chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	^20.9.3 → ^20.19.43
@types/semver (source)	^7.5.6 → ^7.8.0
@xmldom/xmldom	^0.8.10 → ^0.9.12
ConfigureAwaitChecker.Analyzer	5.0.0 → 5.0.0.1
Finbuckle.MultiTenant (source)	6.11.1 → 6.13.1
chalk	^5.3.0 → ^5.6.2
changelogen	^0.5.5 → ^0.6.2
defu	^6.1.3 → ^6.1.7
detect-indent	^7.0.1 → ^7.0.2
dotenv	^16.3.1 → ^16.6.1
eslint (source)	8.54.0 → 8.57.1
globby	^14.0.0 → ^14.1.0
js-yaml	^4.1.0 → ^4.3.1
jsonpath	1.1.1 → 1.3.0
knip (source)	^2.41.5 → ^2.43.0
pathe	^1.1.1 → ^1.1.2
prettier (source)	3.1.0 → 3.9.6
release-it	^17.0.0 → ^17.11.0
rimraf	^5.0.5 → ^5.0.10
semver	^7.5.4 → ^7.8.5
shelljs	^0.8.5 → ^0.10.0
typescript (source)	^5.3.2 → ^5.9.3
xpath	^0.0.33 → ^0.0.34

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

xmldom/xmldom (@​xmldom/xmldom)

v0.9.12

Compare Source

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML RAWTEXT end-tag rule and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. GHSA-6mj3-qw4j-hgrw
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the requireWellFormed serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with InvalidStateError — closing a bypass of the XML QName check. GHSA-jxjr-3g7g-3944
• Security: the requireWellFormed serializer's DocType publicId/systemId validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with InvalidStateError — closing a bypass of the XML PubidLiteral/SystemLiteral check. GHSA-vr34-hp96-76pp
• Security: createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() now reject a name containing a line terminator with InvalidCharacterError, because name validation applies to the whole string — closing a creation-time bypass of the XML Name/QName production on the default serialization path. GHSA-3px3-54cx-rmw9
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content (a recoverable error in XML, a warning in HTML) instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's onError handler. GHSA-6h8r-xr42-gp59
• DOMExceptions raised during parsing are now reported as a fatalError, and the originating error is preserved as the cause on the resulting ParseError.

Chore

• updated dependencies

Thank you,
@​ericchiang,
@​KarimTantawey,
@​bhaswanthc,
@​arpitjain099,
@​Paranoidgrinch,
for your contributions

v0.9.11

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
• Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
• CharacterData nodeValue and data are now kept in sync #990

Chore

• updated dependencies

Thank you,
@​bhaswanthc,
@​jmestwa-coder,
@​stevenobiajulu,
for your contributions

v0.9.10

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
  • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
• isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

• The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

• updated dependencies

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions

v0.9.9

Compare Source

Added

• implement ParentNode.children getter #960 / #410

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains #931

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you,
@​stevenobiajulu,
@​yoshi389111,
@​thesmartshadow,
for your contributions

v0.9.8

Compare Source

Fixed

• fix: replace \u2029 as part of normalizeLineEndings #839 / #838
• perf: speed up line detection #847 / #838

Chore

• updated dependencies
• drop jazzer and rxjs devDependencies #845

Thank you,
@​kboshold,
@​Ponynjaa,
for your contributions.

v0.9.7

Compare Source

Added

• Implementation of hasAttributes #804

Fixed

• locator is now true even when other options are being used for the DOMParser #802 / #803
• allow case-insensitive DOCTYPE in HTML #817 / #819

Performance

• simplify DOM.compareDocumentPosition #805

Chore

• updated devDependencies

Thank you,
@​zorkow,
@​Ponynjaa,
@​WesselKroos,
for your contributions.

v0.9.6

Compare Source

Fixed

• lower error level for unicode replacement character #790 / #794 / #797

Chore

• updated devDependencies
• migrate renovate config #792

Thank you, @​eglitise, for your contributions.

v0.9.5

Compare Source

Fixed

• fix: re-index childNodes on insertBefore #763 / #766

Thank you,
@​mureinik,
for your contributions.

v0.9.4

Compare Source

Fixed

• restore performance for large amount of child nodes #748 / #760
• types: correct error handler level to warning (#​759) #754 / #759

Docs

• test: verify BOM handling #758

Thank you,
@​luffynando,
@​mattiasw,
@​JoinerDev,
for your contributions.

v0.9.3

Compare Source

Fixed

• restore more Node and ProcessingInstruction types #725 / #726
• getElements* methods return LiveNodeList<Element> #731 / #734
• Add more missing Node props #728, triggered by unclosed #724

Docs

• Update supported runtimes in readme (NodeJS >= 14.6 and other ES5 compatible runtimes)

Chore

• updates devDependencies

Thank you,
@​Ponynjaa,
@​ayZagen,
@​sserdyuk,
@​wydengyre,
@​mykola-mokhnach,
@​benkroeger,
for your contributions.

v0.9.2

Compare Source

Feature

• add Element.getElementsByClassName #722

Fixed

• add missing types for Document.documentElement and Element.tagName #721 #720

Thank you, @​censujiang, @​Mathias-S, for your contributions

v0.9.1

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
  • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
• isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

• The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

• updated dependencies

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions

v0.9.0

Compare Source

• Discussion
• Summary on dev.to

Features

• feat: expose all DOM level 2 element prototypes #637 / #40
• feat: add iterator function to NodeList and NamedNodeMap #634 / #633

Fixed

• parse empty/whitspace only doctype internal subset #692
• avoid prototype clash in namespace prefix #554
• report fatalError when doctype is inside elements #550

Other

• test: add fuzz target and regression tests #556
• chore: improve .gitignore and provide .envrc.template #697
• chore: Apply security best practices #546
• ci: check test coverage in PRs #524
• docs: add missing commas to readme #566
• docs: click to copy install command in readme #644
• docs: enhance jsdoc comments #511

Thank you, @​kboshold, @​edi9999, @​apupier,
@​shunkica, @​homer0, @​jhauga,
@​UdayKharatmol, for your contributions

v0.8.15

Compare Source

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you,
@​ericchiang,
@​bhaswanthc,
@​arpitjain099,
@​Paranoidgrinch,
for your contributions

v0.8.14

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you,
@​bhaswanthc,
@​jmestwa-coder,
for your contributions

v0.8.13

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions

v0.8.12

Compare Source

Fixed

• preserve trailing whitespace in ProcessingInstruction data #962 / #42
• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you,
@​thesmartshadow,
@​stevenobiajulu,
for your contributions

v0.8.11

Compare Source

Fixed

• update ownerDocument when moving nodes between documents #933 / #932

Thank you, @​shunkica, for your contributions

Finbuckle/Finbuckle.MultiTenant (Finbuckle.MultiTenant)

v6.13.1

Bug Fixes

• update dependency to protect against CVE-2024-21319 (#​781) (c5e0c8a)

v6.13.0

Features

• .net8.0 LTS release support (#​770) (d7f08f9)

Bug Fixes

• OnTenantNotResolved not called correctly (#​729) (a26081c), closes #​628

v6.12.0

Features

• AdjustIndex preserves existing filter (#​711) (affb66f)
• net8.0 (#​712) (a137dae)

chalk/chalk (chalk)

v5.6.2

Compare Source

• Fix vulnerability in 5.6.1, see: #​656

v5.6.0

Compare Source

• Make WezTerm terminal use true color a8f5bf7

---

v5.5.0

Compare Source

• Make Ghostty terminal use true color (#​653) 79ee2d3

---

v5.4.1

Compare Source

• Fix navigator not defined ReferenceError (#​642) 4ebb62d

v5.4.0

Compare Source

• Update CIRCLECI environments to return level 3 color support f838120

unjs/changelogen (changelogen)

v0.6.2

Compare Source

compare changes

🩹 Fixes

• cli: Accept hideAuthorEmail arg (#​275)

📖 Documentation

• Add note about version number interpretation (#​272)

🌊 Types

• config.types accept boolean value (#​278)

🏡 Chore

• readme: Fix typo (#​270)
• Update deps (037ac74)

❤️ Contributors

• Philipp Kief (@​PKief)
• Pooya Parsa (@​pi0)
• Azat S. (@​azat-io)
• Adarsh DK <adarsh.dk24012@​gmail.com>
• B. Jonson (@​who-jonson)

v0.6.1

Compare Source

compare changes

🩹 Fixes

• Pass cwd in more places before running commands (#​266)

🏡 Chore

• Update deps (f728b52)
• Update tsconfig (e5dced7)

✅ Tests

• Update snapshot (ec2618f)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Daniel Roe (@​danielroe)

v0.6.0

Compare Source

compare changes

🚀 Enhancements

• Update jiti to v2 (6e85d32)
• Add check for breaking changes in commit body (#​228)
• Hide author email address via flag (#​247)
• Add noAuthors option (#​183)

🩹 Fixes

• Use https proto for author's github link (#​225)
• Use https proto for author's github link in tests (#​226)
• Release version regex supporting pre versions (#​259)
• Use correct compare changes URL for Bitbucket (#​257)
• Use tag template for version title and compare change link (#​255)
• Render usernames in github changelog (#​265)

💅 Refactors

• Use consola for colors (49e0401)
• Use confbox for yaml parsing (19e940c)

📦 Build

• ⚠️ Esm-only dist (4a22de6)

🏡 Chore

• Lint (031cfd6)
• Update deps (b184f23)
• Update ci (8662c4e)
• Update esm-only deps (0d5e31d)

✅ Tests

• Add tests for parsing co-authors from commit body (#​229)

⚠️ Breaking Changes

• ⚠️ Esm-only dist (4a22de6)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Klein Petr (@​kleinpetr)
• Jasper Zonneveld (@​JaZo)
• Thorsten Seyschab (@​toddeTV)
• Philipp Kief (@​PKief)
• Jan-Henrik Damaschke jdamaschke@outlook.de
• Damian Głowala (@​DamianGlowala)

v0.5.7

Compare Source

compare changes

🩹 Fixes

• bump: Avoid using + for canary suffix (#​224)

❤️ Contributors

• Pooya Parsa (@​pi0)

v0.5.6

Compare Source

compare changes

🚀 Enhancements

• Add option to sign git tags (#​117)
• git: Support parse git messages that have prefix emoji (#​146)

🩹 Fixes

• github: Use bearer token (#​180)
• Handle repo name with multiple segments (#​219)
• Lowercase scope when filtering (#​199)

💅 Refactors

• Replace execa with execSync (#​222)
• Use human readable date for canary versions (#​223)
• Update execCommand (68127be)

🏡 Chore

• Apply automated lint fixes (72c407f)
• Update ci (bcb16cb)
• Update non major deps (7f714c9)
• Update to eslint v9 (fd40be9)
• Apply automated lint fixes (673255b)
• Update deps (3cfbe27)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Klein Petr (@​kleinpetr)
• Wan Chiu (@​wan54)
• Jianqi Pan (@​Jannchie)
• Vasily Kuzin exer7um@gmail.com
• Daniel Roe (@​danielroe)

unjs/defu (defu)

v6.1.7

Compare Source

compare changes

🩹 Fixes

• defu.d.cts: Export Defu types (#​157)

📦 Build

• Correct the types export entry (#​160)

❤️ Contributors

• Jakub Michálek (@​J-Michalek)
• Kricsleo (@​kricsleo)

v6.1.6

Compare Source

compare changes

📦 Build

• Fix mixed types (407b516)

❤️ Contributors

• Pooya Parsa (@​pi0)

v6.1.5

Compare Source

compare changes

🩹 Fixes

• Prevent prototype pollution via __proto__ in defaults (#​156)
• Ignore inherited enumerable properties (11ba022)

🏡 Chore

• Add tea.yaml (70cffe5)
• Update repo (23cc432)
• Fix typecheck (89df6bb)

✅ Tests

• Add more tests for plain objects (b65f603)

🤖 CI

• Bump node (9237d9c)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)

v6.1.4

Compare Source

compare changes

🩹 Fixes

• Merge objects with Module type (#​121)

💅 Refactors

• Move isPlainObject to _utils to allow testing (e922a16)
• Make isPlainObject logic more readable (e458b63)

📖 Documentation

• Fix typo (#​116)

🏡 Chore

• release: V6.1.3 (3834ca1)
• Update deps and lint (e5a48d3)
• Enable skipLipCheck for type tests (7c7a9a4)

✅ Tests

• Improve tests for isPlainObject (b24a213)

❤️ Contributors

• Alexander Lichter (@​manniL)
• Pooya Parsa (@​pi0)
• Yu Le is.yuler@gmail.com

sindresorhus/detect-indent (detect-indent)

v7.0.2

Compare Source

• Fix multi-line comment indent detection 8c39c07

---

motdotla/dotenv (dotenv)

v16.6.1

Compare Source

Changed

• Default quiet to true – hiding the runtime log message (#​874)
• NOTICE: 17.0.0 will be released with quiet defaulting to false. Use config({ quiet: true }) to suppress.
• And check out the new dotenvx. As coding workflows evolve and agents increasingly handle secrets, encrypted .env files offer a much safer way to deploy both agents and cod

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.