Skip to content

chore(deps): update all non-major dependencies - #73

Merged
sapphi-red merged 5 commits into
mainfrom
renovate/all-minor-patch
Aug 3, 2026
Merged

chore(deps): update all non-major dependencies#73
sapphi-red merged 5 commits into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
@iconify-json/lucide ^1.2.119 → ^1.2.121 age confidence devDependencies patch
@vueuse/core (source) ^14.3.0 → ^14.4.0 age confidence devDependencies minor
oxfmt (source) ^0.60.0 → ^0.61.0 age confidence devDependencies minor
oxlint (source) ^1.75.0 → ^1.76.0 age confidence devDependencies minor
pnpm (source) 11.17.0 → 11.18.0 age confidence packageManager minor
vite (source) ^8.1.5 → ^8.2.0 age confidence pnpm-workspace.overrides minor
vitepress (source) 2.0.0-alpha.18 → 2.0.0-alpha.19 age confidence devDependencies patch
vitepress-plugin-group-icons ^1.7.5 → ^1.7.6 age confidence devDependencies patch
zizmorcore/zizmor-action v0.6.1 → v0.6.2 age confidence action patch

Release Notes

vueuse/vueuse (@​vueuse/core)

v14.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
oxc-project/oxc (oxfmt)

v0.61.0

Compare Source

oxc-project/oxc (oxlint)

v1.76.0

Compare Source

🚀 Features
  • 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#​24598) (vigneshwar)
  • 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#​24724) (Bartok)
  • 016cf2a linter/oxc: Add bad-match-all-arg rule (#​24900) (camc314)
  • cdc941e linter/n: Implement exports-style rule (#​24087) (Mikhail Baev)
  • 1ad6f6c linter/eslint: Implement id-denylist rule (#​24632) (Mikhail Baev)
📚 Documentation
pnpm/pnpm (pnpm)

v11.18.0: pnpm 11.18

Compare Source

Minor Changes

  • Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through optionalDependencies is installable on the current system but one of its regular dependencies is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with MODULE_NOT_FOUND. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped #​13286.

  • pnpm setup now appends PNPM_HOME and the global bin directory to the GitHub Actions environment files (GITHUB_ENV and GITHUB_PATH), so later steps in the same job can run pnpm add --global and other global commands #​9191.

  • Added support for publishConfig.name, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents, pnpm-lock.yaml, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check of pnpm publish -r, its registry selection, and the release-planning probes of pnpm change status and pnpm version -r #​13345.

  • pnpm self-update no longer takes any instruction from the project it is run in:

    • pnpm is fetched through the same trusted registry and auth configuration used when switching pnpm versions, so a project .npmrc or pnpm-workspace.yaml can no longer redirect the download or attach credentials to it, and the project's default .pnpmfile.(c|m)js is no longer loaded. Pnpmfiles from trusted sources (the pnpmfile setting, the global pnpmfile, config dependencies) still apply.
    • The minimumReleaseAge settings in pnpm-workspace.yaml no longer affect self-update. They still govern the project's own dependencies; for self-update the cooldown now comes from the built-in default, your global config, a PNPM_CONFIG_* environment variable, or a command-line flag. This fixes self-update failing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it.
    • The same applies to the trustPolicy settings and to ci: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses.

    When self-update refuses a version that is younger than the cutoff, an interactive run now offers to update anyway; non-interactive runs still fail. CI never prompts, even on a runner that attaches a TTY.

Patch Changes

  • Fixed pnpm licenses list to report every version when the same package is installed under multiple aliases pnpm/pnpm#13438.

  • Sort pnpm dedupe --check snapshot changes for stable output across pnpm implementations.

  • Strip Unicode formatting characters from registry- and manifest-derived terminal output.

  • Speed up installs after compatible catalog or direct dependency range changes by retaining the locked version without resolving the dependency graph again.

  • Speed up installs after safe override changes by reusing unambiguous compatible dependency resolutions, pruning obsolete dependencies, applying independent replacements and removals together, and handling parent-scoped "-" overrides without full lockfile resolution.

  • Installing a local file: directory dependency with the global virtual store enabled no longer fails with TypeError: Cannot read properties of undefined (reading 'split') #​13335.

    Local directory dependencies — file: directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.

  • The Workspace column of pnpm update --interactive now falls back to the project's path when its name is only whitespace, as it already did for a missing or empty one — all three render an equally blank label otherwise.

  • Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither pnpm outdated nor pnpm update reads the workflow files unless --include-github-actions is passed or update.githubActions is set to true in pnpm-workspace.yaml. Reading them runs git ls-remote against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) #​13254.

    pnpm outdated accepts the --include-github-actions option too.

  • pnpm update --interactive now measures its table in terminal columns rather than in characters. A package name, workspace name, or version containing wide characters (CJK, most emoji) no longer knocks its row's columns out of line with the rest of the group, and a wide character in a version no longer aborts the command with Subject parameter value width cannot be greater than the container width #​13357.

  • The Workspace column of pnpm update --interactive is more informative in two cases. A dependency outdated at the same version in several workspace projects is offered as one choice, since selecting it updates every project — that choice now names all of them instead of only the first. And a workspace project without a name is now labelled with its path rather than left blank, so several unnamed projects can be told apart.

  • An auto-installed optional peer is no longer hoisted at a version the workspace root's own dependency on that package excludes. resolvePeersFromWorkspaceRoot already made the workspace root's specifier decide which version a missing required peer is installed at; the optional-peer picker ignored it and always took the highest version present anywhere in the graph. In a workspace whose root pins postcss: 8.5.10, an importer that depends on webpack and declares no postcss of its own got postcss@8.5.22 hoisted for terser-webpack-plugin's optional postcss peer, leaving two postcss@8.5.x instances in the graph #​13320.

  • overrides now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because autoInstallPeers is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with overrides: { react: npm:react@19.2.0 } and a lone lucide-react dependency, pnpm installed react@18.3.1; it now installs the pinned react@19.2.0 #​13320.

  • Under resolvePeersFromWorkspaceRoot, a workspace root dependency declared with link: or file: (or the path form of workspace:, such as workspace:../pkg) now satisfies another project's missing peer dependency at the linked package's own version, instead of being hoisted as a path. Those specifiers are relative to the project that declares them, so the same specifier reached a different directory — or none — from the project the peer was hoisted into, leaving a broken link. The root now has the same authority over the peer as it has when it declares the package with a version range #​13373.

  • Installs through a pnpr server now apply the project's whole verification policy. minimumReleaseAgeExclude, minimumReleaseAgeIgnoreMissingTime, trustPolicy, trustPolicyExclude, trustPolicyIgnoreAfter, and trustLockfile were ignored, so excluded packages were still held back and a lockfile containing them could be rejected.

    trustPolicy: no-downgrade no longer fails with TRUST_POLICY_INCOMPATIBLE_WITH_PNPR when a pnpr server is configured.

    --frozen-lockfile and --no-prefer-frozen-lockfile are now honored on the pnpr path, instead of resolving and rewriting the lockfile anyway. Since frozenLockfile defaults to true on CI, a CI install through a pnpr server now fails on an out-of-date lockfile rather than updating it.

  • Workspace installs through a pnpr server no longer crash with Cannot read properties of undefined (reading 'filter') after linking, when minimumReleaseAge is active #​13275.

  • Fixed pnpm dedupe updating valid catalog resolutions when another matching version exists in the lockfile.

  • pnpm -r run "/pattern/" --no-bail no longer exits zero when one of a project's matched scripts fails and a later one passes. The run summary carries a single status per project, and the passing script overwrote the recorded failure.

  • Restored the store block a first install prints, naming how packages were materialized and where the stores live #​13315:

    Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: ~/.local/share/pnpm/store/v11
  Virtual store is at:             node_modules/.pnpm

  • The root project's pnpm:devPreinstall script now runs before resolution and linking, as it does in pnpm 11. It is skipped under --ignore-scripts, --lockfile-only and --dry-run, by pnpm fetch and pnpm rebuild, and by a repeat install that is already up to date. Workspaces that use the hook to prepare state the install depends on — such as next.js, which generates a placeholder next bin with it — were left with dependents linked against files that were never created #​13313.

  • Prevented pnpm dedupe --check from removing an incompatible node_modules directory.

  • pnpm update --workspace no longer links dependencies the user never named:

    • Running it with updateConfig.ignoreDependencies configured no longer fails with ERR_PNPM_WORKSPACE_PACKAGE_NOT_FOUND for a dependency that is only published to the registry. Such dependencies keep their specifiers, as they already did when no dependencies were ignored.
    • Passing package selectors that match no direct dependency no longer falls back to linking every workspace dependency.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
vitejs/vite (vite)

v8.2.0

Compare Source

Features
Bug Fixes
  • bundledDev: print build errors to the terminal when an HMR update fails (#​23024) (41c4658)
  • deps: update all non-major dependencies (#​23069) (4c07b74)
  • hmr: preserve environment snapshot during server restart (#​22992) (b1186c3)
  • importAnalysis: interop imports injected into optimized dep files by plugins (#​23029) (8c2a87d)
  • module-runner: keep stack trace interception working when Object.prototype is frozen (#​23073) (599c5b0)
  • server: strip base in indexHtml module graph lookup (#​22932) (fa005d1)
  • support resolving top-level input option with plugins (#​23101) (41df81a)
Documentation
Tests
vuejs/vitepress (vitepress)

v2.0.0-alpha.19

Compare Source

Bug Fixes
  • build: apply rewrites when computing createContentLoader urls (9e2148d)
  • build: clear markdown cache with rewritten path on include change (5eac447), closes #​5035
  • build: compose markdown preConfig hook when extending configs (c39a85a), closes #​5205
  • build: don't apply docsearch css transform to pages matching its filter (fa0e48c)
  • build: don't rely on checkout directory name when externalizing types (e6ba9d8)
  • build: report links to pre-rewrite paths of rewritten pages as dead (3cf3f37)
  • build: resolve additional configs by source path (5e4a9e7)
  • build: resolve rewrites against externally injected pages too (769c10e)
  • build: respect cleanUrls in content loader render (027f046), closes #​4331 #​5299
  • build: track include importers by module id (c961655)
  • build: prevent duplicate IDs in MiniSearch (#​5303) (505278c)
  • build: remove stackTraceLimit Infinity for DEBUG (#​5318) (865d04b)
  • build: retry file reads when out of file descriptors (da71173)
  • cli: avoid onAfterConfigResolve (3fbaf9c)
  • client: make the route the single source of truth for the URL hash (dcb7a75)
  • markdown: preserve user-defined attributes (3f4530b), closes #​5123
  • markdown: remove extra whitespace from container markup (b6d9cb8)
  • markdown: skip circular includes (3372516)
  • markdown: remove deprecated cjkFriendly option (27762ea)
  • markdown: rename image option lazyLoading to lazyLoad (078786a)
  • search: index changed files with srcDir-relative paths in dev (6b64f35), closes #​3374
  • search: only index pages on dev updates (559fb24)
  • search: serve a fresh search index after dev updates (1534a67)
  • search: skip pages that fail to render instead of crashing dev server (3ffefa2)
  • theme: use ul and li for lists (#​5326) (3f99872)
  • theme: align docsearch breakpoints with the default theme (90c28d4), closes #​5213
  • theme: align local search breakpoint (#​5217) (a425113)
  • theme: correct anchor scroll margins across viewports (dabc5e9)
  • theme: ensure outline marker follows click (#​3879) (31287c0)
  • theme: external link icon not showing in navbar links (225c94a), closes #​5306
  • theme: pass target and rel to prev/next page links (#​5297) (6b5e770)
  • theme: preserve url params when switching languages (#​5312) (9ee401d)
  • theme: prevent TypeError when navigating to page without outline (#​5329) (9376c58)
  • theme: remove font-synthesis style (#​5309) (c34769c)
  • theme: safari not showing external link icon properly (7118402)
  • theme: rebuild the base styles on tailwind's preflight (f1ee913)
  • theme: route cjk punctuation to matching system fonts (91b06b6)
  • theme: remove deprecated disableDetailedView local search option (cec4998)
  • theme: remove deprecated lastUpdatedText option (18d1b47)
  • theme: remove deprecated outlineTitle option (95c0420)
  • types: declare Badge as a global component (ca8ba5b)
  • types: import EnhanceAppContext from package entry in theme.d.ts (8ff1f3e), closes #​5156
Features
Performance Improvements
  • build: reuse lastUpdated from markdown rendering in sitemap generation (fdd68e3)
  • md: bypass gray-matter's unbounded cache (4f8703d)
  • md: limit the compile cache's memory usage (2fb6bda)
  • use hook filters in vite plugins (fa24c6d)
Reverts
BREAKING CHANGES

