Skip to content

⬆️ Upgrade all non-major dependencies - #5164

Open
renovate[bot] wants to merge 1 commit into
developfrom
renovate/all-non-major-dependencies
Open

⬆️ Upgrade all non-major dependencies#5164
renovate[bot] wants to merge 1 commit into
developfrom
renovate/all-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@lucide/vue (source) 1.59.0 → 1.60.0 age confidence
@typescript-eslint/eslint-plugin (source) 8.70.1 → 8.72.0 age confidence
@typescript-eslint/parser (source) 8.70.1 → 8.72.0 age confidence
@typescript-eslint/utils (source) 8.70.1 → 8.72.0 age confidence
apexcharts (source) 8.3.1 → 8.4.0 age confidence
filp/whoops (source) 2.18.6 → 2.18.7 age confidence
guzzlehttp/guzzle (source) 8.2.0 → 8.3.0 age confidence
laravel/framework (source) 13.37.0 → 13.38.0 age confidence
maplibre-gl (source) 6.14.0 → 6.15.0 age confidence
postcss-selector-parser 7.1.6 → 7.1.7 age confidence
spatie/icalendar-generator 3.3.0 → 3.3.1 age confidence
spatie/laravel-activitylog 5.1.1 → 5.1.3 age confidence
spatie/laravel-ignition (source) 2.12.0 → 2.12.1 age confidence
spatie/laravel-permission 8.3.0 → 8.3.2 age confidence
typescript-eslint (source) 8.70.1 → 8.72.0 age confidence

Release Notes

lucide-icons/lucide (@​lucide/vue)

v1.60.0: Version 1.60.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.72.0

Compare Source

🚀 Features
  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#​12992)
  • eslint-plugin: lazy load rules (#​13010)
🩹 Fixes
  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#​13054)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#​13055)
  • eslint-plugin: [require-array-sort-compare] check tuples (#​13058)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#​13053)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#​12704)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#​13016)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#​12991)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

Compare Source

🩹 Fixes
  • eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#​12805)
  • eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#​12995)
  • eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#​12977)
  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#​12974)
  • eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#​12989)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.1

Compare Source

🩹 Fixes
  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#​12941)
  • eslint-plugin: [prefer-optional-chain] check the constrained type (#​12953)
  • eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#​12930)
  • eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#​12957)
  • eslint-plugin: [require-array-sort-compare] use array argument type constraint (#​12919)
  • eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#​12892)
  • eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#​12923)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

Compare Source

🚀 Features
  • eslint-plugin: [no-unsafe-enum-assignment] add rule (#​12732)
🩹 Fixes
  • eslint-plugin: [no-misused-promises] handle a return outside of any function (#​12912)
  • eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#​12832)
  • eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
  • eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#​12885)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.72.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/utils)

v8.72.0

Compare Source

🩹 Fixes
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#​12704)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

Compare Source

This was a version bump only for utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.1

Compare Source

This was a version bump only for utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

Compare Source

8.71.0 (2026-09-28)

🚀 Features
  • eslint-plugin: [no-unsafe-enum-assignment] add rule (#​12732)
🩹 Fixes
  • eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#​12885)
  • eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
  • eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#​12832)
  • eslint-plugin: [no-misused-promises] handle a return outside of any function (#​12912)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

apexcharts/apexcharts.js (apexcharts)

v8.4.0: 💎 Version 8.4.0

Compare Source

A security fix: a series name, category or goal name containing HTML could run script in the legend or tooltip, also in server-rendered HTML. Data you pass in now shows as text there; HTML a formatter returns still renders. Upgrade if those labels come from user data.

Also less work per render for bars, timelines and treemaps, tooltip.custom on sunburst, icicle and treemap branches, and these changes you may notice:

Change What to check
Names and labels show HTML as text markup in names
tooltip.custom runs on treemap branches custom reading points
Trellis honours chart.zoom.enabled false grids that set it
Sunburst, icicle honour dataLabels.enabled dataLabels.enabled
Sunburst crumb uses drilldown.breadcrumb breadcrumb options

🐛 Fixes

  • Project stream-scroll pathFrom from the joined path (#​5316). Thanks @​SahinurDEV.
  • Do not expand zero stacked columns by series stroke width (#​5046). Thanks @​SahinurDEV.
  • Draw series added to a shared logarithmic axis. Thanks @​Arthur031221.
  • Read dates past year 9999 as utc, not local time.
  • Fire legendHover once per item, not on every mouse move.
  • Keep reordered series on a shared logarithmic axis (#​5353).
  • Ease an axis border from its own extent.
  • Draw server renders the way the browser draws them.
  • Return to a level as it is now, its overrides undone.
  • Honour enabled toggles and settle async levels safely.
  • Hand back the raw series when an alias type is switched off.
  • Grid tooltip reads numeric x and horizontal bars right.
  • Push one panel data patch from render and updateSeries.
  • Keep legend, zoom and tool state in step across rebuilds.
  • Respect zoom.enabled false; edge labels read effective y.
  • Sort dates, leave combo series alone.
  • Restored zoom focus keeps its ancestors.
  • Gradient legend spans explicit colour stops.
  • Keep line forecasts and gradient area strokes on SVG.
  • Paint primitive styling and custom series identity.
  • Divide 100% stacked parts by their own stack's total.
  • Fade every exit ghost, also of a series left empty.
  • Plugin highlight() says null on a nested treemap.
  • Drilled treemap leaves, morph rings, pie part filters.
  • One name per reference series, one warning per dupe set.
  • CSV category labels; export only the promoted panel.
  • Resolve only registered layout names, never inherited ones.
  • Keep the series stroke for the sideways inset of empty columns. Thanks @​SahinurDEV.
  • Draw the host subtitle; honour title align and font.
  • Honour tooltip.custom in sunburst and icicle tooltips.
  • Key ISO date strings by epoch on a datetime x axis.
  • Shared y per axis, log decades and clean label decimals.
  • Colour map follows the theme palette and monochrome.
  • Show series names, categories and goal names as text.
  • Keep the stepline run that leads into a null (#​4787). Thanks @​itisrmk.
  • Keep morph pieces and exit labels in step.
  • Stop padding the user's y axis label colours in place.
  • Ignore a non-number multi-axis bound like a single axis.
  • UpdateSeries(data, false) lands without a tween.
  • Sunburst crumb and morph race, dataLabels.enabled.
  • Honour tooltip.custom in branch tooltips.
  • Close a full-turn slice as a circle so its stroke has no seam. Thanks @​itisrmk.
  • Fold an empty stacked column onto its base edge.
  • Draw a zero slice as a lone moveto so morphs still reach it.

The full bundle is 394,666 B gzipped, up 4,585 B (1.2%) from 8.3.1.

Upgrading is npm install apexcharts@8.4.0.

Full changelog, with the detail behind each change: apexcharts/apexcharts.js@v8.3.1...v8.4.0

filp/whoops

v2.18.7

Compare Source

guzzle/guzzle (guzzlehttp/guzzle)

v8.3.0

Compare Source

Changed
  • Adjusted guzzlehttp/promises version constraint to ^3.1
  • Adjusted guzzlehttp/psr7 version constraint to ^3.2
  • Replace the deprecated Promise\Is with Promise\State for PHP 8.6
  • Decode chunked stream handler bodies as they arrive, ending at the last chunk
  • Reject truncated and malformed chunked stream handler bodies, like libcurl
  • Reject unsupported response transfer codings, like libcurl 8.14+
  • End stream handler bodies at their declared Content-Length, including 0
  • Throw when a streamed body ends before its declared Content-Length
  • Classify cURL errors 8 and 23 with a response as ResponseTransferException
  • Reject stream handler gzip and deflate bodies with trailing data, like libcurl
  • Accept raw deflate stream handler bodies, like libcurl
Fixed
  • Fix streamed stream handler bodies delaying bytes that arrived with the headers

v8.2.1

Compare Source

Fixed
  • Fix PHP 8.6 notices for oversized numeric hosts
  • Fix delay values over 71 minutes
  • Fix CurlMultiHandler delays over 71 minutes
  • Fix overlapping stream handler requests sharing a deadline
  • Fix stream handler responses in Swoole coroutines on PHP 8.4+
  • Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
  • Fix stream handler accepting corrupt gzip and deflate response bodies
Changed
  • Adjusted guzzlehttp/psr7 version constraint to ^3.1.1
laravel/framework

v13.38.0

Compare Source

maplibre/maplibre-gl-js (maplibre-gl)

v6.15.0

Compare Source

✨ Features and improvements
  • Add dragRotate: {around: 'pointer'} to turn and tilt the map around the point under the pointer, and {around: 'center', movement: 'circular' | 'linear'}, which replaces the deprecated aroundCenter (#​8628) (by @​birkskyum)
  • Redraw fewer layers on terrain when a custom layer's terrainTileRevision or a feature state changes (#​8782) (by @​birkskyum)
  • Support the hash option in a projection registered with addProjection (#​8743) (by @​birkskyum)
  • Add experimental addProjection, removeProjection, a built-in identity projection and a {bbox} tile URL token for maps in a custom planar CRS with its own quad tile grid (#​168, #​5764)
  • Speed up tile loading by skipping point labels in the tile buffer, which the neighbouring tile draws (#​8535) (by @​cherenkov)
  • Project GeoJSON sources on a map in a registered CRS, in the workers, from a definition string and a projection handler (#​8736) (by @​johncarmack1984)
  • Support OpenType vert forms in vertical labels rendered with font-faces (#​8489) (by @​NEKOYASAN)
🐞 Bug fixes
  • Fix a map in a registered projection going blank when its center crosses 180° (#​8802) (by @​birkskyum)
  • Fix world projections like Equal Earth throwing and jumping when the mouse is in the space around the world (#​8803) (by @​birkskyum)
  • Work around a regression in Safari 26.6 and later where the map stops loading tiles after the page was in the background (#​8780) (by @​birkskyum)
  • Fix labels in Brahmic scripts such as Devanagari, Thai and Telugu mixing fonts or dropping letters when the style has a glyphs URL (#​8741) (by @​crackalamoo)
  • Fix setWorkerUrl treating a .cjs fragment or query marker as a module worker URL (#​8769) (by @​Anandb71)
  • Fix the terrain not finding a tile's own DEM data when the DEM source's maxzoom is below the terrain tile zoom (#​8765) (by @​johncarmack1984)
  • Fix the camera dropping to sea level while the terrain under the center of a jumpTo, easeTo or flyTo loads (#​8549) (by @​johncarmack1984)
  • Fix a grid of lines along tile borders in line layers of sliced overzoomed tiles when the source tile extent is larger than 4096, by scaling the clip buffer with the extent (#​8705) (by @​tordans)
  • Fix the globe drag rounding its rotation to single precision (#​8784) (by @​johncarmack1984)
  • Fix load and idle firing before the other tiles finish loading when one tile fails (#​8785) (by @​johncarmack1984)
  • Avoid using .innerHTML = … for the Popup close icon (#​8795) (by @​k-yle)
  • Fix a GeoJSON feature without coordinates staying out of the tiles after updateData gives it some, by updating geojson-vt to 6.3.0 (#​8797) (by @​johncarmack1984)
postcss/postcss-selector-parser (postcss-selector-parser)

v7.1.7

Compare Source

  • fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#​337 by @​theRizwan)
  • fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#​340 by @​jakezwang)
  • fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#​343 by @​feritcemkahraman)
  • fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#​342 by @​SAY-5)
  • fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#​339 by @​dkryaklin)
spatie/icalendar-generator

v3.3.1

Compare Source

What changed
  • Normalize CRLF, CR and LF in parameter values before RFC 6868 encoding, including organizer and attendee names. Preserve literal carets and the escaping bypass. (#​173)
  • Update test tooling to Pest 5 and snapshot plugin 2.4, test PHP 8.4 and 8.5 with lowest and latest dependencies, and run PHPStan for pull requests.
  • Replace styling auto-commits with reproducible, read-only Composer style checks.

Requires PHP 8.4 or higher. No public API breaking changes.

Validation: all 177 tests (541 assertions) pass across the four PHP/dependency combinations; PHPStan and style checks pass.

spatie/laravel-activitylog

v5.1.3

Compare Source

What changed
  • Fix eager authentication and session resolution when registering activity callbacks during application boot.
  • Preserve explicit causers, including unsaved models and custom resolvers that return null.
  • Keep the causer available to tap() callbacks and preserve their changes, including anonymous logging.
  • Clear cached causer relations through Eloquent when selecting an anonymous causer.
  • Align the PHPUnit XML schema with the installed runner, retaining PHP 8.4/8.5 coverage with Laravel 12/Pest 4 and Laravel 13/Pest 5.
Compatibility note

No public APIs were removed and supported PHP/Laravel versions are unchanged. The default causer is now selected when log() is called, or before a tap() callback, rather than when the logger is constructed. If authentication changes between those calls, use causedBy() to retain a specific causer.

Validated with 189 tests (467 assertions), the full eight-job dependency matrix, PHPStan, and Pint.

Thanks to @​artygrand for #​1477.

Full changelog: spatie/laravel-activitylog@5.1.2...5.1.3

v5.1.2

Compare Source

What changed
  • Fix eager authentication and session resolution when registering activity callbacks during application boot.
  • Preserve explicit causers, including unsaved models and custom resolvers that return null.
  • Keep the causer available to tap() callbacks and preserve their changes, including anonymous logging.
  • Clear cached causer relations through Eloquent when selecting an anonymous causer.
  • Align the PHPUnit XML schema with the installed runner, retaining PHP 8.4/8.5 coverage with Laravel 12/Pest 4 and Laravel 13/Pest 5.
Compatibility note

No public APIs were removed and supported PHP/Laravel versions are unchanged. The default causer is now selected when log() is called, or before a tap() callback, rather than when the logger is constructed. If authentication changes between those calls, use causedBy() to retain a specific causer.

Validated with 189 tests (467 assertions), the full eight-job dependency matrix, PHPStan, and Pint.

Thanks to @​artygrand for #​1477.

Full changelog: spatie/laravel-activitylog@5.1.2...5.1.3

spatie/laravel-ignition

v2.12.1

Compare Source

What’s Changed
  • Fix Blade exception mapping with multiple nested view-engine decorators, including Sentry and OpenTelemetry combinations, in #​257.
  • Resolve compiled paths through the underlying compiler instead of requiring decorators to forward getCompiler().
  • Preserve the original exception for cyclic or unsupported decorator chains and view exceptions without a view-path suffix.
  • Add regression coverage and fix stale PHPStan suppressions.

No breaking changes or changes to supported PHP/Laravel versions.

Thanks to @​hayleyberryl2s for the original fix.

Full Changelog: spatie/laravel-ignition@2.12.0...2.12.1

spatie/laravel-permission

v8.3.2

Compare Source

Performance
  • Speed up repeated cached permission lookups by name and ID without changing lookup semantics (#​2969).
  • Preserve loose comparisons, guard isolation, first-match ordering, shared model identity, and mutations of returned models. Custom models and keyed collections continue to use the original filter.
  • Keep lookup indexes tied to cache invalidation, including saved changes, deletion, explicit resets, and cache/tenant reinitialization.
Verification
  • Add regression coverage for numeric comparisons, custom accessors and keys, collection ordering, runtime casts, invalidation, strict missing-attribute handling, and release of cached model references.
  • Add an opt-in benchmark covering warm hits/misses, hydration, and retained memory. Indexing trades some hydration work and memory for faster repeated lookups; performance depends on the workload and is not unconditionally O(1).

No breaking changes. Public APIs, persistent cache format, and PHP/Laravel support are unchanged.

Full Changelog: spatie/laravel-permission@8.3.1...8.3.2

v8.3.1

Compare Source

Performance
  • Speed up repeated cached permission lookups by name and ID without changing lookup semantics (#​2969).
  • Preserve loose comparisons, guard isolation, first-match ordering, shared model identity, and mutations of returned models. Custom models and keyed collections continue to use the original filter.
  • Keep lookup indexes tied to cache invalidation, including saved changes, deletion, explicit resets, and cache/tenant reinitialization.
Verification
  • Add regression coverage for numeric comparisons, custom accessors and keys, collection ordering, runtime casts, invalidation, strict missing-attribute handling, and release of cached model references.
  • Add an opt-in benchmark covering warm hits/misses, hydration, and retained memory. Indexing trades some hydration work and memory for faster repeated lookups; performance depends on the workload and is not unconditionally O(1).

No breaking changes. Public APIs, persistent cache format, and PHP/Laravel support are unchanged.

Full Changelog: spatie/laravel-permission@8.3.1...8.3.2

typescript-eslint/typescript-eslint (typescript-eslint)

v8.72.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every 2 weeks on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the 📌 dependencies Pull requests that update a dependency file label Oct 19, 2026
@renovate

renovate Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-20T14_29_06_255Z-debug-0.log

@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from b1ef121 to 870b056 Compare October 20, 2026 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

📌 dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants