deps: all non-major dependencies - #698
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dejanvasic85
enabled auto-merge (squash)
June 28, 2026 20:27
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthrough
ChangesDependency bump
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 84: The prettier dependency is still pinned to 3.9.0 and needs to be
updated to 3.9.1. Update the version in package.json for the prettier entry,
then refresh the lockfile so the resolved package version matches the new
release.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f2bf2d3f-e215-4e40-8978-45b6135414b6
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
June 29, 2026 20:38
46d6561 to
81133d0
Compare
dejanvasic85
changed the title
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
June 30, 2026 20:39
81133d0 to
d4fdb22
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
package.json (1)
84-84: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueNewer prettier patch available (3.9.4).
The current bump lands on
3.9.3, but3.9.4Latest version: 3.9.4, last published: 5 hours ago. Given this PR's intent (per the prior addressed comment) is to track the latest published prettier version, consider bumping once more or letting the next Renovate pass pick it up.As per coding guidelines, "Ensure to find the latest version of a package before adding it."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 84, The Prettier dependency is still pinned to 3.9.3 in package.json, but the latest patch release is 3.9.4. Update the existing prettier version entry to the latest published patch so the version bump matches the PR’s intent; this is the only change needed in the package.json dependency list.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@package.json`:
- Line 84: The Prettier dependency is still pinned to 3.9.3 in package.json, but
the latest patch release is 3.9.4. Update the existing prettier version entry to
the latest published patch so the version bump matches the PR’s intent; this is
the only change needed in the package.json dependency list.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2ba5d3a1-ef52-4818-976d-495168f33085
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
July 1, 2026 20:35
d4fdb22 to
2d1623a
Compare
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
July 2, 2026 20:32
2d1623a to
cfa5cbe
Compare
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
July 3, 2026 20:57
cfa5cbe to
d403a63
Compare
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
July 4, 2026 12:02
d403a63 to
c405bdc
Compare
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
July 4, 2026 20:47
c405bdc to
03f56e0
Compare
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
July 5, 2026 20:52
03f56e0 to
7009c10
Compare
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
July 6, 2026 21:24
7009c10 to
f43c9e8
Compare
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011Ymfh3vFJhfj9K6WPR4MMC
This was referenced Jul 7, 2026
1 task
This was referenced Jul 28, 2026
This was referenced Aug 5, 2026
This was referenced Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.1075.0→3.1079.03.1080.03.2.0→3.3.23.3.5(+2)6.2.0→6.3.010.62.0→10.63.04.3.1→4.3.25.101.1→5.101.25.101.1→5.101.25.6.3→5.6.135.6.141.21.0→1.23.011.9.0→11.10.011.9.0→11.10.03.8.5→3.9.47.80.0→7.81.06.2.0→6.3.04.3.1→4.3.24.22.4→4.23.0Release Notes
aws/aws-sdk-js-v3 (@aws-sdk/client-ses)
v3.1079.0Compare Source
Note: Version bump only for package @aws-sdk/client-ses
v3.1078.0Compare Source
Note: Version bump only for package @aws-sdk/client-ses
v3.1077.0Compare Source
Note: Version bump only for package @aws-sdk/client-ses
v3.1076.0Compare Source
Note: Version bump only for package @aws-sdk/client-ses
sanity-io/ui (@sanity/ui)
v3.3.2Compare Source
Patch Changes
edb7248Thanks @stipsan! - The package is now built with tsdown. It continues to ship both CJS (require) and ESM (import) builds with identical entry points and named exports.v3.3.1Compare Source
Patch Changes
e5e508aThanks @stipsan! - Set up Changesets-based releases with npm trusted publishing. No runtime changes.v3.3.0Compare Source
Features
astypings from v4 (#2209) (ae60285)sanity-io/sanity (@sanity/vision)
v6.3.0Compare Source
Features
getsentry/sentry-javascript (@sentry/nextjs)
v10.63.0Compare Source
url.fullattribute to resource spans (#21846)extendIntegrationmethod (#21759)isTracingSuppressedto the async context strategy (#21785)fastifyIntegration(#21706)sentry.status.messageattribute (#21811)Internal Changes
fastifyIntegration(#21706)spanStreamingIntegrationsetup intoServerRuntimeClient(#21814)mysqlinstrumentation with orchestrion bundler plugin (#21782)Work in this release was contributed by @suzunn. Thank you for your contribution!
tailwindlabs/tailwindcss (@tailwindcss/postcss)
v4.3.2Compare Source
Fixed
auto-rows-*andauto-cols-*utilities (e.g.auto-rows-12andauto-cols-16) (#20229)@tailwindcss/cliin--watchmode from crashing on Windows when@sourcepoints to a directory that doesn't exist (#20242)@tailwindcss/vitefrom crashing in Deno v2.8.x whencontext.parentURLis not a valid URL (#20245)@tailwindcss/cliin--watchmode rebuilds when the input CSS file changes in an ignored directory (#20246)@variantrules used inaddBase(…)to use custom variants defined later (#20247)@tailwindcss/vitefrom crashing during HMR when scanned files or directories are deleted (#20259)font-sizeinstead ofcolordeclarations fortext-[--spacing(…)](#20260)@sourcepatterns from scanning unrelated sibling files and folders (#20263)%]…[%in.tt,.tt2, and.txfiles (#20269)p.text-black[condition](#20269)@position-tryrules from triggering unknown at-rule warnings when optimizing CSS (#20277)--opacitytheme values (#20287)@tailwindcss/postcsswhen used with newer PostCSS patch releases (#20289)TanStack/query (@tanstack/react-query)
v5.101.2Compare Source
Patch Changes
TanStack/query (@tanstack/react-query-devtools)
v5.101.2Compare Source
Patch Changes
f5bf180,25cdd97,ecd89c8,01c7634,49012db]:saadeghi/daisyui (daisyui)
v5.6.13Compare Source
Bug Fixes
v5.6.12Compare Source
Bug Fixes
v5.6.11Compare Source
Bug Fixes
v5.6.10Compare Source
Bug Fixes
<button disabled>style in menu. closes: #4600 (1f07963)v5.6.9Compare Source
Bug Fixes
v5.6.8Compare Source
Bug Fixes
v5.6.7Compare Source
Bug Fixes
v5.6.6Compare Source
Bug Fixes
v5.6.5Compare Source
Bug Fixes
tabclass (1b6f11a), closes #4595v5.6.4Compare Source
Bug Fixes
lucide-icons/lucide (lucide-react)
v1.23.0: Version 1.23.0Compare Source
What's Changed
paper-bagicon by @dkast in #4023New Contributors
Full Changelog: lucide-icons/lucide@1.22.0...1.23.0
v1.22.0: Version 1.22.0Compare Source
What's Changed
carroticon by @jguddas in #4010ungroupicon by @jguddas in #3969phiicon also used asgolden-ratioby @whoisBugsbunny in #4218New Contributors
Full Changelog: lucide-icons/lucide@1.21.0...1.22.0
pnpm/pnpm (pnpm)
v11.10.0Compare Source
Minor Changes
e2e3c81: Added theissuescommand as an alias ofbugs, sopnpm issuesopens the package's bug tracker URL in the browser.8491f8e: Added theprefixcommand which prints the current package prefix directory (or global prefix directory if-g/--globalis used).3425e80: Added an_authsetting for configuring registry authentication as a single structured (URL-keyed) value. It can be set in the global pnpm config (config.yaml) or, for CI, via thepnpm_config__authenvironment variable. The env form sidesteps the GitHub Actions / bash / zsh limitation that broke the existingpnpm_config_//host/:_authToken=…form (env var names containing/,:, or.are silently dropped). Closes #12314.The value is keyed by registry URL so each secret is explicitly bound to the host that may receive it. Registry URL keys must use
httporhttpsand must not include credentials, query strings, or fragments:The equivalent in the global
config.yaml:Within each registry URL,
@means registry-wide/default credentials and package scopes like@orgbind credentials to that scope on the same host. The only supported credential field isauthToken(maps to_authToken/ bearer auth); the deprecatedbasicAuth/username+passwordforms are intentionally not accepted here.Each entry also infers a trusted registry route:
@routes the default registry (andpnpm add <pkg>resolves there), and@orgroutes that scope. Because the credential and destination host arrive in one trusted value, repo-controlledpnpm-workspace.yamlor project.npmrccannot redirect the token to a different host._authis honored only from the env var and the global config — it is ignored in a projectpnpm-workspace.yaml/.npmrc, so repo-controlled config can never supply registry auth. Precedence: CLI flags (--registry,--@​scope:registry) >pnpm_config__auth> globalconfig.yaml_auth>pnpm-workspace.yaml.Both
pnpm_config__auth(lowercase, documented form) andPNPM_CONFIG__AUTH(all-caps, the shell convention some CI runners apply) are honored. If both are set, lowercase wins unless it is empty, in which case uppercase is used. The env var wins over the globalconfig.yaml_authon a conflicting key.tokenHelperis not supported in_auth. Parsing is strict: a malformed value (bad JSON, wrong shape, invalid registry URL or scope, an unsupported credential field) fails fast with an error rather than being silently dropped.Pacquet parity note: the pacquet (Rust) port supports the same single credential field as the TS CLI:
authToken.a33eeec:pnpm self-updateandpackageManagerversion-switching can now install and link pnpm v12 (the Rust port), published with equal content under both thepnpmand@pnpm/exenames on thenext-12dist-tag. Its native binaries ship as@pnpm/exe.<platform>-<arch>packages, which pnpm's built-in installer links directly — no Node.js launcher, so the command pays no Node startup cost. v12 is initialized exactly like@pnpm/exe, including per-platform global-virtual-store hashing. From v12 onward the install converges on the unscopedpnpmpackage (the Rust exe) — even when updating from the SEA@pnpm/exebuild.1dd12bd: When resolving through a pnpr install-accelerator server, pnpm no longer forwards its own upstream registry credentials in the resolve request. Only theAuthorizationheader identifying the caller to pnpr is sent. The pnpr server now selects upstream credentials from its own route policy (operator-configured upstream credential aliases), so private dependencies resolve through a pnpr-managed alias the caller is authorized to use, rather than by sending the client's registry tokens to the server.1e81761: Expose web authenticationauthUrlanddoneUrlin JSON error output when OTP is required in a non-interactive terminal #12724.Patch Changes
2f389d6: Added the Node.js release team's new signing key (Stewart X Addison,655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD) to the embedded Node.js release keys, so runtimes whoseSHASUMS256.txtis signed by the new releaser verify successfully.acbdb94: Fixed shell tab completion not suggesting workspaces after the-Falias for--filteroption.dcabb78: Fixedpnpm up -r <pkg>bumping unrelated packages that have open semver ranges. Previously, any update mutation nullified the lockfile-derivedpreferredVersionsglobally, so packages with^x.y.zranges could re-resolve to newer compatible versions even though the user only asked to update a specific package. The install layer now always seedspreferredVersionsfrom the lockfile, and caller-supplied preferred versions (such as the vulnerability penalties ofpnpm audit --fix) layer on top of the seed instead of replacing it. The targeted package still bumps: the per-resolveupdateRequestedflag makes the resolver ignore the target's own lockfile pins.Closes #10662.