  • markdown.anchor options are now typed by @mdit/plugin-anchor. Common options (level, slugify, permalink, getTokensText, tabIndex, etc.) are unchanged, but the deprecated markdown-it-anchor permalink options (permalinkSymbol, renderPermalink, ...) are no longer accepted. Permalink builders like headerLink are named exports of @mdit/plugin-anchor instead of properties of the plugin.

  • markdown.attrs options are now typed by @mdit/plugin-attrs: leftDelimiter, rightDelimiter, and allowedAttributes are renamed to left, right, and allowed. A rule option is available for toggling individual attribute rules (VitePress disables fence by default).

  • markdown.codeCopyButtonTitle is now markdown.codeCopyButton.tooltipText, and its default changed from "Copy Code" to "Copy code". The --vp-code-copy-copied-text-content CSS variable and its built-in per-language :lang() defaults are removed - set codeCopyButton.copiedText (per locale) instead.

  • useData().hash has been removed. Read the hash from useRoute() instead.

  • callers of vitepress' build() will now notice the version banner gets printed. To disable that, pass a noop function:

    build(root, {
  onAfterConfigResolve() {}
})

  • custom themeConfig.i18nRouting functions now receive the current Route as their second argument instead of the hash

  • normalize-level defaults differ from the old reset - native select and number-input chrome is restored, headings inherit font size and weight, the hidden attribute is enforced with !important, and every element starts with zero margin/padding and border-style: solid. Sites layering custom CSS on the default theme may notice.

  • relative urls in included markdown files resolve against the included file rather than the including page. Partials written for one specific location may need their links updated, or markdown.include.rebaseRelativeUrls set to false to keep resolving them from the including page. Absolute and external urls are unaffected. Note that the marker comments shift the line numbers reported for dead links following an include, which already pointed into the include-expanded source rather than the original file.

  • init: scaffold() now returns a Promise<string> and must be awaited.

  • The defs property of markdown.emoji has been renamed to definitions.

  • The markdown.attrs.disable option has been removed. Set markdown.attrs to false instead.

  • The markdown.image.lazyLoading option has been renamed to markdown.image.lazyLoad.

  • The deprecated disableDetailedView option of local search has been removed. Use detailedView: false instead.

  • The deprecated markdown.cjkFriendly option has been removed. Use markdown.cjkFriendlyEmphasis instead.

  • The deprecated themeConfig.lastUpdatedText option has been removed. Use themeConfig.lastUpdated.text instead.

  • The deprecated themeConfig.outlineTitle option has been removed. Use themeConfig.outline.label instead.

  • The Inter4CJK font family has been renamed to 'Inter Core'. Custom --vp-font-family-base overrides referencing Inter4CJK must be updated.

yuyinws/vitepress-plugin-group-icons (vitepress-plugin-group-icons)

v1.7.6

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.2

Compare Source

zizmor 1.29.0 is now the default version.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Aug 3, 2026
@netlify

netlify Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for vite-plugin-registry ready!

Name Link
🔨 Latest commit 9a1965f
🔍 Latest deploy log https://app.netlify.com/projects/vite-plugin-registry/deploys/6a7014590ba5cf00089b9d55
😎 Deploy Preview https://deploy-preview-73--vite-plugin-registry.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@sapphi-red
sapphi-red merged commit 51d878c into main Aug 3, 2026
11 checks passed
@sapphi-red
sapphi-red deleted the renovate/all-minor-patch branch August 3, 2026 04:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sapphi-red