chore(monorepo): update auto-merge non-major dependencies

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@dotenvx/dotenvx	1.35.0 → 1.51.4			pnpm.catalog.default	minor
@microsoft/api-extractor (source)	^7.49.2 → ^7.55.2			pnpm.catalog.default	minor
@nx/react (source)	^22.1.3 → ^22.3.3			pnpm.catalog.default	minor
@prisma/client (source)	^6.5.0 → ^6.19.1			pnpm.catalog.default	minor
@prisma/prisma-schema-wasm (source)	^6.6.0-41.9061db3b0058e3d3731c6fe68a1b77061bed4861 → ^6.6.0-53.f676762280b54cd07c770017ed3711ddde35f37a			pnpm.catalog.default	patch
@storm-software/unbuild (source)	^0.57.71 → ^0.57.75			pnpm.catalog.default	patch
@swc/wasm	^1.10.14 → ^1.15.8			pnpm.catalog.default	minor
@tanstack/react-query-devtools (source)	^5.70.0 → ^5.91.2			pnpm.catalog.default	minor
@​types/react-native	0.72.8 → 0.73.0			pnpm.catalog.default	minor
GitGuardian/ggshield	v1.39.0 → v1.46.0			action	minor
esbuild	^0.25.12 → ^0.27.2			pnpm.catalog.default	minor
jest (source)	30.0.5 → 30.2.0			pnpm.catalog.default	minor
jest-environment-jsdom (source)	30.0.5 → 30.2.0			pnpm.catalog.default	minor
jest-util (source)	30.0.5 → 30.2.0			pnpm.catalog.default	minor
knip (source)	5.43.6 → 5.80.2			pnpm.catalog.default	minor
markdownlint-cli2	^0.17.2 → ^0.20.0			pnpm.catalog.default	minor
mlly	1.7.4 → 1.8.0			pnpm.catalog.default	minor
node (source)	24.11.1 → 24.12.0				minor
pnpm (source)	10.26.0 → 10.28.0			packageManager	minor
pnpm (source)	>=10.24.0 → >=10.28.0			engines	minor
semver	7.7.1 → 7.7.3			pnpm.catalog.default	patch
sherif	1.3.0 → 1.9.0			pnpm.catalog.default	minor
superjson	2.2.2 → 2.2.6			pnpm.catalog.default	patch
tsdown (source)	^0.17.2 → ^0.19.0			pnpm.catalog.default	minor
unbuild	^3.3.1 → ^3.6.1			pnpm.catalog.default	minor

---

Release Notes

dotenvx/dotenvx (@​dotenvx/dotenvx)

v1.51.4

Compare Source

Changed

• Change description of dotenvx-ops to better reflect its tooling as operational primitives on top of dotenvx for production use cases. (#​721)

v1.51.3

Compare Source

Added

• Add hint on .env.keys for dotenvx ops backup. Dotenvx Ops Backup lets you back up your private keys securely with just a single command. It's a convenient alterantive to manually copy/pasting them in and out of 1Password. (#​718)

v1.51.2

Compare Source

Changed

• Switch npm publish to use Dotenvx Ops' new Rotation Tokens (ROTs) (#​715)

This will allow us to start dogfooding our own solution for third-party API key rotation. Third-party API key rotation would drastically improve security industry wide. Please get in touch if this is interesting to you.

v1.51.1

Compare Source

Added

• Add opsOff type information

v1.51.0

Compare Source

Added

• Add config({opsOff: true}) options and --ops-off flag for turning off Dotenvx Ops features. (#​680)

v1.50.1

Compare Source

Removed

• Remove listed command to radar (now ops) (#​678)

v1.50.0

Compare Source

Added

• Add optional dotenvx ops command (#​677)
• Ops is a coming rename of Radar. Radar will become a feature inside ops.
• With dotenvx ops use dotenvx across your team, infrastructure, agents, and more.

 _______________________________________________________________________
|                                                                       |
|  Dotenvx Ops: Commercial Tooling for Dotenvx                          |
|                                                                       |
|  ░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓███████▓▒░                              |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░                                     |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░                                     |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░ ░▒▓██████▓▒░                               |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░             ░▒▓█▓▒░                              |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░             ░▒▓█▓▒░                              |
|  ░▒▓██████▓▒░░▒▓█▓▒░      ░▒▓███████▓▒░                               |
|                                                                       |
|  Use dotenvx across your team, infrastructure, agents, and more.      |
|                                                                       |
|  Learn more at https://dotenvx.com/ops                                |
|_______________________________________________________________________|

v1.49.1

Compare Source

Changed

• 🐞 patch bug with variable expansion of single quoted values (#​675)

v1.49.0

Compare Source

Added

• For precommit and prebuild, ignore .env.x file like we do with .env.vault file. (#​666)

v1.48.4

Compare Source

Removed

• Remove unnecessary use of eval in proKeypair helper (#​654)

v1.48.3

Compare Source

Changed

• Include privateKeyName and privateKey on internal processedEnv object (#​649)

v1.48.2

Compare Source

Changed

• Check radar status before sending (#​646)

v1.48.1

Compare Source

Changed

• Send beforEnv and afterEnv to Radar if user has installed (#​645)

v1.48.0

Compare Source

Added

• Include beforeEnv and afterEnv for user debugging (#​644)

v1.47.7

Compare Source

Changed

• src should be in internal processEnv object (#​643)

v1.47.6

Compare Source

Changed

• Make Radar call non-blocking (#​642)

v1.47.5

Compare Source

Changed

• Add resilient handling of any Radar failures (#​639)

v1.47.4

Compare Source

Changed

• Smarter require of non-installed libs like dotenvx-radar (#​638)

v1.47.3

Compare Source

Added

• Send to radar#observe if Radar installed by user (#​631)

Removed

• Remove cli in package.json (#​632)

v1.47.2

Compare Source

Added

• Export cli in package.json (#​629)

v1.47.1

Compare Source

Added

• Add convenience log that radar active 📡 when dotenvx-radar is installed (#​625)

v1.47.0

Compare Source

Added

• Add optional dotenvx radar command (#​624)
• Radar is an early access commercial extension for dotenvx that will auto backup your .env files.

 _______________________________________________________________________
|                                                                       |
|  Dotenvx Radar: Env Observability                                     |
|                                                                       |
|  ░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓███████▓▒░    |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓████████▓▒░▒▓███████▓▒░    |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|                                                                       |
|  Observe, version, and back up your environment variables at runtime. |
|                                                                       |
|  Purchase lifetime access at https://dotenvx.com/radar                |
|                                                                       |
| --------------------------------------------------------------------- |
| - thank you for using dotenvx! - @​motdotla                            |
|_______________________________________________________________________|

v1.46.0

Compare Source

Added

• Add error when hoisting issue experienced around commander.js (#​623)

Removed

• Remove git-dotenvx and git dotenvx shorthand (#​621)

v1.45.2

Compare Source

Changed

• Minor README updates

v1.45.1

Compare Source

Changed

• Include setLogName and setLogVersion in config (#​613)

v1.45.0

Compare Source

Added

• Add logger.setName and logger.setVersion for customization of logger (#​612)

v1.44.2

Compare Source

Changed

• Clarify license is BSD-3.

v1.44.1

Compare Source

Changed

• Patch SetOutput type (#​597)

v1.44.0

Compare Source

Added

• Add armv7 support (#​593)

v1.43.0

Compare Source

Removed

• Remove errorv, errornocolor, blank from logger options (#​584)

Changed

• Replace instances of console.error with logger.error (#​584)

v1.42.2

Compare Source

Changed

• Fix --force flag work with ?force=true (2776715)

v1.42.1

Compare Source

Added

• Add --force flag to install.sh (0b8d21c)

v1.42.0

Compare Source

Added

• Add ability to override the os and arch via install.sh and dotenvx.sh (3ded752)

v1.41.0

Compare Source

Added

• Add [directory] argument to precommit and prebuild (#​572)

v1.40.1

Compare Source

Changed

• Patch ext scan command (#​570)

v1.40.0

Compare Source

Added

• Smarter ext precommit and ext prebuild – catch duplicate KEYs in the same .env file where one is mistakenly left unencrypted (#​567)

v1.39.1

Compare Source

Added

• Add version to homebrew formula (#​564)

v1.39.0

Compare Source

Added

• Add --convention flow option to dotenvx run (#​551)

Changed

• Fix typos (#​550)

v1.38.5

Compare Source

Added

• 🐞 Add config.d.ts file to fix type error when loading dotenvx/dotenvx/config with dynamic import (#​547)

v1.38.4

Compare Source

Changed

• 🐞 Fix blank line disappearing after encrypting empty value (#​542)

v1.38.3

Compare Source

Changed

• 🐞 Fix self-referencing expansion when key exists already in process.env (#​536)

v1.38.2

Compare Source

Added

• Add typescript types for main.get.

v1.38.1

Compare Source

Changed

• Support encrypt when mutliline contains windows CRLF (\r\n) (#​534)

Note: dotenvx will convert these \r\n newlines to \n. Our recommendation is to stop using CRLF - its origin is from typewriter days. Instead, set your editor or gitattributes to use LF.

v1.38.0

Compare Source

Changed

• Command substitution failures no longer halt further processing of keys in a .env file (#​533)
• A more helpful error is raised if a command substitution failure occurs (#​533)

v1.37.0

Compare Source

Added

• add dotenvx rotate command 🎉 (#​530)

also: our whitepaper is released as a draft.

v1.36.0

Compare Source

Changed

• --strict flag respects (doesn't throw) anything in --ignore flag (#​527)

microsoft/rushstack (@​microsoft/api-extractor)

v7.55.2

Compare Source

Sat, 06 Dec 2025 01:12:28 GMT

Version update only

v7.55.1

Compare Source

Fri, 21 Nov 2025 16:13:56 GMT

Version update only

v7.55.0

Compare Source

Wed, 12 Nov 2025 01:12:56 GMT

Minor changes

• Bump the @microsoft/tsdoc dependency to ~0.16.0.
• Bump the @microsoft/tsdoc-config dependency to ~0.18.0.

v7.54.0

Compare Source

Tue, 04 Nov 2025 08:15:14 GMT

Minor changes

• Add a new setting IExtractorInvokeOptions.printApiReportDiff that makes build logs easier to diagnose by printing a diff of any changes to API report files (*.api.md).
• Add a --print-api-report-diff CLI flag that causes a diff of any changes to API report files (*.api.md) to be printed.

v7.53.3

Compare Source

Fri, 24 Oct 2025 00:13:38 GMT

Version update only

v7.53.2

Compare Source

Wed, 22 Oct 2025 00:57:54 GMT

Version update only

v7.53.1

Compare Source

Wed, 08 Oct 2025 00:13:28 GMT

Version update only

v7.53.0

Compare Source

Fri, 03 Oct 2025 20:09:59 GMT

Minor changes

• Normalize import of builtin modules to use the node: protocol.

v7.52.15

Compare Source

Tue, 30 Sep 2025 23:57:45 GMT

Version update only

v7.52.14

Compare Source

Tue, 30 Sep 2025 20:33:51 GMT

Version update only

v7.52.13

Compare Source

Fri, 12 Sep 2025 15:13:07 GMT

Patches

• Fixes a bug in ExtractorAnalyzer._isExternalModulePath where type import declarations were not resolved.

v7.52.12

Compare Source

Thu, 11 Sep 2025 00:22:31 GMT

Version update only

v7.52.11

Compare Source

Tue, 19 Aug 2025 20:45:02 GMT

Patches

• Fix self-package import resolution by removing outDir/declarationDir from compiler options

v7.52.10

Compare Source

Fri, 01 Aug 2025 00:12:48 GMT

Patches

• Upgrades the minimatch dependency from ~3.0.3 to 10.0.3 across the entire Rush monorepo to address a Regular Expression Denial of Service (ReDoS) vulnerability in the underlying brace-expansion dependency.

v7.52.9

Compare Source

Wed, 23 Jul 2025 20:55:57 GMT

Version update only

v7.52.8

Compare Source

Tue, 13 May 2025 02:09:20 GMT

Patches

• Fixes API extractor error handling when changed APIs are encountered and the "--local" flag is not specified

v7.52.7

Compare Source

Thu, 01 May 2025 15:11:33 GMT

Patches

• Fix an issue where default exports were sometimes trimmed incorrectly in .api.md files when using reportVariants (GitHub #​4775)

v7.52.6

Compare Source

Thu, 01 May 2025 00:11:12 GMT

Version update only

v7.52.5

Compare Source

Mon, 21 Apr 2025 22:24:25 GMT

Version update only

v7.52.4

Compare Source

Thu, 17 Apr 2025 00:11:21 GMT

Patches

• Update documentation for extends

v7.52.3

Compare Source

Fri, 04 Apr 2025 18:34:35 GMT

Patches

• Add support for customizing which TSDoc tags appear in API reports

v7.52.2

Compare Source

Tue, 25 Mar 2025 15:11:15 GMT

Version update only

v7.52.1

Compare Source

Tue, 30 Sep 2025 23:57:45 GMT

Version update only

v7.52.0

Compare Source

Tue, 11 Mar 2025 00:11:25 GMT

Minor changes

• Upgrade the bundled compiler engine to TypeScript 5.8.2

v7.51.1

Compare Source

Sat, 01 Mar 2025 05:00:09 GMT

Patches

• Include triple-slash references marked with preserve="true" from files that only contain re-exports. There was a behavior change in TypeScript 5.5, where only triple-slash references that are explicitly marked with preserve="true" are emitted into declaration files. This change adds support for placing these references in files that only contain re-exports, like the API entrypoint file.

v7.51.0

Compare Source

Thu, 27 Feb 2025 01:10:39 GMT

Minor changes

• Add a docModel.releaseTagsToTrim property to api-extractor.json to specify which release tags should be trimmed when the doc model is produced.

v7.50.1

Compare Source

Sat, 22 Feb 2025 01:11:11 GMT

Patches

• Upgrade the bundled compiler engine to TypeScript 5.7.3

v7.50.0

Compare Source

Wed, 12 Feb 2025 01:10:52 GMT

Minor changes

• Update merge behavior for derived configurations to allow overriding array properties

nrwl/nx (@​nx/react)

v22.3.3

Compare Source

22.3.3 (2025-12-19)

🩹 Fixes

• misc: remove CNW A/B testing flow branching (#​33967)

❤️ Thank You

• Jack Hsu @​jaysoo

v22.3.2

Compare Source

22.3.2 (2025-12-19)

🚀 Features

• angular: support ngrx v21 (#​33940)
• angular: support cypress component testing with zoneless projects (#​33941)

🩹 Fixes

• angular: support @angular/cli package update during nx migrate (#​33918)
• core: fix vitest test runner options for angular in cnw (#​33921)
• linter: honor setParserOptionsProject in flat config (#​33953, #​33944)
• module-federation: use localhost as default host #​33909 (#​33947, #​33909)
• module-federation: skip non-npm external dependencies in getDependencies (#​33951, #​32819)
• nx-dev: make sure only prod is indexed (#​33922)
• nx-dev: make sure canonical urls are always nx.dev (#​33932)
• react: set up module federation with webpack and ts soln correctly #​31029 (#​33920, #​31029)
• testing: ensure jest v30 migration is run (#​33916)

❤️ Thank You

• Caleb Ukle
• Colum Ferry @​Coly010
• Jack Hsu @​jaysoo
• Leosvel Pérez Espinosa @​leosvelperez
• leosvelperez @​leosvelperez

v22.3.1

Compare Source

22.3.1 (2025-12-18)

🩹 Fixes

• core: ensure no tui on single tasks (#​33910)
• dotnet: fix dependency graph for multi-targeting and transitive deps (#​33908, #​33653, #​33397)

❤️ Thank You

• Claude Opus 4.5
• Craigory Coppola @​AgentEnder

v22.3.0

Compare Source

22.3.0 (2025-12-17)

🚀 Features

• angular: support angular v21 (#​33378)
• angular: add migration to set isolateModules: true to jest tsconfig files (#​33889)
• angular: add migration to replace jest-preset-angular/setup-jest imports (#​33899)
• core: add NX_DEFAULT_OUTPUT_STYLE env var (#​33493, #​27490)
• core: add CnwError class for typed error handling in create-nx-workspace (#​33839)
• core: add hints and status messages to the tui (#​33838)
• js: add option for using tsgo compiler when inferring build and typecheck tasks (#​33821, #​32591)
• js: improve SWC compilation error logging (#​33297)
• misc: support prettier v3 (#​33898, #​30801)
• nx-plugin: allow customizing the location of the companion E2E project (#​32073, #​32069)
• rspack: add support for cssFilename config #​32498 (#​32506, #​32498)
• testing: add option to playwright preset to open html report (#​31282)
• webpack: add support for merging externals to NxAppWebpackPlugin (#​33833)

🩹 Fixes

• angular: process only the in progress entry points in ng-packagr-lite's write bundles transform function (#​33784, #​3172, #​33560)
• angular: collect known tsconfig files from non-buildable angular libraries in migration (#​33834, #​33705)
• angular: improve error message when using esbuild-based build targets and generating cypress ct (#​33846, #​33329)
• angular: install compatible vitest version for angular projects (#​33858, #​33770)
• angular: ensure jest and jest-preset-angular are updated correctly for angular v21 (#​33896)
• bundling: correct project path for createTmpTsConfig (#​31314, #​31522)
• core: optimize pnpm lockfile parsing with pre-built indexes (#​33750, #​32669, #​32254, #​33751)
• core: share visited Set across affected graph traversal (#​33756, #​32265)
• core: set max listeners for process in task orchestrator (#​33596, #​32439)
• core: exit with error when generator prompts fail (#​33691)
• core: fix record stat on initial CNW call (#​33783)
• core: ensure terminalOutput is always a string in task results (#​33782, #​32675)
• core: improve node creation for pnpm parser (#​33788)
• core: add pnpm/yarn support for CNW templates (#​33827)
• core: swc register base url missing when using tsgo (#​33332)
• core: pass more error detail for CNW (#​33844)
• core: create all tables upfront when creating the database (#​33843)
• core: improve performance of buildExplicitPackageJsonDependencies (#​33791)
• core: do not invoke prettier with --write and --list-different when unsupported (#​33857, #​33658, #​31951)
• core: preserve command output in TUI summary for non-cached tasks (#​33673)
• core: update CNW messaging and remove cancel event from SIGINT (#​33872)
• core: restore linkTaskDetails param for backwards compatibility (#​33874, #​33843)
• core: include PNPM patches in externalDependencies hash computations (#​33551)
• core: add back ability to create cache_outputs table without a foreign key (#​33880)
• core: display task output in TUI when native command runner is disabled (#​33881, #​32803)
• core: prevent pinning the same task in multiple panes in the tui (#​33863)
• core: reduce error rate with dir validation and add more debugging data (#​33887)
• core: improve database initialization error handling (#​33820)
• core: invalidate sync generator cache on file changes and use up-to-date project graph (#​33780)
• core: convert * to workspace:* for pnpm/yarn/bun in CNW (#​33893)
• expo: set projectRoot to workspaceRoot for Expo SDK 54+ compatibility (#​33836, #​33597)
• graph: serve full project graph when navigating from PDV (#​33897)
• js: use Set for O(1) package.json root lookup (#​33757, #​32265)
• js: recognize NodeNext as ESM (#​31508)
• js: display pnpm publish errors without requiring --verbose (#​33837)
• js: make CopyAssetsHandler per-file logs opt-in via verbose mode (#​33835, #​33521)
• js: prevent crash when terminating task using the @nx/js:swc executor (#​33845, #​31938)
• js: handle workspace packages when nx.name differs from package.json.name (#​33583, #​33582)
• js: resolve nx binary from workspace root in node executor (#​33842, #​33776)
• js: detect changes to pnpm.overrides and overrides in package.json (#​31914)
• js: check package.json for name when project.json exists but has no name (#​31887)
• js: adjusted stdout and stderr handling to support the latest @​swc/cli version (#​32685)
• js: allow copying generated Prisma client (asset) from 'node_modules' (#​33822)
• misc: send connectUrl in completion metadata (#​33878)
• misc: use string type for fetchDepth in azure-pipelines.yml (#​33727)
• module-federation: normalize workspace protocol versions in requiredVersion (#​33733, #​31397, #​33734)
• module-federation: check port availability before starting remote proxies (#​33871, #​33470)
• nest: ensure library is generated with correct outputPath for TS Soln #​32060 (#​33864, #​32060)
• nextjs: accept fileName option to generate page (#​30013)
• node: sourceMaps option to sourceMap in webpack config (#​33333)
• node: use @​swc/helpers instead of tslib when compiler is swc (#​33885, #​31202)
• react: update template comment to be valid css (#​33169, #​20192639)
• release: {releaseGroupName} not interpolated in changelog tag/releaseTagPattern (#​33779)
• repo: fix dotnet installation on Windows (#​33786)
• repo: restore mise tools in e2e-matrix workflow (#​33785, #​33772)
• repo: install nightly Rust for WASM build in publish workflow (#​33792, #​33772)
• repo: use RUSTUP_TOOLCHAIN env var for WASM builds (#​33794)
• repo: revert to older nightly Rust for WASM builds (#​33797)
• repo: install correct Rust target for x86_64 macOS build (#​33853)
• rspack: enable build mode for TypeScript checker in TS solution setups (#​33447)
• storybook: conditionally include node imports only for non-angular frameworks (#​33728)
• storybook: use helper to find correct version when pnpm catalogs are used (#​33900, [#​29772](https://redirect.github.c

---

Configuration

📅 Schedule: Branch creation - "after 2am and before 3am" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.