chore(deps): update npm non-major dependencies - #1385
Open
github-actions[bot] wants to merge 1 commit into
Open
github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
github-actions
Bot
force-pushed
the
renovate/npm-non-major-dependencies
branch
6 times, most recently
from
September 27, 2026 13:21
95afeac to
fa9335d
Compare
github-actions
Bot
force-pushed
the
renovate/npm-non-major-dependencies
branch
from
September 28, 2026 16:01
fa9335d to
f9722cc
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
10.1.4→10.1.59.8.1→9.9.06.7.0→6.8.06.7.0→6.8.06.7.0→6.8.06.7.0→6.8.06.7.0→6.8.08.70.0→8.70.18.70.0→8.70.15.0.1→5.0.26.0.0→6.0.118.3.0→18.4.011.4.0→11.4.117.5.1→17.6.07.0.3→7.0.55.0.3→5.1.011.27.0→11.28.13.9.8→3.9.92.3.1→2.3.31.2.9→1.2.111.104.1→1.105.011.1.1→11.2.07.2.2→7.3.07.4.13→7.4.168.70.0→8.70.18.3.0→8.3.15.0.1→5.0.218.1.0→18.2.0Release Notes
fastify/fastify-static (@fastify/static)
v10.1.5Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5
fastify/fastify-swagger (@fastify/swagger)
v9.9.0Compare Source
What's Changed
Full Changelog: fastify/fastify-swagger@v9.8.2...v9.9.0
v9.8.2Compare Source
What's Changed
Full Changelog: fastify/fastify-swagger@v9.8.1...v9.8.2
lingui/js-lingui (@lingui/cli)
v6.8.0Compare Source
Bug Fixes
Features
Reverts
BatchExtractor(#2562)" (#2673) (fd416f9)lingui/js-lingui (@lingui/core)
v6.8.0Compare Source
Note: Version bump only for package @lingui/core
lingui/js-lingui (@lingui/format-json)
v6.8.0Compare Source
Note: Version bump only for package @lingui/format-json
lingui/js-lingui (@lingui/react)
v6.8.0Compare Source
Bug Fixes
lingui/js-lingui (@lingui/vite-plugin)
v6.8.0Compare Source
Features
typescript-eslint/typescript-eslint (@typescript-eslint/eslint-plugin)
v8.70.1Compare Source
🩹 Fixes
await(#12716)❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
typescript-eslint/typescript-eslint (@typescript-eslint/parser)
v8.70.1Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
vitest-dev/vitest (@vitest/coverage-v8)
v5.0.2Compare Source
🐞 Bug Fixes
processin case global is overwritten - by @AriPerkkio in #11343 (0b792)process.stdiohandles - by @AriPerkkio in #11333 (0fd6b)toMatchObjectwith asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in #11100 (42523)RequestwithBlobbody on jsdom 28+ - by @harshit-d3v in #11295 (d1c3e)agentto respect--silent- by @Raj4478 and @AriPerkkio in #11271 (5b95e)createReportcalls - by @7rulnik in #11278 (e8e55)hanging-processto use ESM entrypoint - by @AriPerkkio in #11316 (4e91e)Set.prototype.add- by @fengmk2 in #11299 (a0a93)View changes on GitHub
chalk/chalk (chalk)
v6.0.1Compare Source
9c93a04eslint-community/eslint-plugin-n (eslint-plugin-n)
v18.4.0Compare Source
🌟 Features
📚 Documentation
jprichardson/node-fs-extra (fs-extra)
v11.4.1Compare Source
emptyDir*()(#1080)lint-staged/lint-staged (lint-staged)
v17.6.0Compare Source
Minor Changes
#1850
938d3f4- Task functions like{ title, task }can now use a logger functionlog()to emit output while the task runs. By default, the output will only be visible if the task fails, unless the--verboseoption was used. Additionally, when the task rejects, the error will be shown in the output.#1854
30562bc- lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like() => "prettier --write .".If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use
--hide-unstagedto hide your changes while tasks run.Patch Changes
#1860
4296532- The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.#1861
c45f28a- Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following exampleeslintandprettierwill run in parallel (for all files, when any JS files are staged):#1859
f0ea69d- Various performance improvements from skipping redundant internal Git calls.#1856
69d7d17- Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.mobxjs/mobx (mobx)
v7.0.5Compare Source
Patch Changes
105d66d73529812a8eddc0847891e7f0c574e129#4713 Thanks @xaviergonz! - perf: reduce memory used by large, mostly unobserved state.intercept/observehandler arrays are allocated at their exact size, an observable's internal observersSetis released once its last observer leaves, observable objects created with the samedeep/autoBindoptions share one default annotation instead of allocating their own, andendBatch()skips the unobservation pass when nothing is pending.v7.0.4Compare Source
