age confidence dependencies patch
semver ^7.8.0 → ^7.8.1 age confidence devDependencies patch
srvx (source) ^0.11.15 → ^0.11.16 age confidence dependencies patch
srvx (source) ^0.11.15 → ^0.11.16 age confidence devDependencies patch
tinyclip ^0.1.12 → ^0.1.13 age confidence dependencies patch 0.1.14
tinyclip ^0.1.12 → ^0.1.13 age confidence devDependencies patch 0.1.14
tinyexec ^1.1.2 → ^1.2.4 age confidence dependencies minor
tinyexec ^1.1.2 → ^1.2.4 age confidence devDependencies minor
tsdown (source) ^0.22.0 → ^0.22.1 age confidence devDependencies patch
vitest (source) ^4.1.6 → ^4.1.8 age confidence devDependencies patch
vue (source) ^3.5.34 → ^3.5.35 age confidence devDependencies patch
vue-router (source) ^5.0.7 → ^5.1.0 age confidence dependencies minor
vue-router (source) ^5.0.7 → ^5.1.0 age confidence devDependencies minor
vue-tsc (source) ^3.3.0 → ^3.3.3 age confidence devDependencies patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

bombshell-dev/clack (@​clack/prompts)

v1.5.0

Compare Source

Minor Changes

  • #​543 83428ac Thanks @​florian-lefebvre! - Adds support for Standard Schema validation

    Prompts accept an optional validate() function to validate user input. While a function provides more flexibility and customization over your validation, it can be a bit verbose. To help solve this, there are libraries that provide schema-based validation to make shorthand and type-strict validation substantially easier.

    Libraries following the Standard Schema specification are now natively supported. For example, using Arktype:

    import { text } from '@​clack/prompts';
import { type } from 'arktype';

const name = await text({
	message: 'Enter your email',
+	validate: type('string.email').describe('Invalid email'),
});
Patch Changes
CodSpeedHQ/codspeed-node (@​codspeed/vitest-plugin)

v5.5.0

Compare Source

Highlights

We are introducing @codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.

Here's an example usage, but head to the docs for more information

import { bench, type Page } from "@​codspeed/playwright-plugin";
import electronExecutable from "electron";
import path from "node:path";
import { fileURLToPath } from "node:url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const appRoot = path.resolve(__dirname, "..");

async function waitUntilSettled(page: Page): Promise<void> {
  await page.waitForFunction(() => {
    const main = document.getElementById("main");
    return !!main && !main.classList.contains("loading");
  });
}

await bench(
  "inbox-search-archive-threads",
  async ({ page }) => {
    await page.fill("#search", "update");
    await waitUntilSettled(page);

    await page.click("#select-visible-btn");
    await page.click("#archive-btn");
    await waitUntilSettled(page);

    await page.click('#sidebar nav button[data-view="threads"]');
    await waitUntilSettled(page);
  },
  {
    target: {
      kind: "electron",
      appPath: path.join(appRoot, "out/main/index.js"),
      cwd: appRoot,
    },
    beforeRound: async ({ page }) => {
      page.setDefaultTimeout(180_000);
      await page.waitForSelector("#main");
      await waitUntilSettled(page);
    },
  },
);

Note: this plugin is only compatible with the walltime instrument.

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0

nuxt/nuxt (@​nuxt/nitro-server)

