Skip to content

chore(deps): update all non-major dependencies#446

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#446
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 5, 2025

This PR contains the following updates:

Package Change Age Confidence Type Update
@antfu/eslint-config ^8.2.0^8.3.0 age confidence pnpm.catalog.default minor
@types/google.maps (source) ^3.58.1^3.64.0 age confidence peerDependencies minor
@types/youtube (source) ^0.1.0^0.2.0 age confidence peerDependencies minor
@unhead/vue (source) ^2.0.3^2.1.15 age confidence peerDependencies minor
Hebilicious/reproduire v0.0.9-mpv0.0.9 age confidence action patch
actions/checkout v6.0.1v6.0.2 age confidence action patch
actions/stale v10.0.0v10.2.0 age confidence action minor
bumpp ^11.0.1^11.1.0 age confidence pnpm.catalog.default minor
oxc-parser (source) ^0.129.0^0.130.0 age confidence pnpm.catalog.default minor
playwright-core (source) ^1.59.1^1.60.0 age confidence pnpm.catalog.default minor
posthog-js (source) ^1.372.9^1.373.0 age confidence pnpm.catalog.default minor
posthog-js (source) ^1.0.0^1.373.0 age confidence peerDependencies minor
vitest (source) ^4.1.5^4.1.6 age confidence pnpm.catalog.default patch

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v8.3.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
  • markdown: Scope user rule overrides away from md files  -  by @​antfu and Claude Opus 4.7 (1M context) in #​844 (8d25a)
    View changes on GitHub
unjs/unhead (@​unhead/vue)

v2.1.15

Compare Source

No significant changes

    View changes on GitHub

v2.1.13

Compare Source

   🐞 Bug Fixes
  • schema-org: Normalize target to array before merging potentialAction  -  by @​harlan-zw and Claude Opus 4.6 (1M context) in #​709 (22ac9)
    View changes on GitHub

v2.1.12

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.11

Compare Source

    ⚠️ Security
  • Fixed XSS bypass in useHeadSafe via attribute name injection (GHSA-g5xx-pwrp-g3fv). Users handling untrusted input with useHeadSafe should upgrade immediately.
   🐞 Bug Fixes
    View changes on GitHub

v2.1.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.9

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.3

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.1

Compare Source

No significant changes

    View changes on GitHub

v2.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.0.19

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.18

Compare Source

   🏎 Performance
    View changes on GitHub

v2.0.17

Compare Source

No significant changes

    View changes on GitHub

v2.0.14

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.13

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.12

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.11

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.9

Compare Source

   🏎 Performance
    View changes on GitHub

v2.0.8

Compare Source

No significant changes

    View changes on GitHub

v2.0.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
Hebilicious/reproduire (Hebilicious/reproduire)

v0.0.9

Compare Source

compare changes

actions/checkout (actions/checkout)

v6.0.2

Compare Source

actions/stale (actions/stale)

v10.2.0

Compare Source

v10.1.1

Compare Source

What's Changed

Bug Fix
Improvement
Dependency Upgrades

New Contributors

Full Changelog: actions/stale@v10...v10.1.1

v10.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/stale@v10...v10.1.0

antfu-collective/bumpp (bumpp)

v11.1.0

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
oxc-project/oxc (oxc-parser)

v0.130.0

📚 Documentation
microsoft/playwright (playwright-core)

v1.60.0

Compare Source

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:

await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:

await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});

await page.locator('#dropzone').drop({
  data: {
    'text/plain': 'hello world',
    'text/uri-list': 'https://example.com',
  },
});

🎯 Aria snapshots

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:

test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});

New APIs

Browser, Context and Page
Locators and Assertions
Network
  • webSocketRoute.protocols() returns the WebSocket subprotocols requested by the page.
  • New option noDefaults in browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.
Errors and Reporting
Test runner
  • New {testFileBaseName} token in testProject.snapshotPathTemplate — file name without extension.
  • Test runner now errors when a config tries to override a non-option fixture, and rejects workers: 0 or negative values.

🛠️ Other improvements

  • HTML reporter:
    • npx playwright show-report accepts .zip files directly — no need to unzip first.
    • Steps that contain attachments inside nested children show an indicator on the parent step.
    • The repeatEachIndex is shown in the test header when non-zero.
  • Trace Viewer adds a pretty-print toggle for JSON / form request and response bodies in the network details panel.

Breaking Changes ⚠️

  • Removed long-deprecated APIs:
    • Locator.ariaRef() — use the standard locator.ariaSnapshot() pipeline.
    • handle option on BrowserContext.exposeBinding and Page.exposeBinding.
    • logger option on BrowserType.connect and BrowserType.connectOverCDP — use tracing instead.
    • Context options videosPath / videoSize — use recordVideo instead.

