Skip to content

fix(deps): update all non-major dependencies - #130

Merged
wgordon17 merged 1 commit into
mainfrom
renovate/all-non-major-dependencies
Aug 18, 2026
Merged

fix(deps): update all non-major dependencies#130
wgordon17 merged 1 commit into
mainfrom
renovate/all-non-major-dependencies

Conversation

@khepri-bot

@khepri-bot khepri-bot Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@cloudflare/vite-plugin (source) 1.48.0 → 1.50.0 age confidence devDependencies minor 1.53.0 (+6)
@cloudflare/vitest-pool-workers (source) 0.19.0 → 0.20.1 age confidence devDependencies minor 0.22.0 (+6)
@octokit/core 7.0.6 → 7.0.7 age confidence dependencies patch
@octokit/core 7.0.6 → 7.0.7 age confidence devDependencies patch
@octokit/plugin-retry 8.1.0 → 8.1.1 age confidence dependencies patch
@octokit/plugin-retry 8.1.0 → 8.1.1 age confidence devDependencies patch
@octokit/plugin-throttling 11.0.3 → 11.0.5 age confidence dependencies patch
@octokit/plugin-throttling 11.0.3 → 11.0.5 age confidence devDependencies patch
@playwright/test (source) 1.62.0 → 1.62.1 age confidence devDependencies patch
@testing-library/user-event 14.6.1 → 14.6.3 age confidence devDependencies patch 14.6.5 (+1)
daisyui (source) 5.7.7 → 5.7.15 age confidence devDependencies patch 5.7.18 (+2)
node 24.18.0 → 24.19.0 age confidence uses-with minor
pnpm (source) 11.18.0 → 11.20.0 age confidence packageManager minor 11.22.0 (+1)
tsx (source) 4.23.1 → 4.23.5 age confidence devDependencies patch 4.23.12 (+6)
vite (source) 8.1.5 → 8.2.0 age confidence devDependencies minor 8.2.1
wrangler (source) 4.115.0 → 4.118.0 age confidence devDependencies minor 4.124.0 (+6)
ws 8.21.1 → 8.21.2 age confidence dependencies patch 8.21.3

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.50.0

Compare Source

Minor Changes

  • #​14944 a249591 Thanks @​nickpatt! - Enable local observability capture by default in dev

    wrangler dev and the Vite plugin now capture request traces and console logs into the Local Explorer's Observability tab out of the box — previously this was opt-in behind X_LOCAL_OBSERVABILITY=true. Set X_LOCAL_OBSERVABILITY=false to opt out (for example if the extra per-worker collector/streaming-tail services cause trouble in a multi-process dev-registry setup).

Patch Changes

v1.49.1

Compare Source

Patch Changes

  • #​14586 5a56dda Thanks @​emily-shen! - Rewrite local testing paths (/cdn-cgi/*)

    Miniflare v5 moved its internal local testing endpoints to /cdn-cgi/local/* (and /__cf_local/* for endpoints that must remain reachable over tunnels) to prevent any potential collision with production routes. wrangler dev and the Vite plugin now transparently rewrite the old paths to the new ones, meaning you can continue to use the old paths without issue.

    These are the new paths:

    • /cdn-cgi/handler/scheduled → /cdn-cgi/local/scheduled
    • /cdn-cgi/handler/email → /cdn-cgi/local/email
    • /cdn-cgi/explorer/* → /cdn-cgi/local/explorer/*
    • /cdn-cgi/mf/scheduled → /cdn-cgi/local/scheduled (Note /cdn-cgi/mf/scheduled is already deprecated)
    • /cdn-cgi/mf/stream/* → /__cf_local/stream/*
    • /cdn-cgi/mf/imagedelivery/* → /__cf_local/imagedelivery/*

  • Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

v1.49.0

Compare Source

Minor Changes
  • #​14905 b21eac2 Thanks @​jamesopstad! - The experimental build output directory now includes the Worker's configuration at .cloudflare/output/v0/workers/default/config.json instead of .cloudflare/output/v0/workers/<worker-name>/worker.config.json
Patch Changes
cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.20.1

Compare Source

Patch Changes

v0.20.0

Compare Source

Minor Changes

  • #​14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

    • wrappedBindings
    • cacheWarnUsage
    • fetchMock: you should use outboundService instead
    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

    Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

v0.19.1

Compare Source

Patch Changes
octokit/core.js (@​octokit/core)

v7.0.7

Compare Source

Bug Fixes
octokit/plugin-retry.js (@​octokit/plugin-retry)

v8.1.1

Compare Source

Bug Fixes
octokit/plugin-throttling.js (@​octokit/plugin-throttling)

v11.0.5

Compare Source

Bug Fixes

v11.0.4

Compare Source

Bug Fixes
  • defer Bottleneck instantiation until first request (CF Workers compat) (#​850) (d711c52)
microsoft/playwright (@​playwright/test)

v1.62.1

Compare Source

Bug Fixes
  • #​41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
  • #​41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
  • #​41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
  • #​42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
  • #​42013 [BUG]Image-type actionable elements are not presented in the snapshot.
testing-library/user-event (@​testing-library/user-event)

v14.6.3

Compare Source

Bug Fixes
saadeghi/daisyui (daisyui)

v5.7.15

Compare Source

Bug Fixes

v5.7.14

Compare Source

Bug Fixes

v5.7.13

Compare Source

Bug Fixes

v5.7.12

Compare Source

Bug Fixes
  • prevent select arrow to rotate when select is focused but not open (#​4655) (3362dc2)

v5.7.11

Compare Source

Bug Fixes

v5.7.10

Compare Source

Bug Fixes

v5.7.9

Compare Source

Bug Fixes
  • missing CDN responsive class names (46040b1)

v5.7.8

Compare Source

Bug Fixes
actions/node-versions (node)

v24.19.0: 24.19.0

Compare Source

Node.js 24.19.0

v24.18.1: 24.18.1

Compare Source

Node.js 24.18.1

pnpm/pnpm (pnpm)

v11.20.0: pnpm 11.20

Compare Source

Minor Changes

  • Security fix. Affects projects using namedRegistries on pnpm 11.1.0–11.19.x. It is semi-breaking for those projects — see "If you use named registries" below.

    The lockfile recorded no marker for which registry a package came from. Packages were keyed by name@version alone, and entry lookup went through refToRelative(ref, name), so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single packages: entry and whichever resolved first decided the tarball every consumer got.

    That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.

    Packages resolved from a named registry are now recorded under registry-qualified keys (<name>@<registryName>:<version>, e.g. foo@work:1.0.0), so each registry gets its own entry and the lockfile pins which one a dependency came from.

    The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use namedRegistries sees no difference, and older pnpm versions keep reading the file.

If you use named registries

Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.

Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it.

There is no setting to keep the old behavior: the old shape is the vulnerability.

Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the namedRegistries setting on demand.

To use named registries, map your aliases in pnpm-workspace.yaml:

namedRegistries:
  work: https://npm.enterprise.example.com/
New built-in npmjs: alias

npmjs: now resolves to https://registry.npmjs.org/ with no configuration, alongside the existing gh: alias for GitHub Packages. It pins a dependency to the public registry even when registry points elsewhere, such as an internal proxy:

{ "dependencies": { "left-pad": "npmjs:^1.3.0" } }

npm: cannot do this — it is the alias protocol (npm:<name>@<range>) and resolves through whatever registry points at.

If you mirror or proxy npmjs, point the alias at your mirror:

namedRegistries:
  npmjs: https://npm.internal.example.com/

Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on registry.npmjs.org is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, minimumReleaseAge, or trustPolicy check runs. Overriding the alias is the same escape hatch GHES users already have for gh.

Every alias the lockfile references must stay in namedRegistries: reading an entry whose alias is gone fails with ERR_PNPM_MISSING_NAMED_REGISTRY rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it.

Named registry aliases that shadow a reserved dependency specifier prefix (file, link, workspace, runtime, npm, jsr, ...) are now rejected with ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME instead of being silently shadowed by the corresponding resolver.

pnpm licenses and pnpm sbom now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl repository_url qualifier.

Patch Changes

  • An empty http-proxy, https-proxy, proxy, or no-proxy value — from the .npmrc, pnpm-workspace.yaml, the CLI, or the HTTP_PROXY / HTTPS_PROXY / PROXY / NO_PROXY environment variables — no longer fails the install with ERR_PNPM_INVALID_PROXY. Empty settings read as unset, so a shell exporting HTTP_PROXY= disables the proxy, and an empty proxy= in the .npmrc no longer suppresses HTTPS_PROXY #​13533.

    proxy=false in the .npmrc or proxy: false in pnpm-workspace.yaml now turns proxying off instead of being read as a proxy host named false. false and null on https-proxy / http-proxy / no-proxy read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim.

  • The env lockfile no longer pins @pnpm/exe alongside pnpm when the wanted pnpm version is 12 or newer. From v12 the unscoped pnpm package is itself the native executable, so @pnpm/exe is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it.

  • lexCompare and nerfDart are now published as @pnpm/text.ordinal-comparator and @pnpm/config.registry-auth-key. Use these instead of @pnpm/util.lex-comparator and @pnpm/config.nerf-dart.

  • Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs.

  • Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when minimumReleaseAge is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison.

  • Security: pnpm rebuild now refuses a lockfile whose packages key carries a path traversal in the package name (e.g. ../../../escaped@1.0.0), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with ERR_PNPM_INVALID_DEPENDENCY_NAME.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.19.0: pnpm 11.19

Compare Source

Minor Changes

  • pnpm login no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with ERR_PNPM_LOGIN_NON_INTERACTIVE in a non-interactive terminal.

  • The save-prefix setting now accepts =: newly added dependencies are saved with an explicit = operator (=1.2.3) instead of the setting being silently treated as the default ^.

Patch Changes

  • allowBuilds entries can now approve git-hosted packages that pnpm downloads as a tarball, such as github: dependencies (which are fetched from codeload.github.com rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless git+ matching already supported for cloned git dependencies. For example:

    allowBuilds:
  "foo@git+https://github.com/org/foo.git": true

    This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work.

  • pnpm outdated --include-github-actions no longer blocks on an interactive git credential prompt when a workflow uses a private action repo.

  • Prevented minimumReleaseAge from replacing latest with a SemVer-greater version than the registry tag target #​13034.

  • Fixed empty bundledDependencies and bundleDependencies arrays causing nondeterministic lockfile changes. See #​13123.

  • The install summary no longer prints (X is available) when the registry's dist-tags.latest is still held back by the active minimumReleaseAge policy. The hint only ever names the actual latest tag, so an immature latest suppresses the hint instead of advertising the version pnpm just refused to install #​11698.

  • pnpm update keeps the explicit = operator of an exact version pin: a dependency saved as =3.5.1 now updates to =3.5.2 instead of the bare 3.5.2. See #​13168.

  • Preserve a workspace dependency's link: entry when a run does not target it — e.g. pnpm update <other-pkg> (with or without --recursive), or a plain install after a root/catalog dependency change — with injectWorkspacePackages, instead of spuriously rewriting it to a peer-suffixed file: protocol. See #​10433.

  • Workspace dependencies declared with a relative path (e.g. "foo": "workspace:../foo") are no longer silently dropped from the workspace projects graph, so --filter selection and the topological order of recursive commands take them into account.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
privatenumber/tsx (tsx)

v4.23.5

Compare Source

Bug Fixes
  • detect the Node inspector enabled via NODE_OPTIONS (3c1d051)

This release is also available on:

v4.23.4

Compare Source

Bug Fixes
  • cli: allow async process.once() signal handlers to finish (#​827) (2afc7bb)

This release is also available on:

v4.23.3

Compare Source

Bug Fixes

This release is also available on:

v4.23.2

Compare Source

Bug Fixes
  • watch: exit with 128 + signal number when interrupted (#​820) (0b00bc8)

This release is also available on:

vitejs/vite (vite)

v8.2.0

Compare Source

Features
Bug Fixes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@khepri-bot
khepri-bot Bot requested a review from a team August 17, 2026 04:10
@khepri-bot khepri-bot Bot added the renovate label Aug 17, 2026
@khepri-bot
khepri-bot Bot force-pushed the renovate/all-non-major-dependencies branch 4 times, most recently from 76d9c8a to 12a1f59 Compare August 18, 2026 04:05
@wgordon17 wgordon17 added the rebase Triggers Renovate to rebase the PR label Aug 18, 2026
@khepri-bot khepri-bot Bot removed the rebase Triggers Renovate to rebase the PR label Aug 18, 2026
@khepri-bot
khepri-bot Bot force-pushed the renovate/all-non-major-dependencies branch from 12a1f59 to e655d43 Compare August 18, 2026 13:15
@wgordon17
wgordon17 merged commit 139a5f6 into main Aug 18, 2026
1 check passed
@wgordon17
wgordon17 deleted the renovate/all-non-major-dependencies branch August 18, 2026 14:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wgordon17