Skip to content

chore(deps): update all non-major dependencies#312

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#312
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Dec 6, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@antfu/eslint-config ^6.2.0 → ^6.7.3 age confidence devDependencies minor
@types/node (source) ^24.10.1 → ^24.12.4 age confidence devDependencies minor
defu ^6.1.4 → ^6.1.7 age confidence devDependencies patch
esbuild 0.27.0 → 0.28.0 age confidence devDependencies minor
node (source) 24.11.1 → 24.15.0 age confidence minor
pnpm (source) 10.24.0 → 10.33.4 age confidence packageManager minor
rollup (source) ^4.53.3 → ^4.60.3 age confidence devDependencies minor
typescript (source) 6.0.2 → 6.0.3 age confidence devDependencies patch
vite (source) ^7.2.4 → ^7.3.3 age confidence devDependencies patch

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v6.7.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.7.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.7.1

Compare Source

   🐞 Bug Fixes
  • pnpm: Do not set catalogMode when catalogs is not enabled  -  by @​antfu (0471e)
    View changes on GitHub

v6.7.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.6.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.6.0

Compare Source

   🐞 Bug Fixes
  • pnpm: Enforce catalog usage based on smart detection  -  by @​antfu (654c0)
    View changes on GitHub

v6.5.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.5.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.4.2

Compare Source

   🐞 Bug Fixes
  • pnpm: Move pnpm-workspace.yaml sorting config from yaml to pnpm  -  by @​antfu (fc2b1)
    View changes on GitHub

v6.4.1

Compare Source

No significant changes

    View changes on GitHub

v6.3.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
unjs/defu (defu)

v6.1.7

Compare Source

compare changes

🩹 Fixes
  • defu.d.cts: Export Defu types (#​157)
📦 Build
  • Correct the types export entry (#​160)
❤️ Contributors

v6.1.6

Compare Source

compare changes

📦 Build
❤️ Contributors
evanw/esbuild (esbuild)

v0.28.0

Compare Source

v0.27.7

Compare Source

v0.27.5

Compare Source

v0.27.4

Compare Source

v0.27.3

Compare Source

v0.27.2

Compare Source

v0.27.1

Compare Source

nodejs/node (node)

v24.15.0

Compare Source

v24.14.1

Compare Source

v24.14.0

Compare Source

v24.13.1

Compare Source

v24.13.0: 2026-01-13, Version 24.13.0 'Krypton' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

lib:

Commits

v24.12.0: 2025-12-10, Version 24.12.0 'Krypton' (LTS), @​targos

Compare Source

Notable Changes
  • [1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #​59778
  • [ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #​59982
  • [8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #​60600
  • [92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #​59953
  • [b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #​60217
  • [e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #​60178
  • [a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #​58797
  • [92ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #​59711
  • [05d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #​59807
Commits
pnpm/pnpm (pnpm)

v10.33.4: pnpm 10.33.4

Compare Source

Patch Changes

  • Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

    A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

  • Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #​11341.

Platinum Sponsors

Bit

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v10.33.3

Compare Source

v10.33.2

Compare Source

v10.33.1: pnpm 10.33.1

Compare Source

Patch Changes
  • When a project's packageManager field selects pnpm v11 or newer, commands that v10 would have passed through to npm (version, login, logout, publish, unpublish, deprecate, dist-tag, docs, ping, search, star, stars, unstar, whoami, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example, pnpm version --help print npm's help on a project with packageManager: pnpm@11.0.0-rc.3 #​11328.
Platinum Sponsors
Bit
Gold Sponsors
Sanity Discord Vite
<

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Dec 6, 2025
@bolt-new-by-stackblitz
Copy link
Copy Markdown

bolt-new-by-stackblitz Bot commented Dec 6, 2025

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Dec 6, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedesbuild@​0.28.0911007390100
Updatedvite@​7.3.2 ⏵ 7.3.396 +110082 +198100
Updateddefu@​6.1.5 ⏵ 6.1.710010010086100
Updatedrollup@​4.59.0 ⏵ 4.60.38810010098100
Updatedtypescript@​6.0.2 ⏵ 6.0.31001009098 +190
Updated@​antfu/​eslint-config@​6.2.0 ⏵ 6.7.39410010094100
Updated@​types/​node@​24.10.1 ⏵ 24.12.4100 +1100100 +20100 +5100

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from c468e16 to 7dc0ddc Compare December 14, 2025 10:12
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 504d765 to 575c388 Compare December 17, 2025 03:06
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Dec 17, 2025 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@antfu/eslint-config@6.7.3 → npm/@typescript-eslint/eslint-plugin@8.59.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.59.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm eslint-plugin-jsdoc is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@antfu/eslint-config@6.7.3 → npm/eslint-plugin-jsdoc@61.7.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-jsdoc@61.7.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 1612aac to a8c0cb8 Compare December 23, 2025 17:50
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 8090472 to 5ef63db Compare January 5, 2026 11:13
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 5ef63db to 1ece85b Compare January 7, 2026 09:10
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 2eb4859 to 8c8b755 Compare January 30, 2026 09:08
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from ea2f97f to 856250a Compare February 9, 2026 04:39
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from ea12dbd to 83e9866 Compare February 11, 2026 17:10
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from a5374c5 to 86115c6 Compare February 24, 2026 00:41
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 3b2be05 to e4516c8 Compare March 3, 2026 10:03
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from e4516c8 to f553ecf Compare March 6, 2026 02:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants