Repository navigation
chore(deps): update all non-major dependencies - #251
Merged
Merged
Conversation
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #251 +/- ##
=======================================
Coverage 87.53% 87.53%
=======================================
Files 18 18
Lines 409 409
Branches 88 89 +1
=======================================
Hits 358 358
Misses 51 51 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 8, 2026 22:13
cd54ac3 to
d0ee65e
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
October 11, 2026 00:40
3e1e354 to
fcfd81a
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 11, 2026 13:03
fcfd81a to
de4f058
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
23.2.1→23.3.023.2.1→23.3.023.2.1→23.3.023.2.1→23.3.026.6.4→26.6.57.3.6→7.3.823.2.1→23.3.012.10.1→12.11.23.9.9→3.9.108.3.3→8.3.4Release Notes
nrwl/nx (@nx/eslint)
v23.3.0Compare Source
23.3.0 (2026-10-07)
🚀 Features
🩹 Fixes
❤️ Thank You
withastro/astro (astro)
v7.3.8Compare Source
Patch Changes
#18293
28e7410Thanks @astro-factory! - FixesAstro.cachebeingundefinedwhen a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export#18298
0e9e857Thanks @matthewp! - Fixesastro addremoving existingallowBuildsapprovals frompnpm-workspace.yamlwith pnpm v11.0–v11.22#18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.#18290
31f13c3Thanks @astro-factory! - Fixes theglob()loader not reloading changed files in dev when the pattern starts with an extglob such as!(drafts)/**/*.mdv7.3.7Compare Source
Patch Changes
#18266
cba76ccThanks @astro-factory! - Fixes a build error when a Markdown content collection entry loaded withglob({ deferRender: true })has alayoutfrontmatter property.layoutis now ignored for content collection entries, as documented.#18287
38f6793Thanks @astro-factory! - Fixesastro add cloudflarefailing to install dependencies with pnpm v11+ by approving theworkerdbuild script, and shows the package manager's error output whenastro addfails to install dependencies#18222
fcf6ed6Thanks @mingjunlu! - Fixes an issue where AVIF images were served asimage/heifinstead ofimage/avifin the dev server.#18240
de4df06Thanks @astro-factory! - Fixes thecache()handler fromastro/honoandastro/fetchthrowing aTypeErrorwhen a cache provider is configured. It now registers the cache provider before rendering, soAstro.cacheis available to downstream handlers likepages().#18268
547b572Thanks @astro-factory! - Fixessecurity.checkOriginrejecting cross-origin requests with non-form content types such asapplication/json. As documented, the check only applies to unsafe requests that have nocontent-typeheader or one ofapplication/x-www-form-urlencoded,multipart/form-data, ortext/plain.pnpm/pnpm (pnpm)
v12.11.2: pnpm 12.11.2Compare Source
This release fixes
--workspace-concurrency=Infinity, filters set by anupdateConfighook, and store fetches withenable-modules-dir=false.Patch Changes
--workspace-concurrency=Infinitynow runs workspace projects with no concurrency limit. It used to fail withinvalid digit found in string#16793.pnpm installand other recursive commands now apply thefilterandfilterProdthat anupdateConfighook sets. They used to run on every workspace project #16792.enable-modules-dir=falsenow also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.Platinum Sponsors
Gold Sponsors
v12.11.1: pnpm 12.11.1Compare Source
This release fixes two ways
pnpm installcould fail, runs tools of any Rust release throughpnx, and treatsregistry.npmjs.comas an alias of the npm registry.Patch Changes
pnpm installno longer fails whenpackageManagerpins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.pnpm installno longer fails withERR_PNPM_CMD_SHIM_CHMODwhennode_modules/.binholds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.enable-modules-dir=false(enableModulesDir: falsethrough the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing undernode_modules. The setting exists for anode_modulesthat something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain--lockfile-onlyrun still fetches nothing.pnpm packandpnpm publishno longer put.npmignoreand.gitignorefiles in the tarball. Afilesentry that names one still ships it.pnpm now treats
https://registry.npmjs.com/as an alias ofhttps://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.pnx --package=rust@<channel> <tool>runs a tool of that Rust release, for examplepnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets fromrust-toolchain.tomland the target of each--targetargument.pnpm installnow links agent skills for more coding agents. It detects the agent fromANTIGRAVITY_AGENT,COPILOT_AGENT,COPILOT_CLI,CODEX_THREAD_ID,CODEX_SANDBOX,AI_AGENT, andCLAUDE_CODEpnpm/tasks#116.When the registry rejects
pnpm stage publish, the error message now starts with "Failed to stage package".Platinum Sponsors
Gold Sponsors
v12.11.0: pnpm 12.11.0Compare Source
This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the
permissionssetting, and keeps the colors of streamed script output.Minor Changes
pnpm installnow links the agent skills that direct dependencies ship underskills/<name>/SKILL.mdinto the project's agent skill directories, such as.claude/skills. A package's skills are linked only after you approve them withpnpm approve. Theskills.dirssetting chooses the directories pnpm/rfcs#35.Added the
permissionssetting, which records what each dependency may do. Itsbuildcapability works likeallowBuildsand takes precedence over it.pnpm approve-buildswrites topermissionswhenpnpm-workspace.yamlalready has it, and toallowBuildsotherwise.Added
pnpm permissions, which lists the granted and denied permissions and the packages awaiting approval.pnpm approvereviews build scripts and agent skills in one prompt pnpm/rfcs#36.pnpm now installs and runs Rust toolchains.
cargo.enabled,pnpm installinstalls the toolchain named inrust-toolchain.toml. pnpm verifies the release signature, stores the toolchain once per machine, and links it into.pnpm/rust.pnpm runandpnpm execput itscargoandrustcon thePATH.pnpm add -g rust@<channel>installs a toolchain globally. Thecargoandrustccommands run it outside projects that pin their own.pnpm update -g,pnpm ls -g, andpnpm remove -gmanage it like any global package.pnpm add rust@<channel>pins the toolchain inrust-toolchain.toml.pnpm shim add rustadds project-aware shims forcargo,rustc, and the other Rust tools. In a project with arust-toolchain.toml, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name onPATHruns, such as rustup's.pnpm runandpnpm execnow keep the colors of script output that they print under the project's name, such as with--stream. pnpm setsFORCE_COLOR=1for these scripts when its own output is in color, unlessFORCE_COLORis already set.Script output is also rendered more cleanly:
\rshows only its last state.pnpm -r runno longer garbles its live output when a script fails while other scripts are still running.Patch Changes
Installing packages
pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a
linux/amd64container on an Apple Silicon Mac #16696.pnpm view,pnpm update, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLSclose_notifyalert #16704.pnpm now switches to the version a project pins in
packageManagerordevEngines.packageManagereven whenpnpm-workspace.yamlhas a setting the running pnpm cannot read, such as alockfile.includeResolutionSettingssection. If pnpm does not switch, it still reports that setting #16675.When the
pnpmpackage has to download its native binary on first run, it now uses the registry and credentials from.npmrcand from thenpm_config_registryandpnpm_config_registryenvironment variables.COREPACK_NPM_REGISTRYstill takes precedence. A project.npmrcis not read whenCOREPACK_INTEGRITY_KEYSturns off the signature check #16655.pnpm installandpnpm add --confignow applyminimumReleaseAgewhen they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later cleanpnpm install --frozen-lockfileaccepts the lockfile #16660.pnpm removewithcatalogPruneno longer removes catalog entries thatpnpm-lock.yamlstill records for workspace projects missing from disk. Before, a following frozen install failed withERR_PNPM_LOCKFILE_CONFIG_MISMATCH#16679.With
cargo.enabled,pnpm installnow writes the source replacement for vendored crates into.pnpm/crates/config.tomland includes it as optional from.cargo/config.toml. A checkout without.pnpmbuilds with plain Cargo #16659.With
nodeLinker.typeset toloaded, Node.js now stops withERR_PNPM_LOADER_UNSUPPORTED_NODEwhen it preloads the store loader on a version the loader cannot serve. The supported versions are^24.18.0 || >=26.2.0. On other versions, CommonJS packages imported from ESM failed withCannot find moduleon their first relativerequire().On Windows,
pnpm installno longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such asicon.svg?as=metadata.d.ts. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files.On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently pnpm/tasks#53.
Resolving dependencies
pnpm install --no-optionalnow installs the peer dependencies a project declares whenautoInstallPeersis on. The lockfile marked such a peeroptional: truewhen another dependency had it as an optional peer.pnpm installandpnpm dedupenow link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version #16706.Removal overrides such as
"debug>supports-color": "-"now also apply to an optional peer that a package declares only inpeerDependenciesMeta#16681.pnpm addand other installs that re-resolve dependencies now keep the lockeddevEngines.runtimeversion while it still satisfies the declared range #16764.pnpm audit --fix updatenow updates only the dependencies whose locked version is vulnerable #14928.pnpm outdatedandpnpm update --interactivenow applyoverridesbefore they look up the latest version. Before, a dependency overridden to an npm alias was compared with the latest version of the package the override replaces #16719.Patched dependencies
Patches saved with CRLF line endings now apply, including a patch that creates or deletes a file. pnpm rejected the git headers of such a patch with
ERR_PNPM_INVALID_PATCHand the messageinvalid file mode: 100644#16641.A patch that changes a file's mode, such as adding or removing the executable bit, now applies the new mode on Unix pnpm/tasks#110.
Injected dependencies and deploy
With
sharedWorkspaceLockfile: false, an injected workspace package installed in the same run as its dependent now holds only the files itsfilesfield selects. The copy also held other files of the project, such astsconfig.json#16683.A script listed in
syncInjectedDepsAfterScriptsno longer fails when it rewritespackage.jsonwhile pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest.pnpm deploywith a shared lockfile no longer fails withERR_PNPM_LOCKFILE_CONFIG_MISMATCHforsettings.dedupeInjectedDepsorsettings.dedupePeerDependentswhenlockfile.includeResolutionSettingsis enabled. The deployed lockfile now records both settings asfalse, the values the deploy installs with.pnpm deploynow writes the dependencies in the deployedpackage.jsonsorted by name. It also sorts theallowBuildsentries in the deployedpnpm-workspace.yaml. Repeated deploys of the same lockfile now produce identical files #16687.Packing and publishing
pnpm packandpnpm publishnow match.npmignoreand.gitignorerules the way npm does. A negation such as!lib/**or!lib/**/!(*.map)re-includes files under a directory that an earlier*rule excluded #16743.pnpm packandpnpm publishno longer always include root files that merely start withREADME,LICENSE, orLICENCE, such asREADME_INTERNAL.md. OnlyREADME,LICENSE,LICENCE, andCOPYING, with or without an extension, ship regardless offilesand.npmignore, as in npm #16753.pnpm publish --provenance=falseand--no-provenancenow turn off provenance under trusted publishing, so a package can be published from a self-hosted runner. Settingprovenance: falseinpnpm-workspace.yamldoes the same #16721.Speed and resource use
pnpm installhardlinks files from a group-writable or world-writable store again. pnpm copied every file from such a store intonode_modules#16677.A repeat
pnpm installno longer imports patched packages and packages with build scripts again when nothing changed. Their builds no longer run again either. This happened whenrecursiveInstallwasfalseor the project had afile:dependency #16705.Verifying the lockfile against
trustPolicyandminimumReleaseAgeuses less memory. pnpm no longer keeps every published version's manifest of each checked package in memory until the install ends #16656.pnpm rebuild <pkg>andpnpm rebuild --pendingno longer read the manifest of every installed package to find build scripts. Only the selected packages are inspected and built. On a largenode_modulesserved lazily, such as over a network or FUSE mount, this turned a rebuild of a few packages into a fetch of every package.pnpm rebuildno longer removes and recreatesnode_moduleswhen the settings recorded innode_modules/.modules.yamldiffer from the current configuration. The rebuild runs the build scripts against the installed packages as they are.pnpm store prunenow compacts the store'sindex.dbafter removing package entries, so the file shrinks again #16717.Registry commands
pnpm whoami,pnpm bugs,pnpm docs,pnpm repo,pnpm star,pnpm unstar, andpnpm starsnow honor the--registryoption.--registrynow takes precedence over a scope's configured registry for scoped packages inpnpm access,pnpm view,pnpm repo,pnpm star,pnpm unstar,pnpm owner,pnpm deprecate,pnpm undeprecate,pnpm unpublish,pnpm dist-tag,pnpm team, andpnpm stage. Without--registry,pnpm accessnow sends a scoped package or scope to the registry configured for that scope.Registry commands now keep the path of a registry URL such as
https://example.com/npm/when they build request URLs. This applies topnpm access,pnpm owner,pnpm ping,pnpm search,pnpm star,pnpm stars,pnpm team,pnpm unstar, andpnpm whoami.`pnpm view
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.