[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@asyncapi/parser	^3.6.3 → ^3.6.6
@evilmartians/lefthook	^2.2.1 → ^2.2.2
@vitest/ui (source)	^4.1.11 → ^4.1.12
jsdom	^30.1.2 → ^30.1.3
openapi3-ts	4.6.1 → 4.6.2
pnpm (source)	12.12.0 → 12.12.1
postcss (source)	^8.5.29 → ^8.5.30
sass	^1.105.1 → ^1.105.2
sass-embedded	^1.105.1 → ^1.105.2
tsc-alias (source)	^1.9.7 → ^1.9.8
vitest (source)	4.1.11 → 4.1.12
vue (source)	^3.5.43 → ^3.5.44

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

asyncapi/parser-js (@​asyncapi/parser)

v3.6.6

Compare Source

Patch Changes

• 6f39532: fix: allow excess protocol-specific properties on Binding interface (#​735)

v3.6.5

Compare Source

Patch Changes

• ef805c3: fix: allow payload property named message with null value (#​863)

v3.6.4

Compare Source

Patch Changes

• ca0b0df: Move @asyncapi/avro-schema-parser into the parser-js monorepo. Same public API (AvroSchemaParser() and registerSchemaParser). Published as 3.1.0 because 3.0.25 and 3.0.26 were already used on npm and cannot be republished. Remove the unused avsc dependency from @asyncapi/parser. Avro support stays in @asyncapi/avro-schema-parser.

evilmartians/lefthook (@​evilmartians/lefthook)

v2.2.2

Compare Source

• fix: cleanup only current stash hash (#​1597) by @​mrexox
• refactor: simplify mimetype matching (#​1596) by @​scop
• packaging: add support for android (#​1591) by @​mrexox

vitest-dev/vitest (@​vitest/ui)

v4.1.12

Compare Source

   🐞 Bug Fixes

• mocker: Harden manual and redirect mocks [backport to v4]  -  by @​sheremet-va in #​11580 (b8253)

    View changes on GitHub

metadevpro/openapi3-ts (openapi3-ts)

v4.6.2

Compare Source

2026.10.15

• Update build dependencies.

pnpm/pnpm (pnpm)

v12.12.1: pnpm 12.12.1

Compare Source

This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Patch Changes

• pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

• pnpm dist-tag add, rm, and ls now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.

• Added the tool: protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. pnpm add bun@tool:1.3.0, pnx node@tool:22, and pnx yarn@tool:4 work like the runtime: spelling, which stays supported as an alias. A lockfile written for runtime: stays up to date when package.json switches to tool:, and the other way around.

  A named registry can no longer be called tool.

Platinum Sponsors

Gold Sponsors

sass/dart-sass (sass)

v1.105.2

Compare Source

Node.js Embedded Host

• Fix a deadlock when the async compiler fails to start.

sass/embedded-host-node (sass-embedded)

v1.105.2

Compare Source

Node.js Embedded Host

• Fix a deadlock when the async compiler fails to start.

vuejs/core (vue)

v3.5.44

Compare Source

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #​11164) (#​15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#​15724) (d084b90), closes #​15723
• compiler-dom: correctly stringify 0 and false in v-html (#​15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#​15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#​15604) (38012a5), closes #​15602
• custom-element: skip mounting an async custom element removed while its component loads (#​15777) (0f8e7b4), closes #​15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#​15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#​15711) (92798ac), closes #​15710
• reactivity: avoid mutating native array iterators (#​15703) (7f9d45d), closes #​15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#​15782) (db00fe9), closes #​5009
• reactivity: once watcher should stop when its callback throws (#​15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#​15793) (b600466), closes #​15792
• runtime-core: detect new prop keys when comparing full props (#​15634) (702fa61), closes #​15632
• runtime-core: keep async placeholder for block patching and pending component updates (#​15554) (05ec25f), closes #​15551
• runtime-core: only flush jobs queued by the root render itself (#​15757) (0bea14b), closes #​6728
• runtime-core: render nothing for an invalid v-for range in production (#​15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#​15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#​15627) (a084e44)
• server-renderer: propagate async setup errors (#​15857) (6930374), closes #​15716
• ssr: honor falsy vnode content overrides (#​15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#​15640) (2a086a2), closes #​15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#​15818) (d3c6e02), closes #​15817
• transition-group: measure nested groups against their moving outer item (#​15848) (1936c87), closes #​5385 #​1531
• transition: handle comment-wrapped component roots (#​15853) (ff35014), closes #​6080 #​5500

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.