deps: all non-major dependencies by dejanvasic85 · Pull Request #721 · dejanvasic85/williamstownsc

dejanvasic85 · 2026-07-10T21:05:14Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
@aws-sdk/client-ses (source)	dependencies	minor	`3.1082.0` → `3.1084.0`	`3.1085.0`
lucide-react (source)	dependencies	minor	`1.23.0` → `1.24.0`
pnpm (source)	packageManager	minor	`11.10.0` → `11.11.0`
pnpm (source)	uses-with	minor	`11.10.0` → `11.11.0`
prettier (source)	devDependencies	patch	`3.9.4` → `3.9.5`

Release Notes

aws/aws-sdk-js-v3 (@aws-sdk/client-ses)

`v3.1084.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-ses

`v3.1083.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-ses

lucide-icons/lucide (lucide-react)

`v1.24.0`: Version 1.24.0

Compare Source

What's Changed

fix(scripts): fix typo in renameIcon.function.mts by @karsa-mistmere in #4514
chore(icons): remove toBeRemovedInVersion metadata and make it optional in schema by @ericfennis with @Copilot in #4513
feat(site): Add merch link by @ericfennis in #4524
fix(packages/angular): move child rendering logic to template from effect by @karsa-mistmere in #4519
docs(site): list @gyeonghokim/lucide-lit as third-party package by @GyeongHoKim in #4421
fix(icons): changed option icon by @jamiemlaw in #4326
fix(lucide-react-native): restore the icons entry point in the JS bundles by @pvinis in #4528
fix(vue): support kebab-case icon-node prop on Icon component by @Sagargupta16 in #4512
fix(lucide-react-native): Add icon exports property to the package.json file by @ericfennis in #4522
fix(icons): centered the dot icon by @cnlancehu in #4492
feat(icons): added circle-euro-sign icon by @Guido3000 in #4353
feat(icons): added server-plus icon by @Turboman3000 in #4232

New Contributors

@ericfennis with @Copilot made their first contribution in #4513
@GyeongHoKim made their first contribution in #4421
@pvinis made their first contribution in #4528
@Sagargupta16 made their first contribution in #4512
@Guido3000 made their first contribution in #4353
@Turboman3000 made their first contribution in #4232

Full Changelog: lucide-icons/lucide@1.23.0...1.24.0

pnpm/pnpm (pnpm)

`v11.11.0`

Compare Source

Minor Changes

508b8c2: Added the pnpm access command for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.

Patch Changes

c70e33e: Allow allowBuilds entries for git-hosted packages to match by repository URL without pinning the resolved commit hash. This lets trusted git repositories keep running their build scripts after branch updates without approving each new commit, while package-name-only rules still do not approve git-hosted artifacts.
3067e4f: Reduced peak memory usage during cold-cache dependency resolution. The metadata fetch is memoized for the whole resolution phase, and it was retaining each package's raw registry response body (used only to mirror the response to disk) for that entire time. The memoized cache now holds a body-less copy, so the raw body only lives as long as the call that writes the disk mirror. On large graphs that fetch full metadata (e.g. with minimumReleaseAge or trustPolicy enabled) this cuts peak RSS by roughly 30%, back in line with pnpm 10. The resolved lockfile is unchanged.
51300fd: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at formatGlobalVirtualStorePath, the single point every global-virtual-store slot path funnels through — closing the same escape in the isolated linker, the resolver's dependency-graph builder, and the config-dependency installer.
f8058eb: Reject symlinked pnpm-lock.yaml files when reading or writing the env lockfile document.
9318a11: Allow registries and namedRegistries to be configured in the global config.yaml file.
51300fd: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
14332f0: Fail instead of silently removing an optional dependency's locked entries from pnpm-lock.yaml when the registry cannot resolve it. Previously, when registry metadata lacked a version that the lockfile already pinned (for example, a mirror that had not synced a recent release yet), pnpm install and pnpm dedupe silently dropped the optional dependency's entries — emptying maps such as the platform binaries of @napi-rs/canvas — so the lockfile differed between machines and frozen installs on other hosts had nothing to link #12853.
fecfe83: Fixed peer dependency resolution with autoInstallPeers when a workspace package depends on a version of a package that a transitive dependency's self-contained closure also provides for itself. The peer providers that are attached to the root project for reuse are no longer peer-resolved a second time in the root context, so packages inside such a closure no longer get their peers bound to the root project's incompatible version #4993.
5a4daec: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry, namedRegistries, and pnprServer.
d1da02e: pnpm publish no longer prints credentials when the target registry is configured with inline user:pass@ credentials (e.g. registry=https://user:pass@example.com/). They are now redacted both from the "publishing to registry" line and from the OIDC (trusted publishing) failure messages.
dcfc611: pnpm self-update now honors trustPolicy=no-downgrade. It resolves the target pnpm version against full registry metadata, so it refuses to switch to a version whose supply-chain trust evidence is weaker than an earlier-published one, the same way a regular install does.
a8ad82d: Register the pn alias in generated shell completion scripts.
25bd5c3: Fixed standalone installer downgrades from pnpm v12 to v11.
23996e9: pnpm runtime set <name> <version> now validates its arguments: the name must be node, deno, or bun, and the version must not contain a comma. Previously these were interpolated straight into a pnpm add selector, where an unsupported name or a comma (e.g. node 22,is-positive) could be misread as a list of packages or a local directory and install unintended packages or bins.

prettier/prettier (prettier)

`v3.9.5`

Compare Source

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text

1234567890123456789012) text

<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text

1234567890123456789012) text

<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text

1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](<> "title")

<!-- Prettier 3.9.4 -->
[link]( "title")

<!-- Prettier 3.9.5 -->
[link](<> "title")

Less: Remove extra spaces after `[` in map lookups (#19503 by @kovsu)

// Input
.foo {
  color: #theme[ primary];
  color: #theme[@&#8203;name];
  color: #theme[@&#8203;@&#8203;name];
}

// Prettier 3.9.4
.foo {
  color: #theme[ primary];
  color: #theme[ @&#8203;name];
  color: #theme[ @&#8203;@&#8203;name];
}

// Prettier 3.9.5
.foo {
  color: #theme[primary];
  color: #theme[@&#8203;name];
  color: #theme[@&#8203;@&#8203;name];
}

CSS: Prevent addition space in `type()` with `+` (#19516 by @bigandy)

This fixes the addition space before + in CSS type() declaration. For example type(<number>+) was being converted into type(<number> +) which is invalid CSS and does not work.

/* Input */
div {
  border-radius: attr(br type(<length>+));
}

/* Prettier 3.9.4 */
div {
  border-radius: attr(br type(<length> +));
}

/* Prettier 3.9.5 */
div {
  border-radius: attr(br type(<length>+));
}

Less: Remove spaces between merge markers and colons (#19517 by @kovsu)

// Input
a {
  box-shadow  +  : 0 0 1px #&#8203;000;
}

// Prettier 3.9.4
a {
  box-shadow+  : 0 0 1px #&#8203;000;
}

// Prettier 3.9.5
a {
  box-shadow+: 0 0 1px #&#8203;000;
}

Markdown: Preserve wiki links with aliases (#19527 by @kovsu)

<!-- Input -->
[[Foo:Bar]]

<!-- Prettier 3.9.4 -->
[[Foo]]

<!-- Prettier 3.9.5 -->
[[Foo:Bar]]

TypeScript: Fix comments being dropped on shorthand `type` import/export specifiers (#19565 by @kirkwaiblinger)

// Input
export { type /* comment */ T } from "foo";
import { type /* comment */ T } from "foo";

// Prettier 3.9.4
Error: Comment "comment" was not printed. Please report this error!

