chore(deps): update all non-major dependencies - #446
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
9c4e39b to
5bfebea
Compare
5bfebea to
7804f68
Compare
renovate
Bot
changed the title
7804f68 to
2d975ff
Compare
2d975ff to
0104ff1
Compare
0104ff1 to
8120e32
Compare
8120e32 to
5ec9f5e
Compare
5ec9f5e to
efcb3b7
Compare
efcb3b7 to
1a61aec
Compare
1a61aec to
cf8e7f8
Compare
cf8e7f8 to
2b13cf8
Compare
6132302 to
360e116
Compare
360e116 to
aa97a8b
Compare
aa97a8b to
714cf9d
Compare
714cf9d to
bdbb60c
Compare
bdbb60c to
9343bf3
Compare
9343bf3 to
fb7fea7
Compare
fb7fea7 to
556aaae
Compare
commit: |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This PR contains the following updates:
^9.1.0→^9.2.0^3.2.4→^3.4.0^1.0.2→^1.0.3^4.0.3→^4.1.0^10.0.3→^10.1.0^3.65.2→^3.65.3^3.58.1→^3.65.3^26.1.1→^26.1.2^0.1.0→^0.3.0v0.0.9-mp→v0.0.9v10.0.0→v10.4.0^10.7.0→^10.8.0^0.17.0→^0.17.1^20.11.0→^20.11.1^1.0.0→^1.1.0^0.140.0→^0.142.0^1.61.1→^1.62.011.15.1→11.17.0^1.404.1→^1.407.31.407.6(+2)^1.0.0→^1.407.31.407.6(+2)^4.62.2→^4.62.3^3.0.0→^3.2.3^6.3.0→^6.3.1^3.3.7→^3.3.8Release Notes
antfu/eslint-config (@antfu/eslint-config)
v9.2.0Compare Source
🚀 Features
🐞 Bug Fixes
scripts-infoin package.json sorting - by @antfu (09680)eslint-plugin-astrov2 to resolve unmet peer warning - by @ycs77 in #855 (5ada5)View changes on GitHub
nuxt/devtools (@nuxt/devtools-kit)
v3.4.0Compare Source
🚀 Features
@vitejs/devtools-kitto v0.4.10 - by @antfu (5cea1)🐞 Bug Fixes
View changes on GitHub
v3.3.1Compare Source
No significant changes
View changes on GitHub
nuxt/module-builder (@nuxt/module-builder)
v1.0.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
📦 Build
🏡 Chore
resolutions/pnpm.overridestopnpm-workspace.yaml(cfb45fb)afcf2fa)aeb1d38)92eb2af)✅ Tests
809c89f)9412c91)#appornuxt/appin generated declarations (#727)🤖 CI
604d5b3)4442a14)f7be1a6)reproduction(57e7ce9)c3c8e72)d87d217)54c5f13)🎉 New Contributors
❤️ Contributors
nuxt/test-utils (@nuxt/test-utils)
v4.1.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
🩹 Fixes
RouterLinkstub works withpages: false(#1687)ssr.resolve.conditionsto removeimport(#1732)defineVitestProject(#1724)viteEnvironmentApi(#1708)📦 Build
🏡 Chore
h3-nextto optional dependencies (#1733)✅ Tests
autoImport: false(#1688)🤖 CI
❤️ Contributors
paypal/paypal-js (@paypal/paypal-js)
v10.1.0Compare Source
Minor Changes
d9c0200: NarrowPayPalMessagesSession.fetchContentto returnPromise<MessageContent>(previouslyPromise<MessageContent | null>). The evergreen SDK never resolves tonull— on an API error it returns an empty sentinelMessageContent(emptymessageItems) so the<paypal-message>element recognizes the error state and collapses. Existing=== nullchecks against the result become dead code but continue to compile.Patch Changes
09f2994: Fix incomplete prototype-pollution protection inprocessOptions. Theenvironmentoption was still read via destructuring, which reads through the prototype chain, soObject.prototype.environment = "sandbox"could downgrade a production checkout to the sandbox SDK URL.environmentis now read with ahasOwnPropertyguard, matching the existingsdkBaseUrlprotection.Hebilicious/reproduire (Hebilicious/reproduire)
v0.0.9Compare Source
compare changes
actions/stale (actions/stale)
v10.4.0Compare Source
What's Changed
Bug Fix
only-issue-typesvalidation by @trueberryless in #1338Dependency Updates
New Contributors
Full Changelog: actions/stale@v10.3.0...v10.4.0
v10.3.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.3.0
v10.2.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.2.0
v10.1.1Compare Source
What's Changed
Bug Fix
only-issue-typesby @Bibo-Joshi in #1298Improvement
Dependency Upgrades
New Contributors
Full Changelog: actions/stale@v10...v10.1.1
v10.1.0Compare Source
What's Changed
only-issue-typesoption to filter issues by type by @Bibo-Joshi in #1255New Contributors
Full Changelog: actions/stale@v10...v10.1.0
eslint/eslint (eslint)
v10.8.0Compare Source
Features
2fee9bbfeat: exportConfigObjectfromeslint/config(#21082) (sethamus)Bug Fixes
6b8d2f7fix: escape reserved characters in rule id inhtmlformatter (#21129) (Francesco Trotta)9091071fix: preventno-unreachable-loopcrash when all loop types are ignored (#21116) (Pixel)e23fafefix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)20b5ad0fix: quadratic-time regex inprefer-template(#21096) (Milos Djermanovic)8b6f6c0fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)b2c608cfix: NewExpression with parenthesized callee inpreserve-caught-error(#21083) (Francesco Trotta)Documentation
6ddf858docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)784dfbedocs: Clarifyno-eq-nulldescription (#21120) (Park Harin)7ec733adocs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))92bb13fdocs: replace quake link (#21108) (Jung Hyeon Jun)68eb4a5docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)d28f697docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)eccc68ddocs: correct --suppressions-location option description (#21093) (Ga eun Lee)c5963f7docs: Update README (GitHub Actions Bot)Chores
4fbf46dtest: pinwebpackversion to 5.108.4 (#21137) (Francesco Trotta)2d063e2chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)eccbe7btest: add error locations tono-class-assign(#21123) (devoil)e7d1e43ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])e9d66d0ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])ee225b6test: Add error location details tono-eq-nullrule (#21117) (Park Harin)044a627chore: update minimatch to ^10.2.5 (#21107) (김채영)fb09aa8chore: update ecosystem plugins (#21115) (ESLint Bot)5abd878test: add error locations tono-proto(#21114) (Gihyeon Jeong / 정기현)9715887test: Add error location details tono-div-regex(#21110) (Park Harin)a746ec6test: add error locations tono-new-wrappers(#21109) (Gihyeon Jeong / 정기현)8dde645test: add error locations tono-ex-assign(#21102) (devoil)13ab0ectest: add error locations tono-label-var(#21098) (Gihyeon Jeong / 정기현)a99906ftest: Add error location details tono-delete-varrule (#21105) (Park Harin)c47e8dcchore: add missing backticks tolanguages/js/index.js(#21104) (beeen)0174428chore: add missing backticks totranslate-cli-options.js(#21097) (dongkyu lee)3d36589chore: add missing backticks toserialization.js(#21091) (이규환)dcc9312test: add error locations toeqeqeq(#21090) (Ga eun Lee)2710b18ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))5d2f866chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])d584e31chore: fix failing ecosystem test foreslint-plugin-unicorn(#21084) (Francesco Trotta)bf3eda0chore: update ecosystem plugins (#21079) (ESLint Bot)harlan-zw/eslint-plugin-harlanzw (eslint-plugin-harlanzw)
v0.17.1Compare Source
🐞 Bug Fixes
View changes on GitHub
capricorn86/happy-dom (happy-dom)
v20.11.1Compare Source
Rich-Harris/magic-string (magic-string)
v1.1.0Compare Source
Bug Fixes
Performance Improvements
Mapfor tracking chunks (#313) (25d7461)oxc-project/oxc (oxc-parser)
v0.142.0🚀 Features
11f5d1fast_visit: AddUtf8ToUtf16::convert_program_and_comments(#24859) (overlookmotel)🐛 Bug Fixes
e80574festree: Handle empty spans serializingImportMetaandNewTarget(#24775) (overlookmotel)v0.141.0💥 BREAKING CHANGES
54cc121ast: [BREAKING] SplitMetaPropertyintoImportMetaandNewTarget(#24557) (camc314)🚀 Features
7b045cdminfier: Drop last break from last switch case (#24673) (Armano)3d22307parser: AddParseOptions::enable_ident_hashes(#24491) (Boshen)microsoft/playwright (playwright-core)
v1.62.0Compare Source
🧱 New component testing model
Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a
gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
Pass a story type as a template argument to type-check its props, and use
update(props)/unmount()on the returned locator to re-render or tear down within a test.🛑 Cancel operations with AbortSignal
Most operations and web-first assertions now accept a
signaloption that takes anAbortSignal, letting youcancel long-running actions, navigations, waits, and assertions:
Providing a signal does not disable the default timeout; pass
timeout: 0to disable it.🖼️ WebP screenshots
expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a
.webpname:page.screenshot() and locator.screenshot() also accept
webpas atype,where quality
100(the default) is lossless and lower values use lossy compression.🧩 Custom test filtering with Reporter.preprocess()
New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:
🔁 Isolated retries
New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate'retries as soon as a worker is free;'isolated'runs all retries at the end,one by one in a single worker, to minimize interference with the rest of the suite:
New APIs
Browser and Context
credentialsincludes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.Actions
scrolloption ("auto"|"none") on actions to opt out of Playwright's automatic scroll-into-view.Network
Evaluation
Command line & MCP
playwright-cli, runnable vianpx playwright mcpandnpx playwright cli.Reporters
mergeFilesreporter option:Announcements
Browser Versions
This version was also tested against the following stable channels:
pnpm/pnpm (pnpm)
v11.17.0: pnpm 11.17Compare Source
Minor Changes
Added a new setting,
update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from theGITHUB_SERVER_URLenvironment variable, falling back tohttps://github.com. The URL must use thehttps://orhttp://protocol #13220.pnpm outdatedandpnpm updateno longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.Setting
update.githubActionstofalsenow makespnpm outdatedand the interactivepnpm updateskip GitHub Actions dependencies.Patch Changes
The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.
Fixed
catalog:references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g.packages/foo) through a pnpr server #13232.Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #13164.
Revert script ordering change for
pnpm run --sequential /regex/Support the
from-gitargument in thepnpm versioncommand.When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.
Platinum Sponsors
Gold Sponsors
v11.16.0: pnpm 11.16Compare Source
Minor Changes
The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it.
pnpm version -randpnpm change statuscheck the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at1100.0.0with aminorchangeset is therefore published as1100.0.0rather than skipping straight to1100.1.0.Added a
--changesetflag topnpm update. Setupdate.changesettotrueinpnpm-workspace.yamlto enable this behavior by default, and use--no-changesetto override the setting for one update. After the update completes, pnpm writes a.changeset/pnpm-update-<suffix>.mdfile declaring a patch bump for every workspace package whosedependenciesoroptionalDependencieswere changed by the update and a major bump whenpeerDependencieschanged, including packages that consume an updated catalog entry via thecatalog:protocol. Private packages, packages without a name, and packages listed in theignorearray of.changeset/config.jsonare skipped. If.changeset/config.jsondoes not exist, a warning is printed and no changeset is generated.Added GitHub Actions dependencies to
pnpm outdatedand interactivepnpm update. Non-interactive updates can include them with--include-github-actionsor by settingupdate.githubActionstotrueinpnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.Added
updateandauditsettings sections topnpm-workspace.yaml, superseding the awkwardly namedupdateConfig,auditConfig, and top-levelauditLevelsettings:update.ignoreDepslists dependency name patterns thatpnpm updateandpnpm outdatedshould skip.audit.levelandaudit.ignoretunepnpm audit.The deprecated
updateConfig,auditConfig, andauditLevelsettings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.Patch Changes
pnpm add --save-exact/--save-prefixandpnpm updatewriting a package's version with thepeerDependenciesrange's prefix (e.g.^19.2.7instead of the requested19.2.7) whenever the same package also appeared inpeerDependencies. A realdependencies/devDependencies/optionalDependenciesentry now takes precedence over a same-namedpeerDependenciesentry when computing the current specifiers #13108.Platinum Sponsors
Gold Sponsors
This PR was generated by Mend Renovate. View the repository job log.