chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	21.0.1 → 21.0.2
@commitlint/config-conventional (source)	21.0.1 → 21.0.2
es-toolkit (source)	1.46.1 → 1.47.0
knip (source)	6.14.1 → 6.14.2
lefthook	2.1.8 → 2.1.9
vite (source)	8.0.13 → 8.0.14
vue (source)	3.5.34 → 3.5.35
vue-router (source)	5.0.7 → 5.1.0

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v21.0.2

Compare Source

Bug Fixes

• disallow same commit hash for --from and --to (#​4773) (121005e)

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.0.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

toss/es-toolkit (es-toolkit)

v1.47.0

Compare Source

Released on May 25th, 2026.

• Added es-toolkit/server entrypoint with colors namespace for ANSI terminal color utilities. ([#​1683])
• Added exec function. ([#​1689])
• Added sortKeys to the object entrypoint. ([#​1674])
• Added cartesianProduct and combinations to the array entrypoint. ([#​1713])
• Added allKeyed to the promise entrypoint. ([#​1672])
• Added percentile to the math entrypoint. ([#​1710])
• Added an interactive playground page to docs. ([#​1720])
• Reorganized docs to introduce a flavor switcher and co-locate compat under /compat/. ([#​1699])
• Fixed uniqWith in compat to match lodash's comparator argument order. ([#​1729])
• Fixed compat/omitBy to not treat plain objects with numeric length as array-like. ([#​1709])

We sincerely thank @​Antoliny0919, @​ATOM00blue, @​dayongkr, @​guesung, @​myeong-jae-hwi, @​raon0211, @​seungrodotlee, and @​Xiaohang0316 for their contributions. We appreciate your great efforts!

webpro-nl/knip (knip)

v6.14.2: Release 6.14.2

Compare Source

• Fix vscode-knip build: pin native oxc bindings to bundled JS version (1b45a41)
• Release vscode-knip@​2.1.5 (328892e)
• Fix Astro plugin to support both possible middleware entry points (#​1749) (33e0cc1) - thanks @​schmalz-dmi!
• Fix LICENSE link (#​1760) (829620f) - thanks @​vortispy!
• Fix GraphQL Codegen script config dependencies (#​1756) (e841c63) - thanks @​jakeleventhal!
• Set pnpm config via env vars, disable verify-deps in ecosystem tests (53c1224)
• Update slonik ecosystem snapshot (f18410b)
• Fix Serverless TypeScript plugin dependencies (#​1757) (ebde7f8) - thanks @​jakeleventhal!
• Fix extended tsconfig type dependency attribution (#​1758) (f600b09) - thanks @​jakeleventhal!
• Fix Bun binary dependency tracking (#​1759) (1b28923) - thanks @​jakeleventhal!
• Detect Babel plugins/presets in Vite plugin options (resolve #​1761) (2753d69)

evilmartians/lefthook (lefthook)

v2.1.9

Compare Source

• fix: update hooks path after resetting (#​1431) by @​mrexox
• deps: May 2026 (#​1415) by @​mrexox

vitejs/vite (vite)

v8.0.14

Compare Source

Features

• update rolldown to 1.0.2 (#​22484) (96efc88)

Bug Fixes

• deps: update all non-major dependencies (#​22471) (98b8163)
• dev: handle errors when sending messages to vite server (#​22450) (e8e9a34)
• html: handle trailing slash paths in transformIndexHtml (#​22480) (5d94d1b)
• optimizer: pass oxc jsx options to transformSync in dependency scan (#​22342) (b3132da)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​22470) (7cb728e)
• remove irrelevant commits from changelog (2c69495)

Code Refactoring

• glob: do not rewrite import path for absolute base (#​22310) (0ae2844)

Tests

• css: sass does not use main field (#​22449) (ebf39a0)

vuejs/core (vue)

v3.5.35

Compare Source

Bug Fixes

• compiler-core: avoid double processing v-for keys with v-memo (#​14861) (34a0ded), closes #​14859
• compiler-sfc: resolve top-level exports from files registered as global types (#​14805) (3d077f2), closes nuxt/nuxt#33694
• runtime-core: avoid repeated hydration mismatch checks (#​14857) (170fc95), closes #​14855
• runtime-core: skip idle persisted transition hooks in keep-alive moves (#​14865) (80fc139), closes #​14031
• server-renderer: propagate sync errors from ssrRenderSuspense (#​14804) (4760997), closes nuxt/nuxt#28162
• teleport: skip child unmount when pending mount discarded (#​14876) (#​14877) (584beb1)

Performance Improvements

• reactivity: skip type checks for cached proxies (#​14860) (5734fe9)
• runtime-dom: optimize array event handler dispatch (#​14828) (bb18dc8)
• server-renderer: avoid materializing iterables in ssrRenderList (#​14821) (1b7a2cc)

vuejs/router (vue-router)

v5.1.0

Compare Source

   🚀 Features

• Typed definePage params.path  -  by @​posva in #​2716 (d65de)
• Strict type for definePage param default  -  by @​posva (0ae10)
• Support raw param parsers  -  by @​posva (eadec)
• Force array type raw param parsers  -  by @​posva (7a68b)
• Allow overriding the global Router type  -  by @​posva (1cd93)
• Emit runtime warning for invalid format in query params  -  by @​posva (8259a)
• Override useRouter() return with experimental types config  -  by @​posva (39a34)
• Allow string as a param parser for convenience  -  by @​posva (be37b)

   🐞 Bug Fixes

• Fix auto import fixes and make experimental esm only  -  by @​posva (db3a6)
• Deterministic param parser types order  -  by @​posva (bf0fc)
• Avoid importing unused param parsers  -  by @​posva (41c00)
• Filter invalid query params without failing to match  -  by @​posva (db717)
• Detect not set format  -  by @​posva (aa89e)
• Allow undefined values for params in query  -  by @​posva (4726e)
• experimental: Repeatable params in subsegments  -  by @​posva (84664)
• types: Add vite as optional peer dependency  -  by @​ForgottenR, @​posva and shihuijie in #​2712 (facbf)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vue@​3.5.34 ⏵ 3.5.35			+1	+2
	es-toolkit@​1.46.1 ⏵ 1.47.0	+1		+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report