[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@vitejs/devtools (source)	^0.7.6 → ^0.8.0			devDependencies	minor
@vitejs/devtools-rolldown (source)	^0.7.6 → ^0.8.0			devDependencies	minor
@vitejs/devtools-vite (source)	^0.7.6 → ^0.8.0			devDependencies	minor
@vitest/utils (source)	^4.1.11 → ^4.1.12			devDependencies	patch
@vue/shared (source)	^3.5.43 → ^3.5.44			dependencies	patch
baseline-browser-mapping	^2.11.28 → ^2.11.29			devDependencies	patch
eslint (source)	10.12.0 → 10.13.0				minor
github/codeql-action	v4.38.3 → v4.39.0			action	minor
oxfmt (source)	^0.72.0 → ^0.73.0			devDependencies	minor
oxlint (source)	^1.87.0 → ^1.88.0			devDependencies	minor
playwright-chromium (source)	^1.64.0 → ^1.64.1			devDependencies	patch
pnpm (source)	12.11.2 → 12.14.0			packageManager	minor
postcss (source)	^8.5.29 → ^8.5.30			dependencies	patch	8.5.31
react (source)	^19.3.0 → ^19.3.1			dependencies	patch
react (source)	19.3.0 → 19.3.1			dependencies	patch
react (source)	^19.3.0 → ^19.3.1			devDependencies	patch
react-dom (source)	^19.3.0 → ^19.3.1			dependencies	patch
react-dom (source)	^19.3.0 → ^19.3.1			devDependencies	patch
react-fake-client (source)	^19.3.0 → ^19.3.1			devDependencies	patch
react-fake-server (source)	^19.3.0 → ^19.3.1			devDependencies	patch
sass	^1.105.1 → ^1.105.2			devDependencies	patch
sass-embedded	^1.105.1 → ^1.105.2			devDependencies	patch
semgrep/semgrep	1.180.0 → 1.181.0			container	minor
std-env	^4.2.0 → ^4.3.0			devDependencies	minor
svelte-check	^4.7.6 → ^4.7.7			devDependencies	patch
typescript-eslint (source)	8.71.1 → 8.71.2				patch
vitepress-plugin-group-icons	^1.7.7 → ^1.8.1			devDependencies	minor
vitest (source)	^5.0.3 → ^5.0.5			devDependencies	patch
vue (source)	^3.5.43 → ^3.5.44			dependencies	patch
vue (source)	^3.5.43 → ^3.5.44			devDependencies	patch
zizmorcore/zizmor-action	v0.6.4 → v0.7.1			action	minor

---

Release Notes

vitejs/devtools (@​vitejs/devtools)

v0.8.0

Compare Source

   🚨 Breaking Changes

• kit: Move json-render to @​vitejs/devtools  -  by @​antfubot in #​604 (b3a12)

   🐞 Bug Fixes

• Use auto-loaded DevTools in UI dev servers  -  by @​webfansplz (29e11)
• core:
  • Missing types for DevTools() config options  -  by @​jycouet in #​608 (a4805)
• oxc:
  • Preserve successful formatting with stderr notices  -  by @​SaKaNa-Y and Leo in #​594 (1b10c)
• rolldown:
  • Prevent builds from inheriting development NODE_ENV  -  by @​zahidzorbaz in #​587 (bc2e8)
  • Include asset and package data in static reports  -  by @​SaKaNa-Y in #​598 (bc7ff)
  • Keep filtered-out importers from hiding modules in the module graph  -  by @​IWANABETHATGUY in #​610 (2579c)
  • Make run build record sessions and exit cleanly  -  by @​webfansplz in #​609 (aeee7)
• vite:
  • Include no-result transform hooks in module timings  -  by @​SaKaNa-Y in #​599 (6e933)
  • Include no-result load hooks in module timings  -  by @​SaKaNa-Y in #​606 (4cfb4)
  • Include same-ID resolutions in module timings  -  by @​SaKaNa-Y in #​607 (89a70)

    View changes on GitHub

vitest-dev/vitest (@​vitest/utils)

v4.1.12

Compare Source

   🐞 Bug Fixes

• mocker: Harden manual and redirect mocks [backport to v4]  -  by @​sheremet-va in #​11580 (b8253)

    View changes on GitHub

vuejs/core (@​vue/shared)

v3.5.44

Compare Source

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #​11164) (#​15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#​15724) (d084b90), closes #​15723
• compiler-dom: correctly stringify 0 and false in v-html (#​15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#​15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#​15604) (38012a5), closes #​15602
• custom-element: skip mounting an async custom element removed while its component loads (#​15777) (0f8e7b4), closes #​15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#​15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#​15711) (92798ac), closes #​15710
• reactivity: avoid mutating native array iterators (#​15703) (7f9d45d), closes #​15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#​15782) (db00fe9), closes #​5009
• reactivity: once watcher should stop when its callback throws (#​15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#​15793) (b600466), closes #​15792
• runtime-core: detect new prop keys when comparing full props (#​15634) (702fa61), closes #​15632
• runtime-core: keep async placeholder for block patching and pending component updates (#​15554) (05ec25f), closes #​15551
• runtime-core: only flush jobs queued by the root render itself (#​15757) (0bea14b), closes #​6728
• runtime-core: render nothing for an invalid v-for range in production (#​15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#​15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#​15627) (a084e44)
• server-renderer: propagate async setup errors (#​15857) (6930374), closes #​15716
• ssr: honor falsy vnode content overrides (#​15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#​15640) (2a086a2), closes #​15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#​15818) (d3c6e02), closes #​15817
• transition-group: measure nested groups against their moving outer item (#​15848) (1936c87), closes #​5385 #​1531
• transition: handle comment-wrapped component roots (#​15853) (ff35014), closes #​6080 #​5500

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.11.29

Compare Source

eslint/eslint (eslint)

v10.13.0

Compare Source

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#​21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#​21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#​21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#​21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#​21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#​21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#​21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#​21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#​21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#​21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#​21390) (ESLint Bot)

github/codeql-action

v4.39.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

oxc-project/oxc (oxfmt)

v0.73.0

Compare Source

🚀 Features

• a495e82 oxfmt: Support associations config to specify language over filepath (#​27437) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#​27386) (leaysgur)

📚 Documentation

• 408d87f oxfmt: Simplify oxfmtrc docs (#​27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#​27362) (leaysgur)

oxc-project/oxc (oxlint)

v1.88.0

Compare Source

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#​27346) (Mikhail Baev)

microsoft/playwright (playwright-chromium)

v1.64.1

Compare Source

Bug Fixes

• #​43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #​43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

pnpm/pnpm (pnpm)

v12.14.0: pnpm 12.14.0

Compare Source

This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

Minor Changes

• Added the sideEffectsCache.exclude setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a remoteCache server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same name, @scope/*, and name@version patterns as minimumReleaseAgeExclude #​5271.

• pnpm login now prints the npm-notice response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.

Patch Changes

Installing packages

• pnpm install and pnpm add no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes #​16839.

• pnpm install, pnpm add and pnpm update now reuse pnpm-lock.yaml when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an overrides entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry #​16923.

• pnpm install now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With linkWorkspacePackages enabled, it used to run git ls-remote once per project #​16899.

• A filtered install, such as pnpm install --filter <pkg>, now keeps the pnpm-lock.yaml entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #​16931.

• pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install #​16901.

• An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #​16929.

Running commands and scripts

• pnpm no longer aborts with a core dump when the reader of its output has exited, as in pnpm list | head -1 or pnpm start 2>&1 | head -1. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 #​16904 pnpm/tasks#132.

• On Windows, pnpm exec, pnpm run, and commands such as pnpm nx now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited #​16930.

• Commands that do not write the project manifest now leave a missing package.json absent. This covers queries such as pnpm why and pnpm outdated, pnpm fetch, pnpm dedupe --check, and commands that exit with an error, such as pnpm rt ls. These commands used to create one from the initialization template. pnpm sbom run from a lockfile alone now reports the root component as unknown with version 0.0.0 #​16907.

• pnpm run now reports a failed script as a JSON record under --reporter=ndjson. It printed a plain [ELIFECYCLE] line to stderr.

• pnpm run no longer prints [ELIFECYCLE] Command failed with exit code N. to stderr when a script fails under --reporter=silent, --silent, or --loglevel=silent.

• pnpm pipeline --dry-run no longer writes a run report when no projects are selected. With --json it prints {"tasks": []} pnpm/tasks#126.

Packing and publishing

• pnpm pack and pnpm publish now ship the whole gitignored directory that main, browser, or bin points into, as npm does. Previously only the main and bin files themselves were packed, and a gitignored browser file was left out #​16908.

• pnpm pack and pnpm publish now honor a .npmignore or .gitignore inside a subdirectory when package.json has a files field. The package root's ignore files and those inherited from the workspace are still skipped #​16909.

Setting up pnpm and toolchains

• --registry, --https-proxy, --http-proxy, and --no-proxy now apply when pnpm resolves and downloads the pnpm version a project pins in packageManager. Before, these lookups went to https://registry.npmjs.org/, which a firewall that only allows a private registry blocks #​16911.

• On Windows, pnpm install now installs the Rust toolchain for rustup's default host, so a machine set up with rustup set default-host x86_64-pc-windows-gnu gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain #​16854.

Platinum Sponsors

Gold Sponsors

v12.13.0: pnpm 12.13.0

Compare Source

This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.

Minor Changes

• Added the pnpm profile command to view and update registry user profile settings.

• Added pnpm token to list, create, and revoke authentication tokens on the registry.

• Added the storeIndexFormat setting. Set it to files to keep a store's package index as one file per package instead of the SQLite index.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt index.db.

• Added the nodePackageMap setting, which groups the package-map settings. nodePackageMap.mode: write-only writes node_modules/.package-map.json for other tools without making Node.js load it. mode: load also makes Node.js load the map, like nodeExperimentalPackageMap: true. nodePackageMap.type replaces nodePackageMapType. The old settings still work #​14937.

  nodePackageMap:
    mode: write-only
    type: loose

Patch Changes

Setting up pnpm

• pnpm setup now works when pnpm was installed with npm on macOS. It installed pnpm from npm's bin directory and left a $PNPM_HOME/bin/pnpm that could not run #​16855.

• pnpm runs again after pnpm setup when globalShims enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #​16874.

• A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that rust-toolchain.toml names. It used to install the MSVC toolchain.

Installing packages

• On macOS, pnpm install no longer fails with ERR_PNPM_LOCKFILE_WRITE_FILE when the project is on a virtiofs or SMB share. pnpm now falls back to a regular fsync when the file system rejects a full sync #​16846.

• On macOS, pnpm install, pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.

• pnpm install now puts the executables of a Python build backend's requirements on the PATH while the backend runs. Projects built with uv_build now install. Before, they failed with "uv-build was not properly installed".

• Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

• pnpm-lock.yaml no longer records the tarball URL of a package installed from a scoped registry, such as one set by @types:registry=, when pnpm can rebuild the URL from that registry #​16866.

Packing, auditing, and pipelines

• pnpm pack and pnpm publish now pack only package.json, the README, the license, and the files named in main and bin when files is an empty array. They used to pack every file in the package #​16889.

• pnpm audit and pnpm audit signatures no longer check runtimes installed through devEngines.runtime, such as node@runtime:24.21.0, against the npm package of the same name. pnpm audit signatures reported these runtimes as having an invalid registry signature #​16869.

• pnpm pipeline now runs the root's tasks when pnpm-workspace.yaml lists only the root in packages or omits packages, as pnpm -r run does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, pnpm pipeline now reports that no projects are selected #​16849.

Performance

• pnpm install resolves Python dependencies faster. With --lockfile-only, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.

• A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.

• pnpm install with enableModulesDir: false now verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.

Platinum Sponsors

Gold Sponsors

v12.12.1: pnpm 12.12.1

Compare Source

This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Patch Changes

• pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

• pnpm dist-tag add, rm, and ls now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.

• Added the tool: protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. pnpm add bun@tool:1.3.0, pnx node@tool:22, and pnx yarn@tool:4 work like the runtime: spelling, which stays supported as an alias. A lockfile written for runtime: stays up to date when package.json switches to tool:, and the other way around.

  A named registry can no longer be called tool.

Platinum Sponsors

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.