chore(deps): update all non-major dependencies #13883

renovate · 2025-09-15T01:23:26Z

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	`^22.17.2` -> `^22.18.3`
@types/semver (source)	`^7.7.0` -> `^7.7.1`
pnpm (source)	`10.15.0` -> `10.16.1`
sass	`^1.90.0` -> `^1.92.1`
serve	`^14.2.4` -> `^14.2.5`

Release Notes

pnpm/pnpm (pnpm)

`v10.16.1`

Compare Source

Patch Changes

The full metadata cache should be stored not at the same location as the abbreviated metadata. This fixes a bug where pnpm was loading the abbreviated metadata from cache and couldn't find the "time" field as a result #9963.
Forcibly disable ANSI color codes when generating patch diff #9914.

`v10.16.0`

Compare Source

Minor Changes

There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.

The new setting is called minimumReleaseAge. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, setting minimumReleaseAge: 1440 ensures that only packages released at least one day ago can be installed.

If you set minimumReleaseAge but need to disable this restriction for certain dependencies, you can list them under the minimumReleaseAgeExclude setting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:
```
minimumReleaseAgeExclude:
  - webpack
```
Related issue: #9921.
Added support for finders #9946.

In the past, pnpm list and pnpm why could only search for dependencies by name (and optionally version). For example:
```
pnpm why minimist
```
prints the chain of dependencies to any installed instance of minimist:
```
verdaccio 5.20.1
├─┬ handlebars 4.7.7
│ └── minimist 1.2.8
└─┬ mv 2.1.1
  └─┬ mkdirp 0.5.6
    └── minimist 1.2.8
```
What if we want to search by other properties of a dependency, not just its name? For instance, find all packages that have react@17 in their peer dependencies?

This is now possible with "finder functions". Finder functions can be declared in .pnpmfile.cjs and invoked with the --find-by=<function name> flag when running pnpm list or pnpm why.

Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our .pnpmfile.cjs:
```
module.exports = {
  finders: {
    react17: (ctx) => {
      return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    },
  },
};
```
Now we can use this finder function by running:
```
pnpm why --find-by=react17
```
pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph.
```
@&#8203;apollo/client 4.0.4
├── @&#8203;graphql-typed-document-node/core 3.2.0
└── graphql-tag 2.12.6
```
It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder:
```
module.exports = {
  finders: {
    react17: (ctx) => {
      const manifest = ctx.readManifest();
      if (manifest.peerDependencies?.react === "^17.0.0") {
        return `license: ${manifest.license}`;
      }
      return false;
    },
  },
};
```
Every matched package will also print out the license from its package.json:
```
@&#8203;apollo/client 4.0.4
├── @&#8203;graphql-typed-document-node/core 3.2.0
│   license: MIT
└── graphql-tag 2.12.6
    license: MIT
```

Patch Changes

Fix deprecation warning printed when executing pnpm with Node.js 24 #9529.
Throw an error if nodeVersion is not set to an exact semver version #9934.
pnpm publish should be able to publish a .tar.gz file #9927.
Canceling a running process with Ctrl-C should make pnpm run return a non-zero exit code #9626.

`v10.15.1`

Compare Source

Patch Changes

Fix .pnp.cjs crash when importing subpath #9904.
When resolving peer dependencies, pnpm looks whether the peer dependency is present in the root workspace project's dependencies. This change makes it so that the peer dependency is correctly resolved even from aliased npm-hosted dependencies or other types of dependencies #9913.

sass/dart-sass (sass)

`v1.92.1`

Compare Source

Fix a bug where variable definitions from one imported, forwarded module
would not be passed as implicit configuration to a later imported, forwarded
module.

`v1.92.0`

Compare Source

Breaking change: Emit declarations, childless at-rules, and comments in
the order they appear in the source even when they're interleaved with nested
rules. This obsoletes the mixed-decls deprecation.
Breaking change: The function name type() is now fully reserved for the
plain CSS function. This means that @function definitions with the name
type will produce errors, while function calls will be parsed as special
function strings.
Configuring private variables using @use ... with, @forward ... with, and
meta.load-css(..., $with: ...) is now deprecated. Private variables were
always intended to be fully encapsulated within the module that defines them,
and this helps enforce that encapsulation.
Fix a bug where @extend rules loaded through a mixture of @import and
@use rules could fail to apply correctly.

Command-Line Interface

In --watch mode, delete the source map when the associated source file is
deleted.

`v1.91.0`

Compare Source

Potentially breaking change: meta.inspect() (as well as other systems
that use it such as @debug and certain error messages) now emits numbers
with as high precision as is available instead of rounding to the nearest
1e⁻¹⁰ as we do when serializing to CSS. This better fits the purpose of
meta.inspect(), which is to provide full information about the structure of
a Sass value.
Passing a rest argument ($arg...) before a positional or named argument when
calling a function or mixin is now deprecated. This was always outside the
specified syntax, but it was historically treated the same as passing the rest
argument at the end of the argument list whether or not that matched the
visual order of the arguments.

vercel/serve (serve)

`v14.2.5`

Compare Source

Patch Changes

f4b6fbd: Update compression to v1.8.1

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2025-09-15T01:23:34Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2025-09-15T01:24:37Z

Size Report

Bundles

File	Size	Gzip	Brotli
runtime-dom.global.prod.js	101 kB	38.5 kB	34.6 kB
vue.global.prod.js	159 kB	58.6 kB	52.1 kB

Usages

Name	Size	Gzip	Brotli
createApp (CAPI only)	46.6 kB	18.2 kB	16.7 kB
createApp	54.6 kB	21.3 kB	19.4 kB
createSSRApp	58.9 kB	23 kB	21 kB
defineCustomElement	59.6 kB	22.8 kB	20.9 kB
overall	68.8 kB	26.4 kB	24.2 kB

pkg-pr-new · 2025-09-15T01:24:45Z

Open in StackBlitz

@vue/compiler-core

npm i https://pkg.pr.new/@vue/compiler-core@13883

@vue/compiler-dom

npm i https://pkg.pr.new/@vue/compiler-dom@13883

@vue/compiler-sfc

npm i https://pkg.pr.new/@vue/compiler-sfc@13883

@vue/compiler-ssr

npm i https://pkg.pr.new/@vue/compiler-ssr@13883

@vue/reactivity

npm i https://pkg.pr.new/@vue/reactivity@13883

@vue/runtime-core

npm i https://pkg.pr.new/@vue/runtime-core@13883

@vue/runtime-dom

npm i https://pkg.pr.new/@vue/runtime-dom@13883

@vue/server-renderer

npm i https://pkg.pr.new/@vue/server-renderer@13883

@vue/shared

npm i https://pkg.pr.new/@vue/shared@13883

vue

npm i https://pkg.pr.new/vue@13883

@vue/compat

npm i https://pkg.pr.new/@vue/compat@13883

commit: 6852455

chore(deps): update all non-major dependencies

6852455

renovate bot added the dependencies Pull requests that update a dependency file label Sep 15, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update all non-major dependencies #13883

chore(deps): update all non-major dependencies #13883

renovate bot commented Sep 15, 2025

Uh oh!

coderabbitai bot commented Sep 15, 2025

Review skipped

Uh oh!

github-actions bot commented Sep 15, 2025

Uh oh!

pkg-pr-new bot commented Sep 15, 2025

Uh oh!

Uh oh!

Uh oh!

chore(deps): update all non-major dependencies #13883

Are you sure you want to change the base?

chore(deps): update all non-major dependencies #13883

Conversation

renovate bot commented Sep 15, 2025

Release Notes

v10.16.1

Patch Changes

v10.16.0

Minor Changes

Patch Changes

v10.15.1

Patch Changes

v1.92.1

v1.92.0

Command-Line Interface

v1.91.0

v14.2.5

Patch Changes

Configuration

Uh oh!

coderabbitai bot commented Sep 15, 2025

Review skipped

Uh oh!

github-actions bot commented Sep 15, 2025

Size Report

Bundles

Usages

Uh oh!

pkg-pr-new bot commented Sep 15, 2025

Uh oh!

Uh oh!

`v10.16.1`

`v10.16.0`

`v10.15.1`

`v1.92.1`

`v1.92.0`

`v1.91.0`

`v14.2.5`