d539172: Fixed pnpm pack and pnpm publish failing when prepack generates files that are included in the package and postpack cleans them up.be6505a: Hardened global package management:node.exeflavor of a bin, so a stalenode.exeno longer survives onPATHafter uninstall, and a new global install no longer silently overwrites an existingnode.exe.pnpm add -g pnpm@<version>(and@pnpm/exe@<version>) is now rejected like the barepnpmform, pointing topnpm self-update.node_modulespaths, preventing a tampered manifest from escaping the install directory.25c7388: pnpm now rejectsjsr:specifiers whose package name is not a valid npm package name — an empty scope or name (e.g.jsr:@​scope/), path separators inside the name, or any other shapevalidate-npm-package-namerejects — withERR_PNPM_INVALID_JSR_PACKAGE_NAMEinstead of silently converting them into a malformed@jsr/...npm package name.25c7388: pnpm now rejects named-registry specifiers (e.g.gh:) whose package name is not a valid npm package name — an empty scope (e.g.gh:@​/bar), path separators inside the name (e.g.gh:@​scope/../name), or any other shapevalidate-npm-package-namerejects — withERR_PNPM_INVALID_NAMED_REGISTRY_PACKAGE_NAMEinstead of passing the name through to registry URLs and metadata cache file paths.96da7c5: node-gyp'sgyp_main.pyandgypentrypoints are now packed with the executable bit in thepnpmand@pnpm/exetarballs. Without it, building native addons from source could fail with a permission error.99982b9: Sped up resolution and reduced memory use against registries that ignore npm's abbreviated metadata format and always return the full package document (for example, Azure DevOps Artifacts). pnpm now strips such documents down to the abbreviated field set before caching them. Resolution output is unchanged, and registries that honor the abbreviated format (such as the npm registry) pay no extra cost.11a7fdd: Sped up offline and--prefer-offlineresolution on large workspaces (e.g.pnpm dedupe --offline,pnpm install --offline). Package metadata loaded from the local cache is now kept in memory, so each package's metadata is parsed once per command instead of once per dependent that references it.2c7369d:pnpm pack-appnow rejects--entry/pnpm.app.entryand--output-dir/pnpm.app.outputDirvalues that are absolute paths or escape the project directory via..(or a symlink that resolves outside it), and refuses to write the produced executable when its target path already exists as a symlink (or other non-regular file). This prevents a repository-controlledpackage.jsonfrom embedding host files (such as an SSH key) into the produced executable, writing build artifacts outside the project, or overwriting an arbitrary file through a committed symlink. The new error codes areERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT,ERR_PNPM_PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT, andERR_PNPM_PACK_APP_OUTPUT_FILE_NOT_REGULAR.When ad-hoc signing macOS targets,
pnpm pack-appnow runs the systemcodesignby absolute path and resolvesldidto a location outside the project, so a repository-controllednode_modules/.binonPATHcannot hijack the signer.ce5d5a5: Relative paths inpatchedDependenciesare now resolved against the lockfile directory when computing patch file hashes, so runningpnpm installfrom a subdirectory no longer fails withENOENTlooking for the patch file in the wrong location #12762.ebb4096:pnpm peersno longer reports a conflict for a missing peer dependency that is ignored viapnpm.peerDependencyRules.ignoreMissing.dcabb78: Fixed a prototype-pollution hazard when seeding preferred versions: a dependency named__proto__in a manifest or inpnpm-lock.yamlcould write throughObject.prototype(or crash the install) while the preferred-versions map was being built. The maps are now null-prototype objects, so crafted package names land as plain keys.f38e696: Hardenedpnpm deploy --forceso it refuses unsafe deploy targets such as workspace roots, parent directories, out-of-workspace paths, and symlinked target parents.806c3ec: pnpm no longer warns about ignored project-level auth settings whenPNPM_CONFIG_NPMRC_AUTH_FILEpoints at the project.npmrc— setting it to that file is an explicit opt-in to trusting it, so auth env variables in it are expanded pnpm/pnpm#12480.991405e: Restore differential rendering (ansi-diff) to fix duplicated output lines introduced by #12351.c121235: Fixed the topological order of--filtered commands (pnpm run,pnpm exec,pnpm publish,pnpm pack,pnpm rebuild) when the selected projects depend on each other only transitively through projects that were not selected. Previously such selected projects could run concurrently or in the wrong order; now a project always runs after the selected projects it transitively depends on, while projects without a real dependency relationship still run concurrently. This now also holds for prod-only filters (--filter-prod), which resolve order through the production dependency graph so transitive production dependencies are respected without pulling back the dev dependencies the filter drops, and for selections that mix--filterwith--filter-prod#8335.d539172:pnpm packandpnpm publishno longer follow a symlinked workspaceLICENSEfile when injecting it into a package that has no license of its own. Following the symlink could pack bytes from outside the workspace into the published tarball.dcabb78: Fixedpnpm up <pkg>producing a different result than a fresh install of the same manifests would. The resolver now distinguishesupdateRequested(true only for packages that match the user's update target) from the broaderupdateflag, and for the targeted package ignores only its own lockfile-derived preferred-version pins — so the target re-resolves exactly as if its lockfile entries were deleted andpnpm installran. Preferred versions a fresh install applies (manifest pins, versions propagated down the dependency chain, and the vulnerability-avoidance penalties ofpnpm audit --fix) stay in effect, so an update never installs duplicate versions that a reinstall from scratch would not reproduce. When a preferred version holds the update target below the newest version its range admits, pnpm now prints a warning explaining that reaching the newer version everywhere requires an override.dcabb78:pnpm update <dep>@​<version>now prints a warning when<dep>is only present as a transitive dependency: the requested version cannot be applied there (updates resolve the target the way a fresh install would), and the warning recommends adding the version topnpm.overridesinstead, which is the mechanism that does pin transitive dependencies. Closes #12744.a6c4d5f: When a dependency cannot be found in the registry (404) or the registry has no matching version, and a workspace project with the same name exists only at non-matching versions, the error now reports the available workspace versions (ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE) instead of the raw registry failure pnpm/pnpm#1379. Other registry failures (authorization, network, server errors) still propagate unchanged. The pacquet (Rust) resolver applies the same behavior.prettier/prettier (prettier)
v3.9.4Compare Source
diff
Angular: Format
@content(name)->@content (name)to align with other block syntax (#19499 by @fisker)v3.9.3Compare Source
diff
Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @seiyab)
TypeScript: Allow decorators to be used with declare on class fields (#19492 by @evoactivity)
Extensively used within the Ember ecosystem, decorators with
declareon class fields will ignore the babel parser error and allow Prettier to format the code without breaking it.v3.9.2Compare Source
v3.9.1Compare Source
diff
CLI: Fix ignored file has been cached incorrectly (#19483 by @kovsu)
Bug details #18016
v3.9.0Compare Source
diff
🔗 Release Notes
react-hook-form/react-hook-form (react-hook-form)
v7.81.0Compare Source
Added
FieldArraycomponent built onuseFieldArrayfor controlled field-array renderingFixed
clearErrorschanging thenamevalue fromform.subscriberesettriggeringsubscribewith the latest name instead ofundefinedsetValuesleaving stale elements behind when shrinking a field arrayflattenpreservingDatevalues as leaf nodesuseFieldArraymin length validation error changing location in theerrorsobjectuseControllernot reflecting a cleared parent object in controlled fieldsSecurity
unset()against prototype-path traversal (__proto__/constructor/prototype), matching the existingset()guardPerformance
useFieldArrayresetsanity-io/sanity (sanity)
v6.3.0Compare Source
Features
defineXcatch-all pipeline (e7c1bf4)Bug Fixes
<Resizer>component (#13310) (c3fc74b)path[0](115d396)privatenumber/tsx (tsx)
v4.23.0Compare Source
Bug Fixes
Features
This release is also available on:
v4.22.5Compare Source
Bug Fixes
This release is also available on:
Configuration
📅 Schedule: (in timezone Australia/Melbourne)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.