// Prettier 3.9.5
export { type /* comment */ T } from "foo";
import { type /* comment */ T } from "foo";

Miscellaneous: Preserving comments' `placement` property (#19567 by @Janther)

Prettier@3.9.0 deleted an undocumented property on comments, which was already used by plugins, comment.placement is now available again after comment attach.

Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)

// Input
declare module "foo" {}

// Prettier 3.9.4
declare module "foo" {
}

// Prettier 3.9.5
declare module "foo" {}

Angular: Support expression for exhaustive typechecking (#19571 by @fisker)

<!-- Input -->
@&#8203;switch (state.mode) {
  @&#8203;default never(state);
}

<!-- Prettier 3.9.4 -->
@&#8203;switch (state.mode) {
  @&#8203;default never;
}

<!-- Prettier 3.9.5 -->
@&#8203;switch (state.mode) {
  @&#8203;default never(state);
}

TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)

// Input
foo<{
  // comment
  [key in keyof Foo]: number
}>();

// Prettier 3.9.4
foo<
  {
    // comment
    [key in keyof Foo]: number;
  }
>();

// Prettier 3.9.5
foo<{
  // comment
  [key in keyof Foo]: number;
}>();

Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)

// Input
/* a *//* b */
/* a */* {
  color: red;
}

// Prettier 3.9.4
/* a */
/* b */
/* a * {
  color: red;
}

// Prettier 3.9.5
/* a */ /* b */
/* a */
* {
  color: red;
}

JavaScript: Handle dangling comments in `SwitchStatement` (#19581 by @fisker)

// Input
switch (foo) {
 // comment
}

// Prettier 3.9.4
switch (
  foo
  // comment
) {
}

// Prettier 3.9.5
switch (foo) {
  // comment
}

TypeScript: Remove space in comment-only object type (#19583 by @fisker)

// Input
var foo = {
  /* comment */
};
type Foo = {
  /* comment */
};

// Prettier 3.9.4
var foo = {/* comment */};
type Foo = { /* comment */ };

// Prettier 3.9.5
var foo = {/* comment */};
type Foo = {/* comment */};

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Summary by CodeRabbit

Chores
- Updated the Node.js and package management tooling used by automated checks, crawling, and deployments.
- Updated AWS email, icon, and code-formatting packages to newer versions.
- No user-facing feature changes were included.

vercel · 2026-07-10T21:05:22Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
williamstownsc	Ready	Preview, Comment	Jul 10, 2026 9:05pm

coderabbitai · 2026-07-10T21:05:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e4d040db-6dc8-4f5b-9924-6b113489e796

📥 Commits

Reviewing files that changed from the base of the PR and between 8f0384a and a5de3be.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

.github/workflows/ci.yml
.github/workflows/crawl.yml
.github/workflows/deploy-sanity.yml
package.json

📝 Walkthrough

Walkthrough

Updates project tooling from the 11.10.0 to 11.11.0 release line across package metadata and GitHub Actions workflows, and bumps @aws-sdk/client-ses, lucide-react, and prettier.

Changes

Toolchain alignment

Layer / File(s)	Summary
Package manifest versions `package.json`	Updates pnpm metadata and bumps `@aws-sdk/client-ses`, `lucide-react`, and `prettier`.
Workflow runtime versions `.github/workflows/ci.yml`, `.github/workflows/crawl.yml`, `.github/workflows/deploy-sanity.yml`	Configures Node.js 11.11.0 in CI, crawling, and deployment workflows.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

dejanvasic85/williamstownsc#646 — Directly covers the dependency dashboard updates implemented here.
dejanvasic85/jlc-carpentry#593 — Overlaps on the pnpm and Prettier version updates.
dejanvasic85/portfolio#221 — Updates overlapping package and CI/Mise tooling versions.

Possibly related PRs

dejanvasic85/williamstownsc#644 — Updates the same workflow tooling and pnpm metadata fields.
dejanvasic85/williamstownsc#684 — Overlaps on workflow Node tooling, pnpm, and @aws-sdk/client-ses.
dejanvasic85/williamstownsc#698 — Updates overlapping dependencies including @aws-sdk/client-ses, lucide-react, and prettier.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the changes as non-major dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/all-minor-patch

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

deps: all non-major dependencies

a5de3be

dejanvasic85 added the dependencies label Jul 10, 2026

dejanvasic85 enabled auto-merge (squash) July 10, 2026 21:05

dejanvasic85 added the dependencies label Jul 10, 2026

dejanvasic85 merged commit 0f24c20 into main Jul 10, 2026
6 checks passed

dejanvasic85 deleted the renovate/all-minor-patch branch July 10, 2026 21:08

This was referenced Jul 13, 2026

deps: pnpm to v11.12.0 #730

Closed

deps: all non-major dependencies #739

Merged

deps: all non-major dependencies #746

Merged

This was referenced Jul 21, 2026

deps: all non-major dependencies #753

Merged

deps: all non-major dependencies #756

Merged

This was referenced Jul 30, 2026

deps: all non-major dependencies #775

Merged

deps: all non-major dependencies #789

Merged

coderabbitai Bot mentioned this pull request Aug 10, 2026

deps: all non-major dependencies #808

Merged

1 task

Navigation Menu

deps: all non-major dependencies - #721

deps: all non-major dependencies#721
dejanvasic85 merged 1 commit into
mainfrom
renovate/all-minor-patch

dejanvasic85 commented Jul 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dejanvasic85 commented Jul 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.1084.0

v3.1083.0

v1.24.0: Version 1.24.0

What's Changed

New Contributors

v11.11.0

Minor Changes

Patch Changes

v3.9.5

Markdown: Cap ordered list mark at 999,999,999 (#​19351 by @​tats-u)

Markdown: Avoid corrupting empty link with title (#​19487 by @​andersk)

Less: Remove extra spaces after [ in map lookups (#​19503 by @​kovsu)

CSS: Prevent addition space in type() with + (#​19516 by @​bigandy)

Less: Remove spaces between merge markers and colons (#​19517 by @​kovsu)

Markdown: Preserve wiki links with aliases (#​19527 by @​kovsu)

TypeScript: Fix comments being dropped on shorthand type import/export specifiers (#​19565 by @​kirkwaiblinger)

Miscellaneous: Preserving comments' placement property (#​19567 by @​Janther)

Flow: Stop enforcing empty module declaration to break (#​19568 by @​fisker)

Angular: Support expression for exhaustive typechecking (#​19571 by @​fisker)

TypeScript: Ignore comments inside mapped type when checking type parameter comments (#​19572 by @​fisker)

Less: Fix adjacent block comments being corrupted (#​19574 by @​kovsu)

JavaScript: Handle dangling comments in SwitchStatement (#​19581 by @​fisker)

TypeScript: Remove space in comment-only object type (#​19583 by @​fisker)

Configuration

Summary by CodeRabbit

Uh oh!

vercel Bot commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dejanvasic85 commented Jul 10, 2026 •

edited by coderabbitai Bot

Loading

`v3.1084.0`

`v3.1083.0`

`v1.24.0`: Version 1.24.0

`v11.11.0`

`v3.9.5`

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)

Markdown: Avoid corrupting empty link with title (#19487 by @andersk)

Less: Remove extra spaces after `[` in map lookups (#19503 by @kovsu)

CSS: Prevent addition space in `type()` with `+` (#19516 by @bigandy)

Less: Remove spaces between merge markers and colons (#19517 by @kovsu)

Markdown: Preserve wiki links with aliases (#19527 by @kovsu)

TypeScript: Fix comments being dropped on shorthand `type` import/export specifiers (#19565 by @kirkwaiblinger)

Miscellaneous: Preserving comments' `placement` property (#19567 by @Janther)

Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)

Angular: Support expression for exhaustive typechecking (#19571 by @fisker)

TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)

Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)

JavaScript: Handle dangling comments in `SwitchStatement` (#19581 by @fisker)

TypeScript: Remove space in comment-only object type (#19583 by @fisker)

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading