chore(deps): update all non-major dependencies (main)#35095
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
@nuxt/kit
@nuxt/nitro-server
nuxt
@nuxt/rspack-builder
@nuxt/schema
@nuxt/vite-builder
@nuxt/webpack-builder
commit: |
Merging this PR will degrade performance by 10.54%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ❌ | loadNuxt in the basic test fixture |
428 ms | 478.4 ms | -10.54% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing renovate/main-all-minor-patch (1510db6) with main (2312ce3)
Footnotes
-
3 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
102bb1f to
f2735fd
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This PR contains the following updates:
1.0.6→1.1.00.130.0→0.131.02.0.2→2.0.3^2.0.2→^2.0.324.12.3→24.12.4^6.0.6→^6.0.76.0.6→6.0.73.2.8→3.2.9^5.8.0→^5.8.15.8.0→5.8.1v4.35.4→v4.35.511.1.0→11.2.03.2.1→3.3.16.12.2→6.14.1^11.3.6→^11.4.00.130.0→0.131.00.0.71→0.0.7411.1.0→11.1.2v6.0.7→v6.0.84.60.3→4.60.40.8.0→0.9.06.2.0→6.3.0^6.2.0→^6.3.08.0.12→8.0.13^8.0.12→^8.0.138.0.12→8.0.135.0.6→5.0.7^5.0.6→^5.0.73.2.8→3.2.9Release Notes
nuxt/scripts (@nuxt/scripts)
v1.1.0Compare Source
🚀 Features
🐞 Bug Fixes
--pnpmflag topkg-pr-new publishcommand in nightly workflow - by @DamianGlowala and Damian Głowala in #755 (53810)region1.google-analytics.com- by @captnCC in #753 (58f81)View changes on GitHub
web-infra-dev/rspack (@rspack/core)
v2.0.3Compare Source
What's Changed
Performance Improvements ⚡
New Features 🎉
Bug Fixes 🐞
Refactor 🔨
Document Updates 📖
Other Changes
Full Changelog: web-infra-dev/rspack@v2.0.2...v2.0.3
vitejs/vite-plugin-vue (@vitejs/plugin-vue)
v6.0.7Features
@rolldown/pluginutilsversion (#776) (941b651)Bug Fixes
vuejs/language-tools (@vue/language-core)
v3.2.9Compare Source
language-core
vscode
workspace
sveltejs/devalue (devalue)
v5.8.1Compare Source
Patch Changes
206ca67: fix: force sparse arrays to allocate sparselygithub/codeql-action (github/codeql-action)
v4.35.5Compare Source
analysis-kindsinput, onlycode-scanningwill be enabled. Theanalysis-kindsinput is experimental, for GitHub-internal use only, and may change without notice at any time. #3892html-validate/html-validate (html-validate)
v11.2.0Compare Source
Features
toMatchCodeframe()andtoMatchInlineCodeframe()matchers (5153c12)maltsev/htmlnano (htmlnano)
v3.3.1Compare Source
Fixed
cssnanoversion inpeerDependencies[#432].v3.3.0Compare Source
Changed
cssnano@8.webpro-nl/knip (knip)
v6.14.1: Release 6.14.1Compare Source
e1c1b17) - thanks @jinhyuk9714!9dae641)919cba2)v6.14.0: Release 6.14.0Compare Source
d654ec7)e7122a1)2308b5a)6c34287)eee3b89)7ffdc2f)64e5072)0987421)bebe750)77efb32)38d91b6)9149437)a661a21)c11d62f)d4b59d8)694dbf4)6f12997)f21a587)8db5346)662ceaf)v6.13.1: Release 6.13.1Compare Source
44738d6) - thanks @joshkel!74420a6)export * asre-exported namespace case (5923af4).mtsand.ctsconfig files to some plugins (69d1e83)@generated/*, handle local plugin paths (ce5f767){projectRoot}/{workspaceRoot}token variables (8715312)v6.13.0: Release 6.13.0Compare Source
abb08b0) - thanks @unrevised6419!projects(#1710) (7cb2d37) - thanks @joshkel!4c96fd2)6e726a2)42497c2)e566c4b)a123d5c)edfee2b)7c5acc4)0b68b81)8788c1a)0fed975)999a5e3)f63537a)isaacs/node-lru-cache (lru-cache)
v11.4.0Compare Source
stackblitz-labs/pkg.pr.new (pkg-pr-new)
v0.0.74Compare Source
v0.0.73Compare Source
v0.0.72Compare Source
pnpm/pnpm (pnpm)
v11.1.2Compare Source
Patch Changes
convertEnginesRuntimeToDependencies: switch the runtime-dependency write toObject.definePropertyso the CodeQLjs/prototype-polluting-assignmentrule treats the assignment as safe regardless of the property name (follow-up to #11609).Address CodeQL static-analysis findings: guard manifest dependency writes against prototype-polluting keys (
__proto__,constructor,prototype), and replace a potentially super-linear semver-detection regex in registry 404 hints with an O(n) parser.Strip
sec-fetch-*headers from outgoing HTTP requests. These headers are automatically added by undici'sfetch()implementation per the Fetch spec but cause Azure DevOps Artifacts to return HTTP 400 for uncached upstream packages, as ADO interprets them as browser requests #11572.Fix
minimumReleaseAgehandling for cached abbreviated metadata.The version-spec cache fast path no longer rethrows
ERR_PNPM_MISSING_TIMEunderstrictPublishedByCheck; it now falls through to the registry-fetch path, consistent with the adjacent mtime-gated cache block.When the registry returns 304 Not Modified for a package whose cached metadata is abbreviated (no per-version
time), pnpm now re-fetches withfullMetadata: trueifminimumReleaseAgeis active and the package was modified after the cutoff. The upgraded metadata is persisted to disk so subsequent installs don't repeat the fetch. Previously the abbreviated meta was used as-is and the maturity check fell back to its warn-and-skip path, silently bypassing the quarantine and emitting a misleading "metadata is missing the time field" warning.Closes #11619.
Fix
pnpm upgrade --interactive --latest -rnot respecting named catalog groups. Previously, upgrading a dependency using a named catalog (e.g."catalog:foo") would incorrectly rewritepackage.jsonto"catalog:"and place the updated version in the default catalog instead of the named one #10115.Fixed
optimisticRepeatInstallskippingpnpm-lock.yamlmerge conflict resolution when the existingnode_modulesstate appears up to date.Fix
minimumReleaseAge/resolutionMode: time-basedinstalls failing on lockfiles whosetime:block is missing entries. The npm-resolver's peek-from-store fast path now surfacespublishedAtfrom the lockfile rather than discarding it, and falls through to a registry metadata fetch when the time-based cutoff can't be computed from the data on hand.v11.1.1Compare Source
Patch Changes
checkDepsStatus(run byverifyDepsBeforeRun). Previously the status check calledfindWorkspaceProjects, which validates each project'senginesandos/cpu/libcand warns about useless fields in non-root manifests — work that the install pipeline already performs. With nonodeVersionthreaded through, the engine check also fell back to the system Node fromPATHand emitted spurious "Unsupported engine" warnings before scripts ran. Status-only callers now usefindWorkspaceProjectsNoCheck; install paths continue to validate.pnpm add <alias>:@​scope/pkgfor named registries. The local resolver was claiming any specifier containing/as a local directory, sopnpm add bit:@​teambit/bit(withbitconfigured undernamedRegistries) installed a bogus link tobit:@​teambit/bit/instead of resolving from the configured registry. The local resolver now runs after the named-registry resolver in the resolution chain.@zkochan/cmd-shimto 9.0.3. The sh shim it writes for.cmd/.battargets now escapes the/Cswitch as//C, so it survives the path translation Git Bash applies when launchingcmd.exe. Without this, a bare/Cwas rewritten toC:\before reaching cmd.exe — the switch was dropped, cmd started interactively, and the calling script saw the cmd banner instead of the wrapped command's output. Affects any cmd-shim-wrapped batch script invoked from Git Bash / MSYS / Cygwin on Windows. See pnpm/cmd-shim#55.pnpm/action-setup (pnpm/action-setup)
v6.0.8Compare Source
rollup/rollup (rollup)
v4.60.4Compare Source
2026-05-14
Bug Fixes
Pull Requests
bloomberg/ts-blank-space (ts-blank-space)
v0.9.0Compare Source
What's Changed
Full Changelog: bloomberg/ts-blank-space@v0.8.0...v0.9.0
unjs/unimport (unimport)
v6.3.0Compare Source
🚀 Features
rolldown/utilsfor parsing - by @danielroe and danielroe in #537 (53a96)🏎 Performance
View changes on GitHub
vitejs/vite (vite)
v8.0.13Compare Source
Features
onEnd(#22357) (47071ce)Bug Fixes
write=false(#22328) (158e8ae)name/originalFileNamein syntheticassetFileNamescall (#22439) (8e59c97)isBundledper environment (#22257) (a576326)Miscellaneous Chores
vuejs/router (vue-router)
v5.0.7Compare Source
🚀 Features
defineParamParser()more intuitive - by @posva (8715b)@vue/devtools-api- by @posva (87c3a)params: {}workaround in discarded params warning - by @posva and shanliuling in #2689 (c2b13)🐞 Bug Fixes
@vue/language-coreimport - by @danielroe in #2710 (8af50)View changes on GitHub
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.