fix(deps): update all non-major dependencies#218
Merged
Conversation
Contributor
Author
|
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
![renovate-approve-2[bot]](https://avatars.githubusercontent.com/in/62175?s=60&v=4){kind=small}
renovate
Bot
dismissed stale reviews from renovate-approve[bot] and renovate-approve-2[bot]
via
June 29, 2026 17:01
c0fdafb
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
June 29, 2026 17:01
c2bef6f to
c0fdafb
Compare
renovate
Bot
dismissed stale reviews from renovate-approve[bot] and renovate-approve-2[bot]
via
June 30, 2026 02:52
829b1d3
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
June 30, 2026 02:52
c0fdafb to
829b1d3
Compare
renovate
Bot
dismissed stale reviews from renovate-approve[bot] and renovate-approve-2[bot]
via
June 30, 2026 10:34
410e786
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
June 30, 2026 10:34
829b1d3 to
410e786
Compare
Renovate bumped seven specifiers in package.json but did not regenerate pnpm-lock.yaml, so the CI "pnpm install --frozen-lockfile" step failed with ERR_PNPM_OUTDATED_LOCKFILE across the Lint, Build, Unit tests and autofix.ci jobs. Five of those bumps (@commitlint/cli, @commitlint/config-conventional, oxfmt, oxlint and prettier) were published less than 24h ago and violate the repo's minimumReleaseAge=1440 supply-chain policy in pnpm-workspace.yaml, so pnpm refuses to resolve them and the lockfile supply-chain verification rejects them. Keep the two mature bumps (@sentry/node, i18next), revert the five too-new ones to their current versions, and regenerate the lockfile. Renovate will re-propose the deferred updates once they clear the 24h buffer.
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
RedStar071
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^21.0.2→^21.2.0^21.0.2→^21.2.0^10.60.0→^10.62.0^25.6.3→^25.10.10^0.56.0→^0.57.0^1.71.0→^1.72.011.1.3→11.9.0^3.8.4→^3.9.4Release Notes
conventional-changelog/commitlint (@commitlint/cli)
v21.2.0Compare Source
Features
v21.1.0Compare Source
Features
21.0.2 (2026-05-29)
Bug Fixes
21.0.1 (2026-05-12)
Note: Version bump only for package @commitlint/cli
conventional-changelog/commitlint (@commitlint/config-conventional)
v21.2.0Compare Source
Features
v21.1.0Compare Source
Note: Version bump only for package @commitlint/config-conventional
21.0.2 (2026-05-29)
Note: Version bump only for package @commitlint/config-conventional
21.0.1 (2026-05-12)
Note: Version bump only for package @commitlint/config-conventional
getsentry/sentry-javascript (@sentry/node)
v10.62.0Compare Source
Important Changes
feat(server-runtimes): Add v7 support for
vercelAiIntegration(#21613)The
vercelAiIntegrationnow supports v7 of theaipackage. Note that v7 is not yet supported on Cloudflare.Other Changes
Work in this release was contributed by @hyunbinseo. Thank you for your contribution!
Internal Changes
no-browser-sessionlighthouse e2e test mode (#21787)Bundle size 📦
v10.61.0Compare Source
Important Changes
feat(core): Enable
streamGenAiSpansby default (#21732)The SDK now extracts all
gen_aispans out of a transaction and sends them as v2 envelope items by default. This prevents gen_ai spans from being dropped when the transaction payload exceeds size limits. Because they are no longer constrained by transaction size limits, AI message data is also no longer truncated by default. SetenableTruncation: trueon the respective AI integration to re-enable truncation. To keep the previous behavior, setstreamGenAiSpans: false.Self-hosted Sentry users should opt out with
streamGenAiSpans: false, since streamed gen_ai spans may not be ingested by their Sentry instance.Other Changes
db.query.summaryfunctionality (#21670)Sentry.setAttribute(s)APIs (#21705)trace_idswith span streaming (#21714)Internal Changes
bindTracingChannelToSpanacross runtimes (#21642)fsIntegration(#21654)sentry-sdk-initmeasure and marks (#21687)Bundle size 📦
i18next/i18next (i18next)
v25.10.10Compare Source
NODE_ENV=production)v25.10.9Compare Source
SelectorParam<Ns, KPrefix>helper type — a stable, readable alternative toParameters<TFunction<Ns>>[0]for typing selector function props 2414v25.10.8Compare Source
TFunctionSelectoroverloads soParameters<TFunction>resolves to the general selector signature instead of the brandedSelectorKeytype 2412v25.10.7Compare Source
v25.10.6Compare Source
v25.10.5Compare Source
keyPrefixingetFixedTnow provide full type-safe key narrowing — the returnedtfunction is scoped to the prefix subtree 2367v25.10.4Compare Source
exists()is now a type guard that narrows the key toSelectorKey, so a validated key can be passed directly tot()2364v25.10.3Compare Source
v25.10.2Compare Source
keyFromSelectoris now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optionalnsandkeyPrefixoptions for non-default namespace/prefix contexts 2364v25.10.1Compare Source
NODE_ENV=production)v25.10.0Compare Source
keyFromSelectornow returns a brandedSelectorKeytype thatt()accepts directly, enabling pre-computed and reusable translation keys 2364keyPrefixingetFixedTand per-call options 2367{{val, number}}requiresnumber,{{val, datetime}}requiresDate,{{name}}requiresstring, etc. Custom formatters can be typed viainterpolationFormatTypeMapinCustomTypeOptions2378FilterKeysin selector mode now preserves non-context, non-plural leaf keys whencontextis provided, fixing incorrect type narrowing when combiningreturnObjects: truewithcontext2398v25.9.0Compare Source
{ count: number }when a key resolves to plural forms 2373v25.8.20Compare Source
getFixedT()selector now resolves namespaces against the effectivensrather than the global init options 2406v25.8.19Compare Source
nsand primary namespace in array 2405. Reverts the broad namespace-prefix rewrite from v25.8.15 and replaces it with a targeted fix that only rewrites paths starting with a secondary namespace in a multi-namespace array, matching the type-level contract ofGetSourcev25.8.18Compare Source
v25.8.17Compare Source
v25.8.16Compare Source
on()method now correctly returnsthisinstead ofvoid, matching the runtime behavior and enabling proper method chaining in TypeScriptv25.8.15Compare Source
v25.8.14Compare Source
v25.8.13Compare Source
v25.8.12Compare Source
v25.8.11Compare Source
v25.8.10Compare Source
v25.8.9Compare Source
v25.8.8Compare Source
v25.8.7Compare Source
v25.8.6Compare Source
getFixedT()return value 2318v25.8.5Compare Source
v25.8.4Compare Source
v25.8.3Compare Source
v25.8.2Compare Source
getFixedT()selector now resolves namespaces against the effectivensrather than the global init options 2406v25.8.1Compare Source
nsand primary namespace in array 2405. Reverts the broad namespace-prefix rewrite from v25.8.15 and replaces it with a targeted fix that only rewrites paths starting with a secondary namespace in a multi-namespace array, matching the type-level contract ofGetSourcev25.8.0Compare Source
console.infosupport notice regarding the open-source sustainability of the i18next ecosystem. (Note: This can be easily suppressed viashowSupportNotice: false,globalThis, or environment variables. See the FAQ for details on how to disable it).v25.7.4Compare Source
v25.7.3Compare Source
v25.7.2Compare Source
v25.7.1Compare Source
v25.7.0Compare Source
cloneInstanceto create a new interpolator if interpolation options are passed in. This will address 2371.oxc-project/oxc (oxfmt)
v0.57.0Compare Source
oxc-project/oxc (oxlint)
v1.72.0Compare Source
🚀 Features
1c8f50clinter: Add schema foreslint/no-restricted-import(#23642) (Sysix)🐛 Bug Fixes
742be36refactor/node/handle-callback-err: Reject invalid regex config (#23740) (camc314)pnpm/pnpm (pnpm)
v11.9.0Compare Source
v11.8.0Compare Source
Minor Changes
c112b61: Added a--dry-runoption topnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, nonode_modules) and always exits with code 0. This mirrors the preview semantics ofnpm install --dry-run#7340.179ebc4:pnpm run --no-bailnow exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of--no-bailconsistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursivepnpm run --no-bailalways exited with code 0, even when a script failed #8013.0474a9c: Added support for generating Node.js package maps atnode_modules/.package-map.jsonduring isolated and hoisted installs. Added thenode-experimental-package-mapsetting to inject the generated map into pnpm-managed Node.js script environments, and thenode-package-map-typesetting to choose betweenstandardandloosepackage maps.dcededc:pnpm sbomnow marks components reachable only throughdevDependencieswith CycloneDXscope: "excluded"and thecdx:npm:package:developmentproperty. Theexcludedscope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by@cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installedoptionalDependencies) omitscopeand default torequired.1495cb0: Added per-package SBOM generation with--outand--splitflags. Use--out out/%s.cdx.jsonto write one SBOM per workspace package to individual files, or--splitfor NDJSON output to stdout. When--filterselects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (workspace:protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them.293921a: feat(view): support searching project manifest upward when package name is omittedWhen running
pnpm viewwithout a package name, the command now searchesupward for the nearest project manifest (
package.json,package.yaml, orpackage.json5) and uses itsnamefield.If the manifest exists but lacks a
namefield, an error is thrown.This change also replaces the
find-updependency withempathicforimproved performance and consistency across workspace tools.
Patch Changes
29ab905: Fixedpnpm updateoverriding the version range policy of a named catalog whose name parses as a version (e.g.catalog:express4-21). Thecatalog:reference carries no pinning of its own, so the prefix from the catalog entry (such as~) is now preserved instead of being widened to^#10321.bee4bf4: Security: validate config dependency names and versions from the env lockfile (pnpm-lock.yaml) before using them to build filesystem paths. A committed lockfile with a traversal-shapedconfigDependenciesname (such as../../PWNED) or version (such as../../../PWNED) could previously causepnpm installto create symlinks or write package files outsidenode_modules/.pnpm-configand the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See GHSA-qrv3-253h-g69c.96bdd57: Fixlink:workspace protocol switching tofile:afterpnpm rmis run from inside a workspace package whose target workspace dependency has its own dependencies, wheninjectWorkspacePackages: trueis set. Follow-up to #10575, which fixed the same symptom for workspace packages without dependencies.302a2f7: No longer warn about using bothpackageManageranddevEngines.packageManagerwhen the two fields pin the same package manager at the same version with the same integrity hash (e.g. bothpnpm@11.5.1+sha512.…). Previously the hash was stripped from the legacypackageManagerfield but not fromdevEngines.packageManager, so even identical specifications looked like a mismatch #12028.The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version.
3f0fb21: Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment likeadded 0sa':). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared #12350.564619f: Fixedpnpm approve-buildsreporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. aftergit stashdrops theallowBuildsfrompnpm-workspace.yaml) is re-added. The revoked packages are now correctly recorded in.modules.yamlsoapprove-buildscan find them. #122213d1fd20: Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existingnode.exealready matches the target (same hard link or identical content) pnpm/pnpm#12203.1b02b47: Fix macOS Gatekeeper blocking native binaries (.node,.dylib,.so) by removing thecom.apple.quarantineextended attribute after importing them from the store.When pnpm imports files from its content-addressable store into
node_modules, macOS preserves extended attributes, includingcom.apple.quarantine. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates tonode_modules, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile.After importing a package, pnpm now strips
com.apple.quarantinefrom its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batchedxattrcall per package, is restricted to native binaries (other files are untouched), and is non-fatal (it logs a warning on unexpected errors).Fixes #11056
61969fb: Fixpnpm installwithoptimisticRepeatInstallincorrectly reportingAlready up to datewhenpnpm-lock.yamlchanged but project manifests did not. This affected workflows such as checking out or restoring only the lockfile #12100.Also fixes
checkDepsStatusto use the correct lockfile path whenuseGitBranchLockfileis enabled, so the optimistic fast-path and lockfile modification detection work withpnpm-lock.<branch>.yamlfiles instead of always stat'ingpnpm-lock.yaml. Merge-conflict detection now reads the resolved lockfile name as well, and withmergeGitBranchLockfilesenabled everypnpm-lock.*.yamlis scanned for modifications and conflicts. The git branch is now resolved by reading.git/HEADdirectly (no process spawn) and uses the workspace directory rather thanprocess.cwd().5c12968: Fix recursive updates of transitive dependencies when the update command mixes transitive dependency patterns with direct dependency selectors. For example,pnpm up -r "@​babel/core" uuidnow updates matching transitive@babel/coredependencies even whenuuidis a direct dependency selector #12103.9d79ba1: Register thepnpm update --no-saveflag in the CLI help and option parser.0474a9c: Fixedpnpm importfor Yarn v2 lockfiles whenjs-yamlv4 is installed.9e0c375: Fixedpnpm installrepeatedly prompting to remove and reinstallnode_modulesin a workspace package whenenableGlobalVirtualStoreis enabled. The post-install build step recorded a per-projectnode_modules/.pnpmvirtual store directory innode_modules/.modules.yaml, overwriting the global<storeDir>/linksvalue the install step had written. The next install then detected a virtual-store mismatch (ERR_PNPM_UNEXPECTED_VIRTUAL_STORE). The build step now derives the same global virtual store directory as the install step #12307.223d060: Document the--cpu,--osand--libcflags in the output ofpnpm install --help. These flags were already supported but were only documented on the website #12359.e85aea2: Avoid readingREADME.mdfrom disk when publishing if the publish manifest already provides areadmefield. The README is now only read lazily, insidecreateExportableManifest, when it is actually needed.3188ae7: Fixedpnpm peers checkto accept loose peer dependency ranges such as>=3.16.0 || >=4.0.0-when the installed peer version satisfies the range #12149.531f2a3: Fixedpnpm updaterewriting aworkspace:dependency that points at a local path (e.g.workspace:../packages/foo/dist) into a normalizedlink:or version-range specifier. Such specifiers are now preserved verbatim when the workspace protocol is preserved #3902.fe66535: Fixed a lockfile non-convergence bug where an incremental install kept a duplicate transitive dependency that a fresh install would not produce. When a package is reused from the lockfile, its child edges are taken verbatim and bypass the preferred-versions walk, so a transitive dependency could stay pinned to an older version even after a direct dependency resolved to a higher version that satisfies the same range. The resolver now refreshes such a stale pin to the higher direct-dependency version during resolution — so the older version is never resolved or fetched, and the incremental result converges to the fresh one.6d35338:pnpm installdetects changes inside local file dependencies again. The optimistic repeat-install fast path only tracks manifest and lockfile modification times, so edits inside a local dependency's directory (or a repacked local tarball) were reported as "Already up to date". Projects with local file dependencies (file:and bare local path or tarball specifiers, declared directly or throughpnpm.overrides) now always run a full install, which refetches those dependencies, matching pnpm v10 behavior #11795.4ca9247: Preserve the existing Node.js runtime version prefix when resolvingnode@runtime:<range>to a concrete version.30c7590: Create shorter CAFS temporary package directories to leave room for lifecycle scripts that create IPC socket paths under TMPDIR.13815ad: Reporter output (warnings, progress) forpnpm storeandpnpm configsubcommands now goes toConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.
Need help on this PR? Tag
/codesmithwith what you need. Autofix is enabled.