Repository navigation
📦：bump all - #1920
Merged
Merged
📦：bump all#1920
Conversation
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
added
🏗️ Category: Build
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
24.19.1→24.19.2v7.0.0→v7.1.09.2.2→9.6.09.9.0(+2)0.60.1→0.62.00.64.0(+1)v4.38.2→v4.38.3v4.39.05.4.2→5.4.35.5.012.9.1→12.12.112.14.0(+1)12.9.1→12.12.112.14.0(+1)8.5.28→8.5.298.5.31(+1)3.9.9→3.9.1026.10.2→26.10.1126.10.124.6.5→4.6.64.6.7Release Notes
actions/setup-node
v7.1.0Compare Source
What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v7.0.0...v7.1.0
cssnano/cssnano (cssnano)
v9.6.0: v9.6.0Compare Source
What's Changed
New Features
row-gap/column-gap,overscroll-behavior-x/-y,flex-direction/flex-wrap,column-rule-*and equaloverflow-x/-yinto their shorthands when every target supports themBug Fixes
refactor: remove cssesc dependency
fix: improve escape handling in selectors
fix: update postcss-calc
fix: accept the optional leading rounding strategy of
round(), such asround(up, 1s, 1s), when postcss-ordered-values orders animations and transitions and when postcss-merge-longhand folds shorthands. The rounding strategy must be separated by a comma, soround(up 1px, 2px)is no longer treated as valid.Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.5.0...cssnano@9.6.0
v9.5.0: v9.5.0Compare Source
What's Changed
New Features
Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.4.0...cssnano@9.5.0
v9.4.0: v9.4.0Compare Source
What's Changed
New Features
Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.2...cssnano@9.4.0
v9.3.2: v9.3.2Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.1...cssnano@9.3.2
v9.3.1: v9.3.1Compare Source
What's Changed
Bug Fixes
Fix a crash because of a dependency on an unpublished version of cssnano-utils
Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.0...cssnano@9.3.1
v9.3.0: v9.3.0Compare Source
What's Changed
New Features
Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.2.2...cssnano@9.3.0
dprint/dprint (dprint)
v0.62.0Compare Source
Changes
--linesflag todprint fmtfor range formatting (#1329)--reload[=config|plugins]flag (#1328)extends(#1332)--configfile's directory with only its unanchored patterns (#1314)--pluginsCLI flag (#1319)Install
Run
dprint upgradeor see https://dprint.dev/install/Verification
These artifacts have build provenance attestations.
Verify a download with the GitHub CLI:
Checksums
v0.61.1Compare Source
Changes
Install
Run
dprint upgradeor see https://dprint.dev/install/Verification
These artifacts have build provenance attestations.
Verify a download with the GitHub CLI:
Checksums
v0.61.0Compare Source
Changes
This is going to enable dprint-plugin-roslyn to be a Wasm plugin and run sandboxed.
Install
Run
dprint upgradeor see https://dprint.dev/install/Verification
These artifacts have build provenance attestations.
Verify a download with the GitHub CLI:
Checksums
github/codeql-action
v4.38.3Compare Source
nodeca/js-yaml (js-yaml)
v5.4.3Compare Source
Fixed
line, #802.