v4.4.7

Compare Source

4.4.7 is the a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes
  • nitro: Assign noSSR before deciding payload extraction (#​35108)
  • vite: Avoid filtering out dirs with shared prefix from allowDirs (#​35112)
  • nuxt: Use resolve from pathe for buildCache path boundary check (#​35111)
  • nuxt: Prevent sibling-directory traversal in test component wrapper (#​35110)
  • nitro: Pass event data to isValid in dev clipboard-copy listener (#​35109)
  • nuxt: Validate protocols in reloadNuxtApp path before reload (#​35115)
  • vite: Prefix public asset virtuals with null byte (9e303b438)
  • nuxt: Re-run getCachedData after initial fetch (#​35122)
  • nuxt: Propagate useFetch/useAsyncData factory types (#​35133)
  • vite: Close vite dev server on nuxt close (a10a68abc)
  • kit,nuxt: Handle cancelling prompts to install packages (e84813229)
  • kit: Avoid excluding node-context files in legacy tsconfig (#​35152)
  • nuxt: Handle missing payload in chunkError listener (#​35155)
  • nuxt: Await in-lifght template generation when closing nuxt (#​35181)
  • nuxt: Clarify page and layout usage warnings (#​35184)
  • webpack: Surface compilation errors when stats.toString is empty (073b07851)
  • nuxt: Reject prototype-chain keys in the island registry (#​35205)
  • nuxt: Apply isScriptProtocol guard to navigateTo open option (#​35206)
  • nuxt: Prevent server-only page island from recursing via <NuxtPage> (#​35198)
  • rspack,webpack: Require loopback host when missing same-origin signals (#​35200)
  • nitro: Gate chrome devtools workspace endpoint to local requests (#​35201)
  • nuxt: Escape props in <NuxtClientFallback> ssr output (#​35199)
  • kit: Improve TS extension stripping/substitutions (#​35233)
  • nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#​35235)
  • nuxt: Escape <NoScript> slot content (4b054e9d9)
  • nuxt: Match route rules case-insensitively to mirror vue-router (07e39cd6f)
  • nuxt: Reject script-capable protocols in <NuxtLink> href (0103ce06f)
  • nuxt: Block path-normalization open redirect in navigateTo (2cce6fb02)
  • nuxt: Reject cross-origin paths in reloadNuxtApp (e447a793c)
  • vite: Bind vite-node IPC to a permissioned filesystem socket (1f9f4767a)
💅 Refactors
  • kit,nuxt,vite: Use es2023 array methods (#​34980)
  • nuxt: Replace runInNewContext with AST walker (d72a89ef4)
📖 Documentation
  • Document vite client and server options (#​35090)
  • Add dedicated module dependencies page (#​35171)
  • Add nodeTsConfig and sharedTsConfig options (#​35231)
  • Edit for clarity and grammar (#​35214)
🏡 Chore
✅ Tests
  • Update test for js payload rendering (bdcb81536)
  • Cover add regression test for hmr in sibling local layers (#​35125)
  • Improve reliability of hmr test (1d709b3cc)
🤖 CI
  • Always run all tests for 4.x/3.x (0dc4665cf)
  • Migrate from tibdex (ded29dc0f)
  • Add zizmor github actions check (#​35089)
  • Update to agentscan v1.8.0 (#​35120)
  • Automatically close PRs from automated accounts (#​35161)
  • Disable provenance-change enforcement in dependency-review (a2cf43e68)
❤️ Contributors
vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
CodSpeedHQ/action (CodSpeedHQ/action)

v4.17.0

Compare Source

Release Notes

🚀 Features
🐛 Bug Fixes
💼 Other
🏗️ Refactor
🧪 Testing
⚙️ Internals

Install codspeed-runner 4.17.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.17.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.17.0

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.15.1...v4.17.0

actions/checkout (actions/checkout)

v6.0.3

Compare Source

eslint/eslint (eslint)

v10.4.1

Compare Source

Bug Fixes

  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#​20930) (Francesco Trotta)
  • d4ce898 fix: propagate failures from delegated commands (#​20917) (Minh Vu)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#​20916) (kuldeep kumar)
  • c5bc78b fix: false positive for reference in finally block (#​20655) (Tanuj Kanti)
  • 27538c0 fix: add missing CodePath and CodePathSegment types (#​20853) (Pixel998)

Documentation

  • 61b0add docs: remove deprecated rule from related rules of max-params (#​20921) (Tanuj Kanti)
  • 305d5b9 docs: remove deprecated rules from related rules section (#​20911) (Tanuj Kanti)
  • 49b0202 docs: fix display: none of ad (#​20901) (Tanuj Kanti)
  • 9067f94 docs: switch build to Node.js 24 (#​20893) (Milos Djermanovic)
  • c91b041 docs: Update README (GitHub Actions Bot)
  • e349265 docs: clarify semver strings in rule deprecation objects (#​20885) (Milos Djermanovic)

Chores

gajus/eslint-plugin-jsdoc (eslint-plugin-jsdoc)

v63.0.1

Compare Source

Bug Fixes
  • empty-tags: preserve start and ending delimiters to avoid erros with single-line tags; fixes #​1697 (938a1f0)
krisk/Fuse (fuse.js)

v7.4.1

Compare Source

v7.4.0

Compare Source

unjs/httpxy (httpxy)

v0.5.3

Compare Source

compare changes

🩹 Fixes
  • utils: Revert trailing slash preservation in joinURL (3b5f8b0)
🏡 Chore
❤️ Contributors

v0.5.2

Compare Source

compare changes

🚀 Enhancements
  • Derive host from hostname for plain object targets and bracket IPv6 literals (#​136)
  • Forward target URL as the 4th argument in error events (#​135)
🩹 Fixes
  • Preserve trailing slash when proxying root path to a sub-path target (#​137)
🏡 Chore
❤️ Contributors
webpro-nl/knip (knip)

v6.15.0: Release 6.15.0

Compare Source

v6.14.2: Release 6.14.2

Compare Source

stackblitz-labs/pkg.pr.new (pkg-pr-new)

v0.0.75

Compare Source

pnpm/pnpm (pnpm)

v11.5.1

Compare Source

Patch Changes
  • Improve pnpm audit performance by pruning non-vulnerable lockfile subtrees and stopping path enumeration once vulnerable findings reach the path cap.
  • Avoid crashing when the workspace state cache is partially written or malformed.
  • Set npm_config_user_agent for root lifecycle scripts during headless installs.
  • Preserve the integrity field of a remote (non-registry) tarball dependency when its lockfile entry is rebuilt. Re-resolving such a dependency without re-fetching it (for example via pnpm update, or when another dependency changes) produced a resolution with no integrity — URL/tarball resolvers only learn the integrity after the tarball is downloaded — so the previously recorded integrity was dropped, making later installs fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY #​12067.
  • Normalize a string repository field into the { type, url } object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a string repository with a 500 Internal Server Error during pnpm publish #​12099.
  • Preserve compatible optio

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from danielroe as a code owner May 25, 2026 03:00
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedpkg-pr-new@​0.0.751001007097100
Added@​vitest/​coverage-v8@​4.1.8991007998100
Addedfuse.js@​7.4.110010010094100
Added@​nuxt/​nitro-server@​4.4.79810010095100
Addedknip@​6.15.0991009596100
Added@​codspeed/​vitest-plugin@​5.5.0971009896100
Added@​nuxt/​kit@​4.4.79910010096100
Addedeslint@​10.4.19810010096100
Added@​clack/​prompts@​1.5.010010010097100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented May 25, 2026 •
edited
Loading

Merging this PR will not alter performance

✅ 2 untouched benchmarks

Comparing renovate/all-minor-patch (8cbbc92) with main (9dc5bcc)

Open in CodSpeed

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented May 25, 2026 •
edited
Loading

  • nuxt-cli-playground

    npm i https://pkg.pr.new/create-nuxt@1326

    npm i https://pkg.pr.new/nuxi@1326

    npm i https://pkg.pr.new/@nuxt/cli@1326

commit: 8cbbc92

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from e7c72b6 to 72a27d5 Compare May 31, 2026 22:47
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 5928acd to 4bc35d3 Compare June 3, 2026 12:58
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 4bc35d3 to 8cbbc92 Compare June 3, 2026 21:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe Awaiting requested review from danielroe danielroe is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants