Skip to content

chore(deps): update all non-major dependencies#346

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#346
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
@nuxt/icon ^2.2.2 → ^2.2.3 age confidence devDependencies patch
@shikijs/transformers (source) ^4.0.2 → ^4.2.0 age confidence devDependencies minor
@types/node (source) ^24.12.4 → ^24.13.1 age confidence devDependencies minor
@vue/test-utils ^2.4.10 → ^2.4.11 age confidence devDependencies patch
actions/checkout v6.0.2 → v6.0.3 age confidence action patch
devalue ^5.8.0 → ^5.8.1 age confidence dependencies patch
eslint (source) ^10.3.0 → ^10.4.1 age confidence devDependencies minor
happy-dom ^20.9.0 → ^20.10.2 age confidence devDependencies minor
oxc-parser (source) ^0.130.0 → ^0.135.0 age confidence dependencies minor
pkg-pr-new (source) 0.0.72 → 0.0.75 age confidence devDependencies patch
pnpm (source) 10.33.4+sha512.1c67b3b359b2d408119ba1ed289f34b8fc3c6873412bec6fd264fbdc82489e510fcbecb9ce9d22dae7f3b76269d8441046014bdca53b9979cd7a561ad631b800 → 10.34.1 age confidence packageManager minor
sass-embedded ^1.99.0 → ^1.100.0 age confidence devDependencies minor
shiki (source) ^4.0.2 → ^4.2.0 age confidence devDependencies minor
valibot (source) ^1.4.0 → ^1.4.1 age confidence dependencies patch
vitest (source) ^4.1.6 → ^4.1.8 age confidence devDependencies patch
web-vitals ^5.2.0 → ^5.3.0 age confidence dependencies minor

Release Notes

nuxt/icon (@​nuxt/icon)

v2.2.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
shikijs/shiki (@​shikijs/transformers)

v4.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.0

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
vuejs/test-utils (@​vue/test-utils)

v2.4.11

Compare Source

compare changes

🩹 Fixes
  • Drop legacy Mutation Event listener entries (#​2844)
  • Handle setData() correctly for components using both setup() and data() (#​2846)
  • Export GlobalMountOptions type (#​2851)
  • Set spec-compliant event.code on keydown/keyup (#​2850)
❤️ Contributors
actions/checkout (actions/checkout)

v6.0.3

Compare Source

eslint/eslint (eslint)

v10.4.1

Compare Source

Bug Fixes

  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#​20930) (Francesco Trotta)
  • d4ce898 fix: propagate failures from delegated commands (#​20917) (Minh Vu)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#​20916) (kuldeep kumar)
  • c5bc78b fix: false positive for reference in finally block (#​20655) (Tanuj Kanti)
  • 27538c0 fix: add missing CodePath and CodePathSegment types (#​20853) (Pixel998)

Documentation

  • 61b0add docs: remove deprecated rule from related rules of max-params (#​20921) (Tanuj Kanti)
  • 305d5b9 docs: remove deprecated rules from related rules section (#​20911) (Tanuj Kanti)
  • 49b0202 docs: fix display: none of ad (#​20901) (Tanuj Kanti)
  • 9067f94 docs: switch build to Node.js 24 (#​20893) (Milos Djermanovic)
  • c91b041 docs: Update README (GitHub Actions Bot)
  • e349265 docs: clarify semver strings in rule deprecation objects (#​20885) (Milos Djermanovic)

Chores

v10.4.0

Compare Source

capricorn86/happy-dom (happy-dom)

v20.10.2

Compare Source

👷‍♂️ Patch fixes

v20.10.1

Compare Source

v20.10.0

Compare Source

oxc-project/oxc (oxc-parser)

v0.134.0

v0.133.0

v0.132.0

v0.131.0

stackblitz-labs/pkg.pr.new (pkg-pr-new)

v0.0.75

Compare Source

v0.0.74

Compare Source

v0.0.73

Compare Source

pnpm/pnpm (pnpm)

v10.34.1: pnpm 10.34.1

Compare Source

Patch Changes

  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Bit

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v10.34.0: pnpm 10.34

Compare Source

Minor Changes

  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.

    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.

    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.

    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.

Patch Changes

  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml were not loaded when pnpm was invoked from outside <dir> #​11535.
  • Reject dependency aliases that contain path-traversal segments (such as @x/../../../../../.git/hooks) when reading them from a package manifest or symlinking them into node_modules. A malicious registry package could otherwise use a transitive dependency key to make pnpm install create symlinks at attacker-chosen paths outside the intended node_modules directory.

Platinum Sponsors

Bit

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
sass/embedded-host-node (sass-embedded)

v1.100.0

Compare Source

  • Writing two compound selectors adjacent to one another without any whitespace
    between them, such as [class]a, is now deprecated. This was always an error
    in CSS and Sass only supported it by mistake.

    See the Sass website for
    details.

open-circle/valibot (valibot)

v1.4.1

Compare Source

  • Fix intersect schema to infer correct input and output types for non-tuple array options instead of never (pull request #​1478)
vitest-dev/vitest (vitest)

v4.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
GoogleChrome/web-vitals (web-vitals)

v5.3.0

Compare Source

  • Remove getFirstHiddenTimePolyfill
    (#​729)
  • Fixed issue where the same configuration object to multiple metric functions can result in errors
    (#​731)
  • Add more robust interactionTarget setting for INP
    (#​744)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedhappy-dom@​20.10.2661008896100
Addedpkg-pr-new@​0.0.751001007097100
Added@​shikijs/​transformers@​4.2.01001007396100
Added@​types/​node@​24.13.11001008196100
Addedoxc-parser@​0.135.09110010096100
Added@​vue/​test-utils@​2.4.11991009393100
Added@​nuxt/​icon@​2.2.39910010094100
Addedeslint@​10.4.19810010095100
Added@​nuxt/​kit@​4.4.89910010096100

View full report

@pkg-pr-new

pkg-pr-new Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/hints@346

commit: cc21f00

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from b926f16 to 700acdc Compare May 23, 2026 03:02
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies chore(deps): update all non-major dependencies - autoclosed May 23, 2026
@renovate renovate Bot closed this May 23, 2026
@renovate renovate Bot deleted the renovate/all-minor-patch branch May 23, 2026 06:45
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies - autoclosed chore(deps): update all non-major dependencies May 25, 2026
@renovate renovate Bot reopened this May 25, 2026
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from d315a6b to d2076bf Compare May 30, 2026 22:53
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 62c0aa1 to 18e3da2 Compare June 5, 2026 19:35
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 18e3da2 to 0407a6c Compare June 7, 2026 02:41
@socket-security

socket-security Bot commented Jun 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm happy-dom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/happy-dom@20.10.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.10.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 0407a6c to e4b674f Compare June 7, 2026 18:35
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from e4b674f to cc21f00 Compare June 9, 2026 17:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants