fix(deps): update all non-major dependencies with stable versions (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/types (source)	^7.29.0 → ^7.29.7
@commitlint/cli (source)	^21.0.1 → ^21.0.2
@commitlint/config-conventional (source)	^21.0.1 → ^21.0.2
@evilmartians/lefthook	^2.1.6 → ^2.1.10
@vitejs/plugin-vue (source)	^6.0.6 → ^6.0.8
@vitest/ui (source)	^4.1.6 → ^4.1.10
@vue/test-utils	^2.4.10 → ^2.4.11
autoprefixer	^10.5.0 → ^10.5.4
commitizen	^4.3.1 → ^4.3.2
markdown-it-anchor	^9.2.0 → ^9.2.1
markdown-it-attrs	^4.3.1 → ^4.3.2
markdown-it-deflist	^3.0.0 → ^3.0.1
semantic-release	^25.0.3 → ^25.0.8
uuid	^14.0.0 → ^14.0.1
vite-plugin-vue-devtools (source)	^8.1.1 → ^8.1.5
vitest (source)	^4.1.6 → ^4.1.10
vue (source)	^3.5.34 → ^3.5.40

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

babel/babel (@​babel/types)

v7.29.7

Compare Source

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

conventional-changelog/commitlint (@​commitlint/cli)

v21.0.2

Compare Source

Bug Fixes

• disallow same commit hash for --from and --to (#​4773) (121005e)

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.0.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

evilmartians/lefthook (@​evilmartians/lefthook)

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

v2.1.9

Compare Source

• fix: update hooks path after resetting (#​1431) by @​mrexox
• deps: May 2026 (#​1415) by @​mrexox

v2.1.8

Compare Source

• fix: do not warn if local hooks path is equal to default hooks path (#​1421) by @​mrexox

v2.1.7

Compare Source

• fix: use contrast colors (#​1420) by @​mrexox
• fix: apply stage_fixed only if it is safe (#​1418) by @​mrexox
• fix: try to always restore unstaged changes (#​1417) by @​mrexox
• fix: always restore unstaged changes (#​1416) by @​mrexox
• refactor: add new logger without a global state (#​1385) by @​mrexox
• fix: linter, sacrifice optimization for readability by @​mrexox
• fix: separate fallback push branch from pathspecs (#​1396) by @​lawrence3699

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features

• plugin-vue: add forced vapor mode option (#​766) (d59c3c0)

Bug Fixes

• deps: update all non-major dependencies (#​781) (d369e5a)

v6.0.7

Features

• use carets for @rolldown/pluginutils version (#​776) (941b651)

Bug Fixes

• deps: update all non-major dependencies (#​762) (9e825b8)
• deps: update all non-major dependencies (#​774) (77dc8bc)

vitest-dev/vitest (@​vitest/ui)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

v4.1.9

Compare Source

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

vuejs/test-utils (@​vue/test-utils)

v2.4.11

Compare Source

compare changes

🩹 Fixes

• Drop legacy Mutation Event listener entries (#​2844)
• Handle setData() correctly for components using both setup() and data() (#​2846)
• Export GlobalMountOptions type (#​2851)
• Set spec-compliant event.code on keydown/keyup (#​2850)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Renato de Leão (@​renatodeleao)
• Matt Van Horn (@​mvanhorn)
• Carsten Brachem (@​cbrachem)
• Ahmad Hanan (@​AhmadHannan037)
• Paul Cochrane (@​paultcochrane)
• Arpit Jain (@​arpitjain099)

postcss/autoprefixer (autoprefixer)

v10.5.4

Compare Source

• Fixed prefixed rule duplication (by @​xianjianlf2).

v10.5.3

Compare Source

• Fixed brackets and gradient parser (@​alanturing881).

v10.5.2

Compare Source

• Moved -webkit-fill-available before -moz-available, so Firefox
  will use -webkit- version which is closer to stretch.

v10.5.1

Compare Source

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

commitizen/cz-cli (commitizen)

v4.3.2

Compare Source

4.3.2 (2026-06-12)

• chore(deps): bump semantic-release to 25 for npm trusted publishing (#​1029) (6eb168c), closes #​1029
• ci(release): bump actions/checkout and actions/setup-node to v4 (#​1024) (f5702c4), closes #​1024
• ci(release): use npm trusted publishing via OIDC (#​1028) (096ed52), closes #​1028
• chore(deps) Update all non-major dependencies (#​1026) (4e98218), closes #​1026
• chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#​1010) (11be6a1), closes #​1010
• fix(ci): fix pipelines and update matrices to node 18/20/22 (#​1023) (48e4b8b), closes #​1023
• docs: update README.md to add contributors (#​985) (3c08866), closes #​985

valeriangalliat/markdown-it-anchor (markdown-it-anchor)

v9.2.1

Compare Source

• Preserve level of inline token in headerLink. ([#​138])

arve0/markdown-it-attrs (markdown-it-attrs)

v4.3.2

Compare Source

What's Changed

• fix: handle null meta on tbody_open for headerless tables (issue #​161) by @​Copilot in #​167

New Contributors

• @​Copilot made their first contribution in #​167

Full Changelog: arve0/markdown-it-attrs@v4.3.1...v4.3.2

markdown-it/markdown-it-deflist (markdown-it-deflist)

v3.0.1

Compare Source

• Correct lazy paragraph continuations, #​11.

semantic-release/semantic-release (semantic-release)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

v25.0.5

Compare Source

Bug Fixes

• revert: next (#​4200) (db8ffaa)

v25.0.4

Compare Source

Bug Fixes

• code-quality: add missing comma in context object for consistency (493d6cd)

uuidjs/uuid (uuid)

v14.0.1

Compare Source

Bug Fixes

• add types condition to node export for moduleResolution bundler (#​961) (27ffae5)

vuejs/devtools (vite-plugin-vue-devtools)

v8.1.5

Compare Source

No significant changes

    View changes on GitHub

v8.1.4

Compare Source

   🐞 Bug Fixes

• kit,shared: Mark packages side-effect-free for treeshaking  -  by @​danielroe in #​1108 (2b9ce)

    View changes on GitHub

v8.1.3

Compare Source

   🐞 Bug Fixes

• vite: Align module field with emitted ESM output  -  by @​itosa-kazu in #​1106 (4720c)

    View changes on GitHub

vuejs/core (vue)

v3.5.40

Compare Source

Bug Fixes

• compiler-core: avoid leaking slot branch keys (#​15051) (20c9d26), closes #​15048
• hydration: pass namespace when patching dynamic props (#​15082) (e0d2723), closes #​15081 #​15050
• reactivity: handle effect removal during scope stop (#​15084) (378f978), closes #​15083
• runtime-core: skip lazy hydration for detached roots (#​15092) (97f3525), closes #​15091
• runtime-core: unwind dangling blocks when slot content throws (#​15071) (ddc132d), closes #​15070
• runtime-dom: respect current select model type (#​15010) (eb89e93), closes #​15009
• server-renderer: handle errors in optimized component renders (#​12601) (474907c), closes #​12575
• server-renderer: remove package dependency cycle (#​15063) (4d35eca)
• shared: prevent SSR comment escaping from creating closing delimiters (#​15045) (bd962bb)
• types: don't constrain component $el type to Element (#​15040) (164460a)

v3.5.39

Compare Source

Bug Fixes

• compiler-core: correct filter rewrite recursion (#​14959) (be7ce31)
• hydration: force patch dynamic props when hydrating (#​9083) (024cf06), closes #​9033
• hydration: respect data-allow-mismatch on conditional branches (#​12801) (164af63), closes #​12782
• reactivity: avoid triggering effects when set fails (#​14964) (e450973)
• runtime-core: handle non-isomorphic block element update (#​15002) (932ddd0), closes #​6385
• runtime-core: normalize function children for elements and Teleport (#​9108) (2f374cd), closes #​9107
• runtime-core: pause tracking when invoking function refs (#​14985) (3ac052b)
• runtime-core: preserve once event listener name (#​8341) (87b73b6), closes #​8342
• runtime-dom: preserve option modifier event names (#​8338) (4b659e6), closes #​8334
• ssr: dedupe inherited scope ids during vnode rendering (#​15005) (027da6b), closes #​12159 #​12175
• ssr: resolve nested async teleport content (#​9431) (31d0f23), closes #​6207
• teleport: handle teleport unmount edge case (#​12705) (671997a), closes #​12702
• types: support named tuple emits (#​12676) (232f402), closes #​12673
• types: validate defineModel defaults (#​14968) (747f57e), closes #​14966

v3.5.38

Compare Source

v3.5.37

Compare Source

v3.5.36

Compare Source

Bug Fixes

• compiler-core: avoid crash on CDATA at the document root (#​14916) (0ea17e2)
• compiler-core: prefix dynamic keys on v-memo elements (#​14922) (68e978e), closes #​14920
• compiler-sfc: handle vue-ignore on leading intersection/union type (#​14950) (0dcd225), closes #​12254
• compiler-sfc: respect var hoisting in props destructure (48ad452)
• reactivity: preserve watch callback return value when wrapped for once: true (#​14902) (450a8a8)
• runtime-core: add dev warning for silent catch in compat mode and fix test description typo (#​14891) (db3e117)
• runtime-core: force model update when reverted before sync (#​14897) (7f76378), closes #​13524
• runtime-core: skip async component callbacks after unmount (#​14911) (5300ead)
• transition: avoid move transition for hidden v-show group children (#​14895) (c11f6ee), closes #​14894
• watch: trigger immediate callback for empty sources (#​14914) (1f2ca7e), closes #​14898

v3.5.35

Compare Source

Bug Fixes

• compiler-core: avoid double processing v-for keys with v-memo (#​14861) (34a0ded), closes #​14859
• compiler-sfc: resolve top-level exports from files registered as global types (#​14805) (3d077f2), closes nuxt/nuxt#33694
• runtime-core: avoid repeated hydration mismatch checks (#​14857) (170fc95), closes #​14855
• runtime-core: skip idle persisted transition hooks in keep-alive moves (#​14865) (80fc139), closes #​14031
• server-renderer: propagate sync errors from ssrRenderSuspense (#​14804) (4760997), closes nuxt/nuxt#28162
• teleport: skip child unmount when pending mount discarded (#​14876) (#​14877) (584beb1)

Performance Improvements

• reactivity: skip type checks for cached proxies (#​14860) (5734fe9)
• runtime-dom: optimize array event handler dispatch (#​14828) (bb18dc8)
• server-renderer: avoid materializing iterables in ssrRenderList (#​14821) (1b7a2cc)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 122, reused 0, downloaded 0, added 0
 ERR_PNPM_TRUST_DOWNGRADE  High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)

This error happened while installing the dependencies of sass@1.99.0

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had provenance attestation, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.