Skip to content

chore(deps): update all non-major dependencies#57

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch
Jun 15, 2026
Merged

chore(deps): update all non-major dependencies#57
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@rsbuild/core (source) ^2.0.7 → ^2.0.14 age confidence devDependencies patch
@rslib/core (source) ^0.21.5 → ^0.22.1 age confidence devDependencies minor
@types/node (source) ^24.12.4 → ^24.13.2 age confidence devDependencies minor
node 24.15.0 → 24.16.0 age confidence uses-with minor
pnpm (source) 11.3.0 → 11.6.0 age confidence packageManager minor
prettier (source) ^3.8.3 → ^3.8.4 age confidence devDependencies patch

Release Notes

web-infra-dev/rsbuild (@​rsbuild/core)

v2.0.14

Compare Source

What's Changed
Performance 🚀
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.13...v2.0.14

v2.0.13

Compare Source

What's Changed
New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.12...v2.0.13

v2.0.12

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.11...v2.0.12

v2.0.11

Compare Source

What's Changed

Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.10...v2.0.11

v2.0.10

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.9...v2.0.10

v2.0.9

Compare Source

Highlights
Safer npm Staged Publishing

Rsbuild 2.0.9 updates the release workflow so all packages are now published through npm staged publishing, making package releases safer by staging them before final publication.

What's Changed
New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.8...v2.0.9

v2.0.8

Compare Source

Highlights

Tailwind CSS Plugin

Rsbuild 2.0.8 introduces @rsbuild/plugin-tailwindcss, a first-party plugin for integrating Tailwind CSS v4 through @​tailwindcss/webpack.

Compared with the @tailwindcss/postcss package, it avoids running Tailwind CSS transforms through PostCSS and provides better build performance.

import { pluginTailwindcss } from '@​rsbuild/plugin-tailwindcss';

export default {
  plugins: [pluginTailwindcss()],
};

What's Changed

New Features 🎉
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.7...v2.0.8

web-infra-dev/rslib (@​rslib/core)

v0.22.1

Compare Source

What's Changed

Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rslib@v0.22.0...v0.22.1

v0.22.0

Compare Source

Highlights

Isolated Declaration Generation

Rslib now supports generating declaration files with the experimental dts.isolated option, powered by Rspack's built-in SWC fast_dts capability.

dts.isolated emits declaration files directly during the build without running a full type check, making declaration generation significantly faster.

This makes it a good fit for monorepo projects that use a separate high-performance type-checking workflow, such as rslint --type-check.

export default {
  lib: [
    {
      dts: {
        isolated: true,
      },
    },
  ],
};
Isolated Declaration Generation

More details: dts.isolated

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rslib@v0.21.5...v0.22.0

actions/node-versions (node)

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

pnpm/pnpm (pnpm)

v11.6.0

Compare Source

Minor Changes

  • pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.

  • 615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:

    npm_config_//registry.npmjs.org/:_authToken=<token>
pnpm_config_//registry.npmjs.org/:_authToken=<token>

    This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

  • Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
  • Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #​12324.
  • Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g. @nx/nx-win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them #​11702.

v11.5.3

Compare Source

Patch Changes

  • Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from .npmrc, and in workspace registry URLs from pnpm-workspace.yaml. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config.

  • Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution.

  • Avoid writing packageManagerDependencies to pnpm-lock.yaml when package manager policy is set to onFail: ignore or pmOnFail: ignore #​12228.

  • Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest.

  • Using the $ version reference syntax in overrides (e.g. "react": "$react") now prints a deprecation warning. The syntax still works, but catalogs are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with the catalog: protocol instead.

  • Fixed pnpm config get globalconfig to return the global config.yaml path again pnpm/pnpm#11962.

  • Fixed bare --color so it does not consume the following CLI flag, allowing command shorthands like --parallel to expand correctly and forms like pnpm --color with current <command> to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.

  • Fix pnpm install ignoring enableGlobalVirtualStore toggle by including it in the workspace state settings check #​12142.

  • Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.

    This covers two paths that select an executable from repository-controlled input:

    • pacquet install engine — declaring pacquet (or @pnpm/pacquet) in configDependencies opts in to pnpm's Rust install engine. pnpm now verifies that the installed pacquet shim and the host's @pacquet/<platform>-<arch> binary carry a valid npm registry signature for their exact name@version, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.
    • automatic version switch / self-update — the packageManager / devEngines.packageManager field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of pnpm, @pnpm/exe, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command.

    In both cases the signature is verified over the installed integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint.

  • Made peer-dependent deduplication deterministic. When a peer-suf

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@renovate[bot], we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 minute and 45 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3358b3c4-cb1f-40df-8717-0aa82a117507

📥 Commits

Reviewing files that changed from the base of the PR and between a0ddc37 and e928323.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (4)
  • .github/workflows/lint.yml
  • .github/workflows/release.yml
  • .github/workflows/test.yml
  • package.json
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 988c1bd to e928323 Compare June 15, 2026 05:39
@renovate renovate Bot merged commit ee24739 into main Jun 15, 2026
7 checks passed
@renovate renovate Bot deleted the renovate/all-minor-patch branch June 15, 2026 09:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants