Skip to content

chore(deps): update all non-major dependencies - #75

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Closed

chore(deps): update all non-major dependencies#75
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending OpenSSF
@types/node (source) pnpm.catalog.default minor 24.13.6 → 24.19.1 OpenSSF Scorecard
hyparquet (source) pnpm.catalog.default patch 1.31.1 → 1.31.2 1.31.3 OpenSSF Scorecard
knip (source) pnpm.catalog.default minor 6.37.0 → 6.39.0 6.41.0 (+1) OpenSSF Scorecard
mermaid pnpm.catalog.default minor 12.0.0 → 12.1.0 OpenSSF Scorecard
nanoid pnpm-workspace.overrides patch 3.3.19 → 3.3.20 OpenSSF Scorecard
pnpm (source) packageManager minor 12.9.1+sha512.06b055fff5cd20dc12781de173ced3310ce0951bf2ec620211a16045d5444d5c93a663210764ef29a653a610459ba0368f0e74f84d80c54723cf95aae7bc0d6d → 12.10.0 12.10.1 OpenSSF Scorecard
portless (source) pnpm.catalog.default patch 0.15.6 → 0.15.7 OpenSSF Scorecard
postcss (source) pnpm-workspace.overrides patch 8.5.28 → 8.5.29 OpenSSF Scorecard
vega-embed pnpm.catalog.default minor 7.2.0 → 7.3.0 OpenSSF Scorecard
vitepress>vite (source) pnpm-workspace.overrides patch 8.3.0 → 8.3.3 8.3.4 OpenSSF Scorecard

Release Notes

hyparam/hyparquet (hyparquet)

v1.31.2

Compare Source

  • Coalesce column chunk reads within a row group when gaps are at most 8 KB (#​182)
  • Faster INT32 and INT64 delta binary packed decoding (#​180, #​181)
webpro-nl/knip (knip)

v6.39.0: Release 6.39.0

Compare Source

v6.38.0: Release 6.38.0

Compare Source

mermaid-js/mermaid (mermaid)

v12.1.0

Compare Source

Minor Changes

  • #​8303 9140716 Thanks @​filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

  • #​8250 fd4f5f2 Thanks @​kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current
    behaviour, and descending mirrors every row so it reads from that row's highest bit down to its
    lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram
    between the two conventions only means changing bitOrder.

Patch Changes

  • #​8330 50c9e55 Thanks @​ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

  • #​8259 4c90f5c Thanks @​afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

    participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the
    config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error,
    even though the plain form without a config object tolerates trailing whitespace just fine.

  • #​8339 c7fa1a5 Thanks @​ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

  • #​8334 d67331d Thanks @​ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

  • #​8344 99a050b Thanks @​pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

  • #​8276 3101c7d Thanks @​mir-ashiq! - fix(error): show the actual error message in the error diagram

    When a diagram fails to parse, the error diagram now draws the real error message below the
    "Syntax error in text" headline, wrapped to at most four lines. Hosts that only show the SVG
    (GitHub, GitLab, Obsidian, exported images) no longer hide what actually went wrong, e.g. that the
    flowchart edge limit was exceeded and maxEdges needs raising via mermaid.initialize.

  • #​8296 aa29345 Thanks @​pentaoa! - fix: preserve explicit source relations on event modeling reset frames

  • #​8297 967bbde Thanks @​pentaoa! - fix: reject duplicate event modeling frame IDs before rendering

  • #​8337 147f343 Thanks @​knsv-bot! - fix: a flowchart that declares the same subgraph id more than once now renders as one merged subgraph with the ELK layout instead of producing NaN geometry. Classes and view: collapsed set on a repeated subgraph now apply to it, whichever declaration they follow.

  • #​8203 40ef7b4 Thanks @​MFA-G! - perf(frontmatter): replace the quadratic front matter regex on hot paths

    frontMatterRegex backtracks polynomially on whitespace-heavy input, so a
    diagram well inside the default maxTextSize could stall parsing for over a
    second. detectType and extractFrontMatter now use a linear scanner that
    matches the regex result exactly, leaving no document stripped differently.

  • #​8254 351d7d2 Thanks @​galshir! - fix: warn when a gantt task references an unknown after/until task id, or when its end value is neither a valid date nor a valid duration

  • #​8249 b657a2c Thanks @​mir-ashiq! - fix(sequence): allow hyphenated actor and participant names when a config object is attached

  • #​8300 c38a565 Thanks @​filipsajdak! - fix: A partial override of an object-valued theme variable such as xyChart, radar or cynefin keeps the values the theme generates for the keys it leaves out

  • #​8333 8afd83c Thanks @​ashishjain0512! - fix: upgrade the parser to langium 4.4 / chevrotain 13 so bundles no longer include lodash-es@4.17.23

  • #​8285 859f1f8 Thanks @​mir-ashiq! - fix(sequence): allow actor-menu keywords as participant ids in messages

    A participant declared as Link (or Links, Properties, Details) could not be used as a
    message endpoint: the lexer matched the name as the link statement keyword and the parse failed.
    The link, links, properties and details keywords are now only recognized when an actor
    follows them on the same line, so participant ids that happen to spell these words work in
    messages, while the statements themselves keep parsing as before.

  • #​8282 b6d952d Thanks @​belomaxorka! - fix(sequence): allow Link as a participant ID in messages and actor menus

    Preserve the ID's case and alias while keeping the link and links menu commands supported.

  • #​8345 7917c1a Thanks @​knsv-bot! - fix: xychart measures text in SVG units so legends no longer clip on wide charts scaled to fit their container, and the chart title is dropped instead of overflowing when the chart is too short for it

  • #​8338 4a722fb Thanks @​ashishjain0512! - fix: Centre the xychart title over the plot area instead of the whole chart

  • Updated dependencies [8afd83c]:

ai/nanoid (nanoid)

v3.3.20

Compare Source

pnpm/pnpm (pnpm)

v12.10.0: pnpm 12.10.0

Compare Source

This release adds an experimental loaded node linker, lets pnpm-lock.yaml record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store.

Minor Changes

  • Added experimental nodeLinker: { type: loaded } installation. Compatible dependencies load directly from the content-addressable store through an automatically registered Node.js loader. nodeLinker.excluded selects packages and their dependency trees to install in the global virtual store.

  • lockfile.includeResolutionSettings: true makes pnpm-lock.yaml record autoDedupe, dedupeInjectedDeps, dedupePeerDependents and linkWorkspacePackages. Installs then treat a lockfile that records other values as outdated. A lockfile that records autoDedupe is reused by later installs on any machine, so pnpm run after pnpm install --frozen-lockfile no longer starts another install #​16583.

Patch Changes
Security

  • pnpm install now prevents dependency versions with path traversal from writing files outside the global virtual store.

  • pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with version+integrity.

  • Lockfile verification now checks the tarballs inside a variations resolution against the registry. A name@version lockfile entry with an empty variations resolution is now rejected.

  • pnpm audit signatures now verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification.

  • pnpm install and pnpm publish now reject archive metadata larger than 64 MiB before reading it into memory. Publishing a pre-built tarball also rejects manifests and README files larger than 64 MiB.

  • Two URL or local path dependencies no longer share a virtual store directory when one URL has +, #, :, or ? where the other has /. Such dependencies, including git dependencies pinned with #, now get a hash suffix on their directory name.

  • The warning about an ignored project .npmrc registry setting no longer prints the username and password of a URL-scoped key such as //user:password@registry.example.com/${PATH}/:_authToken.

Installing and resolving dependencies

  • pnpm install now fails with ERR_PNPM_UNSUPPORTED_PROTOCOL when a dependency uses a specifier with a protocol pnpm does not support, such as Yarn's patch:. On Windows, such a specifier failed with os error 123. On other platforms, pnpm linked it to a directory that does not exist. Reading a package.json that fails now names the file #​16590.

  • pnpm install now fails with ERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTE when a project declares a dependency whose specifier is not a string, such as "is-positive": 42. Before, the dependency was silently left out of the lockfile. A readPackage hook can still correct the specifier.

  • Fixed pnpm install failing with ERR_PNPM_CMD_SHIM_RESOLVE_PATH when an executable's parent directory contains a dangling symlink.

  • pnpm install --frozen-lockfile no longer fails with ERR_PNPM_RESOLUTION_SHAPE_MISMATCH when a name@version lockfile entry has a resolution served by a custom fetcher pnpm/tasks#108.

  • pnpm install --fix-lockfile repairs a lockfile whose importer references a package that has no snapshot entry, as left by a badly merged lockfile. It failed with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY since 12.8.0 #​16618.

  • When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before, pnpm install and pnpm dedupe kept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies of vue pnpm/tasks#61.

  • pnpm dedupe now reads registry metadata for a dependency pinned to an exact version, as pnpm install does. If the registry metadata disagreed with the package's package.json, the lockfile it wrote depended on whether minimumReleaseAge was set #​16615.

Speed and size

  • Dependency resolution reads cached registry metadata faster. The metadata cache moved to <cache-dir>/v12/, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when --offline is set. pnpm cache prune also removes the metadata cache that older pnpm versions wrote under <cache-dir>/v11/ #​13512.

  • Package metadata requests no longer wait behind queued tarball downloads when maxSockets or a proxy limits the connections to a registry. Large installs resolve faster and print fewer Request took warnings.

  • Sped up installs in large workspaces on macOS when the dependency links already exist. pnpm now keeps a link that already points at the right package without trying to create it first. Relinking the direct dependencies of 1,000 workspace projects took 45 ms, down from 116 ms pnpm/tasks#65.

  • Commands in a project that pins a different pnpm version start about 13 ms faster on macOS. pnpm now runs the pinned version's binary directly, without the shell script in front of it pnpm/tasks#66.

  • The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is about 1 MB smaller still.

Running scripts and commands

  • pnpm run no longer prints [ELIFECYCLE] Command failed ... after Ctrl+C ends the script. pnpm still exits the way the script's shell did: on Windows with the shell's exit code (cmd reports -1073741510, PowerShell 1), on Unix by re-raising SIGINT #​16579.

  • pnpm run "/<regex>/" now accepts JavaScript regular expression syntax such as lookahead and lookbehind. A selector like "/^hello:(?!b).*$/" failed with ERR_PNPM_NO_SCRIPT #​16604.

  • pnpm run and pnpm exec now forward --config.* command-line flags to the install started by verifyDepsBeforeRun pnpm/tasks#60.

  • On Windows, a process started by pnpm run or pnpm exec can again start a child with CREATE_BREAKAWAY_FROM_JOB. That child keeps running after pnpm exits, even if the command fails #​16628.

  • Empty nodeOptions values from command-line flags and environment variables now override lower-priority settings. Scripts retain NODE_OPTIONS from the parent environment or extraEnv when nodeOptions is empty.

  • pnpm now reads the failIfNoMatch setting from pnpm-workspace.yaml, so a filter that matches no workspace project exits with code 1 when the setting is true. The new --no-fail-if-no-match flag turns the setting off for one command #​16577.

Configuration, setup, and pnpm versions

  • pnpm config get --global and pnpm config list --global now show only the global configuration, also when run inside a project. Settings from the project's pnpm-workspace.yaml and .npmrc were included before. The same applies to --location=global #​16598.

  • pnpm now prints config warnings, such as an unset environment variable in .npmrc, when loading the config fails.

  • pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the packageManager field pins it. Since 12.9.0 they failed with SyntaxError: Invalid or unexpected token #​16594.

  • On Windows, pnpm self-update no longer runs the update a second time when it replaces a pnpm.cmd linked by pnpm 12.8 or older. cmd.exe read on in the replaced pnpm.cmd, printed an error about a command that is not recognized, and ran the new pnpm once more #​16573.

  • pnpm setup now puts $PNPM_HOME/bin first on PATH in login shells that inherited it further down, such as the VS Code terminal on macOS. Before, another node took precedence over the one installed by pnpm runtime set node -g. Run pnpm setup again to update the block in your shell config #​16635.

  • pnpm setup now names the shell config file even if it is already up to date #​16608.

Updating, auditing, and publishing

  • pnpm update --latest now applies the savePrefix setting when it rewrites a dependency whose range has no operator of its own, such as <2.0.0.

  • The interactive pnpm audit --fix picker now shows each patched version with the saveExact and savePrefix style that the override is written with #​13209.

  • pnpm unpublish <pkg>@<version> now deletes the tarball under the registry's path when the registry is served under one, such as Gitea's npm registry. It used to send the delete to the host root and report success without removing the version #​16568. It also no longer mistakes a sibling path such as /npm-mirror/ for the registry path /npm/ pnpm/tasks#94.

Output and messages

  • A warning about a project's devEngines or packageManager pin is now printed to stderr. A command such as pnpm cache path or pnpm list --json keeps only its own output on stdout #​16584.

  • pnpm list now reports the correct package paths when nodeLinker is hoisted #​9593.

  • Resolution errors now name the failing dependency and its parent packages. Fatal errors appear as structured error records with their error codes when using --reporter=ndjson.

  • The error for an invalid git repository in the lockfile now has the code ERR_PNPM_INVALID_GIT_REPOSITORY. Its message now lists every rejected form of the value.

