chore(deps): update devdependencies (non-major) by renovate[bot] · Pull Request #700 · sanity-io/cli

renovate · 2026-03-17T04:49:15Z

This PR contains the following updates:

Package	Change	Age	Confidence
knip (source)	`^5.85.0` → `^5.86.0`
lint-staged	`^16.2.7` → `^16.4.0`
turbo (source)	`^2.8.11` → `^2.8.17`

Release Notes

webpro-nl/knip (knip)

`v5.86.0`: Release 5.86.0

Compare Source

Rewrite import specifiers to use .ts extensions, remove tsx (#1548) (58674ad) - thanks @wojtekmaj!
Add .spec-d to vitest entry files (#1556) (3123ab7) - thanks @yamachi4416!
Update docs for tsx → node (0418eba)
Auto-format (7142fd7)
Add Qwik plugin (#1557) (fc668f4) - thanks @azat-io!
Fix Bun plugin to handle directory arguments in bun test (c112b6c)
Update FAQ (b105a42)
fix(plugin): swc with externalHelpers setting ignores @swc/helpers dependency (#1560) (4bcb1f5) - thanks @bobaaaaa!
chore: git ignore artifacts (#1563) (4878724) - thanks @unional!
Fix Vite plugin to respect root option for index.html entries (#1561) (67a5647) - thanks @azat-io!
Fix Astro sharpImageService() false positive for unused sharp (#1559) (c36247c) - thanks @azat-io!
Fix up gitignore test (b2c3d08)
fix: normalize Windows backslash paths in fs.watch listener to fix --watch on Windows (#1558) (b86b421) - thanks @Aiudadadadf!
Fix wrangler plugin not enabled by jsonc config (#1564) (00bb1be) - thanks @DaniFoldi!
Edit AGENTS.md (a2aaf2f)
Fix tsconfig presets marked as unlisted in strict mode (resolve #1568) (463d67d)
oxcellent (8a602c7)
Refactor format test and use prettier for consistent results (b6afc01)
Sort package.json (d3a521b)
Add .git to GLOBAL_IGNORE_PATTERNS (resolve #1571) (4e95ffb)
Detect Yarn plugins that are listed by their path alone (#1574) (de4c7d8) - thanks @robintown!
Start using unbash (a5de2c4)
Bump unbash & simplify bash parser further (57896d3)
Fix refs in workspaces fixture (#1578) (fbee342)
Include a few more entry patterns with pageExtensions (resolve #1581) (c6a6d9e)
Clean exit if --fix fixes all issues (resolve #1577) (c182c29)
Document JSDoc tag hints (0e7b6ae)
Update AGENTS.md (f845462)
Add openapi-ts plugin (#1579) (42d1b3f) - thanks @jonahsnider!
Migrate from js-yaml → yaml (fb042ae)
pnpm dedupe (2586254)
Fix plugin list order (#1587) (519ae3a) - thanks @ikeyan!
Fix confusing test fixtures for openapi-ts plugin (#1591) (f0083ca) - thanks @jonahsnider!
Off-by-1 (7d7dec6)
Don't fix compiled files (pos off) (a9fdc77)
Add aliases from any tsconfig file in typescript plugin (resolve #1347) (ced77c7)
Support auto-imports in Nuxt plugin (#1517) (4ce27b2)
Fix + lint .ts extension in import specifiers (d349de3)
Safe ts.isInTopLevelContext → isInTopLevelScope (1819c20)
Wrap session.handleFileChanges in try/catch (185afb8)
Improve MDX compiler (9205e2a)
fix(playwright): Add missing built-in null reporter (#1596) (0f1ce7d) - thanks @shrink!
Add package.json#imports as entry points (1fbe286)
Update some dependencies + dedupe (381241e)
Add support for extends in nuxt plugin (9fcbdf5)
Update release script (f446b4f)

lint-staged/lint-staged (lint-staged)

`v16.4.0`

Compare Source

Minor Changes

#1739 687fc90 Thanks @hyperz111! - Replace micromatch with picomatch to reduce dependencies.

`v16.3.4`

Compare Source

Patch Changes

#1742 9d6e827 Thanks @iiroj! - Update dependencies, including tinyexec@1.0.4 to make sure local node_modules/.bin are preferred to global locations (released in tinyexec@1.0.3).

`v16.3.3`

Compare Source

Patch Changes

#1740 0109e8d Thanks @iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

`v16.3.2`

Compare Source

Patch Changes

#1735 2adaf6c Thanks @iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

`v16.3.1`

Compare Source

Patch Changes

#1729 cd5d762 Thanks @iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

`v16.3.0`

Compare Source

Minor Changes

#1698 feda37a Thanks @iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.
#1699 1346d16 Thanks @iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

#1726 87467aa Thanks @iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

vercel/turborepo (turbo)

`v2.8.17`: Turborepo v2.8.17

Compare Source

Full Changelog: vercel/turborepo@v2.8.17-canary.16...v2.8.17

`v2.8.16`: Turborepo v2.8.16

Compare Source

What's Changed

turbo-ignore

fix: Resolve pnpm audit vulnerabilities via dependency bumps by @anthonyshew in #12220

@turbo/codemod

fix: Guard against missing pipeline key in clean-globs codemod by @anthonyshew in #12235

Changelog

docs: Replace mermaid with reactflow-based diagram components by @anthonyshew in #11770
fix: Remove unnecessary dependency overrides and bump quinn-proto by @anthonyshew in #12226
fix: Remove all remaining pnpm dependency overrides by @anthonyshew in #12227
fix: Promote nested bun lockfile entries when hoisted version is pruned by @anthonyshew in #12228
fix: Honor --output-logs errors-only for non-cached tasks by @veeceey in #11926
docs: Remove CONSOLE DO NOT TRACK link by @anthonyshew in #12232
docs: missing migrate word by @anthonyshew in #12234

New Contributors

@veeceey made their first contribution in #11926

Full Changelog: vercel/turborepo@v2.8.15...v2.8.16

`v2.8.15`: Turborepo v2.8.15

Compare Source

What's Changed

create-turbo

chore: Remove pnpm-eslint .vscode transform from create-turbo by @anthonyshew in #12186

@turbo/repository

chore: Update to Rust 1.94.0 by @ognevny in #12192

Changelog

perf: Skip irrelevant packages when using package#task syntax by @anthonyshew in #12135
fix: Use delta temporality for OTel metrics export by @bkonkle in #12136
fix: Wait for dependsOn on first run of turbo watch by @MrNaif2018 in #11953
fix: Treat Bun runtime modules as builtins in Boundaries by @anthonyshew in #12141
feat: Add futureFlags.longerSignatureKey to enforce minimum HMAC key length by @anthonyshew in #12142
feat: Add runAttributes config to OTel metrics for cardinality control by @bkonkle in #12144
fix: Preserve deeply nested workspace deps during npm lockfile pruning by @anthonyshew in #12146
fix: Ensure noUpdateNotifier from turbo.json is respected by @sleitor in #11925
docs: Document Yarn v1 pass-through args workaround by @anthonyshew in #12150
fix: Add FORCE_COLOR and NO_COLOR to builtin passthrough env vars by @anthonyshew in #12158
test: Add integration test coverage for --anon-profile markdown generation by @anthonyshew in #12157
feat: Add AI coding agent detection telemetry by @anthonyshew in #12159
feat: Instrument post-hashing setup phase for trace visibility by @anthonyshew in #12160
perf: Fire-and-forget telemetry and analytics HTTP flushes on shutdown by @anthonyshew in #12162
perf: Defer lockfile await until after internal dependency resolution by @anthonyshew in #12164
refactor: Extract turborepo-query-api trait crate for compile-time decoupling by @anthonyshew in #12165
feat: Include version, platform, and CPU count in Chrome trace profiles by @anthonyshew in #12166
docs: Remove bespoke AI prompts from documentation pages by @anthonyshew in #12167
test: Add comprehensive path traversal tests for cache archive by @anthonyshew in #12169
test: Add regression tests and OutputWatcher trait to prepare for daemon removal from turbo watch by @anthonyshew in #12171
feat: Remove daemon from watch mode by @anthonyshew in #12175
perf: Defer SCM task await to overlap with setup work by @anthonyshew in #12177
perf: Defer cache save to after callback to unblock dependents sooner by @anthonyshew in #12178
chore: Add oxfmt check to pre-push hook by @anthonyshew in #12187
fix: Resolve pnpm catalog: specifiers to workspace dependencies in task graph by @anthonyshew in #12185
perf: Avoid Unconditional HTTP Client Warmup by @anthonyshew in #12189
perf: Scope Repo Index Untracked Discovery by @anthonyshew in #12195
perf: Reuse input hashes and trim pnpm lockfile allocations by @anthonyshew in #12199
docs: Improve Oxc tooling guide for type-aware linting and fix race conditions by @anthonyshew in #12200
perf: Overlap untracked file walk with builder setup by @anthonyshew in #12201
perf: Decouple filesystem walk from git index construction by @anthonyshew in #12204
perf: Race parallel git subprocesses against filesystem walk for optimal index construction by @anthonyshew in #12206
perf: Two-phase HTTP client init to avoid macOS Keychain blocking by @anthonyshew in #12208
perf: Skip redundant file writes during cache restore using manifests by @anthonyshew in #12209
perf: Generate cache restore manifest at save time to eliminate first-hit penalty by @anthonyshew in #12213
docs: Clarification in oxc guide by @anthonyshew in #12207
feat: Add affectedTasks query for task-level change detection by @anthonyshew in #12215

New Contributors

@MrNaif2018 made their first contribution in #11953

Full Changelog: vercel/turborepo@v2.8.13...v2.8.15

`v2.8.14`

Compare Source

`v2.8.13`: Turborepo v2.8.13

Compare Source

What's Changed

@turbo/repository

feat: Add experimentalObservability with an OTel backend by @bkonkle in #11130
release(library): 0.0.1-canary.20 by @github-actions[bot] in #12116

Examples

feat: Add with-otel example with pre-configured Grafana dashboard by @anthonyshew in #12043
examples: Upgrade with-react-native-web example to use latest versions by @serjooo in #12085
fix: Duplicate /signup? in Vercel URL by @04cb in #12088
examples: Fix markdown links inside code blocks in basic README by @sleitor in #11946

Changelog

fix: Suppress npm upgrade notices in integration tests and consolidate test helpers by @anthonyshew in #12036
fix: Replace flaky pnpx symlink-dir with native NTFS junctions in find-turbo test by @anthonyshew in #12039
fix: Prevent corepack download prompt from hanging prysk tests on Windows by @anthonyshew in #12041
fix: Send OTEL metrics without requiring --summarize flag by @anthonyshew in #12042
docs: Fix incorrect otel future flag bypass claim by @anthonyshew in #12047
fix: Address root causes of 9 flaky tests and remove retry workarounds by @anthonyshew in #12045
test: Port 6 prysk CLI tests to pure Rust by @anthonyshew in #12048
docs: Fix experimentalObservability config reference by @bkonkle in #12052
test: Port 10 more prysk tests to pure Rust by @anthonyshew in #12051
test: Port 14 more prysk tests to Rust (single-package + commands) by @anthonyshew in #12054
test: Port 13 more prysk tests to Rust by @anthonyshew in #12057
fix: Exclude peer dependencies from workspace external dep resolution by @anthonyshew in #12050
test: Port all 15 workspace-configs prysk tests to Rust by @anthonyshew in #12058
perf: Stream file contents during hashing to lower memory usage by @anthonyshew in #12059
fix: Treat npm: alias dependencies as external, not workspace references by @anthonyshew in #12061
test: Port 18 more prysk tests to Rust (other/ + lockfile-aware-caching/) by @anthonyshew in #12062
fix: Preserve file: protocol entries in pruned yarn v1 lockfile by @anthonyshew in #12064
perf: Use stack-allocated OidHash in FileHashes and skip expanded hashes on normal runs by @anthonyshew in #12065
test: Port all 8 find-turbo prysk tests to Rust by @anthonyshew in #12066
fix: Support pnpm per-workspace lockfiles in turbo prune by @anthonyshew in #12067
test: Port final 2 prysk tests to Rust (100% complete) by @anthonyshew in #12068
fix: Resolve Berry prune failure when resolutions contain patch overrides by @anthonyshew in #12069
test: Add lockfile fixture for yarn berry resolution pruning (issue #2791) by @anthonyshew in #12071
refactor: Clean up test infrastructure and eliminate duplication by @anthonyshew in #12072
fix: Retain injected workspace package entries during pnpm lockfile pruning by @anthonyshew in #12073
refactor: Clean up test infrastructure + improve test quality by @anthonyshew in #12074
perf: Speed up lockfile test suite by @anthonyshew in #12078
fix: Preserve file: and link: protocol entries in pruned bun lockfile by @anthonyshew in #12076
fix: Stop running unnecessary npm install in engines tests by @anthonyshew in #12081
test: Add lockfile fixture for pnpm v9 injected workspace deps (issue #8243) by @anthonyshew in #12082
fix: Filter orphaned Yarn packageExtensions entries during lockfile pruning by @anthonyshew in #12084
fix: Align experimentalObservability on object maps rather than arrays by @bkonkle in #12089
fix: Prevent yarn integration tests from hanging on corepack prompts by @anthonyshew in #12090
fix: Prevent turbo dev from hanging when daemon file watching fails by @anthonyshew in #12091
perf: Optimize npm lockfile parser by @anthonyshew in #12093
chore: Trim unused dependency features for faster compilation by @anthonyshew in #12094
fix: Prevent lockfile-aware yarn test from hanging on corepack downloads by @anthonyshew in #12095
perf: Eliminate per-directory stat syscalls in untracked file detection by @anthonyshew in #12096
perf: Reduce allocations in file hash computation by @anthonyshew in #12102
perf: Replace SWC with oxc for JS/TS parsing by @anthonyshew in #12098
fix: Pre-warm corepack cache to prevent yarn/pnpm tests from hanging by @anthonyshew in #12099
perf: Disable unused zstd default features to reduce C compilation by @anthonyshew in #12107
perf: Replace git subprocess in worktree detection with Rust by @anthonyshew in #12106
test: Add turbo watch tests and refactor file change classification by @anthonyshew in #12119
fix(frameworks): Also check devDependencies when inferring framework in single-package mode by @sleitor in #12056
test: Add boundary tests for framework inference devDependencies support by @anthonyshew in #12122
fix: Stabilize flaky watch_file_change_reruns_affected_package test by @anthonyshew in #12123
fix: Microfrontends merges with into root config instead of replacing it by @anthonyshew in #12125
fix: Omit None otel fields during turbo prune serialization by @bkonkle in #12126
fix: Correct dependency iteration order so dependencies takes precedence over devDependencies by @anthonyshew in #12129

New Contributors

@bkonkle made their first contribution in #11130
@serjooo made their first contribution in #12085
@04cb made their first contribution in #12088
@sleitor made their first contribution in #11946

Full Changelog: vercel/turborepo@v2.8.12...v2.8.13

`v2.8.12`: Turborepo v2.8.12

Compare Source

What's Changed

Changelog

chore: Reduce compile times by deduplicating thiserror and itertools by @anthonyshew in #12000
chore: Upgrade axum 0.7 to 0.8, deduplicate tower/tower-http by @anthonyshew in #12003
fix: Prevent peerDependencies from overwriting concrete dependency specifiers by @anthonyshew in #12004
fix: Resolve correct nested package version in bun lockfile pruning by @anthonyshew in #12008
fix: Resolve all lockfile pruning test failures by @anthonyshew in #12009
perf: Extract query module into turborepo-query crate by @anthonyshew in #12007
refactor: Migrate dry-json prysk tests to Rust + insta snapshots by @anthonyshew in #12010
perf: Deduplicate petgraph, fixedbitset, and dashmap by @anthonyshew in #12011
refactor: Migrate persistent-dependencies and task-dependencies to Rust + insta by @anthonyshew in #12012
test: Add lockfile-tests fixture for issue #12013 by @anthonyshew in #12014
perf: Remove libgit2/git2 dependency, replace with gix-object by @anthonyshew in #12015
refactor: Migrate daemon, jsonc, query, edit-turbo-json tests to Rust by @anthonyshew in #12016
perf: Remove async-graphql from turborepo-lib by @anthonyshew in #12017
refactor: Migrate inference and run-logging tests to Rust by @anthonyshew in #12018
refactor: Migrate run-caching and strict-env-vars tests to Rust by @anthonyshew in #12020
fix: Mark lockfile-aware-caching/bun prysk test as flaky by @anthonyshew in #12021
fix: Add nextest retries for flaky tests by @anthonyshew in #12027
refactor: Migrate prune and run-summary tests to Rust by @anthonyshew in #12022
fix: Add nextest retries for flaky prysk tests by @anthonyshew in #12030
fix: Add nextest retries for flaky prune_test::test_prune_composable_config by @anthonyshew in #12032
fix: Suppress npm upgrade notices in Rust integration tests by @anthonyshew in #12033

Full Changelog: vercel/turborepo@v2.8.11...v2.8.12

Configuration

📅 Schedule: Branch creation - "before 3am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

github-actions · 2026-03-18T22:16:33Z

Coverage Delta

No covered files changed in this PR.

Overall Coverage

Metric	Coverage
Statements	81.8% (±0%)
Branches	70.9% (±0%)
Functions	80.0% (±0%)
Lines	82.2% (±0%)

socket-security · 2026-03-18T22:28:40Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/turbo@2.8.11 ⏵ 2.8.17	⁺¹	⁺¹
npm/knip@5.85.0 ⏵ 5.86.0			⁺¹
npm/lint-staged@16.2.7 ⏵ 16.4.0			⁺⁸

View full report

renovate bot added 📦 deps 🤖 bot labels Mar 17, 2026

renovate bot requested a review from a team as a code owner March 17, 2026 04:49

renovate bot requested review from ryanbonial and removed request for a team March 17, 2026 04:49

renovate bot enabled auto-merge (squash) March 17, 2026 04:49

renovate bot force-pushed the renovate/devdependencies-(non-major) branch 21 times, most recently from 368fbfe to b29e252 Compare March 18, 2026 21:47

chore(deps): update devdependencies (non-major)

aad0dcb

renovate bot force-pushed the renovate/devdependencies-(non-major) branch from b29e252 to aad0dcb Compare March 18, 2026 22:05

binoy14 approved these changes Mar 18, 2026

View reviewed changes

renovate bot merged commit 1fc760d into main Mar 18, 2026
44 checks passed

renovate bot deleted the renovate/devdependencies-(non-major) branch March 18, 2026 23:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update devdependencies (non-major)#700

chore(deps): update devdependencies (non-major)#700
renovate[bot] merged 1 commit intomainfrom
renovate/devdependencies-(non-major)

renovate bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 18, 2026

Uh oh!

socket-security bot commented Mar 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v5.86.0: Release 5.86.0

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

v2.8.17: Turborepo v2.8.17

v2.8.16: Turborepo v2.8.16

What's Changed

turbo-ignore

Changelog

New Contributors

v2.8.15: Turborepo v2.8.15

What's Changed

create-turbo

Changelog

New Contributors

v2.8.13: Turborepo v2.8.13

What's Changed

Examples

Changelog

New Contributors

v2.8.12: Turborepo v2.8.12

What's Changed

Changelog

Configuration

Uh oh!

github-actions bot commented Mar 18, 2026

Coverage Delta

Overall Coverage

Uh oh!

socket-security bot commented Mar 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Mar 17, 2026 •

edited

Loading

`v5.86.0`: Release 5.86.0

`v2.8.17`: Turborepo v2.8.17

`v2.8.16`: Turborepo v2.8.16

`v2.8.15`: Turborepo v2.8.15

`v2.8.13`: Turborepo v2.8.13

`v2.8.12`: Turborepo v2.8.12