chore(deps): update devdependencies - #3929
Merged
Merged
Conversation
renovate
Bot
added
c: dependencies
✅ Deploy Preview for fakerjs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## next #3929 +/- ##
=======================================
Coverage 98.92% 98.92%
=======================================
Files 926 926
Lines 3248 3248
Branches 590 590
=======================================
Hits 3213 3213
Misses 31 31
Partials 4 4 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/devdependencies
branch
10 times, most recently
from
July 7, 2026 21:06
d1b5d73 to
4825681
Compare
renovate
Bot
force-pushed
the
renovate/devdependencies
branch
10 times, most recently
from
July 17, 2026 08:59
afbb1ed to
6a29441
Compare
renovate
Bot
force-pushed
the
renovate/devdependencies
branch
4 times, most recently
from
July 20, 2026 07:05
4e5dddf to
224cf66
Compare
renovate
Bot
force-pushed
the
renovate/devdependencies
branch
16 times, most recently
from
August 10, 2026 15:52
678f147 to
667ad77
Compare
renovate
Bot
force-pushed
the
renovate/devdependencies
branch
8 times, most recently
from
August 14, 2026 20:56
dcabcc1 to
7f9e163
Compare
renovate
Bot
force-pushed
the
renovate/devdependencies
branch
from
August 14, 2026 21:50
7f9e163 to
d4dab27
Compare
Shinigami92
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
24.13.2→24.13.37.7.1→7.8.014.3.0→14.4.015.17.0→15.20.19.0.2→9.0.30.3.21→0.3.232.17.5→2.17.60.22.3→0.22.144.22.4→4.23.123.5.38→3.5.413.3.5→3.3.9Release Notes
vueuse/vueuse (@vueuse/core)
v14.4.0Compare Source
🚀 Features
useColorModeauto import if@nuxtjs/color-modeis detected - by @OrbisK in #5476 (60687)onStartTyping- by @LightQuanta and @9romise in #5395 (1f2b7)behavior,blockandinlineto exposed scrollTo method - by @laurens94, @OrbisK, @43081j and @ilyaliao in #4905 (01875)🐞 Bug Fixes
PUREannotation to avoid Rollup warning - by @serkodev and @9romise in #5388 (16933)tryOnScopeDisposeto avoid operating Vue internal API - by @liangmiQwQ in #5548 (2cad7)View changes on GitHub
cypress-io/cypress (cypress)
v15.20.1Compare Source
Changelog: https://docs.cypress.io/app/references/changelog#15-20-1
v15.20.0Compare Source
Changelog: https://docs.cypress.io/app/references/changelog#15-20-0
v15.19.0Compare Source
Changelog: https://docs.cypress.io/app/references/changelog#15-19-0
v15.18.1Compare Source
Changelog: https://docs.cypress.io/app/references/changelog#15-18-1
v15.18.0Compare Source
Changelog: https://docs.cypress.io/app/references/changelog#15-18-0
bcomnes/npm-run-all2 (npm-run-all2)
v9.0.3Compare Source
Merged
#244#243#242#241#237#239#238Commits
7f5fca6d970668publint/publint (publint)
v0.3.23Compare Source
Patch Changes
#248
9ff88ac- Recursively detect test files (e.g.*.test.js,*.spec.ts) for theUSE_FILESsuggestion.#245
ad737a3- TheUSE_FILESmessage now reports which internal files or directories triggered it viaargs.internalFilePathsv0.3.22Compare Source
Patch Changes
#241
7740a62- Support npm v12 and pnpm v11cad0425- Relax git url regex for repository validation#244
393ac4d- Recognize more common internal files for theUSE_FILESsuggestion.#242
4a8dc75- Refactor supported package manager handling from@publint/packapostrophecms/apostrophe (sanitize-html)
v2.17.6Fixes
Security
textareaorxmp) nested inside ansvgormathroot were re-emitted without HTML-escaping.sanitize-htmltreated that content as inert raw text becausehtmlparser210.x classified raw-text elements by tag name and ignored the namespace, but a real HTML5 parser treatstextarea/xmpas ordinary foreign elements inside SVG/MathML and re-parses their contents as live markup. As a result, markup and event-handler attributes that the allowlist never permitted (for example<svg><textarea><img src=x onerror=alert(1)>) could survive sanitization and execute in the browser. This is now fixed on two fronts:htmlparser2was upgraded to 12.x, which is namespace-aware and parsestextarea/xmpinside SVG/MathML as ordinary elements, so their non-allowlisted children (such as the injectedimg) are dropped by the allowlist instead of being preserved as raw text; and any raw-text contentsanitize-htmlstill emits for these tags (at HTML integration points such asforeignObject/mtext, or outside foreign content) is always HTML-escaped. The default configuration is not affected; the precondition is anallowedTagsthat includessvgormathtogether withtextareaorxmp. Thanks to khoadb175 for responsibly disclosing the vulnerability.allowedTagsbypass affecting configurations that allow thetextareaorxmpraw-text tags.htmlparser210.x did not recognize an end tag with a trailing solidus (e.g.</textarea/>) as closing the element, so it kept the following markup as raw text, but a spec-compliant browser treats</textarea/>as a valid close and parses that markup as a live element. Because raw-text content was re-emitted without escaping, a payload such as<textarea></textarea/><img src=x onerror=...>could smuggle non-allowlisted, executable markup through the sanitizer. The default configuration was not affected. This is now defended at two layers:htmlparser2was upgraded to 12.x, whose tokenizer closes these end tags correctly, and the raw text sanitize-html emits for these tags is always escaped so no<can reopen a tag when the output is re-parsed (textarea, an RCDATA element whose entitieshtmlparser2decodes, is escaped like normal text, whilexmp, a raw-text element, has only its angle brackets escaped to avoid double-encoding already-encoded entities). Becausehtmlparser2is ESM-only from version 11 onward,sanitize-htmlnow requires Node.js>=22.12.0(the first 22.x release in whichrequire()of an ES module is available unflagged). Thanks to bibu123456 for reporting the vulnerability and Kayiz-PT for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).rolldown/tsdown (tsdown)
v0.22.14Compare Source
🚀 Features
View changes on GitHub
v0.22.13Compare Source
🚀 Features
neverBundle: trueto externalize all dependencies - by @sxzz (d30a7)🐞 Bug Fixes
View changes on GitHub
v0.22.12Compare Source
🚨 Breaking Changes
View changes on GitHub
v0.22.11Compare Source
🚀 Features
resolveDepSubpathoption - by @sxzz in #1026 (346cb)View changes on GitHub
v0.22.10Compare Source
🚀 Features
🐞 Bug Fixes
peerDependenciesMetadeps - by @sxzz (bad1b)View changes on GitHub
v0.22.9Compare Source
🚀 Features
🐞 Bug Fixes
onlyImport- by @sxzz in #1019 (a625a)View changes on GitHub
v0.22.8Compare Source
🚀 Features
onlyImportoption - by @sxzz and Claude Fable 5 (c5798)🐞 Bug Fixes
View changes on GitHub
v0.22.7Compare Source
🚀 Features
suppressWarningsoption to filter warnings - by @sxzz (dc510)View changes on GitHub
v0.22.6Compare Source
No significant changes
View changes on GitHub
v0.22.5Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v0.22.4Compare Source
🚀 Features
🐞 Bug Fixes
SOURCEMAP_BROKENwarning - by @ocavue in #982 (84b7c)🏎 Performance
View changes on GitHub
privatenumber/tsx (tsx)
v4.23.12Compare Source
Bug Fixes
import.metawhen tokens are split by comments or newlines (#829) (ed9d330), closes #828This release is also available on:
v4.23.11Compare Source
v4.23.10Compare Source
Bug Fixes
This release is also available on:
v4.23.9Compare Source
Bug Fixes
This release is also available on:
v4.23.8Compare Source
Bug Fixes
This release is also available on:
v4.23.7Compare Source
Bug Fixes
This release is also available on:
v4.23.6Compare Source
v4.23.5Compare Source
v4.23.4Compare Source
Bug Fixes
This release is also available on:
v4.23.3Compare Source
Bug Fixes
This release is also available on:
v4.23.2Compare Source
v4.23.1Compare Source
Bug Fixes
Performance Improvements
This release is also available on:
v4.23.0Compare Source
Bug Fixes
Features
This release is also available on:
v4.22.5Compare Source
Bug Fixes
This release is also available on:
vuejs/core (vue)
v3.5.41Compare Source
Bug Fixes
v3.5.40Compare Source
Bug Fixes
v3.5.39Compare Source
Bug Fixes
vuejs/language-tools (vue-tsc)
v3.3.9Compare Source
component-meta
getProgramAndFilefree of side effects (#6136) - Thanks to @seanogdev!language-core
language-service
workspace
typescript-native-bridge(#6129)v3.3.8Compare Source
language-core
workspace
@typescript/typescript6(#6123) - Thanks to @WaldemarEnns!v3.3.7Compare Source
language-core
return(#6115) - Thanks to @KazariEX!typescript-plugin
v3.3.6Compare Source
language-core
.d.tsboundary (#6104) - Thanks to @Holiden!WeakMapto cache inline TS ASTs - Thanks to @KazariEX!v-bindparsing behavior - Thanks to @KazariEX!allCodeFeatures- Thanks to @KazariEX!Configuration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.