  • pnpm runtime --help and pnpm help runtime now name the set subcommand and the runtimes it accepts #​16580.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude
vercel-labs/portless (portless)

v0.15.7

Compare Source

New Features
  • Turbo JSONC workspaces: Workspaces that only have turbo.jsonc now use Turbo orchestration, the same as turbo.json. (#​422)
  • Unresolved hostname warning: After registering a route, portless asks the proxy to sync the hosts file and warns when the hostname still does not resolve. (#​374)
  • WebMCP documentation site: The docs moved to Geistdocs and expose their pages to agents through WebMCP. (#​427)
Bug Fixes
  • Hosts sync data loss: Manual hosts sync refuses to write when the hosts file cannot be read, verifies what it wrote, and removes stale managed entries when no routes remain. (#​424)
  • Local CA certificate: The generated CA no longer carries a duplicate Basic Constraints extension on OpenSSL 1.1.1 and LibreSSL, which macOS and OpenSSL 3 rejected and left *.localhost untrusted. (#​443)
  • Proxy crash on backend restart: The proxy no longer forwards client hop-by-hop headers, which left backend sockets open and crashed the proxy with ECONNRESET when a backend restarted. (#​445)
  • Wildcard fallback order: With --wildcard, an unregistered subdomain now routes to the most specific registered parent instead of the first one stored. (#​446)
  • Occupied app ports: Free app ports are checked on 127.0.0.1, ::1, 0.0.0.0 and ::, so portless no longer assigns a port another server already holds. (#​447)
  • Version manager node: Child commands now use the node a version manager put first on PATH; portless's own node directory is only a fallback. (#​448)
Contributors
postcss/postcss (postcss)

v8.5.29

Compare Source

vega/vega-embed (vega-embed)

v7.3.0

Compare Source

Bug Fixes
vitejs/vite (vitepress>vite)

v8.3.3

Compare Source

Bug Fixes

v8.3.2

Compare Source

Bug Fixes
Performance Improvements
Documentation
  • fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)
Miscellaneous Chores
Code Refactoring
Tests
  • bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

v8.3.1

Compare Source

Bug Fixes
Miscellaneous Chores
Code Refactoring

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Error: ERR_PNPM_NO_MATURE_MATCHING_VERSION

  × installing dependencies
  ╰─▶ 8 versions do not meet the minimumReleaseAge constraint:
        @mermaid-js/parser@2.0.1 was published at 2026-10-02T11:06:38.186Z,
      within the minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
        knip@6.39.0 was published at 2026-09-30T12:46:34.940Z, within the
      minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
        mermaid@12.1.0 was published at 2026-10-02T11:14:26.341Z, within the
      minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
        nanoid@3.3.20 was published at 2026-10-05T09:44:40.679Z, within the
      minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
        portless@0.15.7 was published at 2026-10-02T06:15:32.048Z, within the
      minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
        postcss@8.5.29 was published at 2026-10-05T09:28:55.780Z, within the
      minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
        source-map-js@1.2.2 was published at 2026-09-30T14:08:09.382Z, within
      the minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
        vite@8.3.3 was published at 2026-10-06T04:10:19.326Z, within the
      minimumReleaseAge cutoff (2026-09-25T10:24:07.699Z)
  help: Run the install interactively to approve these picks, add them to
        minimumReleaseAgeExclude in pnpm-workspace.yaml, or wait for the
        packages to mature.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from f10e108 to 3ed160d Compare October 6, 2026 05:39
@peter-gy peter-gy mentioned this pull request Oct 7, 2026
Merged
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 98958d9 to 595351f Compare October 7, 2026 11:01
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 595351f to 16bc3ec Compare October 9, 2026 10:24
@peter-gy peter-gy mentioned this pull request Oct 9, 2026
Merged
peter-gy added a commit that referenced this pull request Oct 9, 2026
@peter-gy
chore: reconcile dependency updates with workspace constraints (#87)
4b3d6ed 
Reconcile #83 and #75 against the current dependency graph and the
repository's release-age policy. Both bot PRs currently fail during
frozen installation, before their substantive checks run.

- Update Knip from 6.37.0 to the mature 6.38.0 release and regenerate
`pnpm-lock.yaml` with the declared pnpm version, preserving
`pnpmfileChecksum` and package-manager records.
- Keep `@babel/parser` on 7.29.9 and constrain Renovate to `<8`: the
installed Vue 3.5.43 compiler packages declare `^7.29.8`. Forcing parser
8 through a global override is outside their supported dependency range.
Revisit this constraint when the Vue compilers support Babel 8.
- Add npm PR guidance and a contributor workflow for repairing lockfiles
generated without the workspace packing hook, checking frozen
installation, and respecting the cooldown.
@peter-gy

peter-gy commented Oct 9, 2026

Copy link
Copy Markdown
Collaborator

Addressed by the merged replacement PR #87: #87. The replacement updates Knip to the mature 6.38.0 release, includes its regenerated and frozen-install-verified lockfile, and adds dependency-update guidance to future npm PRs. Newer proposed releases remain deferred under the existing 14-day cooldown. Full make check and CI passed before the replacement was squash-merged into main.

@peter-gy peter-gy closed this Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@peter-gy