Skip to content

chore(deps): update all non-major dependencies - #406

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#406
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@changesets/cli (source) ^2.31.0^2.31.1 age confidence pnpm.catalog.default patch
@tanstack/query-core (source) ^5.101.2^5.101.4 age confidence pnpm.catalog.default patch
@types/react (source) ^19.2.17^19.2.18 age confidence pnpm.catalog.default patch
@types/react-dom (source) ^19.2.3^19.2.4 age confidence pnpm.catalog.default patch
@types/semver (source) ^7.7.1^7.8.0 age confidence pnpm.catalog.default minor
@vitejs/plugin-react (source) ^6.0.3^6.0.5 age confidence pnpm.catalog.default patch
@vitejs/plugin-vue (source) ^6.0.7^6.0.8 age confidence pnpm.catalog.default patch
@vue/language-core (source) ^3.1.5^3.3.9 age confidence pnpm.catalog.default patch
actions/checkout v7.0.0v7.0.1 age confidence action patch
danielroe/provenance-action v0.1.1v0.2.0 age confidence action minor
eslint (source) ^10.7.0^10.8.0 age confidence pnpm.catalog.default minor
globals ^17.7.0^17.9.0 age confidence pnpm.catalog.default minor
markdown-link-extractor ^4.0.3^4.0.4 age confidence pnpm.catalog.default patch
nx (source) 23.0.223.1.1 age confidence pnpm.catalog.default minor
pnpm (source) 11.11.011.20.0 age confidence packageManager minor
pnpm (source) >=11.11.0>=11.20.0 age confidence engines minor
prettier (source) ^3.9.5^3.9.6 age confidence pnpm.catalog.default patch
publint (source) ^0.3.21^0.3.22 age confidence pnpm.catalog.default patch 0.3.23
react (source) ^19.2.7^19.2.8 age confidence pnpm.catalog.default patch
react-dom (source) ^19.2.7^19.2.8 age confidence pnpm.catalog.default patch
tsdown (source) ^0.22.4^0.22.14 age confidence pnpm.catalog.default patch
typescript-eslint (source) ^8.63.0^8.66.0 age confidence pnpm.catalog.default minor
vite (source) ^8.1.4^8.2.0 age confidence pnpm.catalog.default minor 8.2.1
voidzero-dev/setup-vp v1.15.0v1.17.0 age confidence action minor
vue (source) ^3.5.39^3.5.40 age confidence pnpm.catalog.default patch 3.5.41
zizmorcore/zizmor-action v0.5.7v0.6.2 age confidence action minor

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).


Release Notes

changesets/changesets (@​changesets/cli)

v2.31.1

Compare Source

Patch Changes
  • #​2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.
TanStack/query (@​tanstack/query-core)

v5.101.4

Compare Source

v5.101.3

Compare Source

Patch Changes
vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.5

Compare Source

Fixed the react compiler preset filter to be linear (#​1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#​1349). The filter was changed to be linear to avoid that.

v6.0.4

Compare Source

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined.
This error is now fixed.

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features
Bug Fixes
vuejs/language-tools (@​vue/language-core)

v3.3.9

Compare Source

component-meta
language-core
language-service
  • fix: preserve trailing modifiers when completing in the middle of a directive (#​6133) - Thanks to @​lazerg!
  • fix: only replace current directive modifier on completion - Thanks to @​KazariEX!
  • fix: preserve current modifier when filtering completion duplicates - Thanks to @​KazariEX!
workspace
  • feat: migrate build and tests to typescript-native-bridge (#​6129)

v3.3.8

Compare Source

language-core
workspace
actions/checkout (actions/checkout)

v7.0.1

Compare Source

danielroe/provenance-action (danielroe/provenance-action)

v0.2.0

Compare Source

compare changes

🚀 Enhancements
  • Respect pnpm's trustPolicyExclude (2f0f52d)
  • Detect loss of npm staged publishing approval (fc86c9a)
📖 Documentation
  • Update action description (e78b179)
  • Add link to pnpm v10.21 trustPolicy 🎉 (fd8dd3c)
🏡 Chore
  • Add licence (cafd196)
  • Revert pnpm trust policy and restore provenance action (4320fb9)
  • Release v0.0.2 (194cad5)
  • Migrate to pnpm v11 (#​99)
✅ Tests
  • Improve coverage of lockfile parsing utils (a9d6553)
  • Migrate to vitest (07fa732)
  • Add api responses as fixtures + test provenance utils (fd6ed30)
🤖 CI
  • Pin github actions to full-length commit shas (9426311)
  • Add agent-scan workflow to flag bot-authored PRs (81568f7)
❤️ Contributors
eslint/eslint (eslint)

