Bump npm non-major - #1823
Conversation
8f6a30b to
70a5aab
Compare
Deploy previewBundle sizeTotal Size Change: 🔺+146B(0.00%) - Total Gzip Change: 🔺+49B(+0.01%) Show details for 71 more bundlescompileCssWithPostcss parsed: 🔺+146B(+0.03%) gzip: 🔺+49B(+0.03%) PerformanceTotal duration: 16.26 ms -0.40 ms(-2.4%) | Renders: 5 (+0) | Paint: 58.16 ms -2.02 ms(-3.4%)
5 tests within noise — details Metric alarms
Check out the code infra dashboard for more information about this PR. |
70a5aab to
c71302c
Compare
c71302c to
dd666cb
Compare
dd666cb to
79e1ea3
Compare
79e1ea3 to
36010fc
Compare
36010fc to
1cf7bf4
Compare
1cf7bf4 to
6802306
Compare
github-actions
Bot
added
the
PR: out-of-date
6802306 to
964114b
Compare
github-actions
Bot
added
PR: out-of-date
964114b to
3c45619
Compare
github-actions
Bot
removed
the
PR: out-of-date
1 participant
This PR contains the following updates:
6.8.1→6.8.2^3.1115.0→^3.1120.0^4.0.8→^4.0.9^6.2.0→^6.3.0^5.2.2→^5.2.3^16.3.1→^16.3.3^16.3.1→^16.3.3^16.3.1→^16.3.3^1100.2.0→^1100.2.1^5.101.4→^5.102.8^16.3.2→^16.3.316.3.2→16.3.3^14.6.5→^14.6.619.2.4→19.2.5^6.1.0→^6.1.12.11.16→2.11.20^1.51.0→^1.52.0^11.9.0→^11.10.0^6.2.9→^6.2.10^1.33.0→^1.35.0^3.23.4→^3.24.2^16.3.1→^16.3.3^9.0.1→^9.0.2^5.3.0→^5.3.211.22.0→11.24.0^0.8.1→^0.8.2^6.1.1→^6.2.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
bump,lockfileUpdate, orrollbackupdates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).Release Notes
argos-ci/argos-javascript (@argos-ci/core)
v6.8.2Compare Source
Bug Fixes
aws/aws-sdk-js-v3 (@aws-sdk/client-s3)
v3.1120.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1119.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1118.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1117.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1116.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
csstools/postcss-plugins (@csstools/postcss-relative-color-syntax)
v4.0.9Compare Source
August 25, 2026
@csstools/css-color-parserto4.2.1(patch)SBoudrias/Inquirer.js (@inquirer/confirm)
v6.3.0Compare Source
@inquirer/confirm@6.3.0
What's new
sfor sí, Frenchofor oui, Chinese 是/否), instead of only Englishy/n. A newkeywordstheme property ({ yes, no }) is the source of truth for both parsing and display, with prefix-based, case-insensitive matching and the default answer marked in the hint.Dependencies
@inquirer/corebumped to^12.0.1@inquirer/typebumped to^4.1.0vercel/next.js (@next/bundle-analyzer)
v16.3.3Compare Source
This release contains security fixes for the following advisories:
Critical:
v16.3.2Compare Source
Core Changes
Credits
Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!
TanStack/query (@tanstack/react-query)
v5.102.8Compare Source
Patch Changes
v5.102.7Compare Source
Patch Changes
v5.102.6Compare Source
Patch Changes
#11305
ac2b612- fix(react-query): throw falsy errors fromuseQueriesanduseSuspenseQueriesto the error boundaryUpdated dependencies []:
v5.102.5Compare Source
Patch Changes
578e5c2]:v5.102.4Compare Source
Patch Changes
a05df6a]:v5.102.3Compare Source
Patch Changes
v5.102.2Compare Source
Patch Changes
80fbf73]:v5.102.1Compare Source
Patch Changes
134890d]:v5.102.0Compare Source
Minor Changes
e674826- react-query: update usePrefetchQuery and usePrefetchInfiniteQuery to use queryClient.query and queryClient.infiniteQueryPatch Changes
#11245
37127db- revert: remove NoInfer from useQuery return types#10373
6e3d521- fix(types): propagate generic type parameters touseMutationStateselect callback#11224
294d4e6- FixqueryOptionsandinfiniteQueryOptionsreturn types so exported inferred options can be emitted in declaration files without leaking internal data tag symbols.#11147
cb6c9d3- DefaultTDataofUseInfiniteQueryOptionsandUseSuspenseInfiniteQueryOptionstoInfiniteData<TQueryFnData>so it matches the hook generics.#8737
2215bb0- fix: make mutation variables optional whenundefined extends TVariables#11221
1ef4208- Remove experimental render-time prefetching and thepromiseproperty from query results.#11228
fb6c3fa- Avoid emitting a runtime import for React Query's type-only exports.#11130
8834267- fix(react-query): don't show optimistic fetching for unsubscribed useQueries#11233
b866a95- remove unused experimental_beforeQuery and experimental_afterQuery hooks#11144
e546d03- fix: remove placeholderData from suspense infinite queryUpdated dependencies [
34f7cee,b4368c4,5bb089d,ba4650c,294d4e6,1f631b3,01a02bf,18c1c1e,5448063,2215bb0,1ef4208,5981771,4a9bef6,bef4bc7,9656dc4,326aaf1,3e83601,c6fc17c]:testing-library/react-testing-library (@testing-library/react)
v16.3.3Compare Source
Bug Fixes
testing-library/user-event (@testing-library/user-event)
v14.6.6Compare Source
Bug Fixes
vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.1.1Compare Source
Add
compiler.logDiagnosticsoptionRecoverable React Compiler diagnostics are no longer logged by default. Set
compiler.logDiagnosticstotrueto log them through Vite. Fatal diagnostics are always logged and fail the transform.Respect environment sourcemap option for React Compiler transform when
builder.sharedPluginsis enabled (#1439)The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental
builder.sharedPluginswas enabled.web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)
v2.11.20Compare Source
v2.11.19Compare Source
v2.11.18Compare Source
v2.11.17Compare Source
toss/es-toolkit (es-toolkit)
v1.52.0Compare Source
Released on August 28th, 2026.
Added the
es-toolkit/iteratorentrypoint, a lazy iterator module withchunk,count,dropWhile,head,iterate,partition,range,scan,takeWhile,uniqBy, andzip([#1815]), pluscartesianProduct([#2031]).The same functions are also available from
es-toolkit/fp/iterator.Added
deferanddeferAsynctoes-toolkit/util. ([#2032])Added
flowAsynctoes-toolkit/fp, a promise-aware left-to-right composition. ([#2033])Added the
EmptyObject,IsEqual,JSONValue,Primitive,SetOptional,SetRequired, andUnknownRecordtypes. ([#2044])Fixed
mergeto infer the deep merged return type, and exported theMergetype. ([#1959])Fixed
omitByandpickByto type numeric callback keys as strings, andexported the
ObjectKeystype. ([#2037])Fixed
attemptandattemptAsyncto default their error type parameter tounknown. ([#2052])The following bring
es-toolkit/compatcloser to Lodash. Behavior for the affectededge cases now matches Lodash, so results may differ if you relied on the previous output.
Fixed
compat/debounceto skip themaxWaitinvocation when bothleadingandtrailingarefalse. ([#1678])Fixed
compat/toStringto convert objects with a customvalueOf. ([#2034])Fixed
compat/mergeWithto assignnullvalues in array sources. ([#1929])Fixed
compat/hasandcompat/hasInto normalize the-0path key. ([#2035])Fixed
compat/differenceWithandcompat/withoutto normalize-0to0. ([#2049])Fixed
compat/findLastIndexto convertfromIndexto an integer. ([#2047])Fixed
compat/xorWithto match Lodash when no comparator is given. ([#2057])Covered the new iterator entrypoints in the dist and browser compatibility
checks. ([#2030])
Made the agent skills portable when installed on their own. ([#2054])
Fixed documentation typos and the Deno install commands. ([#2062])
html-validate/html-validate (html-validate)
v11.10.0Compare Source
Features
ariato specify which ARIA version to use (64321ed)toHTMLValidate()matcher accepts any object withouterHTML,innerHTMLorhtml()(749dfc2)attr-case(b22b27c)attr-delimiter(72fc6cb)doctype-html(12ed8b8)doctype-style(168b786)element-case(f5bc934)no-trailing-whitespace(94b7dba)no-utf8-bom(78b2ff1)toHTMLValidate()matcher accepts any object withouterHTML,innerHTMLorhtml()(3898790)panva/jose (jose)
v6.2.10Compare Source
Fixes
Documentation
Refactor
lucide-icons/lucide (lucide-react)
v1.35.0: Version 1.35.0Compare Source
What's Changed
ship-cargoicon by @l0uisgrange in #4706trailericon by @MadsMadsDk in #4405galaxyicon by @karsa-mistmere in #4715baticon to lab by @RajnishKMehta in #3914ghosticon by @jguddas in #3533robot-armicon by @zoharma in #4447New Contributors
Full Changelog: lucide-icons/lucide@1.34.0...1.35.0
v1.34.0: Version 1.34.0Compare Source
What's Changed
mail-clockicon by @ericfennis in #4722Full Changelog: lucide-icons/lucide@1.33.0...1.34.0
sidorares/node-mysql2 (mysql2)
v3.24.2Compare Source
Bug Fixes
trace: falseon every promise-API method (#4502) (1dcd8ef), closes #4501v3.24.1Compare Source
Performance Improvements
v3.24.0Compare Source
Features
Bug Fixes
Performance Improvements
taoqf/node-fast-html-parser (node-html-parser)
v9.0.2Compare Source
piscinajs/piscina (piscina)
v5.3.2Compare Source
Full Changelog: piscinajs/piscina@v5.3.1...v5.3.2
v5.3.1Compare Source
What's Changed
Full Changelog: piscinajs/piscina@v5.3.0...v5.3.1
pnpm/pnpm (pnpm)
v11.24.0: pnpm 11.24Compare Source
Minor Changes
Patch Changes
Fixed pnpm v11 incorrectly reporting
confirmModulesPurgeas unrecognized when set inpnpm-workspace.yaml. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting.pnpm install --frozen-lockfileno longer fails withERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILEwhen the pinned pnpm version recorded inpnpm-lock.yamlhas to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged #14124.Under
nodeLinker: hoisted, peer-resolution variants of an injected directory dependency (afile:snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this.Fixed
pnpm install --merge-git-branch-lockfiles --frozen-lockfilefailing withERR_PNPM_OUTDATED_LOCKFILEwhen a branch lockfile predates the removal of a dependency, or its move to another dependency group #13966. A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it.Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the
publishandpostpublishscripts after each completed registry group pnpm/pnpm#14101.The Rust CLI now honors five settings it recognized but ignored:
updateNotifier,legacyDirFiltering,initAuthorName/initAuthorEmail/initAuthorUrl,initLicense, andinitVersion.pnpm installandpnpm addcheck once a day for a newer pnpm and print how to get it (turn it off withupdateNotifier: false); a{<dir>}filter selector can go back to matching the subtree below the directory withlegacyDirFiltering: true; andpnpm initwrites the configured author, license, and version into thepackage.jsonit scaffolds.PNPM_CONFIG_INIT_VERSIONis now read as well.maxsockets, npm's spelling ofmaxSockets, is no longer ignored: both spellings are read frompnpm-workspace.yaml, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently.A
lastUpdateChecktimestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around.legacyDirFilteringno longer reaches the workspace-root selectors pnpm generates for itself: the!{<workspace-root>}exclusion a recursiverun/exec/add/testappends, and the{<workspace-root>}inclusion--workspace-rootappends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and--workspace-rootpulled in every project below the root instead of the root alone #14101.pnpm install --frozen-lockfileno longer fails whenpnpm-lock.yamlrecords the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block #14124.v11.23.0: pnpm 11.23Compare Source
Minor Changes
pnpm config getandpnpm config listnow show the settings pnpm acts on under their documented names:registriesshows the registries pnpm resolves from, merged across every source (.npmrc,pnpm-workspace.yaml, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare@scope. Built-in routes are included — the@jsrscope and thenpmjsandghprefixes — unless pointed elsewhere. Previouslypnpm config get registriesprintedundefined.updateandauditshow the effective sections, whichever spelling set them. The deprecated internal spellings (updateConfig,auditConfig,auditLevel) are no longer listed.catalogsshows the complete resolved catalog set — the singularcatalogblock is itsdefaultentry — whichever spelling declared it.registryand@scope:registryentries show the merged routes rather than raw.npmrcvalues, so they always agree with theregistriesview.Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level
pnpm-workspace.yaml(where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example,globalShimsis a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project'spnpm-workspace.yaml, previously ignored silently, are now reported the same way.pnpm config get <key>andpnpm get <key>no longer print config-load warnings, so a script capturing the value gets the value alone.The
importPackagepnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on #14101.node_modules/.modules.yamlno longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it.It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use:
pnpm list,pnpm why, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one.They now use the configured registries, like every other command already did.
When
enableGlobalVirtualStoreis on, every prConfiguration
📅 Schedule: (in timezone UTC)
* 5-9 * * 7)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by self-hosted Renovate.