chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@​rocicorp/zero	^0.14.0 -> ^0.15.0					dependencies	minor
@types/node (source)	22.13.1 -> 22.13.4					devDependencies	patch
jose	5.9.6 -> 5.10.0					dependencies	minor
pnpm (source)	10.2.1 -> 10.4.1					packageManager	minor
postgres	16.6-alpine -> 16.7-alpine						minor
vue-tsc (source)	2.2.0 -> 2.2.2					devDependencies	patch

---

Release Notes

panva/jose (jose)

v5.10.0

Compare Source

Features

• support fully specified Ed25519 algorithm identifier (c39f57d)

pnpm/pnpm (pnpm)

v10.4.1

Compare Source

Patch Changes

• Throws an error when the value provided by the --allow-build option overlaps with the pnpm.ignoredBuildDependencies list #​9105.
• Print pnpm's version after the execution time at the end of the console output.
• Print warning about ignored builds of dependencies on repeat install #​9106.
• Setting init-package-manager should work.

v10.4.0

Compare Source

Minor Changes

• pnpm approve-builds --global works now for allowing dependencies of globally installed packages to run postinstall scripts.

• The pnpm add command now supports a new flag, --allow-build, which allows building the specified dependencies. For instance, if you want to install a package called bundle that has esbuild as a dependency and want to allow esbuild to run postinstall scripts, you can run:

  pnpm --allow-build=esbuild add bundle
  

  This will run esbuild's postinstall script and also add it to the pnpm.onlyBuiltDependencies field of package.json. So, esbuild will always be allowed to run its scripts in the future.

  Related PR: #​9086.

• The pnpm init command adds a packageManager field with the current version of pnpm CLI #​9069. To disable this behaviour, set the init-package-manager setting to false.

Patch Changes

• pnpm approve-builds should work after two consecutive pnpm install runs #​9083.
• Fix instruction for updating pnpm with corepack #​9101.
• The pnpm version specified by packageManager cannot start with v.

v10.3.0

Compare Source

Minor Changes

• Added a new setting called strict-dep-builds. When enabled, the installation will exit with a non-zero exit code if any dependencies have unreviewed build scripts (aka postinstall scripts) #​9071.

Patch Changes

• Fix a false negative of verify-deps-before-run after pnpm install --production|--no-optional #​9019.
• Print the warning about blocked installation scripts at the end of the installation output and make it more prominent.

vuejs/language-tools (vue-tsc)

v2.2.2

Compare Source

Features

• feat(language-core): navigation support for $attrs, $slots, $refs and $el in the template (#​5056) - Thanks to @​KazariEX!
• feat(language-service): support global directives completion (#​4989) - Thanks to @​KazariEX!
• feat(language-core): type support of useAttrs (#​5106) - Thanks to @​KazariEX!
• feat(language-core): add options for fine-grained configuration of strictTemplates (#​5138)
• feat(language-service): display deprecated info of props in completion (#​5134) - Thanks to @​KazariEX!
• feat(component-meta): collect destructured props defaults (#​5101) - Thanks to @​Akryum!
• feat(language-core): add checkUnknownDirectives option (#​5141) - Thanks to @​KazariEX!
• feat(language-core): support <script vapor> - Thanks to @​KazariEX!

Bug Fixes

• fix(language-core): ignore ts errors in function-scoped declare expressions (#​5090) - Thanks to @​zhiyuanzmj!
• fix(language-core, typescript-plugin): handle self-reference component correctly (#​5102) - Thanks to @​KazariEX!
• fix(language-core): do not generate element for <template> with v-slot (#​5077) - Thanks to @​KazariEX!
• fix(language-service): set code action kinds to avoid warning (#​5096) - Thanks to @​KazariEX!
• fix(language-core): handle parentheses in v-for exp
• fix(language-core): slot exp formatting virtual code syntax incorrect
• fix(language-core): arrow function formatting virtual code syntax incorrect in interpolation
• fix(language-core): improve multiple lines event formatting result
• fix(language-core): prefer loc.source instead of node content
• fix(language-core): intersect local $attrs with __VLS_ctx.$attrs (#​5113) - Thanks to @​KazariEX!
• fix(language-core): only generate model modifiers for components - Thanks to @​KazariEX!
• fix(language-plugin-pug): ignore duplicate attribute error of class (#​5100) - Thanks to @​KazariEX!
• fix(language-core): align types of v-for with core (#​5084) - Thanks to @​KazariEX!
• fix(language-core): map interpolation error with multiple variables correctly (#​5158) - Thanks to @​KazariEX!
• fix(vscode): ask user to reload extension host when configuration changes (#​5160) - Thanks to @​typed-sigterm!
• fix(typescript-plugin): update component names correctly for the first time - Thanks to @​KazariEX!
• fix(language-core): add undefined to first param type of optional model emits (#​5171) - Thanks to @​KazariEX!
• fix(language-core): intersect __VLS_slots with __VLS_ctx.$slots (#​5083) - Thanks to @​KazariEX!
• fix(language-core): complete codegen of slot name prop (#​5139) - Thanks to @​KazariEX!

Other Changes

• refactor(language-service): read ast from codegen instead of parsing it repeatedly (#​5086) - Thanks to @​KazariEX!
• refactor(language-core): rewrite vueCompilerOptions resolution logic
• refactor(component-meta): read scriptSetupRanges from codegen - Thanks to @​KazariEX!
• refactor(component-meta): read node directly instead of creating sub ast - Thanks to @​KazariEX!
• refactor(component-meta): read ast from sfc.script - Thanks to @​KazariEX!
• refactor(language-core): generate the type of slots with function property (#​5173) - Thanks to @​KazariEX!
• refactor(language-core): reduce codegen size of template returns - Thanks to @​KazariEX!
• refactor(language-core): remove semantic highlight of directives - Thanks to @​KazariEX!
• refactor: update alien-signals to 1.0.3 (#​5181) - Thanks to @​KazariEX!

---

Configuration

📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@antfu/eslint-config@4.3.0 🔁 npm/@antfu/eslint-config@4.2.1	Transitive: eval, filesystem, shell, unsafe	+265	48.6 MB	antfu
npm/@rocicorp/zero@0.15.2025021402 🔁 npm/@rocicorp/zero@0.14.2025021404	Transitive: eval, filesystem, shell, unsafe	+225	58.1 MB	aboodman
npm/@types/node@22.13.4 🔁 npm/@types/node@22.13.1	None	+1	2.39 MB	types
npm/jose@5.10.0 🔁 npm/jose@5.9.6	None	0	552 kB	panva
npm/vue-tsc@2.2.2 🔁 npm/vue-tsc@2.2.0	Transitive: environment, eval	+24	8.66 MB	johnsoncodehk

View full report↗︎