Browser Versions

  • Chromium 148.0.7778.96
  • Mozilla Firefox 150.0.2
  • WebKit 26.4

This version was also tested against the following stable channels:

  • Google Chrome 147
  • Microsoft Edge 147
PostHog/posthog-js (posthog-js)

v1.373.0

Compare Source

1.373.0

Minor Changes
Patch Changes

v1.372.10

Compare Source

1.372.10

Patch Changes
  • #​3544 d120042 Thanks @​ksvat! - fix: stop session recording before destroying sessionManager in opt_out_capturing() with cookieless_mode: "on_reject". Previously, queued/throttled rrweb events (e.g. mousemove) could fire after the sessionManager was set to undefined and throw [SessionRecording] must be started with a valid sessionManager. Also adds a defensive early-return in onRRwebEmit so any remaining late events bail out instead of throwing.
    (2026-05-07)

  • #​3542 94a5ba0 Thanks @​TueHaulund! - Preserve <style> textContent when the browser's CSSOM serialization would
    emit empty longhands from var() inside a shorthand. When a stylesheet has
    e.g. padding: var(--p); padding-bottom: var(--pb);, browsers store the
    shorthand's longhands with empty token lists per the CSS Custom Properties
    spec, and CSSStyleRule.cssText re-emits them as padding-top: ; padding-right: ; padding-left: ;. The previous behavior replaced the
    <style> text with that corrupted output, silently dropping layout rules
    on replay. We now detect the empty-longhand pattern and keep the original
    textContent in that case. Affects users of any CSS-in-JS framework that
    combines var() with shorthands (Chakra UI v3, Panda CSS, Emotion, etc.).
    Same class of bug as rrweb-io/rrweb#1667. (2026-05-07)

  • Updated dependencies []:

vitest-dev/vitest (vitest)

v4.1.6

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Apr 5, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
scripts-docs Error Error May 11, 2026 7:34pm
scripts-playground Ready Ready Preview, Comment May 11, 2026 7:34pm

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9c4e39b to 5bfebea Compare April 5, 2025 00:30
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 5bfebea to 7804f68 Compare April 6, 2025 09:08
@renovate renovate Bot changed the title chore(deps): update resolutions typescript to v5.8.3 chore(deps): update all non-major dependencies Apr 6, 2025
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7804f68 to 2d975ff Compare April 7, 2025 04:48
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 2d975ff to 0104ff1 Compare April 7, 2025 08:22
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 0104ff1 to 8120e32 Compare April 7, 2025 15:15
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 8120e32 to 5ec9f5e Compare April 7, 2025 18:22
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 5ec9f5e to efcb3b7 Compare April 8, 2025 08:39
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from efcb3b7 to 1a61aec Compare April 10, 2025 00:28
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 1a61aec to cf8e7f8 Compare April 10, 2025 09:47
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from cf8e7f8 to 2b13cf8 Compare April 11, 2025 01:12
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 6132302 to 360e116 Compare April 16, 2025 14:05
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 360e116 to aa97a8b Compare April 17, 2025 00:59
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from aa97a8b to 714cf9d Compare April 17, 2025 08:46
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 714cf9d to bdbb60c Compare April 17, 2025 18:14
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from bdbb60c to 9343bf3 Compare April 18, 2025 20:28
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9343bf3 to fb7fea7 Compare April 21, 2025 12:46
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from fb7fea7 to 556aaae Compare April 21, 2025 16:40
@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Jul 16, 2025

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts@446

commit: cc6eb8c

Comment thread pnpm-lock.yaml Outdated
Comment thread docs/package.json Outdated
"@nuxt/image": "^1.11.0",
"@nuxt/scripts": "workspace:*",
"@nuxt/ui": "4.0.0",
"@nuxt/ui": "4.2.1",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"@nuxt/ui": "4.2.1",
"@nuxt/ui": "^4.2.1",

The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.

View Details

Analysis

Inconsistent version pinning for @nuxt/ui dependency

What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.

How to reproduce:

cat docs/package.json | grep -A 15 '"dependencies"'

Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:

  • "@nuxt/content": "^3.8.2"
  • "@nuxt/fonts": "^0.12.1"
  • "@nuxthq/studio": "^2.2.1"
  • All other 10 dependencies also use ^ prefix

Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.

Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.

Comment thread package.json Outdated
"posthog-js": "^1.0.0"
"@types/youtube": "^0.1.2",
"@unhead/vue": "^2.1.2",
"posthog-js": "^1.321.2"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"posthog-js": "^1.321.2"
"posthog-js": "^1.0.0"

The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).

View Details

Analysis

Overly restrictive posthog-js peer dependency breaks backward compatibility

What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.

How to reproduce:

# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2

Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"

Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:

  • Code only uses posthog.init() and basic config options (api_host, capture_pageview, disable_session_recording) available since 1.0.0
  • The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
  • Peer dependencies should be permissive to maximize compatibility
  • Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible

This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 29, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: pnpm-lock.yamlnpm/entities@4.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 8, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedsirv@​3.0.210010010081100
Addedmagic-string@​0.30.2110010010086100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants