chore(deps): update all-minor-updates #6
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: lucasoskorep/mta-sign#6
Reference in New Issue
Block a user
Delete Branch "renovate/minor"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
25.1.0→25.5.019.2.10→19.2.145.1.2→5.2.010.4.24→10.4.271.13.4→1.14.010.0.0→10.1.016.1.6→16.2.128.0.0→28.1.016.1.6→16.2.125.5.0→25.8.210.28.2→10.33.08.5.6→8.5.84.0.18→4.1.24.12.0→4.13.0Release Notes
vitejs/vite-plugin-react (@vitejs/plugin-react)
v5.2.0Compare Source
v5.1.4Compare Source
Fix
canSkipBabelnot accounting forbabel.overrides(#1098)When configuring
babel.overrideswithout top-level plugins or presets, Babel was incorrectly skipped. ThecanSkipBabelfunction now checks foroverrides.lengthto ensure override configurations are processed.v5.1.3Compare Source
postcss/autoprefixer (autoprefixer)
v10.4.27Compare Source
package.json.v10.4.26Compare Source
v10.4.25Compare Source
axios/axios (axios)
v1.14.0Compare Source
This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.
⚠️ Important Changes
proxy-from-envv2 alignment andmainentry compatibility fix).🚀 New Features
🐛 Bug Fixes
ReadableStreamcreated during request-stream capability probing to prevent async resource leaks. (#7515)proxy-from-envv2 usage. (#7499)mainentry regression affecting CJS consumers. (#7532)🔧 Maintenance & Chores
formidableand refreshed package set to newer versions. (#7533, #10556)🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve Axios:
Full Changelog: v1.13.6...v1.14.0
v1.13.6Compare Source
This release focuses on platform compatibility, error handling improvements, and code quality maintenance.
⚠️ Important Changes
🚀 New Features
🐛 Bug Fixes
Environment Compatibility:
Error Handling:
🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors! Thank you for helping improve the project:
Full Changelog: v1.13.5...v1.13.6
v1.13.5Compare Source
Release 1.13.5
Highlights
__proto__key inmergeConfig. (PR #7369)AxiosErrorcould be missing thestatusfield on and after v1.13.3. (PR #7368)Changes
Security
__proto__key inmergeConfig. (PR #7369)Fixes
statusis present inAxiosErroron and after v1.13.3. (PR #7368)Features / Improvements
isAbsoluteURL. (PR #7326)Documentation
Bufferconstructor usage and README formatting. (PR #7371)CI / Maintenance
karma-sourcemap-loaderfrom 0.3.8 to 0.4.0. (PR #7360)New Contributors
Full Changelog: https://github.com/axios/axios/compare/v1.13.4...v1.13.5
eslint/eslint (eslint)
v10.1.0Compare Source
Features
ff4382bfeat: apply fix forno-varinTSModuleBlock(#20638) (Tanuj Kanti)0916995feat: Implement api support for bulk-suppressions (#20565) (Blake Sager)Bug Fixes
2b8824efix: Preventno-varautofix when a variable is used before declaration (#20464) (Amaresh S M)e58b4bffix: update eslint (#20597) (renovate[bot])Documentation
b7b57fedocs: use correct JSDoc link in require-jsdoc.md (#20641) (mkemna-clb)58e4cfcdocs: add deprecation notice partial (#20639) (Milos Djermanovic)7143dbfdocs: update v9 migration guide for@eslint/jsusage (#20540) (fnx)035fc4fdocs: note thatglobalReturnapplies only withsourceType: "script"(#20630) (Milos Djermanovic)e972c88docs: merge ESLint option descriptions into type definitions (#20608) (Francesco Trotta)7f10d84docs: Update README (GitHub Actions Bot)aeed007docs: open playground link in new tab (#20602) (Tanuj Kanti)a0d1a37docs: Add AI Usage Policy (#20510) (Nicholas C. Zakas)Chores
a9f9ccechore: update dependency eslint-plugin-unicorn to ^63.0.0 (#20584) (Milos Djermanovic)1f42bd7chore: updateprettierto 3.8.1 (#20651) (루밀LuMir)c0a6f4achore: update dependency @eslint/json to ^1.2.0 (#20652) (renovate[bot])cc43f79chore: update dependency c8 to v11 (#20650) (renovate[bot])2ce4635chore: update dependency @eslint/json to v1 (#20649) (renovate[bot])f0406eechore: update dependency markdownlint-cli2 to ^0.21.0 (#20646) (renovate[bot])dbb4c95chore: remove trunk (#20478) (sethamus)c672a2atest: fix CLI test for empty output file (#20640) (kuldeep kumar)c7ada24ci: bump pnpm/action-setup from 4.3.0 to 4.4.0 (#20636) (dependabot[bot])07c4b8btest: fixRuleTestertest without test runners (#20631) (Francesco Trotta)079bba7test: Add tests forisValidWithUnicodeFlag(#20601) (Manish chaudhary)5885ae6ci: unpin Node.js 25.x in CI (#20615) (Copilot)f65e5d3chore: update pnpm/action-setup digest tob906aff(#20610) (renovate[bot])v10.0.3Compare Source
Bug Fixes
e511b58fix: update eslint (#20595) (renovate[bot])f4c9cf9fix: include variable name inno-useless-assignmentmessage (#20581) (sethamus)ee9ff31fix: update dependency minimatch to ^10.2.4 (#20562) (Milos Djermanovic)Documentation
9fc31b0docs: Update README (GitHub Actions Bot)4efaa36docs: add info box foreslint-plugin-eslint-comments(#20570) (DesselBane)23b2759docs: add v10 migration guide link to Use docs index (#20577) (Pixel998)80259a9docs: Remove deprecated eslintrc documentation files (#20472) (Copilot)9b9b4badocs: fix typo in no-await-in-loop documentation (#20575) (Pixel998)e7d72a7docs: document TypeScript 5.3 minimum supported version (#20547) (sethamus)Chores
ef8fb92chore: package.json update for eslint-config-eslint release (Jenkins)e8f2104chore: updates for v9.39.4 release (Jenkins)5cd1604refactor: simplify isCombiningCharacter helper (#20524) (Huáng Jùnliàng)70ff1d0chore: eslint-config-eslint require Node^20.19.0 || ^22.13.0 || >=24(#20586) (Milos Djermanovic)e32df71chore: update eslint-plugin-eslint-comments, remove legacy-peer-deps (#20576) (Milos Djermanovic)53ca6eechore: disableeslint-comments/no-unused-disablerule (#20578) (Milos Djermanovic)e121895ci: pin Node.js 25.6.1 (#20559) (Milos Djermanovic)efc5aefchore: updatetsconfig.jsonineslint-config-eslint(#20551) (Francesco Trotta)v10.0.2Compare Source
Bug Fixes
2b72361fix: updateajvto6.14.0to address security vulnerabilities (#20537) (루밀LuMir)Documentation
13eeedbdocs: link rule type explanation to CLI option --fix-type (#20548) (Mike McCready)98cbf6bdocs: update migration guide per Program range change (#20534) (Huáng Jùnliàng)61a2405docs: add missing semicolon in vars-on-top rule example (#20533) (Abilash)Chores
951223bchore: update dependency @eslint/eslintrc to ^3.3.4 (#20553) (renovate[bot])6aa1afechore: update dependency eslint-plugin-jsdoc to ^62.7.0 (#20536) (Milos Djermanovic)v10.0.1Compare Source
Bug Fixes
c87d5bdfix: update eslint (#20531) (renovate[bot])d841001fix: updateminimatchto10.2.1to address security vulnerabilities (#20519) (루밀LuMir)04c2147fix: update error message for unused suppressions (#20496) (fnx)38b089cfix: update dependency @eslint/config-array to ^0.23.1 (#20484) (renovate[bot])Documentation
5b3dbcedocs: add AI acknowledgement section to templates (#20431) (루밀LuMir)6f23076docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)b69cfb3docs: Update README (GitHub Actions Bot)Chores
e5c281fchore: updates for v9.39.3 release (Jenkins)8c3832achore: update @typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)8330d23test: add tests for config-api (#20493) (Milos Djermanovic)37d6e91chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)da7cd0erefactor: cleanup error message templates (#20479) (Francesco Trotta)84fb885chore: package.json update for @eslint/js release (Jenkins)1f66734chore: addeslinttopeerDependenciesof@eslint/js(#20467) (Milos Djermanovic)vercel/next.js (eslint-config-next)
v16.2.1Compare Source
Core Changes
cacheComponents(#91711){eval:true}in worker_threads constructors (#91666)Credits
Huge thanks to @icyJoseph, @abhishekmardiya, @ijjk, @mischnic, @unstubbable, @sokra, and @lukesandberg for helping!
v16.2.0Compare Source
Core Changes
f93b9fd4-20251217to65eec428-20251218: #87323experimental.strictRouteTypesconfig: #87378satisfieswhen validating page and route modules: #87398numberinconfig.api.bodyParser.sizeLimitwhen validating route: #87633images.maximumResponseBodyconfig: #88183'use cache'wrapper: #88219'use cache'function calls: #86920pending revalidates...debug log if applicable: #88221noUncheckedSideEffectImportsfor CSS imports: #88199/_next/routes: #8835365eec428-20251218to3e1abcc8-20260113: #88530interopDefault: #884863e1abcc8-20260113to4a3d993e-20260114: #885474a3d993e-20260114tobef88f7c-20260116: #88649--debug-build-pathsbracket escaping for glob patterns: #88660--debug-build-paths: #88654next start --inspect: #88744--debug-build-pathssupport to filter routes: #88655bef88f7c-20260116to41b3e9a6-20260119: #8875641b3e9a6-20260119tod2908752-20260119: #88774rewroteURLtorewrittenPathnamein request metadata: #88751getImplicitTagsto accept pathname instead of url object: #88753NEXT_DEPLOYMENT_IDglobal: #86738<html data-dpl-id>and don't inline it into JS anymore: #88761revalidatePathwith params and trailing slash when deployed: #88623d2908752-20260119tob546603b-20260121: #88860deploymentIdfrom App RouterRenderOptsPartial: #88866b546603b-20260121to24d8716e-20260123: #88963?dpl=to all asset urls returned by Turbopack: #88828useEffectEventto disallowed React APIs in Server Components: #88985renderOpts.nextExporttoisBuildTimePrerendering: #88951README.mds: #89022__turbopack_load_by_url__with query: #8889924d8716e-20260123to8c34556c-20260126: #89066baseline-browser-mappingwarnings: #89175.mdlicenses are included in vendored packages: #8920110680271-20260126to230772f9-20260128: #89250tarused to extract SWC binary : #89158browserslistdoesn't issue outdated warnings forbaseline-browser-mapping: #89287230772f9-20260128toda641178-20260129: #89301rules.*.typeconfig to allow changing the type of a module: #88788logging.serverFunctions: #89321'use cache'functions: #89408da641178-20260129toed4bd540-20260202: #89401ed4bd540-20260202tob1533b03-20260203: #89444b1533b03-20260203to3e00319b-20260203: #89449experimental.reportSystemEnvInliningfor Turbopack: #89304instant(): #89469cacheLifeon outer"use cache"when nesting short-lived caches: #894813e00319b-20260203to95ffd6cd-20260205: #89550discoverRoutes()API: #8897195ffd6cd-20260205to2dd9b7cf-20260208: #89681AggregateError.errorsin terminal output: #889992dd9b7cf-20260208to272441a9-20260209: #89722next dev: #89798type: "text"under a new experimental flag, following what webpack did: #89560use: #89793experimental.appNewScrollHandler: #83107272441a9-20260209to6066c782-20260212: #89923--debug-prerenderis set: #89834require.resolve()to get the installednextversion: #89166prefetch={true}on Links to routes withinstant: #900616066c782-20260212to4842fbea-20260217: #90144pnpm build: #89819images.maximumDiskCacheSize: #89963isPartialbyte stripping when deployed: #902722ba30655-20260219toab18f33d-20260220: #90279ignoreListof 3rd party sourcemaps in Redbox: #90317AggregateError: #90391config.reactProductionProfilingfor Webpack: #90430rust-toolchain: #90442ab18f33d-20260220toc0060cf2-20260224: #90452NEXT_TEST_NATIVE_DIRis specified: #90387unstable_instantis used in Client Component: #90396experimental.reactDebugChannelby default: #90310c0060cf2-20260224to98ce535f-20260226: #90605reset()from user's global-error: #89684unstable_retry()to error.js: #89685restartevent: #90550next devandnext build: #90603unstable_instantexports: #90273unstable_retry(): #8973298ce535f-20260226to4cc5b7a9-20260303: #90827transitionTypesprop tonext/link: #90701isRoutePPREnabledfrom render options and delete dead PPR branch: #90713PrerenderStorePPRtype and allprerender-pprswitch cases: #907214cc5b7a9-20260303to3bc2d414-20260304: #90876@vercel/ogandsatorivendors: #90933experimental.cachedNavigationsfeature flag: #909283bc2d414-20260304to46103596-20260305: #90989picocolorsto 1.1.1: #9125246103596-20260305to5e9eedb5-20260312: #91272--inspectis used: #91271generateStaticParamsin instant navigation shell: #91316turbo_tasks::functionfrom ModuleReference getters: #91229generateStaticParams: #91189undefinedouter work unit store in"use cache": #91190unstable_dynamicStaleTimeroute segment config: #91437unstable_catchError()API for component-level error recovery: #89688cargo doc --no-deps --workspace, and run rustdoc as part of our CI checks: #91339http-proxylib: #91480unstable_catchErrortype inference for fallback props: #91485"use cache"functions: #911915e9eedb5-20260312toc80a0750-20260312: #91324generateStaticParams: #91519c80a0750-20260312to3f0b9e61-20260317: #91522Documentation Changes
Optimizing Package Bundlingto include new Bundle Analyzer: #87246unsafe-evalin devContent-Security-Policy: #89163RedirectTypeusage example topermanentRedirect: #89833unstable_catchError(): #89847Example Changes
with-recoilexmaple: #81836with-tigrisexample: #81843Misc Changes
livenessof exports based on assignment analysis (#82802)"": #87214url.parseas possible: #87286namesfield of sourcemaps: #87911format!instead ofanyhow!inside ofanyhow::Context::with_contextcalls: #88293test/integration/invalid-custom-routes/test/index.test.ts: #88416run-tests.jsand remove unusedrelatedflag: #88433NEXT_TEST_SKIP_RETRY_MANIFEST: #88434pack-next --compress: #88439lerna bootstrapfrom thecleanscript in package.json: #88527VcRead::Reprassociated type: #88456declare global {}inVarDeclWithTsDeclareCollector: #88568parent_task_idcompile failure w/tokio_tracingenabled: #88598concurrencyfeature in build-and-test: #87287test/development/app-dir/browser-log-forwarding/fixtures/verbose-level/verbose-level.test.ts: #88754Build Commandssection in AGENTS.md: #88757test/development/app-dir/hydration-error-count/hydration-error-count.test.ts: #88749test/productionfrom deploy tests: #88763buildArgsalso for deploy tests (viapackage.json): #88731cache-components.server-action.test.ts: #88854searchparams-reuse-loading.test.ts: #88821prefetch-runtimetests for deploy tests: #88826Equivalentkeys: #88760/ci-failurescommand: #88960gh auth statusoptional when triggering a release: #89098next-env.d.tsfiles in all top-level apps: #89176node_modulesin route handlers: #89316browser-log-forwarding verbose leveltest suite: #89324_backendfield from TaskGuardImpl: #89015Vc::try_resolve_*methods in favor of theResolvedVcalternatives: #89696ChunkItemwith a single impl in most cases: #89548client_source_mapsbefore generate source map: #89915std::any::type_namefor global naming of turbo-task items: #89874#[derive(ValueToString)]: #89936cache-components-errors: #90105next/linknavigation: #89959jsonimports work by turning it into a source transform: #89631DefaultonPartialProjectOptions, remove sillypartial_project_options_with_debug_build_pathshelper: #901704842fbea-20260217to2ba30655-20260219: #90211act: #90261typed-routes-validatorusingtsc: #90451pnpm buildand into apnpm build-allcommand: #90543typed-routes-validator: #90562getStackFramesContent: #90571testonlytotestheadlessin AGENTS.md: #90578NEXT_TEST_CIinstead ofCIfor e2e test retry guard: #90606evaled modules: #90561VisitMutinstead ofFoldfor debug_instant_stack transform: #90274unstable_instantis used withoutcacheComponents: #90793instant()test helper in the Playwright UI: #90664window.next.versionfor PR builds: #90937ReadVcFuture::strongly_consistentprivate: #90843ReferenceTypeCondition: #91101.context(format!(...)): #91122json-schema-types: #91255turbo_tasks::functionrustdoc: #91132framereceivedpayload: #91266instant-navs-devtools: #91256generateStaticParams: #91188require(/* turbopackChunkingType: parallel */: #91278instant-navs-devtoolsdeflaking: #91345"use cache"tests: #91529architecture.mdfile from turbopack crate: #91473debug = "line-tables-only"for dev builds: #91539Credits
Huge thanks to @icyJoseph, @nextjs-bot, @sokra, @Juneezee, @delbaoliveira, @wbinnssmith, @ztanner, @lukesandberg, @bgw, @naveenkarmegam, @Marukome0743, @pji2918, @nathannewyen, @eps1lon, @ijjk, @feedthejim, @vercel-release-bot, @xusd320, @huozhi, @mischnic, @wyattjoh, @styfle, @timneutkens, @unstubbable, @lubieowoce, @gnoff, @acdlite, @Rani367, @andrewimm, @brookemosby, @karlhorky, @kdy1, @mmastrac, @naaa760, @jgeschwendt, @williambout, @SimeonGriggs, @gaojude, @hanzala-sohrab, @dango0812, @msmx-mnakagawa, @davidgolden, @LucianBuzzo, @devjiwonchoi, @alexcarpenter, @jaffarkeikei, @BradErz, @mintydev789, @Suhaib3100, @pavan-sh, @amannn, @fireairforce, @JamBalaya56562, @wheresrhys, @ericrav, @Thomas465xd, @bgub, @Netail, @robert-j-webb, @bencmbrook, @shadcn, @sigmachirality, @abhishekmardiya, @vvscode, @freek-boon-greenberry, @alubbe, @FurryR, @01-binary, @andrewdamelio, @swarnava, @kristiyan-velkov, @haydenbleasel, @rishishanbhag, @tdarthur, @lavanitha, @agneliutkiene, @Mimori256, @pieh, @sleitor, @jantimon, @clicktodev, @mitul-s, @aurorascharff, @shuding, @jonasherr, @thdxg, @kowyo, @samselikoff, @dependabot, @benfavre, @zamadye, @cursor, and @richardjzhang for helping!
v16.1.7Compare Source
Core Changes
maxPostponedStateSizeis always respected (See: CVE-2026-27979)images.maximumDiskCacheSize(See: CVE-2026-27980)Credits
Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!
jsdom/jsdom (jsdom)
v28.1.0Compare Source
blob.text(),blob.arrayBuffer(), andblob.bytes()methods.getComputedStyle()to account for CSS specificity when multiple rules apply. (@asamuzaK)XMLHttpRequestperformance by using a persistent worker thread, avoiding ~400ms of setup overhead on every synchronous request after the first one.node.getRootNode(),node.isConnected, andevent.dispatchEvent()by caching the root node of document-connected trees.getComputedStyle()to correctly handle!importantpriority. (@asamuzaK)document.getElementById()to return the first element in tree order when multiple elements share the same ID.<svg>elements to no longer incorrectly proxy event handlers to theWindow.FileReaderevent timing andfileReader.resultstate to more closely follow the spec.XMLHttpRequestencountered dispatch errors.fetch()has been used before importing jsdom, by working around undici v6/v7 incompatibilities.nodejs/node (node)
v25.8.2: 2026-03-24, Version 25.8.2 (Current), @RafaelGSSCompare Source
This is a security release.
Notable Changes
SNICallbackinvocation intry/catch(Matteo Collina) - HighheadersDistinct/trailersDistinct(Matteo Collina) - Highpipe_wrap.cc(RafaelGSS) - MediumNGHTTP2_ERR_FLOW_CONTROLerror code (RafaelGSS) - Mediumrealpath.native(RafaelGSS) - Lowlib/fs/promises(RafaelGSS) - LowCommits
2086b7477b] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#8340f9332a40a] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#8222b6937ddb2] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #62271bfb8ad5787] - deps: update undici to 7.24.3 (Node.js GitHub Bot) #62233be6384727f] - deps: upgrade npm to 11.11.1 (npm team) #622162feea5bb97] - deps: V8: overridedepot_toolsversion (Richard Lau) #6234486c04784dd] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#8215197a56a34] - (CVE-2026-21711) permission: include permission check to pipe_wrap.cc (RafaelGSS) nodejs-private/node-private#82004a886c735] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#7959a7f80f2b0] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#794d9c9b628cf] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#83245b55dc786] - (CVE-2026-21712) src: handle url crash on different url formats (RafaelGSS) nodejs-private/node-private#8164bfda307c0] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819pnpm/pnpm (pnpm)
v10.33.0: pnpm 10.33Compare Source
Minor Changes
dedupePeerssetting that reduces peer dependency duplication. When enabled, peer dependency suffixes use version-only identifiers (name@version) instead of full dep paths, eliminating nested suffixes like(foo@1.0.0(bar@2.0.0)). This dramatically reduces the number of package instances in projects with many recursive peer dependencies #11070.Patch Changes
Fail on incompatible lockfiles in CI when frozen lockfile mode is enabled, while preserving non-frozen CI fallback behavior.
When package metadata is malformed or can't be fetched, the error thrown will now show the originating error.
Fixed intermittent failures when multiple
pnpm dlxcalls run concurrently for the same package. When the global virtual store is enabled, the importer now verifies file content before skipping a rename, avoiding destructive swap-renames that break concurrent processes. Also tolerates EPERM during bin creation on Windows and properly propagatesenableGlobalVirtualStorethrough the install pipeline.Fixed handling of non-string version selectors in
hoistPeers, preventing invalid peer dependency specifiers.Improve the non-interactive modules purge error hint to include the
confirmModulesPurge=falseworkaround.When pnpm needs to recreate
node_modulesbut no TTY is available, the error now suggests either settingCI=trueor disabling the purge confirmation prompt viaconfirmModulesPurge=false.Adds a regression test for the non-TTY flow.
Fixed false "Command not found" errors on Windows when a command exists in PATH but exits with a non-zero code. Also fixed path resolution for
--filtercontexts where the command runs in a different package directory.When a pnpm-lock.yaml contains two documents, ignore the first one. pnpm v11 will write two lockfile documents into pnpm-lock.yaml in order to store pnpm version integrities and config dependency resolutions.
Fixed a bug preventing the
clearCachefunction returned bycreateNpmResolverfrom properly clearing metadata cache.Platinum Sponsors
Gold Sponsors
v10.32.1: pnpm 10.32.1Compare Source
Patch Changes
pnpm-workspace.yamlwithout apackagesfield caused all directories to be treated as workspace projects. This broke projects that usepnpm-workspace.yamlonly for settings (e.g.minimumReleaseAge) without defining workspace packages #10909.Platinum Sponsors
Gold Sponsors
v10.32.0: pnpm 10.32Compare Source
Minor Changes
--allflag topnpm approve-buildsthat approves all pending builds without interactive prompts #10136.Patch Changes
lockfile-include-tarball-url. Fixes #10915.Platinum Sponsors
Gold Sponsors
v10.31.0: pnpm 10.31Compare Source
Minor Changes
pnpm-workspace.yaml, comments, string formatting, and whitespace will be preserved.Patch Changes
Added
-Fas a short alias for the--filteroption in the help output.Handle undefined pkgSnapshot in
pnpm why -r#10700.Fix headless install not being used when a project has an injected self-referencing
file:dependency that resolves tolink:in the lockfile.Fixed a race condition when multiple worker threads import the same package to the global virtual store concurrently. The rename operation now tolerates
ENOTEMPTY/EEXISTerrors if another thread already completed the import.When
lockfile-include-tarball-urlis set tofalse, tarball URLs are now always excluded from the lockfile. Previously, tarball URLs could still appear for packages hosted under non-standard URLs, making the behavior flaky and inconsistent #6667.Fixed
optimisticRepeatInstallskipping install whenoverrides,packageExtensions,ignoredOptionalDependencies,patchedDependencies, orpeersSuffixMaxLengthchanged.Fixed
pnpm patch-commitfailing with "unable to access '/.config/git/attributes': Permission denied" error in environments where HOME is unset or non-standard (Docker containers, CI systems).The issue occurred because pnpm was setting
HOMEand the Windows user profile env var to empty strings to suppress user git configuration when runninggit diff. This caused git to resolve the home directory (~) as root (/), leading to permission errors when attempting to access/.config/git/attributes.Now uses
GIT_CONFIG_GLOBAL: os.devNullinstead, which is git's proper mechanism for bypassing user-level configuration without corrupting the home directory path resolution.Fixes #6537
Fix
pnpm why -r --parseablemissing dependents when multiple workspace packages share the same dependency #8100.Fix
link-workspace-packages=trueincorrectly linking workspace packages when the requested version doesn't match the workspace package's version. Previously, on fresh installs the version constraint is overridden to*in the fallback resolution paths, causing any workspace package with a matching name to be linked regardless of version #10173.Fixed
pnpm update --interactivetable breaking with long version strings (e.g., prerelease versions like7.0.0-dev.20251209.1) by dynamically calculating column widths instead of using hardcoded values #10316.Explicitly tell
npmthe path to the globalrcconfig file.The parameter set by the
--allow-buildflag is written toallowBuilds.Fix a bug in which specifying
filteronpnpm-workspace.yamlwould cause pnpm to not detect any projects.Print help message on running pnpm dlx without arguments and exit.
Platinum Sponsors
Gold Sponsors
v10.30.3: pnpm 10.30.3Compare Source
Patch Changes
packageManagerfield failing when pnpm is installed as a standalone executable in environments without a system Node.js #10687.Platinum Sponsors
Gold Sponsors
v10.30.2: pnpm 10.30.2Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
v10.30.1: pnpm 10.30.1Compare Source
Patch Changes
/-/npm/v1/security/audits/quickendpoint as the primary audit endpoint, falling back to/-/npm/v1/security/auditswhen it fails #10649.Platinum Sponsors
Gold Sponsors
v10.30.0: pnpm 10.30Compare Source
Minor Changes
pnpm whynow shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.Patch Changes
pnpm whydependency pruning to prefer correctness over memory consumption. Reverted PR: #7122.pnpm whyandpnpm listperformance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #10596.Platinum Sponsors
Gold Sponsors
v10.29.3: pnpm 10.29.3Compare Source
Patch Changes
pnpm list(andpnpm why) on large dependency graphs by replacing the recursive tree builder with a two-phase approach: a BFS dependency graph followed by cached tree materialization. Duplicate subtrees are now deduplicated in the output, shown as "deduped (N deps hidden)" #10586.allowBuildsnot working when set via.pnpmfile.cjs#10516.enableGlobalVirtualStoreoption is set, thepnpm deploycommand would incorrectly create symlinks to the global virtual store. To keep the deploy directory self-contained,pnpm deploynow ignores this setting and always creates a localized virtual store within the deploy directory.minimumReleaseAgeExcludenot being respected bypnpm dlx#10338.Platinum Sponsors
Gold Sponsors
v10.29.2: pnpm 10.29.2Compare Source
Patch Changes
Reverted fix: Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.
Platinum Sponsors
Gold Sponsors
v10.29.1: pnpm 10.29.1Compare Source
Minor Changes
pnpm dlx/pnpxcommand now supports thecatalog:protocol. Example:pnpm dlx shx@catalog:.auditLevelin thepnpm-workspace.yamlfile #10540.workspace:protocol without version specifier. It is now treated asworkspace:*and resolves to the concrete version during publish #10436.Patch Changes
Fixed
pnpm list --jsonreturning incorrect paths when using global virtual store #10187.Fix
pnpm store pathandpnpm store statususing workspace root for path resolution whenstoreDiris relative #10290.Fixed
pnpm run -rfailing with "No projects matched the filters" when an emptypnpm-workspace.yamlexists #10497.Fixed a bug where
catalogMode: strictwould write the literal string"catalog:"topnpm-workspace.yamlinstead of the resolved version specifier when re-adding an existing catalog dependency #10176.Fixed the documentation URL shown in
pnpm completion --helpto point to the correct page at https://pnpm.io/completion #10281.Skip local
file:protocol dependencies duringpnpm fetch. This fixes an issue wherepnpm fetchwould fail in Docker builds when local directory dependencies were not available #10460.Fixed
pnpm audit --jsonto respect the--audit-levelsetting for both exit code and output filtering #10540.update tar to version 7.5.7 to fix security issue
Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842
Fix
pnpm audit --fixreplacing reference overrides (e.g.$foo) with concrete versions #10325.Fix
shamefullyHoistset viaupdateConfigin.pnpmfile.cjsnot being converted topublicHoistPattern#10271.pnpm helpshould correctly report if the currently running pnpm CLI is bundled with Node.js #10561.Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for
node_modules/.bin, causing binaries to not be found when running commands likepnpm exec#10457.Platinum Sponsors
Gold Sponsors
postcss/postcss (postcss)
v8.5.8Compare Source
Processor#version.v8.5.7Compare Source
vitest-dev/vitest (vitest)
v4.1.2Compare Source
This release bumps Vitest's
flattedversion and removes version pinning to resolveflatted's CVE related issues (#9975).🐞 Bug Fixes
setupFilesfrom parent directory - by @hi-ogawa in #9960 (7aa93)toMatchScreenshotcan't capture a stable screenshot - by @macarie in #9847 (faace)coverageConfigDefaultsvalues and types - by @Arthie in #9940 (b3c99)View changes on GitHub
v4.1.1Compare Source
🚀 Features
matchesTagsto test if the current filter matches tags - by @sheremet-va in #9913 (eec53)experimental.vcsProvider- by @sheremet-va in #9928 (56115)🐞 Bug Fixes
TestProject.testFilesListinternal properly - by @sapphi-red in #9867 (54f26)use- by @oilater in #9831 and #9861 (633ae)vi.advanceTimersto the preview provider - by @sheremet-va in #9891 (1bc3e)--standalonemode without running tests - by @sheremet-va in #9911 (e78ad)body- by @sheremet-va in #9912 (6fdb2)retry.conditionRegExp serialization issue - by @nstepien and @hi-ogawa in #9942 (7b605)testreturn as tests - by @sheremet-va in #9871 (141e7)View changes on GitHub
v4.1.0Compare Source
Vitest 4.1 is out!
This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.
🚀 Features
setTickModeto timer controls - by @atscott and @sheremet-va in #8726 (4b480)toTestSpecificationto reported tasks - by @sheremet-va in #9464 (1a470)vi.mockorvi.hoistedare declared outside of top level of the module - by @sheremet-va in #9387 (5db54)aroundEachandaroundAllhooks - by @sheremet-va in #9450 (2a8cb)neworallin--updateflag - by @sheremet-va in #9543 (a5acf)metain test options - by @sheremet-va in #9535 (7d622)test.extendsyntax - by @sheremet-va in #9550 (e5385)vitest listto statically collect tests instead of running files to collect them - by @sheremet-va in #9630 (7a8e7)--detect-async-leaks- by @AriPerkkio in #9528 (c594d)mockThrowandmockThrowOnce- by @thor-juhasz and @sheremet-va in #9512 (61917)update: "none"and add docs about snapshots behavior on CI - by @hi-ogawa in #9700 (05f18)launchOptionswithconnectOptions- by @hi-ogawa in #9702 (f0ff1)page/locator.markAPI to enhance playwright trace - by @hi-ogawa in #9652 (d0ee5)testinexperimental_parseSpecification- by @jgillick and Jeremy Gillick in #9235 (2f367)createSpecification- by @sheremet-va in #9336 (c8e6c)runTestFilesas alternative torunTestSpecifications- by @sheremet-va in #9443 (43d76)allowWriteandallowExecoptions toapi- by @sheremet-va in #9350 (20e00)toTestSpecification- by @sheremet-va in #9627 (6f17d)userEvent.wheelAPI - by @macarie in #9188 (66080)filterNodeoption to prettyDOM for filtering browser assertion error output - by @Copilot, sheremet-va and @sheremet-va in #9475 (d3220)detailsPanelPositionoption and button - by @shairez in #9525 (c8a31)findElementand enable strict mode in webdriverio and preview - by @sheremet-va in #9677 (c3f37)ignore start/stopignore hints - by @AriPerkkio in #9204 (e59c9)coverage.changedoption to report only changed files - by @kykim00 and @AriPerkkio in #9521 (1d939)onModuleRunnerhook toworker.init- by @sheremet-va in #9286 (e977f)importDurations: { limit, print }options - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9401 (7e10f)importDurations- by @hi-ogawa and Claude Opus 4.6 in #9533 (3f7a5)beforeAll/afterAll- by @sheremet-va in #9572 (c8339)agentreporter to reduce ai agent token usage - by @cpojer in #9779 (3e9e0)retryoptions - by @MazenSamehR, Matan Shavit, @AriPerkkio and @sheremet-va in #9370 (9e4cf)🐞 Bug Fixes
meta.urlincreateRequire- by @sheremet-va in #9441 (e3422)external/noExternalduringconfigEnvironmenthook - by @hi-ogawa and Claude Opus 4.6 in #9508 (59ea2)browser.isolateis used - by @sheremet-va in #9410 (3d48e)vi.mock({ spy: true })node v8 coverage - by @hi-ogawa, hi-ogawa and Claude Opus 4.6 in #9541 (687b6).namefrom statically collected test - by @sheremet-va in #9596 (b66ff)expect.soft- by @iumehara, @hi-ogawa and Claude Opus 4.6 in #9231 (3eb2c)sequence.shuffle.testsis enabled - by @kaigritun, Kai Gritun and @sheremet-va in #9576 (8182b)expect/src/utilsfromvitest- by @hi-ogawa in #9616 (48739)--detect-async-leaks- by @AriPerkkio in #9638 (9fd4c)aroundEach/Allwhen inneraroundEach/Allthrows - by @hi-ogawa in #9657 (4ec6c)aroundEach/Allsetup timed out - by @hi-ogawa in #9670 (bb013)VitestRunnerConfigoptional fields withSerializedConfig- by @hi-ogawa in #9661 (79520)toBe*spy assertions in favor oftoHaveBeen*(andtoThrowError) - by @sheremet-va in #9665 (4d390)aroundEach/Allerrors but aggregate them on runner - by @hi-ogawa in #9673 (b6365)resolves/rejectschained assertion error - by @hi-ogawa in #9679 (c6151)maxConcurrency- by @hi-ogawa in #9653 (16d13)resolve.conditionsfor externals - by @hi-ogawa in #9717 (1d498)mockObjectchange backwards compatible - by @sheremet-va in #9744 (84c69)URL.nameon jsdom - by @hi-ogawa in #9767 (031f3)vi.importActual()for virtual modules - by @hi-ogawa and Claude Opus 4.6 in #9772 (1e89e)FixtureAccessErrorif suite hook accesses undefined fixture - by @sheremet-va in #9786 (fc2ce)loadortransformoriginal module - by @hi-ogawa and Claude Opus 4.6 in #9774 (a8216)hideSkippedTestsshould not hidetest.todo- by @oilater in #9562 and #9781 (8181e)beforeEachhooks - by @hi-ogawa and Claude Opus 4.6 in #9826 (99e52)performance.nowto measure test timeout duration - by @hi-ogawa and Claude Opus 4.6 in #9795 (f48a6)toMatchScreenshotpasses - by @macarie in #9289 (46aab)toMatchScreenshot- by @macarie in #9552 (83ca0)--remote-debugging-addressfrom chrome args - by @hi-ogawa and @AriPerkkio in #9712 (f09bb)ensureAwaited- by @sheremet-va in #9732 (97685)getCDPSessionandcdp()- by @AriPerkkio in #9716 (689a2)deepEqualin the config because it's not serializable - by @sheremet-va in #9666 (9ee99)thresholds.autoUpdateto preserve ending whitespace - by @AriPerkkio in #9436 (7e534)/config/#optionhash links causing hydration errors - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9610 (a603c)toMatchObject(Map/Set)should expectMap/Seton left hand side - by @hi-ogawa and Claude Opus 4.6 in #9532 (381da)toThrowand make Error detection robust - by @hi-ogawa and Claude Opus 4.6 in #9570 (de215)dotreporter leaves pending tests - by @AriPerkkio in #9684 (4d793)undefined- by @sheremet-va in #9511 (6f181)bench.reportersno longer gives type errors when passing file name string paths - by @Bertie690 in #9695 (093c8)🏎 Performance
View changes on GitHub
yarnpkg/berry (yarn)
v4.13.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.
chore(deps): update dependency @types/node to v25.2.0to chore(deps): update all-minor-updates39ac40e884toac7c6a25e7View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.