pnpm/pnpm (pnpm)
v12.12.1: pnpm 12.12.1Compare Source
This release adds OIDC authentication to
pnpm dist-tagand thetool:protocol.pnpm publishnow checks which registry anNPM_ID_TOKENwas issued for before using it.Patch Changes
pnpm publishnow uses anNPM_ID_TOKENonly if itsaudclaim matches the selected registry, such asnpm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.pnpm dist-tag add,rm, andlsnow support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.Added the
tool:protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn.pnpm add bun@tool:1.3.0,pnx node@tool:22, andpnx yarn@tool:4work like theruntime:spelling, which stays supported as an alias. A lockfile written forruntime:stays up to date whenpackage.jsonswitches totool:, and the other way around.A named registry can no longer be called
tool.Platinum Sponsors
Gold Sponsors
v12.12.0: pnpm 12.12.0Compare Source
This release shares task results and dependency builds through a remote cache, adds the
addMissingPeerTypessetting, and letspnpm add --configandpnpm updatemanage configuration dependencies. It also fixesdangerouslyAllowAllBuildsrunning the build scripts of packages thatallowBuildsdenies.Minor Changes
pnpm pipelinecan share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache.The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new
remoteCachesetting, which names the server and holds the signing keys.pnpm pipeline --reportrecords the run under the organizationremoteCache.orgnames.Added the
addMissingPeerTypessetting, which links the@typespackage of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends onreactgets the project's@types/reactlinked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on #15689.pnpm add --configandpnpm updatenow handle configuration dependencies the way they handle other dependencies #16814.pnpm add --configsaves a version range inpnpm-workspace.yamlby the same rules aspnpm add, sopnpm add --config my-config@latestsaves a range such as^1.2.0. It also resolves the package again whenpnpm-lock.yamlalready locks an older version.pnpm updateupdates configuration dependencies within their ranges, andpnpm update --latestmoves them to their latest version. A selector such aspnpm update my-configupdates only the configuration dependencies it names.Patch Changes
A package set to
falseinallowBuildsno longer runs its build scripts whendangerouslyAllowAllBuildsistrue. The two settings together now allow every build except the denied ones. Previously,dangerouslyAllowAllBuildsignored the denials.pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an
.npmrcfile, or_auth, or apnpm-workspace.yamlit could not parse, stopped every command,pnpm --versionincluded.pnpm updateandpnpm whyaccept--depth Infinityagain. They failed withinvalid value 'Infinity' for '--depth <DEPTH>'#16817.pnpm deploywithoutinjectWorkspacePackagesnow binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed withERR_PNPM_DEPLOY_AMBIGUOUS_PEERwhenever other packages in the deployed graph depended on different versions of that peer #16807.pnpm deploy --legacyno longer fails withERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVERwhen a workspace dependency of the deployed project declares aworkspace:peer dependency that the project does not depend on itself. pnpm now copies that peer from the workspace into the deploy directory.An auto-installed peer declared with
workspace:now always resolves to the workspace project. Previously,workspace:*andworkspace:^1.0.0peers could be installed from the registry #16806.Repeat installs no longer resolve again when an injected workspace package lists a dependency also as a peer dependency.
Sped up frozen installs of unchanged injected workspace packages that use hardlinks.
Sped up workspace discovery with subtree exclusions such as
!generated/**.A key under a registry URL in the
_authsetting that does not start with@is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds anauthTokenobject but lacks its@, such asorgfor@org, is still an error.Platinum Sponsors
Gold Sponsors
v12.11.2: pnpm 12.11.2Compare Source
This release fixes
--workspace-concurrency=Infinity, filters set by anupdateConfighook, and store fetches withenable-modules-dir=false.Patch Changes
--workspace-concurrency=Infinitynow runs workspace projects with no concurrency limit. It used to fail withinvalid digit found in string#16793.pnpm installand other recursive commands now apply thefilterandfilterProdthat anupdateConfighook sets. They used to run on every workspace project #16792.enable-modules-dir=falsenow also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.Platinum Sponsors
Gold Sponsors
v12.11.1: pnpm 12.11.1Compare Source
This release fixes two ways
pnpm installcould fail, runs tools of any Rust release throughpnx, and treatsregistry.npmjs.comas an alias of the npm registry.Patch Changes
pnpm installno longer fails whenpackageManagerpins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.pnpm installno longer fails withERR_PNPM_CMD_SHIM_CHMODwhennode_modules/.binholds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.enable-modules-dir=false(enableModulesDir: falsethrough the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing undernode_modules. The setting exists for anode_modulesthat something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain--lockfile-onlyrun still fetches nothing.pnpm packandpnpm publishno longer put.npmignoreand.gitignorefiles in the tarball. Afilesentry that names one still ships it.pnpm now treats
https://registry.npmjs.com/as an alias ofhttps://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.pnx --package=rust@<channel> <tool>runs a tool of that Rust release, for examplepnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets fromrust-toolchain.tomland the target of each--targetargument.pnpm installnow links agent skills for more coding agents. It detects the agent fromANTIGRAVITY_AGENT,COPILOT_AGENT,COPILOT_CLI,CODEX_THREAD_ID,CODEX_SANDBOX,AI_AGENT, andCLAUDE_CODEpnpm/tasks#116.When the registry rejects
pnpm stage publish, the error message now starts with "Failed to stage package".Platinum Sponsors
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.