Patch Changes
7d85a68fb7e449650535aba22e47ce4d21bfbc10#4592 Thanks @VimHax! - Extend IReactionDisposer with Disposable01211a698b64ea94de8e5f276ff8235fcf8ddf96#4700 Thanks @kubk! - FixonBecomeObservednot firing for dependencies gained when an observed computed is recomputed inside an action.6e0a03ef74750b3040c76d3ecc14c4adf202b95a#4710 Thanks @kubk! - Use TypeScript's built-inNoInferutility instead of a local compatibility alias.pnpm/pnpm (pnpm)
v11.28.1: pnpm 11.28.1Compare Source
pnpm 11.28.1 makes
pnpm installwork in StackBlitz WebContainers, repairs lockfiles whose patch hashes disagree withpatchedDependencies, and fixes many bugs in Windows command shims, injected workspace dependencies, andpnpm deploy.Patch Changes
Installing packages
pnpm installnow works in StackBlitz WebContainers. On projects without a lockfile, it used to fail withENOENT ... pnpm-lock.yaml, because pnpm did not recognize the errors that WebContainers return from asynchronous file system calls. It also failed with "this.db.exec is not a function", becausenode:sqlitethere lacksDatabaseSync.exec. Whennode:sqlitecannot prepare statements either, pnpm stores the index inindex.fallback#15649.pnpm installnow completes after downloading a Node.js runtime specified bydevEngines.runtimewhen pnpm runs on Node.js 24.4.x #14667.pnpm installno longer fails when a package from the registry declares afile:dependency on a directory inside itself, such as"@​types/css-tree": "file:./typings/css-tree". pnpm links that dependency to the directory inside the package, as npm and Yarn do. The lockfile records it aslink:<root>/typings/css-tree#9141.Installing a git-hosted dependency that has to be built no longer fails when that dependency's own dependencies have build scripts nobody approved. pnpm skips those builds while preparing the dependency, as it does without
strictDepBuilds#9764.pnpm now uses pnpm to prepare a git-hosted dependency that is a pnpm workspace without a committed lockfile. It used npm before, which could skip the dependency's build #14011.
When installing a git dependency over SSH fails with
Permission denied (publickey), pnpm suggests checking the loaded keys withssh-add -l. Resolving an SSH URL that refuses the key also shows a local HTTPS rewrite that leaves the recorded URL alone #13743.pnpm install --devandpnpm fetch --devnow install the optional dependencies of devDependencies, such as the platform binaries of Biome and oxlint. The project's ownoptionalDependenciesare still skipped #9678.pnpm install --frozen-lockfilenow works on a detached HEAD whengitBranchLockfileis enabled. The install now reads the lockfiles of the local and remote-tracking branches that contain the checked-out commit. It still writes the sharedpnpm-lock.yaml#7672.pnpm installon CI now fails on an outdated lockfile whenpreferFrozenLockfileis explicitly set totrue. Setting it totrueused to let CI update the lockfile #9072.pnpm installnow fails withERR_PNPM_IGNORED_BUILDSon a repeat install whenstrictDepBuildsis on and a dependency's build is still undecided. A repeat install against an existingnode_modulesreported success where a fresh install failed #10450.pnpm installnow removes an optional dependency fromnode_modulesif its install script fails. Code that checks whether the package is installed no longer finds a package that cannot load #8756.pnpm install --offlineandpnpm add --offlinenow resolve a version range to the newest matching version whose tarball is already in the store. They used to pick the newest version in the cached metadata and fail withERR_PNPM_NO_OFFLINE_TARBALLwhen its tarball was missing #10715.If an offline install fails because the registry metadata cache uses the layout from before pnpm 11.27 and 12.4, the error now names the older mirror on disk and explains that one online install repopulates the cache #15656.
pnpm installnow fails right away when writing package files fails because the store is full. It no longer retries the tarball download first #8581.With
nodeLinker: hoisted,pnpm installnow restores a workspace project'snode_modulesafter it was deleted. Before, the install printed "Already up to date" and left the project without the dependencies nested under it.Under
nodeLinker: hoisted,pnpm installnow clears orphaned package directories that an interrupted or failed install leaves in a project'snode_modules. A directory recorded by the previous install is removed, while an unrecorded directory is moved tonode_modules/.ignored. A copy already in.ignoredis never overwritten #13676.Packages in an external
virtualStoreDircan resolve the project's direct dependencies selected byhoistPattern. Runpnpm install --forceto repair an existing installation #5652.A repeat install now keeps the fast path when a declared local file dependency is replaced by an override #12892.
Store, build cache, and global virtual store
Files imported from the store now follow the umask of the install that writes them. Installing with a umask of
077no longer leaves imported files readable by the group and others #3807.With the global virtual store,
pnpm rebuildno longer modifies packages shared with projects that have not approved their build scripts #12302.The side-effects cache now restores the symlinks that a build script creates inside a package. A warm install used to replace each of them with a copy of its target #12859.
After upgrading, every package with a build script is built once more.
pnpm installnow restores cached build artifacts when reinstalling a workspace that uses separate lockfiles #12942.The global virtual store and the side-effects cache now key built packages by the Node.js version that the root project's
devEngines.runtimeorengines.runtimepins. That is the Node.js their build scripts run with. A dependency that declares its ownengines.runtimeno longer changes the key for every other package.Concurrent installs that share a global virtual store now run a package's build in its shared slot one at a time. A failed build leaves the slot in place and marks it for the next install to rebuild #15568.
Concurrent installs no longer fail when they replace the same stale hoisted dependency link. Virtual store cleanup now keeps the temporary lockfiles that concurrent installs are still writing.
pnpm installkeeps the owner, group, and mode of files already in a shared store, includingindex.db. New store files and directories inherit the store directory's group-write bit. When that directory is setgid, new files inherit its group. pnpm does not change a file's owner or group #12765.When
pnpm installrepairs a store file that was modified through a hard link innode_modules, the repair now keeps the file's inode on Linux and macOS. Hard-linked copies in other projects are healed at the same time. Before, only the project running the install received the restored content. On Windows the repair still replaces the file, so other projects are healed on their next install #3445.A tarball whose integrity pnpm computed during download is now found in the store on the next install. Before, that install downloaded the tarball again once the lockfile recorded the integrity #12562.
pnpm now warns when it cannot hard link packages from an existing store in the pnpm home directory and uses a store on the project's filesystem. This can happen when the project is on another filesystem, such as a bind-mounted workspace in a container. The warning names both stores and suggests setting
storeDir#14505.Resolving and linking dependencies
A peer dependency no longer resolves to two different versions for one package. This happened when the package peer-depends on another package and on one of that package's peers, and it is installed deeper than a direct dependency of the package that provides them #12098.
An optional peer dependency is no longer resolved from another workspace project's package when the project provides one of that package's own peers at a version it rejects. This avoids bogus unmet peer errors #13989.
pnpm no longer reports unmet peer dependency warnings for aliased
npm:peer ranges that a tarball dependency satisfies #11126.pnpm installnow links the executables of auto-installed peer dependencies into the workspace root'snode_modules/.bin, including after a frozen-lockfile reinstall #8511.With
resolutionMode: time-basedandminimumReleaseAgeboth set,pnpm installno longer reports a subdependency as too new when only the time-based cutoff excludes it. Such subdependencies used to fail a strict install withERR_PNPM_NO_MATURE_MATCHING_VERSION, or were added tominimumReleaseAgeExclude#13569.A transitive dependency that has no matching version published before the time-based cutoff now resolves to the lowest matching version allowed by
minimumReleaseAge. pnpm picks a version younger thanminimumReleaseAgeonly if no older version matches #16298.With
minimumReleaseAgeset, re-resolving the lockfile no longer rewrites thepeerDependenciesrecorded for a package whose version did not change. This happened when the registry metadata of a package differed from thepackage.jsonin its tarball #13988.pnpm no longer revalidates cached registry metadata when the registry sends
Cache-Control: max-age=0,no-cache, orno-store. It downloads the metadata again, so a version newly published to such a registry is visible on the next install #13487.pnpm's built-in package compatibility database no longer applies to a project's own manifest. A project named like a published package, such as
vue-loader, no longer gains dependencies onpnpm installorpnpm update. User-configuredpackageExtensionsstill apply to project manifests #11700.Relative local tarball paths in
pnpm.overrideswithout an explicitfile:prefix are now rebased correctly for workspace packages #11131.pnpm no longer reports
pnpm-lock.yamlas broken when a project depends on a package namedconstructor. A__proto__key in the lockfile is now kept as a plain entry when pnpm reads or writes the lockfile. It no longer replaces the prototype of the objects pnpm builds from it #11028.With
nodeLinker: pnp, a workspace package can now require another workspace package it depends on #3567. On Windows, workspace dependency paths in the generated.pnp.cjsnow use forward slashes.Performance
pnpm now uses less memory when installing a package whose archive is larger than 64 MiB unpacked, and when installing a runtime from a zip archive, such as Node.js on Windows, Deno, or Bun #14164.
A fresh install reusing a warm global virtual store skips reimporting packages whose target directory is already complete #11112.
A warm
pnpm installreuses on-disk package metadata for five minutes when the registry does not send an ETag. Registries that send an ETag, including the public npm registry, still revalidate with a conditional request.pnpm updatestill fetches current metadata #13976.Patched dependencies
pnpm installnow repairs apnpm-lock.yamlwhose(patch_hash=<hash>)dependency paths disagree with itspatchedDependenciesmap, including paths that lack the hash their patch calls for. pnpm previously accepted such a lockfile as up to date and kept the old patched files.pnpm install --frozen-lockfilenow fails on such a lockfile withERR_PNPM_INCONSISTENT_PATCH_HASH. It fails withERR_PNPM_UNCHECKABLE_PATCH_HASHwhen a patch hash in the lockfile is malformed, or when the lockfile lacks the package version or patch entry that the check needs #15336.pnpm installnow fails withERR_PNPM_PATCH_NOT_FOUNDwhen a patch file listed inpatchedDependenciesdoes not exist. It used to fail with a rawENOENTerror and a stack trace #5268.pnpm now fails with
ERR_PNPM_INVALID_PATCHED_DEPENDENCYwhenpatchedDependencieshas an invalid shape or contains a non-string value.engineStrictnow checks the patchedpackage.jsonwhen apatchedDependenciesentry changesengines. A patch that relaxesengines.nodeno longer fails the install against the published range #9603.pnpm patchnow applies the existing patch file to the edit directory of a git-hosted dependency, as it already does for packages from the registry #9699.pnpm patch-commitnow fails with an error whengitcannot be found inPATH. It previously reported that no changes were found #8666.Workspaces and filtering
pnpm installrefreshes injected copies of workspace packages when source projects are rebuilt. Injected copies previously stayed stale untilpnpm install --force#4407.Scripts listed in
syncInjectedDepsAfterScriptsnow update injected dependencies while they run. A watcher on the injected package, such as a dev server, sees each change before the script exits #4410.pnpm installno longer fails for an injected workspace dependency whose package publishes from apublishConfig.directorythat its ownpreparescript builds. The injected copy now picks up that directory oncepreparefinishes building it.pnpm install --frozen-lockfileno longer reports the dependency as outdated while the directory has not been built yet #7811.With
sharedWorkspaceLockfile: false, an injected workspace package that has lifecycle scripts is now hard linked into the projects that depend on it. Before, pnpm left a plain copy, so later edits to the package did not reach those projects #9828.injectWorkspacePackagesnow hard links a workspace dependency declared with a relative path, such asworkspace:../foo, the same way it already does forworkspace:*#10446.pnpm installno longer creates anode_modulessymlink inside thepublishConfig.directoryof a workspace package linked withlinkDirectory. A build tool that cleaned its output directory through that symlink deleted the files of the package's dependencies.pnpm installalso removes a symlink that an earlier install left there #16226.When
verifyDepsBeforeRuntriggers an install before a filteredpnpm runorpnpm exec, pnpm now installs only the selected projects and their dependencies. A later filtered command also installs a selected project that an earlier filtered install skipped #11865.pnpm importin a workspace now keeps the versions pinned by ayarn.lockinside a workspace project #4385.Installing with
pnprServerset now records the pnpmfile checksum in the lockfile, so a laterpnpm install --frozen-lockfileaccepts that lockfile. A frozen install through the pnpr server now fails if the pnpmfile changed. If the pnpmfile defines areadPackage,afterAllResolvedorpreResolutionhook or custom resolvers, pnpm resolves dependencies locally and prints a warning that the pnpr server was not used #14460.Installing through a pnpr server now links a workspace project at the directory its
publishConfig.directorynames. An install that resolves through a server which does not forward the setting fails withERR_PNPM_PNPR_PUBLISH_DIRECTORY_MISMATCH. The server rejects apublishConfig.directorythat points outside its project.Adding, updating, and removing dependencies
With
autoInstallPeers,pnpm addandpnpm removein a workspace project keep the locked version of a peer dependency the project declares. In a workspace where another project depended on a different version of that package, the peer could switch to that version #11225.Adding a dependency now keeps unrelated transitive dependencies on their locked versions #11456.
pnpm update --recursive <pkg>no longer changes the version of a peer dependency that another workspace project installs automatically. Such a peer could move to a version outside the range the project declares, for example to React 19 in a project that declaresreact: ^18.3.1#14928.pnpm update package@betaon a dependency declared ascatalog:now updates the catalog entry and keepscatalog:inpackage.json. Before, pnpm wrote the resolved specifier topackage.json#13399.pnpm updatenow applies an override that references a catalog with the catalog's new value when the update bumps that catalog entry. Before, the packages the override targets kept the old version in the lockfile #12159.pnpm add <dir>now warns when the added directory declares peer dependencies, aspnpm linkdoes. The directory is saved as alink:dependency, and its peers are not resolved from the project that adds it. Use thefile:protocol to have them resolved #5523.Running scripts and commands
pnpm runandpnpm execno longer install dependencies automatically when the rootpackage.jsonstill keepsoverrides,packageExtensions,patchedDependencies, orignoredOptionalDependenciesin itspnpmfield. pnpm no longer reads that field, so the install rewrote the lockfile without those settings. The command now fails and asks to move the settings topnpm-workspace.yaml#16278.pnpm runno longer reinstalls dependencies when anode_modulesdirectory installed outside CI is used withCI=true, or the other way around #12337.pnpm no longer hangs after a lifecycle script exits while a process it started in the background keeps the script's output open. pnpm stops reading that output one second after the script exits #5730.
A signal sent to pnpm, such as
SIGTERM, now reaches the pnpm that pnpm switches to because ofpackageManagerordevEngines.packageManager, and the one thatpnpm withruns. The signal used to be dropped, so scripts running under that pnpm never got to shut down #9948.pnpm runexits with the code of a script that handles Ctrl+C and shuts down. A script that finished cleanly is not reported as a lifecycle failure. The commands after it in the same script still run #9945.pnpm runand lifecycle scripts use the configuredscriptShell, including Git Bash on Windows, whenshellEmulatoris also enabled.shellEmulatorstill runs scripts whenscriptShellis not set. Extra arguments passed topnpm runare quoted for the shell that runs the script, so a Windows path stays intact #14719.pnpm -r run /regexp/now honors thetasksdependsOndeclared for each script the selector matches, like running the script by name does. Matched scripts that depend on each other run in order. Each matched script runs once #15596.Commands run from a POSIX shell through a dependency's own
node_modules/.bin, such asnode_modules/vite/node_modules/.bin/esbuild, no longer fail withMODULE_NOT_FOUND#10189.pnpm rebuildwithnodeLinker: hoistedno longer puts one package's parentnode_modules/.bindirectories on thePATHof the packages it builds after it.Publishing, packing, and deploying
pnpm publishnow waits at least 5 minutes for the registry to answer a publish request, like npm. This fixes "Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.