Skip to content

⬆️ deps: Update dependencies (non-major) - #90

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dependencies-(non-major)
Open

⬆️ deps: Update dependencies (non-major)#90
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dependencies-(non-major)

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@astrojs/markdown-remark (source) 7.3.1 → 7.3.2 age confidence dependencies patch
@astrojs/mdx (source) 8.0.2 → 8.0.3 age confidence dependencies patch
@astrojs/react (source) 7.0.0 → 7.0.1 age confidence dependencies patch
@lucide/astro (source) 1.51.0 → 1.55.0 age confidence dependencies minor
caniuse-lite 1.0.30001814 → 1.0.30001815 age confidence dependencies patch
j178/prek-action v3.0.0 → v3.0.1 age confidence action patch
oxlint (source) 1.86.0 → 1.87.0 age confidence devDependencies minor
pnpm (source) 11.28.4 → 11.28.5 age confidence packageManager patch
satori ^0.35.0 → ^0.47.0 age confidence dependencies minor 0.52.0 (+6)
vite (source) 1.0.0 → 1.1.0 age confidence pnpm.catalog.default minor
vite-plus (source) 1.0.0 → 1.1.0 age confidence pnpm.catalog.default minor
wrangler (source) 4.147.0 → 4.149.0 age confidence devDependencies minor

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

withastro/astro (@​astrojs/markdown-remark)

v7.3.2

Compare Source

Patch Changes
withastro/astro (@​astrojs/mdx)

v8.0.3

Compare Source

Patch Changes
withastro/astro (@​astrojs/react)

v7.0.1

Compare Source

Patch Changes
lucide-icons/lucide (@​lucide/astro)

v1.55.0: Version 1.55.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

v1.54.0: Version 1.54.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

v1.53.0: Version 1.53.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.52.0...1.53.0

v1.52.0: Version 1.52.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.51.0...1.52.0

browserslist/caniuse-lite (caniuse-lite)

v1.0.30001815

Compare Source

j178/prek-action (j178/prek-action)

v3.0.1

Compare Source

What's Changed

Full Changelog: j178/prek-action@v3.0.0...v3.0.1

oxc-project/oxc (oxlint)

v1.87.0: oxlint v1.87.0

Compare Source

🚀 Features
  • 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#​27292) (Mikhail Baev)
  • cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#​27245) (Mikhail Baev)
  • 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#​27181) (Mikhail Baev)
🐛 Bug Fixes
  • 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#​27302) (sama Pyb)
  • 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#​27306) (sama Pyb)
  • 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#​27304) (sama Pyb)
  • 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#​27207) (breken)
  • e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#​27206) (breken)
  • 3d61a59 parser: Validate TypeScript type member separators (#​27222) (camc314)
  • f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#​27150) (camc314)
  • 7d60ae3 linter/valid-title: Continue checks after allowed words (#​27146) (Cameron)
  • ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#​26925) (camc314)
pnpm/pnpm (pnpm)

v11.28.5: pnpm 11.28.5

Compare Source

This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.

Patch Changes
Security

  • pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with version+integrity.

  • Lockfile verification now checks the tarballs inside a variations resolution against the registry. A name@version lockfile entry with an empty variations resolution is now rejected.

  • pnpm audit signatures now verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification.

  • pnpm now rejects a git dependency whose lockfile repository is empty, begins with -, or contains a null byte. Git can no longer read such a value as a command-line option pnpm/tasks#84.

  • A git dependency with a #path: subpath can no longer reach files outside the repository through a symlink in the subpath.

  • pnpm pack, pnpm publish, and installs of git and local directory dependencies now leave out files that a directory symlink or a bundleDependencies entry points to outside the package directory pnpm/tasks#83 pnpm/tasks#93.

  • pnpm deploy with deployAllFiles now rejects symlinks that point outside the package directory. Local package installs with this setting apply the same check.

  • pnpm no longer hangs on a package archive with a negative PAX record length or an entry of 4 GiB or more pnpm/tasks#78 pnpm/tasks#79.

  • Large package downloads and large files inside gzip and bzip2 package archives now use bounded memory during installation. Package manifests and archive metadata larger than 64 MiB are rejected. pnpm publish also rejects manifests and README files larger than 64 MiB in pre-built tarballs before reading them into memory.

  • Two URL or local path dependencies no longer share a virtual store directory when one URL has +, #, :, or ? where the other has /. Such dependencies, including git dependencies pinned with #, now get a hash suffix on their directory name.

  • pnpm licenses now removes terminal control characters from package metadata in table output.

  • The warnings about ignored project .npmrc registry and auth settings no longer print the username and password of a URL-scoped key such as //user:password@registry.example.com/:_authToken.

Installing and resolving dependencies

  • Dependency resolution reads cached registry metadata faster. The metadata cache moved to <cache-dir>/v12/, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when --offline is set #​13512.

  • pnpm install now fails with ERR_PNPM_UNSUPPORTED_PROTOCOL when a dependency uses a specifier with a protocol pnpm does not support, such as Yarn's patch:. pnpm linked such a dependency to a directory that does not exist #​16590.

  • When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before, pnpm install and pnpm dedupe kept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies of vue pnpm/tasks#61.

  • pnpm add and pnpm install now keep the peer dependencies that pnpm-lock.yaml records for a package they did not update. A registry whose metadata disagrees with the package's package.json, for example by omitting peerDependenciesMeta, made pnpm add and pnpm dedupe write different lockfiles, so pnpm dedupe --check failed after pnpm add #​16615.

Configuration

  • pnpm config get and pnpm config list with --global or --location=global now show only the global configuration. Both flags included the project's .npmrc before. --location=global also included the project's pnpm-workspace.yaml. pnpm config get --global failed when the global bin directory was not in PATH #​16598.

  • pnpm now prints config warnings, such as an unset environment variable in .npmrc, when loading the config fails.

  • pnpm now fails when httpProxy or httpsProxy in pnpm-workspace.yaml or the global configuration is not a string.

  • pnpm dlx now uses the release entry of nodeDownloadMirrors from the workspace configuration when downloading Node.js runtimes #​11281. Mirrors for other channels, such as rc and nightly, still apply only from the global configuration.

Commands

  • pnpm run and pnpm exec now forward --config.* command-line flags to the install started by verifyDepsBeforeRun pnpm/tasks#60.

  • pnpm dlx with --package but no command now fails with 'pnpm dlx' requires a command to run. Before, it installed the package and then crashed trying to run an empty command.

  • pnpm unpublish <pkg>@<version> now deletes the tarball under the registry's path when the registry is served under one, such as Gitea's npm registry. It used to send the delete to the host root and report success without removing the version #​16568. It also no longer mistakes a sibling path such as /npm-mirror/ for the registry path /npm/ pnpm/tasks#94.

  • The interactive pnpm audit --fix picker now shows each patched version with the saveExact and savePrefix style that the override is written with #​13209.

  • pnpm list now reports the correct package paths when nodeLinker is hoisted #​9593.

  • pnpm setup now puts $PNPM_HOME/bin first on PATH in login shells that inherited it further down, such as the VS Code terminal on macOS. Before, another node took precedence over the one installed by pnpm runtime set node -g. Run pnpm setup again to update the block in your shell config #​16635.

  • pnpm setup now names the shell config file even if it is already up to date #​16608.

Output and messages

  • A warning about a project's devEngines or packageManager pin is now printed to stderr. A command such as pnpm cache path or pnpm list --json keeps only its own output on stdout #​16584.

  • The warning for a non-root resolutions field now points at the overrides field in pnpm-workspace.yaml #​11757.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude
vercel/satori (satori)

v0.47.1

Compare Source

Bug Fixes
  • Align text by its baseline (#​873) (2bace17)
  • Clamp the lines of vertical -webkit-box elements like browsers (#​875) (680bbe4)
  • Move tabs to the tab stops of their line (#​876) (e441832)
  • Only keep a character before an ellipsis at the start of a line (#​874) (ca93f94)
  • Show the background through transparent stops of radial gradients (#​872) (b480215)

v0.47.0

Compare Source

Features

v0.46.0

Compare Source

Features

v0.45.0

Compare Source

Features

v0.44.3

Compare Source

Bug Fixes
  • Report the boxes of inline elements to onNodeDetected (#​865) (f1fab0e)

v0.44.2

Compare Source

Bug Fixes

v0.44.1

Compare Source

Bug Fixes
  • Dash rounded borders around their corners like Chrome (#​862) (10386b7)
  • Don't wrap the content of inline blocks around outer floats (#​863) (6cd3ca6)

v0.44.0

Compare Source

Features
  • Draw list markers, and support listStyle and counters (#​859) (21fabc4)

v0.43.0

Compare Source

Features
  • Support position: sticky, wordSpacing, translate, rotate, scale and the grid shorthands (#​858) (573f007)

v0.42.0

Compare Source

Features
  • Convert CSS Color 4 and 5 colors, and interpolate gradients in color spaces (#​857) (6843297)

v0.41.0

Compare Source

Features
  • Support all overflow values, overflowX, overflowY and overflowClipMargin (#​854) (a7e9338)

v0.40.0

Compare Source

Features

v0.39.0

Compare Source

Features
  • Support aspectRatio, order, visibility, outline, place-* and all border styles (#​852) (c2545da)

v0.38.2

Compare Source

Bug Fixes
  • Filter groups, conic gradients, math functions and lenient styles (#​851) (43c54d4)

v0.38.1

Compare Source

Performance Improvements

v0.38.0

Compare Source

Features
  • Apply opacity as a group and fix CSS rendering bugs (#​846) (3b84a9e)

v0.37.1

Compare Source

Bug Fixes

v0.37.0

Compare Source

Features
  • Support mix-blend-mode, isolation, paint-order and WebKit text properties (#​842) (2f6bbdf)

v0.36.0

Compare Source

Features

v0.35.2

Compare Source

Bug Fixes

v0.35.1

Compare Source

Bug Fixes
voidzero-dev/vite-plus (vite)

v1.1.0: vite-plus v1.1.0: faster vp dev startup and clearer interactive prompts

Compare Source

Vite+ 1.1 starts vp dev faster and makes the interactive prompts clearer, alongside fixes for vp migrate, package-manager commands, and Windows terminals.

Highlights
  • vp dev reaches its local URL about 24% sooner and uses about 30% less memory in the parent process, because Vite+ no longer loads Vite and Vitest there before starting the dev server (#​2851), by @​camc314.
  • Interactive prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions (#​2870), by @​cpojer.
Features
  • vp run sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn, so tools such as npm-run-all2 use the project's package manager instead of falling back to npm (#​2895), by @​naokihaba and @​tarikermis.
  • Upgrade vite@8.3.1 to vite@8.3.3, rolldown@1.2.11 to rolldown@1.2.12, vitest@5.0.1 to vitest@5.0.3, oxlint@1.85.0 to oxlint@1.87.0, and oxfmt@0.70.0 to oxfmt@0.72.0. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check. vp migrate now keeps the React Refresh allowCompoundComponents option because the bundled Oxlint supports it (#​2871, #​2896, #​2904), by @​voidzero-guard[bot].
Fixes & Enhancements
  • vp migrate keeps Oxlint rules written with plugin aliases (such as @typescript-eslint/*, react-hooks/*, and import-x/*) and removes rules the bundled Oxlint does not support, listing them in a warning (#​2820, #​2906), by @​TheAlexLichter and @​yusuke99.
  • vp migrate leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one (#​2817), by @​TheAlexLichter.
  • vp migrate reports a short error for a directory without package.json instead of an ENOENT stack trace (#​2821), by @​TheAlexLichter.
  • vp create in an existing pnpm workspace adds the catalog entries the new application needs, so installation no longer fails with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC (#​2808), by @​SaKaNa-Y.
  • On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at Terminate batch job (Y/N)? (#​2890), by @​fengmk2.
  • vp pack --watch on Windows rebuilds with the new options after the config file changes (#​2826), by @​liangmiQwQ.
  • vp test doctor and vp test complete run the Vitest subcommands instead of being treated as test file filters (#​2879), by @​liangmiQwQ.
  • With isolated dependency layouts such as pnpm's global virtual store, vp pack finds installed Vue language tools and TypeScript Go for declaration generation, and Playwright browser provider options keep their types (#​2868, #​2865), by @​liangmiQwQ.
  • Package-manager commands fail when the project's package manager does not support a named option, instead of silently dropping it and continuing. Bun 1.4.1+ receives --offline and --prefer-offline, and Yarn Classic accepts a single --filter for vp remove (#​2775), by @​jong-kyung.
  • vp pm config in Bun projects falls back to npm, as its warning says (#​2899), by @​jong-kyung.
  • vp pm approve-builds states that Yarn Berry disables third-party build scripts by default from 4.14.0, not in every version (#​2902), by @​jong-kyung.
  • vp implode asks you to type boom instead of uninstall to confirm (#​2901), by @​fengmk2.
  • Global package installs and updates print a green +, and removals a red -, with bold package names in both (#​2828), by @​liangmiQwQ.
  • Setup headings and command hints keep their colors when the installer captures stdout (#​2829), by @​liangmiQwQ.
Refactor
  • Replace semver with verkit in the CLI, reducing the bundled CLI JavaScript by about 26 KB (#​2837), by @​liangmiQwQ.
  • Share the shim filename logic between setup and vp env doctor, and remove unused config migration metadata (#​2876, #​2894), by @​jong-kyung.
Docs
Chore
Bundled Versions
Tool Version Source Changelog
vite 8.3.3 fea5b21 8.3.2, 8.3.3
rolldown 1.2.12 [45e407b](https://redirect.github.com/r

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 12, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 zrr-website-slides 7c4b1e6 Commit Preview URL

Branch Preview URL		 Oct 12 2026, 12:57 AM

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 zrr-website-blog 7c4b1e6 Commit Preview URL

Branch Preview URL		 Oct 12 2026, 12:59 AM

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 zrr-website-root 7c4b1e6 Commit Preview URL

Branch Preview URL		 Oct 12 2026, 01:00 AM

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants