chore(deps): update all non-major dependencies#446
chore(deps): update all non-major dependencies#446renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
9c4e39b to
5bfebea
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
5bfebea to
7804f68
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
7804f68 to
2d975ff
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
2d975ff to
0104ff1
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
0104ff1 to
8120e32
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
8120e32 to
5ec9f5e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
5ec9f5e to
efcb3b7
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
efcb3b7 to
1a61aec
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
1a61aec to
cf8e7f8
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
cf8e7f8 to
2b13cf8
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
64d7d5a to
6132302
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
6132302 to
360e116
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
360e116 to
aa97a8b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
aa97a8b to
714cf9d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
714cf9d to
bdbb60c
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
bdbb60c to
9343bf3
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
9343bf3 to
fb7fea7
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
fb7fea7 to
556aaae
Compare
commit: |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
This PR contains the following updates:
^3.58.1→^3.64.0^0.1.0→^0.2.0^2.0.3→^2.1.13v0.0.9-mp→v0.0.9v6.0.1→v6.0.2v10.0.0→v10.2.0^0.128.0→^0.129.010.33.2→10.33.4^1.372.6→^1.372.9^1.0.0→^1.372.9^1.3.1→^1.4.0^3.5.33→^3.5.34^3.2.7→^3.2.8Release Notes
unjs/unhead (@unhead/vue)
v2.1.13Compare Source
🐞 Bug Fixes
targetto array before merging potentialAction - by @harlan-zw and Claude Opus 4.6 (1M context) in #709 (22ac9)View changes on GitHub
v2.1.12Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.9Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.8Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.7Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.6Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.5Compare Source
🐞 Bug Fixes
useScript- by @cernymatej in #660 (e8f5b)View changes on GitHub
v2.1.4Compare Source
🐞 Bug Fixes
<link rel="alternate">by hreflang/type only, drop href from key - by @harlan-zw in #656 (86175)View changes on GitHub
v2.1.3Compare Source
🐞 Bug Fixes
<link rel="alternate">- by @danielroe and onmax in #655 (fdabe)s._statusRef- by @danielroe in #642 (4ef03)🏎 Performance
View changes on GitHub
v2.1.2Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.1.1Compare Source
No significant changes
View changes on GitHub
v2.1.0Compare Source
🚀 Features
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
v2.0.19Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.18Compare Source
🏎 Performance
View changes on GitHub
v2.0.17Compare Source
No significant changes
View changes on GitHub
v2.0.14Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.13Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.12Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.9Compare Source
🏎 Performance
View changes on GitHub
v2.0.8Compare Source
No significant changes
View changes on GitHub
v2.0.7Compare Source
🐞 Bug Fixes
unheadhoisting issue - by @harlan-zw (bb0e4)View changes on GitHub
v2.0.6Compare Source
🐞 Bug Fixes
View changes on GitHub
v2.0.5Compare Source
🐞 Bug Fixes
setTimeoutas render's debounced delayer - by @kricsleo in #540 (8f7c5)View changes on GitHub
v2.0.4Compare Source
🐞 Bug Fixes
View changes on GitHub
Hebilicious/reproduire (Hebilicious/reproduire)
v0.0.9Compare Source
compare changes
actions/checkout (actions/checkout)
v6.0.2Compare Source
actions/stale (actions/stale)
v10.2.0Compare Source
v10.1.1Compare Source
What's Changed
Bug Fix
only-issue-typesby @Bibo-Joshi in #1298Improvement
Dependency Upgrades
New Contributors
Full Changelog: actions/stale@v10...v10.1.1
v10.1.0Compare Source
What's Changed
only-issue-typesoption to filter issues by type by @Bibo-Joshi in #1255New Contributors
Full Changelog: actions/stale@v10...v10.1.0
oxc-project/oxc (oxc-parser)
v0.129.0🐛 Bug Fixes
429deacnapi/parser: ExportvisitorKeysfromwasmentrypoint (#21996) (NullVoxPopuli)pnpm/pnpm (pnpm)
v10.33.4: pnpm 10.33.4Compare Source
Patch Changes
Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.
A new
gitHosted: truefield is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.Fix a regression where
pnpm --recursive --filter '!<pkg>' run/exec/test/addwould include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative--filterarguments are provided, matching the documented behavior. To include the root, pass--include-workspace-root#11341.Platinum Sponsors
Gold Sponsors
v10.33.3Compare Source
PostHog/posthog-js (posthog-js)
v1.372.9Compare Source
1.372.9
Patch Changes
026e09dThanks @TueHaulund! - Pull in the canvas-manager fix from@posthog/rrweb0.0.61: skip canvassnapshots while the WebGL context is lost so transparent bitmaps don't
poison the worker's fingerprint dedup map and silently kill canvas
recording for the rest of the session. Also wraps
getCanvas()intry/catch so DOM/shadow-root traversal errors can't cancel the rAF
loop. See PR #3527 for context. (2026-05-05)
v1.372.8Compare Source
1.372.8
Patch Changes
255b273Thanks @marandaneto! - Gate survey translation logs behind SDK debug logging to avoid production console spam.(2026-05-04)
220cd61,255b273]:v1.372.7Compare Source
1.372.7
Patch Changes
8aee3d5]:open-circle/valibot (valibot)
v1.4.0Compare Source
Many thanks to @ksaurav24, @heiwen, @compulim, @ysknsid25, @alaycock-stripe, @IlyaSemenov, @wszgrcy, @LMGO, @yslpn, @EltonLobo07 and @Eronmmer for contributing to this release.
isoDateTimeSecondvalidation action to validate ISO date times with seconds (pull request #1418)toCamelCase,toKebabCase,toPascalCaseandtoSnakeCasetransformation actions to convert strings between common naming conventions (pull request #1457)ReadonlyOutputKeysandOutputWithReadonlytypes ofobjectschemas andWithReadonlytype ofrecordschemas to improve TypeScript type performance (pull request #1442)_LruCacheto use a TypeScriptprivatemethod instead of a#privateclass field to avoid runtime helpers in the transpiled output (pull request #1455)_isValidObjectKeyto useObject.prototype.hasOwnProperty.callinstead ofObject.hasOwnso the distributed output stays compatible with runtimes that lack the ES2022Object.hasOwnbuiltin (pull request #1421)flattenmethod to accept readonly issue arrays (pull request #1269)RangeErrorcaused by spreading large issue arrays (pull request #1437)creditCardvalidation action to reject Mastercard numbers with invalid lengths (pull request #1462)intersectschema to no longer mutate input values, allowing frozen objects and arrays to be merged (pull request #1463)vuejs/core (vue)
v3.5.34Compare Source
Bug Fixes
<image>elements (#14756) (090b2e3)vuejs/language-tools (vue-tsc)
v3.2.8Compare Source
language-core
GlobalComponents(#6026) - Thanks to @Gehbt!language-service
@importnavigation (#6033) - Thanks to @KazariEX!typescript-plugin
vscode
reactive-vscodeto v1.0.1 (#6019) - Thanks to @kermanx!Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.