Skip to content

chore(deps): update all non-major dependencies#145

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch
May 31, 2026
Merged

chore(deps): update all non-major dependencies#145
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented May 31, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@biomejs/biome (source) 2.4.15 → 2.4.16 age confidence devDependencies patch
@clack/prompts (source) ^1.4.0 → ^1.5.0 age confidence devDependencies minor
@rslib/core (source) 0.21.5 → 0.22.0 age confidence devDependencies minor
@rstest/core (source) 0.10.2 → 0.10.3 age confidence devDependencies patch
eslint (source) ^10.4.0 → ^10.4.1 age confidence devDependencies patch
eslint-plugin-svelte (source) ^3.17.1 → ^3.19.0 age confidence devDependencies minor
node 24.15.0 → 24.16.0 age confidence uses-with minor
pnpm (source) 11.3.0 → 11.5.0 age confidence packageManager minor
rslog ^2.1.1 → ^2.1.2 age confidence devDependencies patch
tinyexec ^1.2.2 → ^1.2.3 age confidence devDependencies patch 1.2.4
typescript-eslint (source) ^8.59.4 → ^8.60.0 age confidence devDependencies minor

Release Notes

biomejs/biome (@​biomejs/biome)

v2.4.16

Compare Source

Patch Changes

  • #​10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

  • #​10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

    Input:

    <span
  ><!-- 1
--><span>a</span
  ><!-- 2
--><span>b</span
  ><!-- 3
--></span>

    Output:

      <span
	  ><!-- 1
- --> <span>a</span<!-- 2
- --> ><span>b</span><!-- 3
+ --><span>a</span><!-- 2
+ --><span>b</span><!-- 3
  --></span
  >

  • #​10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

  • #​10358 05c2617 Thanks @​dyc3! - Fixed #​10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

  • #​10300 950247c Thanks @​dyc3! - Fixed #​10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

  • #​9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #​8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

  • #​10425 1948b72 Thanks @​sjh9714! - Fixed #​10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

  • #​10442 001f94f Thanks @​ematipico! - Fixed #​10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

  • #​10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

  • #​10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

    - <span> {{ value }} </span>
+ <span>
+   {{ value }}
+ </span>

  • #​10365 0a58eb0 Thanks @​Netail! - Fixed #​10361: noUnusedFunctionParameters now mentions the parameter name in the diagnostic.

  • #​10439 df6b867 Thanks @​denbezrukov! - Fixed CSS and SCSS formatting for comments around declaration colons so comments between property names, colons, and values stay at the same boundary as Prettier.

     .selector {
-  color: /* red, */
-    blue;
+  color: /* red, */ blue;
 }

  • #​10344 b30208c Thanks @​siketyan! - Fixed #10123: Corrected the noReactNativeDeepImports source rule to point to the proper upstream rule, so users can migrate from the original rule correctly.

  • #​10328 b59133f Thanks @​dyc3! - Fixed #​10309: Biome no longer adds newlines to Astro frontmatter when linter or assist --write mode is enabled.

bombshell-dev/clack (@​clack/prompts)

v1.5.0

Compare Source

Minor Changes

  • #​543 83428ac Thanks @​florian-lefebvre! - Adds support for Standard Schema validation

    Prompts accept an optional validate() function to validate user input. While a function provides more flexibility and customization over your validation, it can be a bit verbose. To help solve this, there are libraries that provide schema-based validation to make shorthand and type-strict validation substantially easier.

    Libraries following the Standard Schema specification are now natively supported. For example, using Arktype:

    import { text } from '@&#8203;clack/prompts';
import { type } from 'arktype';

const name = await text({
	message: 'Enter your email',
+	validate: type('string.email').describe('Invalid email'),
});
Patch Changes
web-infra-dev/rslib (@​rslib/core)

v0.22.0

Compare Source

Highlights

Isolated Declaration Generation

Rslib now supports generating declaration files with the experimental dts.isolated option, powered by Rspack's built-in SWC fast_dts capability.

dts.isolated emits declaration files directly during the build without running a full type check, making declaration generation significantly faster.

This makes it a good fit for monorepo projects that use a separate high-performance type-checking workflow, such as rslint --type-check.

export default {
  lib: [
    {
      dts: {
        isolated: true,
      },
    },
  ],
};
Isolated Declaration Generation

More details: dts.isolated

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rslib@v0.21.5...v0.22.0

web-infra-dev/rstest (@​rstest/core)

v0.10.3

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

Full Changelog: web-infra-dev/rstest@v0.10.2...v0.10.3

eslint/eslint (eslint)

v10.4.1

Compare Source

sveltejs/eslint-plugin-svelte (eslint-plugin-svelte)

v3.19.0

Compare Source

Minor Changes

v3.18.0

Compare Source

Minor Changes
actions/node-versions (node)

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

pnpm/pnpm (pnpm)

v11.5.0

Compare Source

Minor Changes

  • Added a new hoistingLimits setting for nodeLinker: hoisted installs, mirroring yarn's nmHoistingLimits. It accepts none (the default — hoist as far as possible), workspaces (hoist only as far as each workspace package), or dependencies (hoist only up to each workspace package's direct dependencies). Originally proposed in #​6468, closing #​6457.

  • Replaced enquirer with @inquirer/prompts for all interactive prompts. Fixes the update -i scrolling overflow bug where long choice lists were clipped in the terminal #​6643.

    User-facing changes:

    • pnpm update -i / pnpm update -i --latest: Scrolling now works correctly when many packages are available; the new library uses visual-line-aware pagination via usePagination
    • pnpm audit --fix -i: Same scrolling fix for vulnerability selection
    • pnpm approve-builds: Interactive build approval prompts updated
    • pnpm patch: Version selection and "apply to all" prompts updated
    • pnpm patch-remove: Patch removal selection updated
    • pnpm publish: Branch confirmation prompt updated
    • pnpm login: Credential prompts updated
    • pnpm run / pnpm exec (with verifyDepsBeforeRun=prompt): Confirmation prompt updated

    Vim-style j/k keys still work for up/down navigation in all interactive prompts.

    Internal: The OtpEnquirer and LoginEnquirer DI interfaces changed from { prompt } to { input } / { input, password } respectively. Plugins or custom builds that inject their own enquirer mock will need to update.

  • Staged publishes are now recognized in the trust scale. When a package version's registry metadata carries an approver field, it is treated as the strongest trust evidence (ranked above trusted publishers and provenance attestations), since staged publishes require 2FA publish approvals. This prevents false-positive trust downgrade errors when moving from a staged publish to a lower trust level #​11887.

Patch Changes

  • Fix pnpm hanging during peer resolution when an aliased install pulls in transitive packages with mutual peer cycles at different depths in the dependency tree (for example, pnpm i nuxt@npm:nuxt-nightly@5x). Cycles whose members hit the findHit cache instead of running their own calculateDepPath are now short-circuited by sibling resolutions at the level where the cycle is detected, so the cached path promises no longer deadlock. #​11999.

  • Fix pnpm dist-tag add and pnpm dist-tag rm against npmjs.org failing without --otp with [ERR_PNPM_UNAUTHORIZED] You must be logged in to set dist-tag … "You must provide a one-time pass. Upgrade your client to npm@latest in order to use 2FA.". pnpm now sends npm-auth-type: web on dist-tag writes and surfaces the resulting OTP challenge through the existing browser-based 2FA flow (the same withOtpHandling helper used by pnpm publish), so the browser opens, the user authenticates, and the dist-tag is set on retry. --otp=<code> continues to work via the classic flow.

  • Fix minimumReleaseAgeExclude handling in npm resolution fast paths so excluded packages do not get pinned to stale versions. Excludes are honored consistently during publishedBy metadata selection and cache-mtime shortcuts.

  • Fix the integrity field being dropped from the lockfile entry of a remote (non-registry) https-tarball dependency when an unrelated package is installed afterwards. URL/tarball resolvers do not return an integrity (it is only known after the tarball is downloaded), so when such a dependency was reused from the lockfile without being re-fetched, its integrity was lost. It is now carried over from the existing resolution. With pnpm's lockfile-integrity hardening, the missing integrity made subsequent --frozen-lockfile installs fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY. #​12001.

  • Skip dependency re-resolution when pnpm-lock.yaml is missing but node_modules/.pnpm/lock.yaml exists and still satisfies the manifest. pnpm install now reuses the materialized snapshot to regenerate pnpm-lock.yaml instead of walking the registry to rebuild it from scratch, turning the cache+node_modules variation into a near-no-op for users who deleted the lockfile but kept the install #​11993.

    --frozen-lockfile still refuses to proceed when pnpm-lock.yaml is absent — the regenerated lockfile must be committed, so failing loudly is the correct behavior for CI.

v11.4.0

Compare Source

Minor Changes

  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.

    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.

    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.

    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.

  • pnpm runtime set <name> <version> now saves the runtime to devEngines.runtime by default instead of engines.runtime. Pass --save-prod (or -P) to save it to engines.runtime instead #​11948.

Patch Changes

  • Fix a credential disclosure issue where an unscoped _authToken (or _auth, or username + _password, or tokenHelper) defined in one source — ~/.npmrc, ~/.config/pnpm/auth.ini, a workspace .npmrc, CLI flags, etc. — would be sent as an Authorization header to whichever registry a different (potentially untrusted) source named. The same fix extends to client TLS credentials (cert, key) so they aren't presented to a registry their author didn't choose.

    pnpm now rewrites each unscoped per-registry setting (_authToken, _auth, username, _password, tokenHelper, cert, key) to its URL-scoped form at load time, using the registry= value declared in the same source (or the npmjs default registry if the source declares none). A later layer overriding registry= therefore cannot pull an unscoped credential along, because it is already pinned to the URL its author intended. ca/cafile are intentionally not rescoped — they're trust anchors, not credentials, and corporate MITM-proxy setups rely on them applying globally.

    Every rescope emits a deprecation warning telling the user where the setting was pinned and how to write it directly. npm has rejected unscoped credentials outright since npm@9, and pnpm intends to remove support in a future major release. To target a specific registry, write the setting URL-scoped (e.g. //registry.example.com/:_authToken=... or //registry.example.com/:cert=...).

    @pnpm/network.auth-header: removed the defaultRegistry parameter from createGetAuthHeaderByURI and getAuthHeadersFromCreds. Now that credentials are URL-scoped at load time, the merged configByUri never contains the empty-string "default registry" placeholder slot, so re-keying it onto the merged default registry is no longer needed.

  • Fix pnpm deploy crashing with ENOENT: ... lstat '<deployDir>/node_modules' when configDependencies declares pacquet (pacquet or @pnpm/pacquet). The deploy directory never installs config dependencies, so the install engine they designate isn't on disk to invoke; the nested install now skips them.

  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.

  • Limit concurrent project manifest reads while listing large workspaces to avoid EMFILE errors.

  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.

  • Improve the log message that pnpm prints after auto-adding entries to minimumReleaseAgeExclude when minimumReleaseAge is set without minimumReleaseAgeStrict. The message previously referred to the internal "loose mode" terminology, which wasn't searchable in the docs; it now tells the user to set minimumReleaseAgeStrict to true if they want these updates gated behind a prompt instead #​11747.

  • Reject dependency aliases that contain path-traversal segments (such as @x/../../../../../.git/hooks) when reading them from a package manifest or symlinking them into node_modules. A malicious registry package could otherwise use a transitive dependency key to make pnpm install create symlinks at attacker-chosen paths outside the intended node_modules directory.

  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

  • Validate devEngines.runtime and engines.runtime version ranges for node, deno, and bun when onFail is set to error or warn. Previously these settings only had an effect with onFail: 'download' — the error and warn modes silently did nothing #​11818. Violations now throw ERR_PNPM_BAD_RUNTIME_VERSION.

  • Require provenance before treating trusted publisher metadata as the strongest trust evidence.

rstackjs/rslog (rslog)

v2.1.2

Compare Source

tinylibs/tinyexec (tinyexec)

v1.2.3

Compare Source

What's Changed

  • chore(deps-dev): bump the development-dependencies group with 4 updates by @​dependabot[bot] in #​135
  • fix: destroy piped streams on child exit to prevent grandchild deadlock by @​Mearman in #​137

New Contributors

Full Changelog: tinylibs/tinyexec@1.2.2...1.2.3

typescript-eslint/typescript-eslint (typescript-eslint)

v8.60.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot merged commit f67de8e into main May 31, 2026
5 checks passed
@renovate renovate Bot deleted the renovate/all-minor-patch branch May 31, 2026 21:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants