Skip to content

chore(deps): update all non-major dependencies - #795

Merged
renovate[bot] merged 1 commit into
masterfrom
renovate/all-minor-patch
Nov 15, 2026
Merged

chore(deps): update all non-major dependencies#795
renovate[bot] merged 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/markdown-remark (source) 7.3.8 → 7.3.9 age confidence
@astrojs/mdx (source) 8.1.5 → 8.1.6 age confidence
@astrojs/sitemap (source) 3.7.4 → 3.7.5 age confidence
astro (source) 7.4.11 → 7.4.12 age confidence
eslint (source) 10.14.0 → 10.15.0 age confidence
pnpm (source) 12.18.0 → 12.21.0 age confidence

Release Notes

withastro/astro (@​astrojs/markdown-remark)

v7.3.9

Compare Source

Patch Changes
withastro/astro (@​astrojs/mdx)

v8.1.6

Compare Source

Patch Changes
withastro/astro (@​astrojs/sitemap)

v3.7.5

Compare Source

Patch Changes
withastro/astro (astro)

v7.4.12

Compare Source

Patch Changes
eslint/eslint (eslint)

v10.15.0

Compare Source

Features

  • ec52157 feat: check proto and assignment targets in func-names (#​21521) (Lê Văn Xuân Hoàn)
  • 34a8b1b feat: recognize string and computed keys in accessor-pairs descriptors (#​21519) (Lê Văn Xuân Hoàn)
  • 663c825 feat: handle TS type assertions in no-invalid-this (#​21464) (Valentin)
  • 4941015 feat: check individual specifier importKind in no-shadow (#​21518) (Lê Văn Xuân Hoàn)
  • 17f17cd feat: update error location to head for default-case (#​21469) (Tanuj Kanti)

Bug Fixes

Documentation

  • 16eb1d9 docs: remove Contributor Pool reference (#​21539) (Nicholas C. Zakas)
  • e368730 docs: discourage non-serializable values in rule options (#​21487) (Vitalii Maslianok)
  • 0146008 docs: revamp code path analysis docs (#​21423) (xbinaryx)
  • aeb2267 docs: revise AI acknowledgment options in templates (#​21489) (lumir)
  • e47a477 docs: Update README (GitHub Actions Bot)
  • 11c66ba docs: fix typo in custom rules documentation (#​21472) (Pixel)

Chores

pnpm/pnpm (pnpm)

v12.21.0: pnpm 12.21

Compare Source

pnpm 12.21.0 lets pnpm store add prepare tarball and git dependencies for offline installs. It also makes repeated installs keep their peer dependency choices and fixes several lockfile.format: v13, nodeLinker: hoisted, and pnpm deploy failures. If a pnpr server refuses a setting, pnpm now resolves locally.

Minor Changes
  • pnpm store add run in a project now prepares downloaded tarballs for every lockfile entry that pins them. Besides registry packages, pnpm install --offline --frozen-lockfile can then install dependencies on a tarball URL and dependencies on a git host such as GitHub whose lockfile entry records an integrity.
Patch Changes
Installs that failed

  • pnpm now reads a lockfile with a mapping key longer than 1,024 characters written as 'key':, without the ? marker. Before, pnpm install and other commands failed on such a lockfile with ERR_PNPM_BROKEN_LOCKFILE.

  • With lockfile.format: v13, pnpm install no longer fails to create or rewrite the lockfile when a package declares many of its dependencies as peers.

  • Fixed pnpm deploy failing with lockfile.format: v13 when injected workspace packages have hashed peer bindings.

  • Frozen installs with v13 lockfiles now accept valid peer dependencies of injected workspace packages that use catalogs.

  • Fixed injected workspace packages that depend on themselves linking to a nonexistent directory.

  • pnpm install with frozenStore enabled no longer fails with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD when nodeLinker is hoisted. pnpm fetch with nodeLinker: hoisted no longer populates global virtual store links or modifies linked agent skills, and it preserves an existing hoisted node_modules directory #​18037.

  • A requirements.txt beside a pyproject.toml that declares [tool.uv.workspace] without a [project] table no longer makes that directory a Python project. pnpm install stopped there with an error when the directory had a .venv that pnpm did not create #​18023.

Peer dependencies

  • Repeated installs no longer change the peer dependency providers that the previous install chose. This covers adding, updating, or removing a dependency, projects that use different ranges of one dependency, dependency cycles, and injected dependencies with autoInstallPeers: false pnpm/tasks#221.

    An unchanged install keeps a valid locked peer provider even when a direct dependency provides another compatible version. Explicit pnpm add and pnpm update requests take precedence over it.

  • Workspace projects that select different versions of a peer provider no longer share one copy of the package that depends on it. This affected peers reached through an aliased dependency or a peer dependency cycle.

  • A removed dependency no longer comes back as a peer provider. Before, a direct dependency removed with autoInstallPeers: false could be restored from an old peer resolution, and a removed one could still supply its old peer context.

  • With nodeLinker: hoisted and autoInstallPeers: false, pnpm install no longer creates duplicate copies of a package whose resolved peers are identical. A package also no longer loads a copy of its dependency that was resolved with different peer versions #​18003.

  • pnpm deploy now binds optional peers declared only in peerDependenciesMeta for linked workspace packages. The deployed manifest and lockfile also retain these peers when filtering dependency groups.

Running scripts

  • Scripts now stop when pnpm's process group is killed while they are starting.

  • Bin shims in the global virtual store no longer include the hoisted modules directory of the project that installed them #​18035.

  • pnpm pipeline now rebuilds local packages and reruns build scripts after it restores a shared Cargo build cache with Cargo 1.100 or newer. Before, a worktree could reuse build-script output from the worktree that created the cache.

pnpr

  • If the pnpr server refuses a setting the install uses, or cannot return the lockfile format pnpm reads, pnpm install and pnpm update print a warning and resolve locally. Cargo and Python resolution also fall back to resolving locally. pnpm now rejects a pnpr resolution of npm dependencies that does not name its lockfile format.

  • pnpm install with pnprServer now limits the size of the server's resolve and lockfile verification responses. An oversized response ends the request with an error.

  • pnpm now displays pnpr error codes and reasons when remote requests fail.

Other commands and settings

  • pnpm setup and the install script now support PowerShell as the login shell on Linux and macOS. They add PNPM_HOME to PATH in profile.ps1 under $XDG_CONFIG_HOME/powershell or ~/.config/powershell #​18026.

  • A lockfileDir setting that points at the default lockfile directory now installs the same way as leaving it unset pnpm/tasks#275.

Platinum Sponsors
Bit OpenAI Notion
CodeRabbit Cloudflare
Gold Sponsors
Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude Syntax

v12.20.0: pnpm 12.20

Compare Source

pnpm 12.20.0 records the specifiers of local directory dependencies in the experimental v13 lockfile and fixes several nodeLinker: hoisted, peer dependency, and overrides bugs. The bundled node-gyp no longer ships the undici version that security scanners flag. Remote resolution and shared build caches no longer work with pnpr 0.1.0-alpha.19 or older.

Minor Changes
  • With lockfile.format: v13, pnpm install records the dependency specifiers of local directory packages. Frozen installs reject changed specifiers even when the locked versions still satisfy them.
Patch Changes
Upgrading and security

  • Remote resolution, shared build caches, and release notes no longer work with pnpr 0.1.0-alpha.19 or older. pnpm now reads the capabilities a pnpr server advertises under pnpr.protocols. Installs fail when the server does not confirm the requested resolution and verification policies.

  • The node-gyp bundled with pnpm no longer ships undici 6, which security scanners flag for CVE-2026-84947. On Node.js 26, node-gyp downloads through a proxy or with a custom CA file no longer crash with "invalid onError method" #​17941.

Resolving dependencies

  • Version-selector overrides entries such as "ms@^2.0.0": "2.1.1" now apply to dependencies declared with the catalog: protocol when the catalog entry's range matches the selector #​17922.

  • A root overrides entry that points a package at a workspace: path, such as workspace:./packages/foo, now also applies when a registry package depends on that package pnpm/tasks#270.

  • Git dependencies now accept npm's :: separator between fragment parameters, such as github:owner/repo#v1.0.0::path:packages/foo. Before, pnpm read the whole fragment as a branch name and failed to resolve it #​17827.

  • pnpm dedupe now keeps a locked runtime version, from devEngines.runtime or from a dependency's engines.runtime, when the declared range still admits it. pnpm dedupe --check no longer fails each time a newer Node.js release in the range comes out #​17984.

  • With autoInstallPeersFromHighestMatch, conflicting non-semver peer dependencies now remain missing, and identical non-semver peer specifiers are preserved. Preferred registry versions no longer replace local paths or protocol-prefixed specifiers when pnpm installs missing peers pnpm/tasks#272.

Hoisted node linker
  • With nodeLinker: hoisted, a package now keeps its nested copy of a dependency that it resolved at a version other than the top-level one, including a peer dependency its parent supplies. Before, pnpm could remove that copy as a duplicate or give the top-level slot to a peer variant found deeper in the graph. The package then loaded the top-level version.
Lockfile and peer dependency graphs

  • Fixed pnpm install keeping stale peer bindings after dependency changes. Required dependencies no longer remain marked optional when another workspace project removes a shared package pnpm/tasks#221.

  • Repeated installs now keep the same dependency links when packages form cycles with several peer dependency variants pnpm/tasks#221.

  • Fixed writing lockfile.format: v13 for dependency cycles with missing, optional, or transitive peers. Frozen installs also accept unchanged injected packages whose peers use catalogs. With --no-optional, frozen installs reject required catalog children recorded only as optional dependencies pnpm/tasks#221.

  • pnpm deploy preserves an injected workspace package's resolved dependencies when they differ from the workspace project's own dependencies. This also applies to packages with publishConfig.directory pnpm/tasks#221.

Running scripts and runtimes

  • Scripts that pnpm runs in a process group of their own are now ended when pnpm is killed right after starting them. A parallel run that was killed before pnpm registered its scripts left all of them running.

  • When a command name matches no script and pnpm falls back to running it as a command, the install that runs before scripts now runs once. Its errors and warnings print once #​17977.

  • Failed downloads by project-aware global runtime commands now explain which configuration applies. Node.js failures also list the global mirror settings and environment variables to check.

Other commands and settings

  • Fixed pnpm occasionally crashing on the first HTTPS request, mostly on Windows virtual machines under load. pnpm now seeds TLS randomness from the operating system's random number generator pnpm/tasks#239.

  • Fixed pnpm deprecate, pnpm undeprecate, and pnpm unpublish failing with revision conflicts when a registry cache serves stale package metadata.

  • pnpm sbom now reports malformed workspace manifests. Before, it omitted their packages pnpm/tasks#59.

  • Fixed pnpm store status reporting approved builds of git dependencies as modified when the store contains legacy build metadata.

  • pnpm now recognizes Capawesome Cloud and RWX as CI environments.

Platinum Sponsors
Bit OpenAI Notion
CodeRabbit Cloudflare
Gold Sponsors
Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude Syntax

v12.19.0: pnpm 12.19

Compare Source

pnpm 12.19.0 adds pnpm fund, lets the loaded node linker handle packages that need a build, and adds the projectScopedOptionalPeers setting and an experimental JSON lockfile format. It also includes a security fix: an offline install error no longer prints registry credentials. pnpm now checks the engines and platform fields of every workspace project, and many hoisted-linker and frozen-lockfile bugs are fixed.

Minor Changes

  • Added pnpm fund, which lists the funding URLs declared by the installed dependencies in the same tree npm fund prints. Use --json for the npm fund --json report and --recursive or --filter to report on workspace projects. pnpm fund <pkg> opens the funding URL of an installed package, and --which picks one when it lists several #​7354.

  • With nodeLinker.type: loaded, packages that need a build no longer have to be listed in nodeLinker.excluded. A package with a matching side-effects cache entry loads from the store. If side-effects cache reads and writes are enabled, pnpm builds an approved package once, saves the result to the side-effects cache, and then loads it from the store. This includes a build that changes no files in its package, so its script does not run again in other projects that use the same store. List a package in sideEffectsCache.exclude if its build must run in every project, such as a git hook installer. pnpm materializes other cache misses, packages with native .node addons, and their dependencies automatically.

    pnpm also scans JavaScript sources for filesystem imports and for __dirname or import.meta, and materializes matching packages. The scan does not detect computed imports. List such packages in nodeLinker.excluded.

  • Added the projectScopedOptionalPeers setting. When it is true, a project gets a missing optional peer dependency only if the project's own dependencies install a version of it. Another workspace project's dependencies, such as its devDependencies, no longer supply one. dedupePeerDependents keeps deduplicating everything else #​16666.

  • Added the experimental lockfile.format: v13 setting. With it, pnpm writes pnpm-lock.yaml in a JSON-like syntax, indented with tabs, with a trailing comma after every entry. The file is still valid YAML. The file has one packages entry per package version in place of the packages and snapshots sections, and each entry records the versions of its peer dependencies as its properties. Updating a peer dependency then changes only the lines that record its version. pnpm reads lockfiles in both formats whatever the setting is.

  • pnpm store add now accepts directories of tarballs, such as pnpm store add ./tarballs, and adds every .tgz, .tar.gz, and .tar file inside them recursively. pnpm store add is now faster when it adds many packages or local tarballs #​17875.

  • With supportedArchitectures set, pnpm install and pnpm fetch also store, without linking them, the dependencies of the archives kept for the other listed platforms. A platform added to the setting gets its archives and their dependencies on the next install. Optional dependencies a listed platform cannot run are not stored, and one that fails to download is skipped. Dependencies from git repositories are not stored for other platforms.

  • When supportedArchitectures names exactly one platform and not current, pnpm links that platform's variant of a package published with platform variants, together with that variant's dependencies. This holds for the list form and for the os, cpu, and libc form. A variant whose floor or ABI the listed platform does not state is not linked for it: pnpm links another variant that fits, or the version's own archive. Changing the setting, or the platform of the host, such as a node_modules mounted into a musl container or a Node.js with another ABI, relinks the package on the next install, even from a frozen lockfile.

  • pnpm now provides a prebuilt binary for NetBSD 10 on x64 #​17803.

Patch Changes
Security
  • The error for a tarball that is missing from the store in offline mode no longer prints the credentials or token in the tarball URL.
Installs that failed or hung

  • pnpm install, pnpm ci, and pnpm install-test outside a workspace now fail with ERR_PNPM_NO_PKG_MANIFEST when the directory has no package.json, package.json5, or package.yaml. They no longer create a package.json, a lockfile, and node_modules there #​17727.

  • Fixed pnpm install hanging when a concurrent tarball download or manifest read is cancelled while other tasks are waiting on the same archive.

  • Running a global command such as node in a project that pins its version no longer hangs while pnpm installs that version. The hang kept starting new processes until the machine ran out of memory.

  • A global command such as node now runs the version a project pins when PNPM_CONFIG_LOCKFILE_DIR, PNPM_CONFIG_VIRTUAL_STORE_ONLY, or PNPM_CONFIG_SYMLINK is set in the environment. Before, the dispatch failed with "the installed node executable is not under" the store.

  • pnpm install now fetches fresh metadata for a package when a version allowed by minimumReleaseAgeExclude is missing from the cached metadata. Before, it could fail with ERR_PNPM_NO_MATCHING_VERSION without contacting the registry #​17723.

  • A ${VAR} placeholder in a registry URL in pnpm-workspace.yaml or the project .npmrc now fails the command. pnpm does not expand environment variables in these files. Before, pnpm ignored such a URL and resolved packages from another registry, such as npmjs.org. pnpm now warns when it ignores a placeholder in a proxy, pnprServer, or userAgent setting in pnpm-workspace.yaml #​17762.

  • Fixed local package installs failing while a workspace lockfile is being written.

  • pnpm self-update and switching to the packageManager version now work behind a proxy that ends a response by closing the TLS connection without a close_notify alert. The registry signature check failed there with ERR_PNPM_PNPM_ENGINE_IDENTITY_UNVERIFIABLE #​17763.

  • A package tarball that keeps failing to download now fails the install after fetchRetries retries. pnpm used to download it again with a second full set of retries, which doubled the wait. The error now names the actual download failure.

  • When the native binary of the pnpm version a project pins fails to download, pnpm now reports the download error. It used to report only that no native binary was found for the host.

  • POSIX bin shims and the pnpm, pn, pnpx, and pnx launchers now run inside a Nix build on macOS with the sandbox enabled. Installing again replaces the shims already in node_modules #​17750.

  • Fixed pnpm leaving process pipes open after it exits on macOS pnpm/tasks#229.

Engines and platform checks

  • pnpm install, pnpm add, pnpm update, and pnpm remove now check the engines, os, cpu, and libc fields of every workspace project, including the workspace root. pnpm run -r and pnpm exec -r check them before running anything. An incompatible engines.pnpm fails the command. An incompatible engines.node prints a warning, or fails the command with engineStrict enabled. An unsupported platform prints a warning. A project that downloads its own Node.js through devEngines.runtime is checked against that Node.js #​17751 pnpm/tasks#281 pnpm/tasks#299.

  • Fixed missing warnings when a required dependency does not support the current Node.js version.

  • An optional dependency that declares no os, cpu, or libc field is no longer skipped because its name contains only an operating system word, such as get-windows on macOS. pnpm now infers its platform from the name only when the name also has a cpu or libc token, such as -win32-x64 #​17774.

Peer dependencies

  • With dedupePeerDependents: false, a missing optional peer is no longer resolved from a version that only another workspace project depends on. The workspace root's dependencies still count if resolvePeersFromWorkspaceRoot is true. Before, a tool in one project's devDependencies, such as webpack-cli, could become an optional peer of another project's production dependencies #​16666.

  • pnpm install no longer gives a project an optional peer dependency that it skipped because a required peer would conflict with the project's dependencies. Before, dedupePeerDependents merged the project's

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot

changeset-bot Bot commented Nov 14, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 8b1d0f1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@codecov

codecov Bot commented Nov 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e105afa) to head (8b1d0f1).

Additional details and impacted files 
@@            Coverage Diff            @@
##            master      #795   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            1         1           
  Lines            2         2           
=========================================
  Hits             2         2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 6666cf4 to 8b1d0f1 Compare November 15, 2026 01:44
@renovate
renovate Bot merged commit d1ec146 into master Nov 15, 2026
4 checks passed
@renovate
renovate Bot deleted the renovate/all-minor-patch branch November 15, 2026 06:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants