Skip to content

chore(deps): update all non-major dependencies - #249

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#249
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@angular/common (source) ^22.1.0 → ^22.1.1 age confidence dependencies patch
@angular/compiler (source) ^22.1.0 → ^22.1.1 age confidence dependencies patch
@angular/compiler-cli (source) ^22.1.0 → ^22.1.1 age confidence devDependencies patch
@angular/core (source) ^22.1.0 → ^22.1.1 age confidence devDependencies patch
@angular/core (source) ^22.1.0 → ^22.1.1 age confidence dependencies patch
@angular/forms (source) ^22.1.0 → ^22.1.1 age confidence dependencies patch
@angular/platform-browser (source) ^22.1.0 → ^22.1.1 age confidence dependencies patch
@angular/router (source) ^22.1.0 → ^22.1.1 age confidence dependencies patch
@eslint-react/eslint-plugin (source) ^5.18.3 → ^5.18.6 age confidence devDependencies patch
@tanstack/devtools-ui (source) 0.6.0 → 0.7.0 age confidence dependencies minor
@tanstack/preact-devtools (source) ^0.10.9 → ^0.10.10 age confidence dependencies patch
@tanstack/react-devtools (source) 0.10.9 → 0.10.10 age confidence devDependencies patch
@tanstack/solid-devtools (source) 0.8.9 → 0.8.10 age confidence dependencies patch
@tanstack/typedoc-config (source) 0.3.3 → 0.3.4 age confidence devDependencies patch
@testing-library/jest-dom ^7.0.0 → ^7.0.1 age confidence devDependencies patch
actions/checkout v6.0.2 → v6.1.0 age confidence action minor
changesets/action v1.8.0 → v1.9.0 age confidence action minor
eslint (source) ^10.8.0 → ^10.8.1 age confidence devDependencies patch
happy-dom ^20.11.1 → ^20.11.2 age confidence devDependencies patch
knip (source) ^6.32.0 → ^6.32.2 age confidence devDependencies patch
pnpm (source) 11.20.0 → 11.21.0 age confidence packageManager minor
pnpm (source) >=11.0.0 → >=11.21.0 age confidence engines minor
vite (source) ^8.2.0 → ^8.2.1 age confidence devDependencies patch
zizmorcore/zizmor-action v0.5.3 → v0.6.2 age confidence action minor

Release Notes

angular/angular (@​angular/common)

v22.1.1

Compare Source

core
Commit Type Description
aa6d3189c1 fix initialize hydration triggers after late runtime activation
deecb301c8 fix warn when style property bindings receive invalid values
http
Commit Type Description
ac3728e79f fix avoid aborting completed requests in FetchBackend
688a0a7118 fix respect content-type charset in fetch backend text decoder
a13b968451 fix run root interceptors in the terminal request chain
32af9b525e fix strip RFC 6265 DQUOTE characters and handle URIError in parseCookieValue
Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.18.6

Compare Source

🏗️ Internal
  • @eslint-react/core: added createElement helper APIs (getCreateElementChildrenArguments, getCreateElementProp, getCreateElementPropsObject, getCreateElementTypeArgument, isCreateElementChildrenArgument, and isInsideCreateElementProps) and reused them in react-x/no-children-prop-with-children, react-x/no-children-prop, react-x/no-array-index-key, and react-x/no-nested-component-definitions. (#​1937)

Full Changelog: Rel1cx/eslint-react@v5.18.5...v5.18.6

v5.18.5

Compare Source

📝 Documentation
  • react-jsx/no-leaked-dollar: corrected the full rule name in the documentation from @eslint-react/no-leaked-dollar to @eslint-react/jsx-no-leaked-dollar. (#​1935)
🏗️ Internal
  • @eslint-react/core: simplified function component detection logic.
  • @eslint-react/core: added missing test cases for API exports, nested HOC init paths, named callback exclusion, displayName collection, indirect cleanup callbacks, and custom createElement heuristics.
  • Added a script check that verifies rule docs include correct full name sections.
  • Bumped typescript-eslint to 8.67.0, eslint-plugin-package-json to 1.7.1, and globals to 17.10.0.

Full Changelog: Rel1cx/eslint-react@v5.18.4...v5.18.5

v5.18.4

Compare Source

🐞 Fixes
  • react-x/no-class-component: reports are now located on the class name (falling back to the class token for anonymous classes) instead of the entire class declaration. (#​1934, closes #​1932)
🏗️ Internal
  • Bumped eslint to 10.8.1, @types/node to 26.2.0, eslint-plugin-package-json to 1.7.0, eslint-plugin-react-refresh to 0.5.4, fumadocs to 16.14.3, fumadocs-mdx to 15.2.3, lucide-react to 1.31.0, postcss to 8.5.26, and pnpm to 11.21.0.
New Contributors

Full Changelog: Rel1cx/eslint-react@v5.18.3...v5.18.4

TanStack/devtools (@​tanstack/devtools-ui)

v0.7.0

Compare Source

Minor Changes

  • #​492 a46d1f5 - feat: apply TanStack branding and the compact Workbench layout across core, shared UI, and accessibility Devtools

    The Workbench now separates chrome from canvas: the header and the secondary strips paint the brand surface and share one 16px gutter with the content below them. The palm emblem is inline SVG instead of a filtered raster, plugin destinations get a real empty state, and the Marketplace, SEO, and Settings destinations drop their competing accent colours in favour of the semantic theme.

    The secondary strip gets a pull tab on its bottom edge that folds the strip away behind the header, leaving the panel height and the destination content untouched. It only appears on destinations that have a strip.

    The SEO tab's <head> watcher no longer reports <style> tags. It observes attributes and character data across the whole <head> subtree, and a CSS-in-JS library rewrites a <style> tag there on every render — so an SEO analysis triggered a re-render, the re-render emitted CSS, and the CSS triggered another analysis. Stylesheets carry no SEO metadata, so they are filtered out.

    Fixes along the way: the resize handle had grown to 24px and sat on top of the header, so a press aimed at a header button started a resize instead of clicking; the Marketplace settings drawer was position: fixed and covered the host page instead of the Workbench; the floating trigger lost its brand fill on hover and its transition was overridden away; the "New" ribbon on a plugin card overlapped the card icon; scroll gestures inside the panel chained on to the host page; and the hotkey editor showed each shortcut's description as its heading and never rendered its title.

TanStack/devtools (@​tanstack/preact-devtools)

v0.10.10

Compare Source

Patch Changes
TanStack/devtools (@​tanstack/react-devtools)

v0.10.10

Compare Source

Patch Changes
TanStack/devtools (@​tanstack/solid-devtools)

v0.8.10

Compare Source

Patch Changes
TanStack/config (@​tanstack/typedoc-config)

v0.3.4

Compare Source

Patch Changes
testing-library/jest-dom (@​testing-library/jest-dom)

v7.0.1

Compare Source

actions/checkout (actions/checkout)

v6.1.0

Compare Source

v6.0.3

Compare Source

changesets/action (changesets/action)

v1.9.0

Compare Source

Minor Changes
Patch Changes

  • #​535 34f64f6 Thanks @​Andarist! - Fixed an issue with GitHub releases not being created for successfully published packages when some packages failed to be published to the registry.

  • #​632 1d54b9e Thanks @​bluwy! - Simplify internal implementation to get changelog entries for a package version

  • #​629 e0c90aa Thanks @​bluwy! - Fix custom version and publish command argument parsing

  • #​645 f9585d9 Thanks @​Andarist! - Improved force-push handling when using commitMode: "github-api" so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.

eslint/eslint (eslint)

v10.8.1

Compare Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

capricorn86/happy-dom (happy-dom)

v20.11.2

Compare Source

👷‍♂️ Patch fixes
webpro-nl/knip (knip)

v6.32.2: Release 6.32.2

Compare Source

v6.32.1: Release 6.32.1

Compare Source

pnpm/pnpm (pnpm)

v11.21.0: pnpm 11.21

Compare Source

Minor Changes

  • Added interactive group selection to pnpm update --global --interactive.

  • Running pnpm setup, pnpm self-update, or a command that modifies the global installation (such as pnpm add --global) through sudo now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with ERR_PNPM_SUDO_NOT_SUPPORTED in pnpm v12. Read-only global commands (such as pnpm bin --global) are unaffected.

Patch Changes

  • Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists pnpm/pnpm#11701.

  • Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.

  • Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from pnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.

  • Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in pnpm-lock.yaml directly, reusing the same check the pnpm.overrides fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.

  • Fixed a CI regression where github:owner/repo dependencies (and other shorthand Git specifiers) would fail to install with Permission denied (publickey) on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. git+ssh:// or git@host:...):

    • The repository visibility probe (an HTTP HEAD request) now retries transient failures such as 429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.
    • For non-SSH specifiers, anonymous HTTPS git ls-remote access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
    • When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
    • A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. codeload.github.com, which would fail to download for a private repository); it stays a regular git resolution so installs can use ambient Git credentials such as credential helpers and tokens.

    Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

    Fixes pnpm/pnpm#13276.

  • ng build and nuxt build now work under the global virtual store: pnpm's built-in compatibility extensions add the tslib dependency that @angular/build uses without declaring and the unplugin dependency that @nuxt/vite-builder v4 uses without declaring.

  • Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated by their resolved link targets.

  • An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and pendingBuilds entries for removed packages are dropped instead of staying pending forever.

  • The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #​13071.

  • Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an ! exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.

  • Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in pnpm-lock.yaml and the install proceeds from the existing resolution. Every other case still falls back to a full resolution.

  • Adding, editing, or removing an entry in patchedDependencies no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in pnpm-lock.yaml and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while allowUnusedPatches is off, so ERR_PNPM_UNUSED_PATCH is still reported.

  • Resolving a private git repository no longer blocks on an interactive credential prompt: git ls-remote now fails fast with an authentication error when git has no credentials for the repository #​13522.

  • Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same ERR_PNPM_NO_OFFLINE_META condition used by offline resolution.

  • POSIX shell shims now follow symbolic links before computing basedir, preventing execution failures when a shim is invoked via an external symlink on PATH #​13405.

  • The automatic packageManager version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command #​13619.

  • Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip dist.signatures) no longer break the automatic packageManager version switch and pnpm self-update #​13147. When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from registry.npmjs.org and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a shasum), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.

  • pnpm fetch, and any install run with virtualStoreOnly, no longer writes a .pnp.cjs loader under nodeLinker: pnp. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and node_modules/.package-map.json were already skipped; the PnP loader now follows the same rule.

  • Prevent pnpm from removing project files when modulesDir resolves to the project root.

  • Speed up installs after adding ignoredOptionalDependencies patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again.

  • When a failed install re-copies a bin script from the store, rerunning pnpm install now reapplies the executable bit to the bin instead of leaving it non-executable #​12742.

  • pnpm root -g and pnpm bin -g now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with --global in a project that pins a package manager (e.g. via the packageManager field) printed a warning like [WARN] Using --global skips the package manager check for this project ahead of the path, breaking programs that capture the output as a path #​13672.

    In pnpm 12, pnpm root -g and pnpm prefix -g are now supported (they previously failed with ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED / ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED), and the reporter output of dlx, create, config, sbom, with, store, prefix, root, and bin goes to stderr, matching pnpm 11.

  • pnpm setup no longer makes Node.js print a MODULE_TYPELESS_PACKAGE_JSON warning about dist/worker.js on every command. The package.json it writes next to a standalone executable now declares "type": "module".

  • pnpm update without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or --latest resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next pnpm install --frozen-lockfile rejected with ERR_PNPM_OUTDATED_LOCKFILE #​12764.

  • pnpm version -r --json now outputs [] instead of human-readable text when no pending changes exist pnpm/pnpm#13217.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
vitejs/vite (vite)

v8.2.1

Compare Source

Bug Fixes
Performance Improvements
Documentation
Miscellaneous Chores
Code Refactoring
Tests
zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.2

Compare Source

zizmor 1.29.0 is now the default version.

v0.6.1

Compare Source

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

Compare Source

zizmor 1.27.0 is now the default version used by the action.

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 10, 2026 01:02
@socket-security

socket-security Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​tanstack/​typedoc-config@​0.3.4891006491100
Addedhappy-dom@​20.11.2661008896100
Added@​angular/​platform-browser@​22.1.1771007496100
Updated@​tanstack/​devtools-ui@​0.6.0 ⏵ 0.7.0100 +11007595 +1100
Added@​angular/​compiler-cli@​22.1.1801007696100
Added@​angular/​router@​22.1.1791007798100
Added@​angular/​forms@​22.1.1801007797100
Added@​tanstack/​preact-devtools@​0.10.10771009297100
Added@​angular/​compiler@​22.1.1811007897100
Added@​angular/​core@​22.1.1811007996100
Added@​angular/​common@​22.1.11001007997100
Addedvite@​8.2.1991008298100
Added@​tanstack/​solid-devtools@​0.8.10961009098100
Added@​tanstack/​react-devtools@​0.10.101001009298100
Addedknip@​6.32.2991009596100
Added@​testing-library/​jest-dom@​7.0.110010010096100
Added@​eslint-react/​eslint-plugin@​5.18.69910010096100
Addedeslint@​10.8.19710010097100

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 58f707d to 9e695c1 Compare August 13, 2026 03:21
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9e695c1 to d94c03d Compare August 13, 2026 09:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants