chore(deps): update all non-major dependencies with stable versions (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@evilmartians/lefthook	^2.1.9 → ^2.1.10
@vitejs/plugin-vue (source)	^6.0.7 → ^6.0.8
commitizen	^4.3.1 → ^4.3.2
eslint (source)	^9.39.4 → ^9.39.5
semantic-release	^25.0.5 → ^25.0.8
tsx (source)	^4.22.4 → ^4.22.5
vite (source)	^7.3.5 → ^7.3.6
vite-plugin-vue-devtools (source)	^8.1.2 → ^8.1.5
vitest (source)	^4.1.8 → ^4.1.10
vue (source)	^3.5.38 → ^3.5.40
vue-tsc (source)	^3.3.4 → ^3.3.8

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

evilmartians/lefthook (@​evilmartians/lefthook)

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features

• plugin-vue: add forced vapor mode option (#​766) (d59c3c0)

Bug Fixes

• deps: update all non-major dependencies (#​781) (d369e5a)

commitizen/cz-cli (commitizen)

v4.3.2

Compare Source

4.3.2 (2026-06-12)

• chore(deps): bump semantic-release to 25 for npm trusted publishing (#​1029) (6eb168c), closes #​1029
• ci(release): bump actions/checkout and actions/setup-node to v4 (#​1024) (f5702c4), closes #​1024
• ci(release): use npm trusted publishing via OIDC (#​1028) (096ed52), closes #​1028
• chore(deps) Update all non-major dependencies (#​1026) (4e98218), closes #​1026
• chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#​1010) (11be6a1), closes #​1010
• fix(ci): fix pipelines and update matrices to node 18/20/22 (#​1023) (48e4b8b), closes #​1023
• docs: update README.md to add contributors (#​985) (3c08866), closes #​985

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

semantic-release/semantic-release (semantic-release)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

privatenumber/tsx (tsx)

v4.22.5

Compare Source

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

vitejs/vite (vite)

v7.3.6

Compare Source

Please refer to CHANGELOG.md for details.

vuejs/devtools (vite-plugin-vue-devtools)

v8.1.5

Compare Source

No significant changes

    View changes on GitHub

v8.1.4

Compare Source

   🐞 Bug Fixes

• kit,shared: Mark packages side-effect-free for treeshaking  -  by @​danielroe in #​1108 (2b9ce)

    View changes on GitHub

v8.1.3

Compare Source

   🐞 Bug Fixes

• vite: Align module field with emitted ESM output  -  by @​itosa-kazu in #​1106 (4720c)

    View changes on GitHub

vitest-dev/vitest (vitest)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

vuejs/core (vue)

v3.5.40

Compare Source

Bug Fixes

• compiler-core: avoid leaking slot branch keys (#​15051) (20c9d26), closes #​15048
• hydration: pass namespace when patching dynamic props (#​15082) (e0d2723), closes #​15081 #​15050
• reactivity: handle effect removal during scope stop (#​15084) (378f978), closes #​15083
• runtime-core: skip lazy hydration for detached roots (#​15092) (97f3525), closes #​15091
• runtime-core: unwind dangling blocks when slot content throws (#​15071) (ddc132d), closes #​15070
• runtime-dom: respect current select model type (#​15010) (eb89e93), closes #​15009
• server-renderer: handle errors in optimized component renders (#​12601) (474907c), closes #​12575
• server-renderer: remove package dependency cycle (#​15063) (4d35eca)
• shared: prevent SSR comment escaping from creating closing delimiters (#​15045) (bd962bb)
• types: don't constrain component $el type to Element (#​15040) (164460a)

v3.5.39

Compare Source

Bug Fixes

• compiler-core: correct filter rewrite recursion (#​14959) (be7ce31)
• hydration: force patch dynamic props when hydrating (#​9083) (024cf06), closes #​9033
• hydration: respect data-allow-mismatch on conditional branches (#​12801) (164af63), closes #​12782
• reactivity: avoid triggering effects when set fails (#​14964) (e450973)
• runtime-core: handle non-isomorphic block element update (#​15002) (932ddd0), closes #​6385
• runtime-core: normalize function children for elements and Teleport (#​9108) (2f374cd), closes #​9107
• runtime-core: pause tracking when invoking function refs (#​14985) (3ac052b)
• runtime-core: preserve once event listener name (#​8341) (87b73b6), closes #​8342
• runtime-dom: preserve option modifier event names (#​8338) (4b659e6), closes #​8334
• ssr: dedupe inherited scope ids during vnode rendering (#​15005) (027da6b), closes #​12159 #​12175
• ssr: resolve nested async teleport content (#​9431) (31d0f23), closes #​6207
• teleport: handle teleport unmount edge case (#​12705) (671997a), closes #​12702
• types: support named tuple emits (#​12676) (232f402), closes #​12673
• types: validate defineModel defaults (#​14968) (747f57e), closes #​14966

vuejs/language-tools (vue-tsc)

v3.3.8

Compare Source

language-core

• feat: support vapor directives (#​6126) - Thanks to @​liangmiQwQ!

workspace

• chore: upgrade to TypeScript 7 and support @typescript/typescript6 (#​6123) - Thanks to @​WaldemarEnns!

v3.3.7

Compare Source

language-core

• fix: wrap single expression event handlers to avoid ASI after return (#​6115) - Thanks to @​KazariEX!

typescript-plugin

• fix: filter const globals from template completions

v3.3.6

Compare Source

language-core

• fix: make generic component internal context inference type-safe across .d.ts boundary (#​6104) - Thanks to @​Holiden!
• fix: do not treat non-trivial property accesses as compound - Thanks to @​KazariEX!
• fix: treat semicolon-terminated expressions as compound - Thanks to @​KazariEX!
• fix: preserve return types for compound event handlers - Thanks to @​KazariEX!
• fix: use WeakMap to cache inline TS ASTs - Thanks to @​KazariEX!
• fix: match upstream CSS v-bind parsing behavior - Thanks to @​KazariEX!
• fix: include setup bindings as potential component names (#​6111) - Thanks to @​KazariEX!
• perf: reduce boundary code feature allocations - Thanks to @​KazariEX!
• refactor: centralize code features and deprecate allCodeFeatures - Thanks to @​KazariEX!

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.