Skip to content

chore(deps): update all non-major dependencies#1357

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#1357
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@antfu/eslint-config ^9.0.0 → ^9.1.0 age confidence devDependencies minor
@bomb.sh/tab ^0.0.17 → ^0.0.19 age confidence dependencies patch
@bomb.sh/tab ^0.0.17 → ^0.0.19 age confidence devDependencies patch
@clack/prompts (source) ^1.6.0 → ^1.7.0 age confidence dependencies minor
@clack/prompts (source) ^1.6.0 → ^1.7.0 age confidence devDependencies minor
@codspeed/vitest-plugin (source) ^5.6.0 → ^5.7.1 age confidence devDependencies minor
@types/node (source) ^24.13.2 → ^24.13.3 age confidence devDependencies patch
@vitest/coverage-v8 (source) ^4.1.9 → ^4.1.10 age confidence devDependencies patch
CodSpeedHQ/action v4.17.6 → v4.18.5 age confidence action minor
eslint (source) ^10.5.0 → ^10.7.0 age confidence devDependencies minor
eslint-plugin-jsdoc 63.0.7 → 63.0.13 age confidence pnpm-workspace.overrides patch
exsolve ^1.0.8 → ^1.1.0 age confidence dependencies minor
exsolve ^1.0.8 → ^1.1.0 age confidence devDependencies minor
h3-next (source) ^2.0.1-rc.22 → ^2.0.1-rc.24 age confidence devDependencies patch 2.0.1-rc.25
httpxy 0.5.3 → 0.5.5 age confidence pnpm-workspace.overrides patch
knip (source) ^6.17.1 → ^6.26.0 age confidence devDependencies minor
nypm ^0.6.7 → ^0.6.8 age confidence dependencies patch
nypm ^0.6.7 → ^0.6.8 age confidence devDependencies patch
pnpm (source) 11.8.0 → 11.11.0 age confidence packageManager minor 11.12.0
srvx (source) ^0.11.17 → ^0.11.21 age confidence dependencies patch 0.11.22
srvx (source) ^0.11.17 → ^0.11.21 age confidence devDependencies patch 0.11.22
std-env ^4.1.0 → ^4.2.0 age confidence dependencies minor
std-env ^4.1.0 → ^4.2.0 age confidence devDependencies minor
tinyclip ^0.1.14 → ^0.1.15 age confidence dependencies patch
tinyclip ^0.1.14 → ^0.1.15 age confidence devDependencies patch
tsdown (source) ^0.22.3 → ^0.22.4 age confidence devDependencies patch 0.22.5
undici (source) ^8.5.0 → ^8.7.0 age confidence devDependencies minor
vitest (source) ^4.1.9 → ^4.1.10 age confidence devDependencies patch
vue (source) ^3.5.38 → ^3.5.39 age confidence devDependencies patch
vue-tsc (source) ^3.3.5 → ^3.3.7 age confidence devDependencies patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v9.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
bombshell-dev/tab (@​bomb.sh/tab)

v0.0.19

Compare Source

Patch Changes
  • 0f2d0f3: Widen Commander peer dependency support to include Commander 14 and 15.

v0.0.18

Compare Source

Patch Changes
  • 998ab6f: prevent duplicate empty args in generated completions
bombshell-dev/clack (@​clack/prompts)

v1.7.0

Compare Source

Minor Changes
  • #​574 8f1c380 Thanks @​dreyfus92! - Add showInstructions option to select, multiselect, and groupMultiselect. Keyboard hints remain shown by default; pass showInstructions: false to hide them.
Patch Changes
CodSpeedHQ/codspeed-node (@​codspeed/vitest-plugin)

v5.7.1

Compare Source

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1

v5.7.0

Compare Source

Highlights

  • Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set CODSPEED_WALLTIME_PROFILER=samply env variable in the codspeed action.
  • Added support for tinybench v5 and v6 in @​codspeed/tinybench-plugin

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
CodSpeedHQ/action (CodSpeedHQ/action)

v4.18.5

Compare Source

Release Notes

💼 Other

Install codspeed-runner 4.18.4

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.4

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.18.4...v4.18.5

v4.18.4

Compare Source

What's Changed

Full Changelog: CodSpeedHQ/action@v4.18.3...v4.18.4

v4.18.2

Compare Source

Release Notes

🐛 Bug Fixes
⚙️ Internals

Install codspeed-runner 4.18.2

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.2

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.18.1...v4.18.2

v4.18.1

Compare Source

Release Notes

🚀 Features

Install codspeed-runner 4.18.1

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.1

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

v4.18.0

Compare Source

Release Notes

🚀 Features
🐛 Bug Fixes

Install codspeed-runner 4.18.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.0

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

eslint/eslint (eslint)

v10.7.0

Compare Source

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#​21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#​21063) (fnx)
  • 557fde8 feat: support computed Number.parseInt member access in radix rule (#​21041) (Pixel)
  • 0b4a73b feat: add suggestions to no-compare-neg-zero (#​21034) (den$)
  • 96cdd42 feat: report invalid signed numeric radix values in radix rule (#​21030) (Pixel)

Bug Fixes

  • 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#​21069) (Pixel)
  • 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#​21062) (Mahin Anowar)
  • 75ec753 fix: handle static template literals in eqeqeq rule (#​21058) (Pixel)
  • b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#​21057) (Pixel)
  • e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#​21051) (Pixel)
  • a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#​21050) (Pixel)
  • d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#​21045) (spokodev)
  • 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#​21047) (한국)
  • a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#​20958) (sethamus)
  • 8a240a7 fix: avoid false positives in radix rule for spread arguments (#​21044) (Pixel)

Documentation

  • c30d808 docs: Update README (GitHub Actions Bot)
  • 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#​20980) (Alex Bit)
  • 04174cb docs: Update README (GitHub Actions Bot)
  • 026e130 docs: update semver policy for bug fixes (#​21048) (Milos Djermanovic)
  • 9d42fef docs: Update README (GitHub Actions Bot)
  • b230159 docs: Update README (GitHub Actions Bot)
  • 0129972 docs: correct **/.js glob to **/*.js in config files guide (#​21036) (EduardF1)

Chores

v10.6.0

Compare Source

Features

  • b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#​20981) (Taejin Kim)
  • f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#​20948) (sethamus)

Bug Fixes

  • 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#​20997) (Milos Djermanovic)
  • bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#​21013) (den$)
  • 8fd8741 fix: don't report shadowed undefined in radix rule (#​21011) (Pixel)
  • 5784980 fix: don't report shadowed undefined in no-throw-literal (#​21010) (Pixel)
  • 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#​21008) (Pixel)
  • d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#​21006) (Pixel)
  • 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#​21003) (den$)
  • 63d52d2 fix: restore max-classes-per-file report range (#​21002) (Pixel)
  • 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#​20979) (fnx)
  • 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#​20995) (Milos Djermanovic)

Documentation

  • a83683d docs: Update README (GitHub Actions Bot)
  • f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#​20986) (playgirl)
  • bea49f7 docs: Update README (GitHub Actions Bot)
  • e5f70f9 docs: update code-path diagrams (#​20984) (Tanuj Kanti)
  • 8890c2d docs: add TypeScript config guidance for MCP server (#​20796) (Pierluigi Lenoci)
  • 3eb3d9b docs: Update README (GitHub Actions Bot)
  • c5bb59c docs: Update README (GitHub Actions Bot)
  • eb3c97c docs: fix grammar in prefer-const rule description (#​20983) (lumir)

Chores

gajus/eslint-plugin-jsdoc (eslint-plugin-jsdoc)

v63.0.13

Compare Source

Bug Fixes
  • failing pages build and deployment (3728347)

v63.0.12

Compare Source

v63.0.11

Compare Source

Bug Fixes
  • require-jsdoc: skip overloads to find method comment blocks; fixes #​1688 (7676b50)

v63.0.10

Compare Source

Bug Fixes
  • escape-inline-tags: allow scoped packages in declaration references (#​1705) (70e0a11)

v63.0.9

Compare Source

Bug Fixes
  • check-template-names, require-template, valid-types: keep commas inside @template default values (0980b71)

v63.0.8

Compare Source

Bug Fixes
  • check-template-names: detect template usage in @augments/@extends/@implements types (208079f)
unjs/exsolve (exsolve)

v1.1.0

Compare Source

compare changes

🚀 Enhancements
  • Sync internal with latest Node.js upstream (#​49)
🔥 Performance
  • Optimize resolver cache lookups (#​48)
🏡 Chore
❤️ Contributors
h3js/h3 (h3-next)

v2.0.1-rc.24

Compare Source

compare changes

🚀 Enhancements
  • proxy: Support client aborts (#​1417)
  • ws: Allow optional HTTP handling in defineWebSocketHandler (#​1425)
  • Export resolveDotSegments as a public path utility (#​1428)
  • readBody: Support formdata type (#​1164)
  • Add QUERY method support (#​1445)
  • Add requireContentType and appendAcceptQuery utils (#​1446)
  • Automatically match GET routes for HEAD requests (#​1452)
🩹 Fixes
  • sanitizeStatusCode: Return default for non-numeric input instead of NaN (#​1420)
  • auth: Reject Basic credentials with no colon separator (#​1393)
  • sse: Ignore pushes after stream close (#​1411)
  • proxy: Ignore incoming accept-encoding header (#​1423)
  • cache: HandleCacheHeaders ignores multi-value If-None-Match header (#​1395)
  • serve-static: Compare if-modified-since at whole-second precision (#​1394)
  • request: Parse first entry of comma-list x-forwarded-proto header (#​1413)
  • serve-static: Check the response (not request) for an existing content-length (#​1391)
  • cors: Merge Vary headers when both origin and allow-headers emit vary (#​1396)
  • writeEarlyHints: Normalize Link key to prevent hanging with Node.js (#​1385)
  • event: Return 400 for malformed percent-encoded request URLs (#​1424)
  • mount: Restore pathname on error with try/finally (#​1319)
  • serve-static: Decode the resolved id before lookup (#​1431)
  • request: Shadow parsed _url in requestWithURL proxy (d21d93c)
  • event: Clone URL for pathname normalization instead of mutating shared _url (a1cf066)
  • adapters: Sync raw node req.url with event.url in fromNodeHandler (#​1433)
  • json-rpc: Do not leak internal exception messages to clients (ea2f2a3)
  • request: Prevent decode:true from reintroducing path separators (cd03d41)
  • handleCacheHeaders: Correct conditional-request precedence and Cache-Control default (#​1454)
💅 Refactors
📖 Documentation
  • proxy: Add note about reading body (7eb018e)
  • Fix decode function name in router param helpers (#​1419)
  • session: Note secure cookie limitation over local HTTP (#​1409)
  • Document the session name option for multiple sessions (#​1405)
  • Add arkstack framework to community section (#​1382)
  • ws: Use zero-config crossws server plugin (#​1427)
  • Fix typos in response and handler guides (#​1444)
  • Add QUERY method docs (#​1447)
  • Remove non-existent sendEventStream from createEventStream example (#​1450)
🌊 Types
  • Expose .crossws on defineWebSocketHandler return type (#​1435)
🏡 Chore
✅ Tests
  • Cover zod schema query validation types (#​1404)
  • Cover cloned pipeable node responses (#​1414)
  • iron-crypto: Accept getRandomValues length error for invalid salt bits (dae12fe)
  • event: Cover shared _url normalization semantics ([4a

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from danielroe as a code owner June 29, 2026 05:39
@pkg-pr-new

pkg-pr-new Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

  • nuxt-cli-playground

    npm i https://pkg.pr.new/create-nuxt@1357

    npm i https://pkg.pr.new/nuxi@1357

    npm i https://pkg.pr.new/@nuxt/cli@1357

commit: f23cb17

@socket-security

socket-security Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/nitro@3.0.1-alpha.2 → npm/nitropack@2.13.4 → npm/@nuxt/eslint-config@1.16.0 → npm/knip@6.26.0 → npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm eslint-plugin-jsdoc is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@nuxt/eslint-config@1.16.0 → npm/@antfu/eslint-config@9.1.0 → npm/eslint-plugin-jsdoc@63.0.13

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-jsdoc@63.0.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@codspeed-hq

codspeed-hq Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Merging this PR will degrade performance by 46.82%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 1 regressed benchmark
✅ 1 untouched benchmark

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Benchmark BASE HEAD Efficiency
❌ makes requests to dev server 56 ms 105.3 ms -46.82%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

Comparing renovate/all-minor-patch (f23cb17) with main (49dd7f7)

Open in CodSpeed

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 5805d71 to d0ee4cc Compare July 5, 2026 23:31
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 8ab5221 to 2836967 Compare July 11, 2026 19:43
@socket-security

socket-security Bot commented Jul 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedtinyclip@​0.1.15711007892100
Addedvitest@​4.1.10981007999100
Added@​vitest/​coverage-v8@​4.1.10991007999100
Updatedh3@​2.0.1-rc.22 ⏵ 2.0.1-rc.2483 -1610087 +19380
Added@​types/​node@​24.13.31001008196100
Addedexsolve@​1.1.010010010085100
Addedstd-env@​4.2.0991008788100
Addedtsdown@​0.22.4981008897100
Addednypm@​0.6.810010010089100
Added@​antfu/​eslint-config@​9.1.09610010091100
Addedvue@​3.5.391001009196100
Addedvue-tsc@​3.3.71001009297100
Addedsrvx@​0.11.211001009695100
Addedknip@​6.26.0991009596100
Added@​codspeed/​vitest-plugin@​5.7.1971009896100
Addedundici@​8.7.09710010098100
Addedeslint@​10.7.09810010097100
Added@​clack/​prompts@​1.7.010010010097100
Updated@​bomb.sh/​tab@​0.0.17 ⏵ 0.0.19100100100 +198 +1100

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 2836967 to dd5845c Compare July 11, 2026 23:45
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from dd5845c to f23cb17 Compare July 12, 2026 14:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe Awaiting requested review from danielroe danielroe is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants