Skip to content

fix(deps): update npm dependencies (non-major) - #121

Merged
yukin01 merged 1 commit into
mainfrom
renovate/npm-dependencies-(non-major)
Aug 5, 2026
Merged

fix(deps): update npm dependencies (non-major)#121
yukin01 merged 1 commit into
mainfrom
renovate/npm-dependencies-(non-major)

Conversation

@renovate

@renovate renovate Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@aws-sdk/client-ssm (source) 3.1078.03.1097.0 age confidence
@slack/web-api (source) 7.18.07.19.0 age confidence
@swc/core (source) 1.15.431.15.46 age confidence
@types/node (source) 25.9.425.9.5 age confidence
minimatch 10.2.310.2.6 age confidence
oxfmt (source) 0.57.00.61.0 age confidence
oxlint (source) 1.72.01.76.0 age confidence
pnpm (source) 11.10.011.18.0 age confidence

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/client-ssm)

v3.1097.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1096.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1095.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1094.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1093.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1092.0

Compare Source

Features
  • client-ssm: Added a WarningMessage field to Automation along with corresponding public documentation. (7af6eb5)

v3.1091.0

Compare Source

3.1091.0(2026-07-20)
Documentation Changes
  • client-organizations: Updated InvalidInputException error documentation to clarify that the service validates free-text field values against common cross-site scripting (XSS) patterns. (6ac1bf08)
  • client-marketplace-metering: For new SaaS product integrations, CustomerIdentifier is not populated in ResolveCustomer responses and is not supported in BatchMeterUsage. Use CustomerAWSAccountId and LicenseArn instead. (f1ff8983)
New Features
  • client-quicksight: Adds support for custom permissions for Triggers, allowing administrators to control user access to Schedule, Inbound Email and Quick Event triggers. (fbe7d94d)
  • client-bedrock-agentcore: Add W3C trace context headers (traceparent, tracestate, baggage) and X-Amzn-Trace-Id to InvokeHarness request for end-to-end observability propagation. Add toolResultMetadata to the streaming content block delta for MCP tool result meta delivery without oversized SSE frames. (4cf22ef3)
  • client-bedrock-agentcore-control: This release adds support for specifying a connector version on Gateway targets to pin the connector's tool schema. It also introduces web-search connector version 1.2.0, which adds agent-side domain filtering, published date range filtering, and admin-side domain allowlisting. (2c37055a)
  • client-sesv2: Amazon SES introduces three new Pricing Plans (Essentials, Pro, Enterprise), which bundle SES features under one pricing umbrella. The new PutAccountPricingAttributes API lets the user set the account's plan, while current plan retrievalif done through the new PricingAttributes field on GetAccount. (751dc8df)
  • client-mediatailor: This change adds api support for configuring ad decision server timeouts and concurrency fields on MediaTailor playback configurations (97ea965e)
  • client-inspector2: Adds Windows path support for deep inspection. Fixes tag propagation for connector CloudFormation stack operations. (2263613f)
Tests

For list of updated packages, view updated-packages.md in assets-3.1091.0.zip

v3.1090.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1089.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1088.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1087.0

Compare Source

Features
  • client-ssm: Update AWS Systems Manager Automation Targets to be correct max value. (7506cef)

v3.1086.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1085.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1084.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1083.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1082.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1081.0

Compare Source

Features
  • client-ssm: Adding SSM Cloud Connector to support Azure Virtual Machines onboarding to AWS Systems Manager (6efef57)

v3.1080.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

v3.1079.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ssm

slackapi/node-slack-sdk (@​slack/web-api)

v7.19.0

Compare Source

Minor Changes
  • a795b86: feat: expand app manifest types — add agent_view and assistant_view features, recent agent events (app_context_changed, assistant_thread_started, assistant_thread_context_changed), optional OAuth scopes (bot_optional/user_optional), and event metadata_subscriptions
swc-project/swc (@​swc/core)

v1.15.46

Compare Source

Bug Fixes
Documentation
Features
Refactor
Testing
  • (react-compiler) Add build-pass fixtures for wrapped assignment targets (#​11967) (58d9b53)
Build
Ci
isaacs/minimatch (minimatch)

v10.2.6

Compare Source

v10.2.5

Compare Source

v10.2.4

Compare Source

oxc-project/oxc (oxfmt)

v0.61.0

Compare Source

v0.60.0

Compare Source

v0.59.0

Compare Source

🐛 Bug Fixes
  • 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#​24286) (leaysgur)

v0.58.0

Compare Source

oxc-project/oxc (oxlint)

v1.76.0

Compare Source

🚀 Features
  • 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#​24598) (vigneshwar)
  • 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#​24724) (Bartok)
  • 016cf2a linter/oxc: Add bad-match-all-arg rule (#​24900) (camc314)
  • cdc941e linter/n: Implement exports-style rule (#​24087) (Mikhail Baev)
  • 1ad6f6c linter/eslint: Implement id-denylist rule (#​24632) (Mikhail Baev)
📚 Documentation

v1.75.0

Compare Source

🚀 Features
  • dd18383 linter/node: Implement no-top-level-await rule (#​24634) (Connor Shea)
  • 16a65f2 linter/react: Implement function-component-definition rule (#​24471) (Cole Ellison)
  • 7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#​24519) (Mikhail Baev)
  • 99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#​24502) (camc314)
🐛 Bug Fixes
  • 8694167 linter/eslint/prefer-destructuring: Handle typed declarations (#​24616) (camc314)

v1.74.0

Compare Source

🚀 Features
  • 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#​24044) (Boshen)
🐛 Bug Fixes
  • 8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#​24341) (leaysgur)
  • 2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#​24339) (leaysgur)
⚡ Performance
  • 7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#​24413) (connorshea)
  • 6272051 linter/typescript/no-require-imports: Compile allow patterns once (#​24417) (connorshea)
  • 33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#​24420) (connorshea)

v1.73.0

Compare Source

🚀 Features
  • a2c97f3 linter/unicorn: Implement explicit-timer-delay rule (#​23612) (Mikhail Baev)
  • 85735cb linter/unicorn: Implement no-confusing-array-with rule (#​23638) (Shekhu☺️)
  • cb4fbb9 linter/eslint: Implement no-unreachable-loop rule (#​23975) (Todor Andonov)
  • dc32112 linter/eslint/no-constant-binary-expression: Check relational comparisons (#​24088) (camc314)
  • d963967 linter/unicorn/no-array-sort: Add allowAfterSpread option (#​24043) (Boshen)
  • 0a75682 linter: Add per-rule timings for type-aware linting (#​22488) (camchenry)
  • 743e222 linter/react: Add disallowedValues option for forbid-dom-props rule (#​23970) (Mikhail Baev)
🐛 Bug Fixes
  • bdb51c7 linter/jest/prefer-ending-with-an-expect: Validate config patterns (#​24122) (camc314)
  • 45d607d linter/react/forbid-component-props: Make allow/disallow lists optional in schema (#​24024) (Boshen)
pnpm/pnpm (pnpm)

v11.18.0: pnpm 11.18

Compare Source

Minor Changes

  • Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through optionalDependencies is installable on the current system but one of its regular dependencies is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with MODULE_NOT_FOUND. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped #​13286.

  • pnpm setup now appends PNPM_HOME and the global bin directory to the GitHub Actions environment files (GITHUB_ENV and GITHUB_PATH), so later steps in the same job can run pnpm add --global and other global commands #​9191.

  • Added support for publishConfig.name, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents, pnpm-lock.yaml, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check of pnpm publish -r, its registry selection, and the release-planning probes of pnpm change status and pnpm version -r #​13345.

  • pnpm self-update no longer takes any instruction from the project it is run in:

    • pnpm is fetched through the same trusted registry and auth configuration used when switching pnpm versions, so a project .npmrc or pnpm-workspace.yaml can no longer redirect the download or attach credentials to it, and the project's default .pnpmfile.(c|m)js is no longer loaded. Pnpmfiles from trusted sources (the pnpmfile setting, the global pnpmfile, config dependencies) still apply.
    • The minimumReleaseAge settings in pnpm-workspace.yaml no longer affect self-update. They still govern the project's own dependencies; for self-update the cooldown now comes from the built-in default, your global config, a PNPM_CONFIG_* environment variable, or a command-line flag. This fixes self-update failing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it.
    • The same applies to the trustPolicy settings and to ci: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses.

    When self-update refuses a version that is younger than the cutoff, an interactive run now offers to update anyway; non-interactive runs still fail. CI never prompts, even on a runner that attaches a TTY.

Patch Changes

  • Fixed pnpm licenses list to report every version when the same package is installed under multiple aliases pnpm/pnpm#13438.

  • Sort pnpm dedupe --check snapshot changes for stable output across pnpm implementations.

  • Strip Unicode formatting characters from registry- and manifest-derived terminal output.

  • Speed up installs after compatible catalog or direct dependency range changes by retaining the locked version without resolving the dependency graph again.

  • Speed up installs after safe override changes by reusing unambiguous compatible dependency resolutions, pruning obsolete dependencies, applying independent replacements and removals together, and handling parent-scoped "-" overrides without full lockfile resolution.

  • Installing a local file: directory dependency with the global virtual store enabled no longer fails with TypeError: Cannot read properties of undefined (reading 'split') #​13335.

    Local directory dependencies — file: directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.

  • The Workspace column of pnpm update --interactive now falls back to the project's path when its name is only whitespace, as it already did for a missing or empty one — all three render an equally blank label otherwise.

  • Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither pnpm outdated nor pnpm update reads the workflow files unless --include-github-actions is passed or update.githubActions is set to true in pnpm-workspace.yaml. Reading them runs git ls-remote against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) #​13254.

    pnpm outdated accepts the --include-github-actions option too.

  • pnpm update --interactive now measures its table in terminal columns rather than in characters. A package name, workspace name, or version containing wide characters (CJK, most emoji) no longer knocks its row's columns out of line with the rest of the group, and a wide character in a version no longer aborts the command with Subject parameter value width cannot be greater than the container width #​13357.

  • The Workspace column of pnpm update --interactive is more informative in two cases. A dependency outdated at the same version in several workspace projects is offered as one choice, since selecting it updates every project — that choice now names all of them instead of only the first. And a workspace project without a name is now labelled with its path rather than left blank, so several unnamed projects can be told apart.

  • An auto-installed optional peer is no longer hoisted at a version the workspace root's own dependency on that package excludes. resolvePeersFromWorkspaceRoot already made the workspace root's specifier decide which version a missing required peer is installed at; the optional-peer picker ignored it and always took the highest version present anywhere in the graph. In a workspace whose root pins postcss: 8.5.10, an importer that depends on webpack and declares no postcss of its own got postcss@8.5.22 hoisted for terser-webpack-plugin's optional postcss peer, leaving two postcss@8.5.x instances in the graph #​13320.

  • overrides now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because autoInstallPeers is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with overrides: { react: npm:react@19.2.0 } and a lone lucide-react dependency, pnpm installed react@18.3.1; it now installs the pinned react@19.2.0 #​13320.

  • Under resolvePeersFromWorkspaceRoot, a workspace root dependency declared with link: or file: (or the path form of workspace:, such as workspace:../pkg) now satisfies another project's missing peer dependency at the linked package's own version, instead of being hoisted as a path. Those specifiers are relative to the project that declares them, so the same specifier reached a different directory — or none — from the project the peer was hoisted into, leaving a broken link. The root now has the same authority over the peer as it has when it declares the package with a version range #​13373.

  • Installs through a pnpr server now apply the project's whole verification policy. minimumReleaseAgeExclude, minimumReleaseAgeIgnoreMissingTime, trustPolicy, trustPolicyExclude, trustPolicyIgnoreAfter, and trustLockfile were ignored, so excluded packages were still held back and a lockfile containing them could be rejected.

    trustPolicy: no-downgrade no longer fails with TRUST_POLICY_INCOMPATIBLE_WITH_PNPR when a pnpr server is configured.

    --frozen-lockfile and --no-prefer-frozen-lockfile are now honored on the pnpr path, instead of resolving and rewriting the lockfile anyway. Since frozenLockfile defaults to true on CI, a CI install through a pnpr server now fails on an out-of-date lockfile rather than updating it.

  • Workspace installs through a pnpr server no longer crash with Cannot read properties of undefined (reading 'filter') after linking, when minimumReleaseAge is active #​13275.

  • Fixed pnpm dedupe updating valid catalog resolutions when another matching version exists in the lockfile.

  • pnpm -r run "/pattern/" --no-bail no longer exits zero when one of a project's matched scripts fails and a later one passes. The run summary carries a single status per project, and the passing script overwrote the recorded failure.

  • Restored the store block a first install prints, naming how packages were materialized and where the stores live #​13315:

    Packages are hard linked from the content-addressable store to the virtual store.
      Content-addressable store is at: ~/.local/share/pnpm/store/v11
      Virtual store is at:             node_modules/.pnpm
    
  • The root project's pnpm:devPreinstall script now runs before resolution and linking, as it does in pnpm 11. It is skipped under --ignore-scripts, --lockfile-only and --dry-run, by pnpm fetch and pnpm rebuild, and by a repeat install that is already up to date. Workspaces that use the hook to prepare state the install depends on — such as next.js, which generates a placeholder next bin with it — were left with dependents linked against files that were never created #​13313.

  • Prevented pnpm dedupe --check from removing an incompatible node_modules directory.

  • pnpm update --workspace no longer links dependencies the user never named:

    • Running it with updateConfig.ignoreDependencies configured no longer fails with ERR_PNPM_WORKSPACE_PACKAGE_NOT_FOUND for a dependency that is only published to the registry. Such dependencies keep their specifiers, as they already did when no dependencies were ignored.
    • Passing package selectors that match no direct dependency no longer falls back to linking every workspace dependency.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.17.0: pnpm 11.17

Compare Source

Minor Changes
  • Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #​13220.

    pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

    Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes
  • The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.

  • Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #​13232.

  • Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #​13164.

  • Revert script ordering change for pnpm run --sequential /regex/

  • Support the from-git argument in the pnpm version command.

  • When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors
Bit
OpenAI
Gold Sponsors
Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.16.0: pnpm 11.16

Compare Source

Minor Changes

  • The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Asia/Tokyo)

  • Branch creation
    • "before 8am on Monday,after 9pm on Monday,before 8am on Tuesday,after 9pm on Tuesday,before 8am on Wednesday,after 9pm on Wednesday,before 8am on Thursday,after 9pm on Thursday,before 8am on Friday,every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested review from a team, iryotakadowaki-hash and reiichii and removed request for a team July 9, 2026 18:41
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from efa996b to 5a8d644 Compare July 10, 2026 00:11
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 5a8d644 to 7f2b597 Compare July 14, 2026 00:37
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 7f2b597 to fcfed5c Compare July 14, 2026 20:15
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from fcfed5c to 886a8a0 Compare July 15, 2026 08:07
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 886a8a0 to 60dd600 Compare July 15, 2026 20:06
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 60dd600 to 54dcbce Compare July 16, 2026 02:49
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 54dcbce to 08d8176 Compare July 17, 2026 03:34
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 08d8176 to b2b3172 Compare July 17, 2026 23:03
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from b2b3172 to b74d8ea Compare July 20, 2026 23:52
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from b74d8ea to a9172da Compare July 21, 2026 15:03
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from a9172da to e4d29b4 Compare July 21, 2026 21:51
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from e4d29b4 to 59f48ea Compare July 22, 2026 19:06
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 3333126 to a3f19b2 Compare July 27, 2026 23:41
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from a3f19b2 to 2692219 Compare July 28, 2026 18:14
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 2692219 to 070b69b Compare July 28, 2026 23:48
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 070b69b to e2076a0 Compare July 29, 2026 19:32
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from e2076a0 to eccb0c3 Compare July 29, 2026 23:02
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from eccb0c3 to 1888c06 Compare July 30, 2026 19:16
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 1888c06 to ebc4231 Compare August 1, 2026 00:00
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from ebc4231 to 604ffae Compare August 3, 2026 17:37
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 604ffae to 6f5fb61 Compare August 3, 2026 23:40
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from 6f5fb61 to d5443c6 Compare August 4, 2026 19:34
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from d5443c6 to bb8db6d Compare August 5, 2026 07:50
@renovate
renovate Bot force-pushed the renovate/npm-dependencies-(non-major) branch from bb8db6d to 747f1dd Compare August 5, 2026 07:51
@yukin01
yukin01 merged commit 1ddcf8b into main Aug 5, 2026
5 checks passed
@yukin01
yukin01 deleted the renovate/npm-dependencies-(non-major) branch August 5, 2026 07:53
@sre-app sre-app Bot mentioned this pull request Aug 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant