Skip to content

chore(deps): update all non-major dependencies - #537

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#537
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update New value References Sourcegraph
eslint (source) 10.14.0 → 10.15.0 age confidence devDependencies minor 10.15.0 homepage, source code search for "eslint"
node (source) >=22.23.4 → >=22.23.5 age confidence engines patch >=22.23.5 homepage, source code search for "node"
node 24.22.2 → 24.22.3 age confidence uses-with patch 24.22.3 source code search for "node"
node (source) 24.22.2-slim → 24.22.3-slim age confidence final patch 24.22.3-slim homepage, source code search for "node"
node (source) 24.22.2 → 24.22.3 age confidence patch 24.22.3 homepage, source code search for "node"
pnpm (source) 12.18.0 → 12.21.0 age confidence devDependencies minor 12.21.0 homepage, source code search for "pnpm"
pnpm (source) 12.18.0 → 12.21.0 age confidence minor 12.21.0 homepage, source code search for "pnpm"
prettier (source) 3.9.10 → 3.10.1 age confidence devDependencies minor 3.10.1 homepage, source code search for "prettier"

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

Release Notes

eslint/eslint (eslint)

v10.15.0

Compare Source

Features

  • ec52157 feat: check proto and assignment targets in func-names (#​21521) (Lê Văn Xuân Hoàn)
  • 34a8b1b feat: recognize string and computed keys in accessor-pairs descriptors (#​21519) (Lê Văn Xuân Hoàn)
  • 663c825 feat: handle TS type assertions in no-invalid-this (#​21464) (Valentin)
  • 4941015 feat: check individual specifier importKind in no-shadow (#​21518) (Lê Văn Xuân Hoàn)
  • 17f17cd feat: update error location to head for default-case (#​21469) (Tanuj Kanti)

Bug Fixes

Documentation

  • 16eb1d9 docs: remove Contributor Pool reference (#​21539) (Nicholas C. Zakas)
  • e368730 docs: discourage non-serializable values in rule options (#​21487) (Vitalii Maslianok)
  • 0146008 docs: revamp code path analysis docs (#​21423) (xbinaryx)
  • aeb2267 docs: revise AI acknowledgment options in templates (#​21489) (lumir)
  • e47a477 docs: Update README (GitHub Actions Bot)
  • 11c66ba docs: fix typo in custom rules documentation (#​21472) (Pixel)

Chores

nodejs/node (node)

v22.23.5: 2026-11-11, Version 22.23.5 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
  • (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
  • (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
  • (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
  • (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
  • (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
  • (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
  • (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
  • (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
  • (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
  • (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
  • (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
  • (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
  • (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
  • (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
  • deps: update llhttp to 9.4.4 (Antoine du Hamel)
  • deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
Commits
actions/node-versions (node)

v24.22.3: 24.22.3

Compare Source

Node.js 24.22.3

pnpm/pnpm (pnpm)

v12.21.0: pnpm 12.21

Compare Source

pnpm 12.21.0 lets pnpm store add prepare tarball and git dependencies for offline installs. It also makes repeated installs keep their peer dependency choices and fixes several lockfile.format: v13, nodeLinker: hoisted, and pnpm deploy failures. If a pnpr server refuses a setting, pnpm now resolves locally.

Minor Changes
  • pnpm store add run in a project now prepares downloaded tarballs for every lockfile entry that pins them. Besides registry packages, pnpm install --offline --frozen-lockfile can then install dependencies on a tarball URL and dependencies on a git host such as GitHub whose lockfile entry records an integrity.
Patch Changes
Installs that failed

  • pnpm now reads a lockfile with a mapping key longer than 1,024 characters written as 'key':, without the ? marker. Before, pnpm install and other commands failed on such a lockfile with ERR_PNPM_BROKEN_LOCKFILE.

  • With lockfile.format: v13, pnpm install no longer fails to create or rewrite the lockfile when a package declares many of its dependencies as peers.

  • Fixed pnpm deploy failing with lockfile.format: v13 when injected workspace packages have hashed peer bindings.

  • Frozen installs with v13 lockfiles now accept valid peer dependencies of injected workspace packages that use catalogs.

  • Fixed injected workspace packages that depend on themselves linking to a nonexistent directory.

  • pnpm install with frozenStore enabled no longer fails with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD when nodeLinker is hoisted. pnpm fetch with nodeLinker: hoisted no longer populates global virtual store links or modifies linked agent skills, and it preserves an existing hoisted node_modules directory #​18037.

  • A requirements.txt beside a pyproject.toml that declares [tool.uv.workspace] without a [project] table no longer makes that directory a Python project. pnpm install stopped there with an error when the directory had a .venv that pnpm did not create #​18023.

Peer dependencies

  • Repeated installs no longer change the peer dependency providers that the previous install chose. This covers adding, updating, or removing a dependency, projects that use different ranges of one dependency, dependency cycles, and injected dependencies with autoInstallPeers: false pnpm/tasks#221.

    An unchanged install keeps a valid locked peer provider even when a direct dependency provides another compatible version. Explicit pnpm add and pnpm update requests take precedence over it.

  • Workspace projects that select different versions of a peer provider no longer share one copy of the package that depends on it. This affected peers reached through an aliased dependency or a peer dependency cycle.

  • A removed dependency no longer comes back as a peer provider. Before, a direct dependency removed with autoInstallPeers: false could be restored from an old peer resolution, and a removed one could still supply its old peer context.

  • With nodeLinker: hoisted and autoInstallPeers: false, pnpm install no longer creates duplicate copies of a package whose resolved peers are identical. A package also no longer loads a copy of its dependency that was resolved with different peer versions #​18003.

  • pnpm deploy now binds optional peers declared only in peerDependenciesMeta for linked workspace packages. The deployed manifest and lockfile also retain these peers when filtering dependency groups.

Running scripts

  • Scripts now stop when pnpm's process group is killed while they are starting.

  • Bin shims in the global virtual store no longer include the hoisted modules directory of the project that installed them #​18035.

  • pnpm pipeline now rebuilds local packages and reruns build scripts after it restores a shared Cargo build cache with Cargo 1.100 or newer. Before, a worktree could reuse build-script output from the worktree that created the cache.

pnpr

  • If the pnpr server refuses a setting the install uses, or cannot return the lockfile format pnpm reads, pnpm install and pnpm update print a warning and resolve locally. Cargo and Python resolution also fall back to resolving locally. pnpm now rejects a pnpr resolution of npm dependencies that does not name its lockfile format.

  • pnpm install with pnprServer now limits the size of the server's resolve and lockfile verification responses. An oversized response ends the request with an error.

  • pnpm now displays pnpr error codes and reasons when remote requests fail.

Other commands and settings

  • pnpm setup and the install script now support PowerShell as the login shell on Linux and macOS. They add PNPM_HOME to PATH in profile.ps1 under $XDG_CONFIG_HOME/powershell or ~/.config/powershell #​18026.

  • A lockfileDir setting that points at the default lockfile directory now installs the same way as leaving it unset pnpm/tasks#275.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit Cloudflare

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude Syntax

v12.20.0: pnpm 12.20

Compare Source

pnpm 12.20.0 records the specifiers of local directory dependencies in the experimental v13 lockfile and fixes several nodeLinker: hoisted, peer dependency, and overrides bugs. The bundled node-gyp no longer ships the undici version that security scanners flag. Remote resolution and shared build caches no longer work with pnpr 0.1.0-alpha.19 or older.

Minor Changes
  • With lockfile.format: v13, pnpm install records the dependency specifiers of local directory packages. Frozen installs reject changed specifiers even when the locked versions still satisfy them.
Patch Changes
Upgrading and security

  • Remote resolution, shared build caches, and release notes no longer work with pnpr 0.1.0-alpha.19 or older. pnpm now reads the capabilities a pnpr server advertises under pnpr.protocols. Installs fail when the server does not confirm the requested resolution and verification policies.

  • The node-gyp bundled with pnpm no longer ships undici 6, which security scanners flag for CVE-2026-84947. On Node.js 26, node-gyp downloads through a proxy or with a custom CA file no longer crash with "invalid onError method" #​17941.

Resolving dependencies

  • Version-selector overrides entries such as "ms@^2.0.0": "2.1.1" now apply to dependencies declared with the catalog: protocol when the catalog entry's range matches the selector #​17922.

  • A root overrides entry that points a package at a workspace: path, such as workspace:./packages/foo, now also applies when a registry package depends on that package pnpm/tasks#270.

  • Git dependencies now accept npm's :: separator between fragment parameters, such as github:owner/repo#v1.0.0::path:packages/foo. Before, pnpm read the whole fragment as a branch name and failed to resolve it #​17827.

  • pnpm dedupe now keeps a locked runtime version, from devEngines.runtime or from a dependency's engines.runtime, when the declared range still admits it. pnpm dedupe --check no longer fails each time a newer Node.js release in the range comes out #​17984.

  • With autoInstallPeersFromHighestMatch, conflicting non-semver peer dependencies now remain missing, and identical non-semver peer specifiers are preserved. Preferred registry versions no longer replace local paths or protocol-prefixed specifiers when pnpm installs missing peers pnpm/tasks#272.

Hoisted node linker
  • With nodeLinker: hoisted, a package now keeps its nested copy of a dependency that it resolved at a version other than the top-level one, including a peer dependency its parent supplies. Before, pnpm could remove that copy as a duplicate or give the top-level slot to a peer variant found deeper in the graph. The package then loaded the top-level version.
Lockfile and peer dependency graphs

  • Fixed pnpm install keeping stale peer bindings after dependency changes. Required dependencies no longer remain marked optional when another workspace project removes a shared package pnpm/tasks#221.

  • Repeated installs now keep the same dependency links when packages form cycles with several peer dependency variants pnpm/tasks#221.

  • Fixed writing lockfile.format: v13 for dependency cycles with missing, optional, or transitive peers. Frozen installs also accept unchanged injected packages whose peers use catalogs. With --no-optional, frozen installs reject required catalog children recorded only as optional dependencies pnpm/tasks#221.

  • pnpm deploy preserves an injected workspace package's resolved dependencies when they differ from the workspace project's own dependencies. This also applies to packages with publishConfig.directory pnpm/tasks#221.

Running scripts and runtimes

  • Scripts that pnpm runs in a process group of their own are now ended when pnpm is killed right after starting them. A parallel run that was killed before pnpm registered its scripts left all of them running.

  • When a command name matches no script and pnpm falls back to running it as a command, the install that runs before scripts now runs once. Its errors and warnings print once #​17977.

  • Failed downloads by project-aware global runtime commands now explain which configuration applies. Node.js failures also list the global mirror settings and environment variables to check.

Other commands and settings

  • Fixed pnpm occasionally crashing on the first HTTPS request, mostly on Windows virtual machines under load. pnpm now seeds TLS randomness from the operating system's random number generator pnpm/tasks#239.

  • Fixed pnpm deprecate, pnpm undeprecate, and pnpm unpublish failing with revision conflicts when a registry cache serves stale package metadata.

  • pnpm sbom now reports malformed workspace manifests. Before, it omitted their packages pnpm/tasks#59.

  • Fixed pnpm store status reporting approved builds of git dependencies as modified when the store contains legacy build metadata.

  • pnpm now recognizes Capawesome Cloud and RWX as CI environments.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit Cloudflare

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude Syntax

v12.19.0: pnpm 12.19

Compare Source

pnpm 12.19.0 adds pnpm fund, lets the loaded node linker handle packages that need a build, and adds the projectScopedOptionalPeers setting and an experimental JSON lockfile format. It also includes a security fix: an offline install error no longer prints registry credentials. pnpm now checks the engines and platform fields of every workspace project, and many hoisted-linker and frozen-lockfile bugs are fixed.

Minor Changes

  • Added pnpm fund, which lists the funding URLs declared by the installed dependencies in the same tree npm fund prints. Use --json for the npm fund --json report and --recursive or --filter to report on workspace projects. pnpm fund <pkg> opens the funding URL of an installed package, and --which picks one when it lists several #​7354.

  • With nodeLinker.type: loaded, packages that need a build no longer have to be listed in nodeLinker.excluded. A package with a matching side-effects cache entry loads from the store. If side-effects cache reads and writes are enabled, pnpm builds an approved package once, saves the result to the side-effects cache, and then loads it from the store. This includes a build that changes no files in its package, so its script does not run again in other projects that use the same store. List a package in sideEffectsCache.exclude if its build must run in every project, such as a git hook installer. pnpm materializes other cache misses, packages with native .node addons, and their dependencies automatically.

    pnpm also scans JavaScript sources for filesystem imports and for __dirname or import.meta, and materializes matching packages. The scan does not detect computed imports. List such packages in nodeLinker.excluded.

  • Added the projectScopedOptionalPeers setting. When it is true, a project gets a missing optional peer dependency only if the project's own dependencies install a version of it. Another workspace project's dependencies, such as its devDependencies, no longer supply one. dedupePeerDependents keeps deduplicating everything else #​16666.

  • Added the experimental lockfile.format: v13 setting. With it, pnpm writes pnpm-lock.yaml in a JSON-like syntax, indented with tabs, with a trailing comma after every entry. The file is still valid YAML. The file has one packages entry per package version i

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title chore(deps): update dependency pnpm to v12.18.0 fix(deps): update all non-major dependencies Nov 7, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from d695888 to 0021f84 Compare November 10, 2026 09:19
@christoph-sg christoph-sg mentioned this pull request Nov 10, 2026
Merged
@renovate renovate Bot changed the title fix(deps): update all non-major dependencies fix(deps): update all non-major dependencies - autoclosed Nov 10, 2026
@renovate renovate Bot closed this Nov 10, 2026
@renovate
renovate Bot deleted the renovate/all-minor-patch branch November 10, 2026 11:33
@renovate renovate Bot changed the title fix(deps): update all non-major dependencies - autoclosed chore(deps): update all non-major dependencies Nov 11, 2026
@renovate renovate Bot reopened this Nov 11, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 59144d6 to da0105f Compare November 13, 2026 22:16
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from da0105f to 57fec4b Compare November 15, 2026 03:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bot npm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants