Repository navigation
chore(deps): update all non-major dependencies - #424
renovate[bot] wants to merge 1 commit into
Conversation
|
🚀 Changeset Version PreviewNo changeset entries found. Merging this PR will not cause a version bump for any packages. |
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx affected --targets=test:sherif,test:docs,tes... |
❌ Failed | 11s | View ↗ |
nx run-many --target=build |
✅ Succeeded | 6s | View ↗ |
☁️ Nx Cloud last updated this comment at 2026-11-06 01:49:00 UTC
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
commit: |
a2b0f46 to
d97ff5a
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
d6f9b2f to
cef273d
Compare
3ef5c9c to
88fc800
Compare
aeb2cb9 to
a3c5659
Compare
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
a3c5659 to
ccccf91
Compare
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^5.104.5→^5.105.35.106.1(+1)^6.1.2→^6.2.1^3.3.13→^3.3.14^10.13.0→^10.14.0^17.13.0→^17.14.024.0.2→24.0.324.0.412.14.0→12.17.012.18.0>=12.14.0→>=12.17.012.18.0^7.8.5→^7.8.6^0.23.1→^0.23.40.23.5^8.72.0→^8.72.1^8.3.4→^8.3.58.3.6^5.0.5→^5.1.0v0.8.0→v0.8.1bump,lockfileUpdate, orrollbackupdates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).Release Notes
TanStack/query (@tanstack/query-core)
v5.105.3Compare Source
Patch Changes
#11537
3f4de1b- Prevent a cancelled retry from pausing the query when its retry delay expires.#12497
969e580- Allow static queries without data to refetch after reset, invalidation, or an explicit refetch. A query is static only when it has data.v5.105.2Compare Source
Patch Changes
#10969
2ee2fd9- Fix infinite queries to respect a reducedmaxPageslimit when fetching in either direction.#12480
8d0dc27- Excludestatusfrom the filters accepted byQueryClient.isMutating,useIsMutating, andinjectIsMutating. These APIs always count mutations withstatus: 'pending'.#12442
e69cac6- Handle the rejection of a paused refetch started byrefetchQuerieswiththrowOnError, so cancelling it later no longer causes an unhandledCancelledError.#12447
f2215d2- Use() => voidinstead of the DOM-onlyVoidFunctiontype inaddConsumeAwareSignal, so the published declarations type-check without the DOM lib.#10777
86e7957- FixshallowEqualObjectsto compare own property keys and values and ignore inherited properties. Objects with different own keys now compare as unequal, including when the differing values areundefined.#12489
b6576b3- Keep all callers of an in-flight query waiting for the replacement fetch when invalidation cancels it, including after repeated invalidations.#12481
af0e0ef- Prevent cancelled streamed queries from writing to the cache or starting a delayed stream, even when the stream does not consume the abort signal.#11788
05d9b6a- ClearisPausedon a mutation that can start once itsonMutateresolves, so it is no longer dehydrated and resumed a second time while its request is in flight.v5.105.1Compare Source
Patch Changes
#12406
6f8a48d- Reduce temporary allocations when checking tracked result properties for observer notifications.#12390
18e54bf- ExcludefetchStatusfrom the filters accepted byQueryClient.isFetching,useIsFetching, andinjectIsFetching. These APIs always count queries withfetchStatus: 'fetching'.v5.105.0Compare Source
No changes in this release.
vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.2.1Compare Source
Fix
refreshIncludeandrefreshExcludeoptions not working (#1543)Fix mistake from #1516
v6.2.0Compare Source
Add
refreshIncludeandrefreshExcludeoptions (#1516)Add
refreshIncludeandrefreshExcludeoptions to skip fast refresh for certain files that won't run in the browser.Expand
oxc-transform-reactpeer dependency range (#1540)The peer dependency version range for
oxc-transform-reactwas expanded from^0.152.0to>=0.152.0 <0.157.0.Expand
@rolldown/plugin-babelpeer dependency range (#1541)The peer dependency version range for
@rolldown/plugin-babelwas expanded from^0.1.7 || ^0.2.0to^0.1.7 || ^0.2.0 || ^0.3.0.vuejs/language-tools (@vue/language-core)
v3.3.14Compare Source
language-core
__VLS_unwrapto keep literal bindings on TS 7.1 (ce6c1de)neverslot props for dynamic slot names in generic components (7957e7f)$eventparameter of inline handlers explicitly (d3b42a1)@ts-nocheckand/// <reference>effective in script setup (c2e2e6f)language-service
html.customDataconfiguration (3961653)typescript-plugin
Contributors: @johnsoncodehk, @lazerg, @ValentinYoushkevich, @so1ve, @WangKepeople
eslint/eslint (eslint)
v10.14.0Compare Source
Features
d23a7f9feat: fix property descriptor handling infunc-name-matching(#21400) (xbinaryx)Bug Fixes
4a12580fix: require minimatch10.2.6to avoid vulnerable brace-expansion (#21460) (lumir)827a8f3fix:no-restricted-globalscrash on global objects as property values (#21449) (xbinaryx)161558afix: handle LS, PS and empty hashbang comments (#21419) (lumir)6194939fix:no-invalid-thiscrash onaccessorfields without initializer (#21442) (xbinaryx)9155e14fix: Update @humanfs/node dependency version (#21434) (Nicholas C. Zakas)cb2b9d4fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)5ee3915fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)Documentation
0f94f47docs: removezh-hansfrom docs language switcher (#21437) (lumir)dab466edocs: Update README (GitHub Actions Bot)97431f8docs: replace--rulesdirwith a virtual plugin in custom rules docs (#21452) (Pixel)7697550docs: Update README (GitHub Actions Bot)0c699d5docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)0880666docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)e06fe87docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)Chores
0e2ab70ci: disableeslint-plugin-unicornecosystem test (#21462) (Francesco Trotta)6e3f988chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])a031c40chore: update ecosystem plugins (#21445) (ESLint Bot)67d2ca2chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)276021dchore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])449724echore: update ecosystem plugins (#21420) (ESLint Bot)8ffeb8cchore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])sindresorhus/globals (globals)
v17.14.0Compare Source
7abfb5dnrwl/nx (nx)
v24.0.3Compare Source
24.0.3 (2026-10-30)
🩹 Fixes
❤️ Thank You
pnpm/pnpm (pnpm)
v12.17.0: pnpm 12.17Compare Source
pnpm 12.17.0 adds
pnpm peers check --global, dependency-group selectors and wildcards inoverrides, and runtime, package manager, Cargo, and Python updates inpnpm outdatedandpnpm update. It also fixes files that other users could not read in Docker images, and repeat installs that missed changes to local dependencies.Minor Changes
pnpm peers checknow accepts--global(-g) to check globally installed packages. After a global install or update, the peer dependency warning now suggestspnpm peers check -g#17504.pnpm outdatedandpnpm updatenow inspect and update package manager and runtime versions indevEngines.packageManager,packageManager,devEngines.runtime,engines.runtime, andruntime:dependencies. Withcargo.enabledorpython.enabled,pnpm outdatedandpnpm updatealso inspect and update Cargo dependencies inCargo.tomlandCargo.lockand Python dependencies inpyproject.tomlandpylock.toml.overridesselectors now support:prod,:optional, and:peerpseudo-selectors that target a single dependency group. They also support*wildcard patterns on parent and target package names. An override with a non-range value, such asnpm:orfile:, no longer adds a peer dependency todependencies. Removing an optional dependency with"-"now also removes the duplicate entry fromdependencies#5391.Patch Changes
Installing packages
Files that pnpm creates in a project now get the permissions the umask gives any new file, such as
0644. Before, several of them were readable only by the user who ran pnpm, which broke Docker images that run as a different user #17435.The fix applies to:
node_modules/.pnpm-workspace-state-v1.json. A different user runningpnpm runreinstalled the dependencies because it could not read this file.pnpm-workspace.yamlpnpm deploypnpm patch-commitpnpm dedupe --checkWhen pnpm edits an existing file, the file keeps its permissions.
pnpm installno longer writes broken dependency links when the project'snode_modulesis a symlink to another directory, such as another project'snode_modules. The install reported success, but the links it wrote did not resolve #17448.Commands installed with
pnpm add --globalnow find the dependencies that pnpm hoists for their package. A package that loads a dependency it does not declare, such as a native addon's platform-specific package, failed with "Cannot find module". Reinstall such a package withpnpm add --globalto update its existing command #17503.When pnpm switches to the version a project pins, it now installs that version's native binary for the current host, even if the project's
supportedArchitecturesexcludes the host. Before, pnpm could not use the pinned version and kept running the installed one. pnpm also repairs a pinned version that an earlier install left without the host's binary.With the global virtual store, a change to a dependency of one package in a dependency cycle now gives every package in that cycle a new directory. Before, the other packages kept their directories and still linked the old copy of the changed package, so the project could load two copies of it #17466.
Packages in a dependency cycle, and packages that depend on one, move to new global virtual store directories once after this update. Those that run a build miss the side-effects cache once.
With
nodeLinker: hoisted, when two workspace projects need the same package version and it cannot be hoisted to the root, each project now keeps the copy installed in its ownnode_modules. Build scripts run in each of these copies. Before, the second project's copy was replaced with a symlink to the first project's, so every repeat install imported it again #17498.The Node.js
latestselector now chooses the newest stable release #17490.Hardlinking from the store now stats each store file once per install. Since pnpm 12.8.0, a store file was stat'ed again for every package that links it. On an offline install of a large workspace, that added up to 15% system CPU #17500.
Repeat installs and local dependencies
pnpm install --frozen-lockfileno longer reports an outdated lockfile right after the install that wrote it. This happened when a pnpmfilereadPackagehook orpackageExtensionschanged the dependencies or peer dependencies of a local directory dependency outside the workspace projects. It affected afile:dependency, an injectedworkspace:../dirdependency outside the workspace patterns, and an injected workspace package left out by--filter#17447 #17473.A repeat
pnpm installnow takes the fast path whenignoredOptionalDependenciesremoves an optional dependency of afile:directory dependency. It used to resolve again on every run.pnpm installnow resolves again after an edit to an injectedworkspace:../dirdependency outside the workspace patterns under a shared lockfile. It used to keep the lockfile unchanged. The nextpnpm install --frozen-lockfilethen failed #17476.pnpm installnow resolves a local directory again after itspackage.jsonchanges when an override or a package extension adds it to the dependencies of a registry package.pnpm install --frozen-lockfilefails on a lockfile that still records the old dependencies of such a directory #17486.With
injectWorkspacePackagesand per-project lockfiles,pnpm installnow updates a project's lockfile when a local tarball that an injected workspace project depends on is replaced. The project's lockfile kept the old version and integrity before.pnpm installnow detects a change to a local tarball or directory that only a pnpmfilereadPackagehook depends on. A repeat install reported "Already up to date" and kept the old contents before pnpm/tasks#227.pnpm installnow relinks aworkspace:orlink:dependency whose link was deleted fromnode_modules. It used to report "Already up to date" and leave the link missing #17485.A repeat
pnpm installreports "Already up to date" again when a pnpmfilereadPackagehook changes the dependencies of a workspace project. Since 12.15.0, every such install ran in full #17468.After an edit to a project's
package.json,pnpm installandverifyDepsBeforeRunnow run the pnpmfile'sreadPackagehook on the edited manifest before comparing it with the lockfile. They could report the project up to date when the hook rewrote the edited dependency to a specifier the lockfile did not record.Adding and updating dependencies
pnpm update --latestwith package selectors now updates the dependencies of the selected packages within their declared ranges. Excluded packages and their dependencies keep their locked versions #17444.pnpm add <pkg>@<tag>now uses a catalog entry set to that same dist-tag. The dependency is saved ascatalog:and the entry stays as written pnpm/tasks#225.When
pnpm addadds a new dist-tag such asvue@legacyto a catalog, the catalog entry records the exact version the tag points to. The same applies to a dependency added without a version when thetagsetting names a dist-tag other thanlatest.pnpm addnow saves the resolved version range of an npm alias. For example,pnpm add v2@npm:vueandpnpm add v2@npm:vue@^3.0.0both savenpm:vue@^3.5.13.Running scripts and commands
Programs that a script or
pnpm execcommand leaves running, such as a browser opened by theopenpackage, now outlive pnpm exactly when they would outlive the command run without pnpm. Before, on Windows, a failed command,Ctrl+C, or a closed terminal ended all of them. pnpm still ends them when it is killed or crashes.When a recursive or parallel run bails, the scripts still running now receive
SIGTERMon Unix and are killed only if they are still running two seconds later. On Windows, everything those scripts started is ended, including detached processes whose parent has already exited. Before, a bail killed them at once #17465.On Windows, the shell shim of a
.cmdor.batbin now runs it under Git Bash when MSYS argument conversion is off, such as withMSYS_NO_PATHCONV=1orMSYS2_ARG_CONV_EXCL='*'. The shim used to start an interactive cmd.exe prompt #17480.pnxandpnpm createnow run the command in the directory selected by--diror--workspace-root. Without either flag, the command still runs in the directory pnpm was started in.pnpm --env-filenow reads files the waynode --env-filedoes. Values are taken as written, so$VARis no longer expanded and Windows paths such asC:\Users\meload unchanged. A file is no longer rejected for its contents.Settings and messages
pnpm versionno longer creates a git commit and tag whengitTagVersionis set tofalse#17460.pnpm publishnow reads thepublishBranchsetting frompnpm-workspace.yamland fromPNPM_CONFIG_PUBLISH_BRANCH. The--publish-branchflag overrides it.pnpmnow accepts--strict-ssland--local-address <ip>on the command line.pnpm doctoruses a 15-second timeout when checking registry connectivity.pnpm-workspace.yamlparse errors now reportERR_PNPM_INVALID_SETTING.The error for a dependency with an invalid name in a project's manifest now names the project's directory. It used to say only "The current package", which did not tell which workspace project to fix #17475.
Platinum Sponsors
Gold Sponsors
v12.16.1: pnpm 12.16.1Compare Source
This release fixes
pnpm installhanging on a cold store in workspaces that install Cargo crates, andpnpm packshipping a file thatfilesexcludes by name.Patch Changes
pnpm installno longer hangs on a cold store in a workspace that also installs Cargo crates or a Rust toolchain.pnpm packandpnpm publishnow apply afilesentry that names a file after the glob and directory entries, as npm does. A file excluded by name, such as!dist/index.js, stays out even when a laterdist/**matches it. A file named by its path, such aslib/secret.js, ships even when a later!lib/*.jsmatches it.pnpm installno longer leaves a broken symlink in an injected workspace dependency when the package links to a file outside its published files and pnpm imports by hardlink. Installing a git dependency now skips internal directory symlinks when importing its files into the store.pnpm installnow relinks a command that a workspace project renames into the projects that depend on it whensharedWorkspaceLockfileisfalsepnpm/tasks#224.pnpm installandpnpm rebuildnow refresh privately hoisted.binshims innode_modules/.pnpm/node_modules/.binafter a dependency build replaces a script target with a native executable #17402.pnpm installnow reads a package's manifest to decide its peer dependencies when it updates an existing lockfile, as it does when it resolves from scratch.Commands,
pnpm --version,pnpm self-update, and invocations with unknown flags now apply the samepackageManageranddevEngines.packageManagersettings when switching to the pinned pnpm version or recording it inpnpm-lock.yaml. `--config.<Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.