v10.8.0

Compare Source

Features

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)
sindresorhus/globals (globals)

v17.9.0

Compare Source

v17.8.0

Compare Source


tcort/markdown-link-extractor (markdown-link-extractor)

v4.0.4

Compare Source

  • update dependencies
nrwl/nx (nx)

v23.1.1

Compare Source

23.1.1 (2026-07-30)

🚀 Features
  • core: derive stable repo key from normalized remote and relative path (#​36439)
  • repo: add react + vite + vitest + playwright example (#​35921)
🩹 Fixes
  • angular-rspack: speed up builds and align behavior with the esbuild application builder (#​36268, #​34936)
  • bundling: support TypeScript esbuildConfig files in the esbuild executor (#​36352, #​36349)
  • bundling: acknowledge @​swc/core build scripts when configuring rollup (#​36412)
  • core: speed up npm lockfile parsing (#​36216)
  • core: speed up lockfile parsing and catalog resolution (#​36223)
  • core: show performance report recommendations only when actionable (#​36344)
  • core: close daemon log descriptors after spawn to avoid Node 26 crash (#​36280)
  • core: prevent shell injection in nx import (#​36348)
  • core: correct the 22.6.0 gitignore and analytics migration wiring (#​36356)
  • core: support npm 12 and pnpm in the package provenance check (#​36354, #​36338)
  • core: honor pnpm minimumReleaseAge config on pnpm 11 (#​36335, #​36330)
  • core: support pnpm 11 patched dependency hashes (#​36360)
  • core: resolve name refs copied into pattern-matched target arrays (#​36359)
  • core: resolve source-loaded plugin transitive workspace imports (#​36296)
  • core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#​36302)
  • core: include continuous and default-config dependencies in show target (#​36374)
  • core: make unit tests pass locally regardless of invoking package manager (#​35994)
  • core: respect --aiAgents none to skip AI agent file generation (#​34944, #​34692)
  • core: use --config.frozen-lockfile=false for pnpm add during migrate (#​36337)
  • core: run selected projects with --exclude-task-dependencies (#​35562)
  • core: stop passing git revisions through a shell in affected commands (#​36379)
  • core: collect trickling watcher bursts fully on daemon force-flush (#​36391)
  • core: report tasks running in another Nx process in the inline TUI (#​36341)
  • core: stop ratatui cursor queries from racing the TUI event stream (#​36318)
  • core: render critical-path tasks as a nested list in the job summary (#​36394)
  • core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#​36411)
  • core: support multiple brace groups in workspace glob matching (#​36395)
  • core: handle CRLF line endings in pnpm multi-document lockfiles (#​36419, #​35828, #​35840)
  • core: correct glob pattern expansion for ZeroOrOne groups (#​31857)
  • core: stop re-querying confirmed cache misses in task orchestrator (#​36301, #​35632)
  • core: sample project graph perf span telemetry per session at 10% (#​36420)
  • core: strip terminal query sequences when replaying task output (#​36432)
  • core: preserve FORCE_COLOR=0 intent for forked child tasks (#​35293)
  • core: handle colons in target name when resolving inputs to generate graph (#​36429, #​33710)
  • core: merge default plugins through the source-map-aware merge path (#​36257)
  • core: keep nx migrate on the requested version when release-age gates interfere (#​36444)
  • core: avoid bogus duplicate project name errors when generating nested apps (#​36458)
  • core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#​36497)
  • core: bump pinned axios and brace-expansion past vulnerable versions (#​36507, #​36474)
  • core: parse pnpm lockfiles that omit the packages block (#​36512)
  • core: keep real dependencies when omitting peers from npm temp installs (#​36518)
  • devkit: resolve ensurePackage against the workspace (#​36496)
  • docker: run release pipeline docker commands without a shell (#​36505)
  • js: support private methods and static blocks in babel preset (#​36218, #​36205)
  • js: parse pnpm/npm publish JSON containing braces in file paths (#​36241, #​36236)
  • js: resolve the verdaccio bin through its package.json (#​36479)
  • js: resolve package and extension-less tsconfig extends read from the tree (#​36271)
  • linter: keep override parser when convert-to-flat-config uses FlatCompat (#​36363)
  • linter: use projectService for typed linting in flat configs (#​35727)
  • misc: resolve CSS url() assets on Windows in postcss-cli-resources (#​36353, #​36336)
  • misc: suppress outdated disclaimer for unsupported AI agents with AGENTS.md (#​36324, #​36264)
  • misc: bump ci-workflow generator to node 24 and current action majors (#​36364)
  • misc: preserve package alias keys in generated package.json (#​35207)
  • misc: prevent crash when opening browser in Podman+WSL container (#​34639)
  • module-federation: do not cache static remote assets in the dev-server plugin (#​36279, #​36278)
  • module-federation: strip version suffix from npm dependency names for bun compatibility (#​34960)
  • react-native: include migration docs in the built package (#​36378)
  • release: only extract body issue references linked via closing keywords (#​36326, #​123)
  • release: align VersionDataEntry dependency types with VersionActions to allow null values (#​35932, #​35913)
  • repo: bump decompress to safe version (#​36333)
  • repo: drop stale e2e dependsOn overrides that omit the local registry (#​36482)
  • repo: serialize cypress installs and skip the binary when unused (#​36493)
  • rspack: lazy-load @​rspack/core in create-compiler to avoid eager ESM resolution (#​36476)
  • storybook: update configuration generator nx.json (#​34880, #​34879)
  • testing: add @​swc/core when configuring jest with the swc compiler (#​36409)
  • vite: prevent watch false leaking into dev server config (#​36080, #​36078)
  • vitest: honor watch config and keep --ui open in the test executor (#​36237, #​30263)
  • vitest: generate root vitest.config.ts instead of deprecated vitest.workspace (#​36316, #​36311)
  • vitest: prevent out-of-memory crash during atomized test graph creation (#​36339, #​36315)
  • webpack: disable extractComments on the swc terser minimizer (#​36238, #​36233)
  • webpack: bundle non-buildable library subpaths with fallback-array exports (#​36313, #​36309)
  • webpack: propagate watch option from executor to webpack config (#​34927, #​22945)
❤️ Thank You

v23.1.0

Compare Source

23.1.0 (2026-07-13)
🚀 Features
🩹 Fixes
  • angular: resolve esbuild option paths relative to the workspace root (#​36017, #​35936)
  • angular: bump prescribed angular version to 22.0.4 (#​36130)
  • angular: make nx migrate to Angular 22 leave a buildable workspace (#​36183)
  • angular-rspack: surface compilation failures as build errors and release resources on teardown (#​36018)
  • bundling: restore preprocessor extensions in postcss normalizeOp… (#​36057, #​35854)
  • bundling: prevent TS6059 when an app imports a workspace lib from source (#​36217, #​35017)
  • core: avoid tsconfig path false positives for sibling project roots (#​35796, #​35795, #​35786)
  • core: do not write minimumReleaseAgeExclude during nx migrate (#​36045)
  • core: do not crash nx migrate on non-semver dependency specifiers (#​36051)
  • core: format AI-edited files after agentic migrations (#​36064)
  • core: prefer module.registerHooks to avoid DEP0205 deprecation warning (#​36081)
  • core: prevent nx migrate crash when include=optional filters out the target package (#​36087)
  • core: make nx migrate honor preapproved packages and emit a valid temp workspace (#​36086)
  • core: skip daemon project-graph recompute on no-op file rewrites (#​36082)
  • core: prevent the TUI from auto-selecting a completed task when a batch finishes (#​35833)
  • core: deregister pseudo-terminal exit handlers when tasks finish (#​36115)
  • core: prevent path traversal / zip-slip in self-hosted remote cache (#​36116)
  • core: respect explicit --nxCloud=skip for AI agents in create-nx-workspace (#​36131)
  • core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#​36132, #​36116)
  • core: throw actionable error when pnpm .modules.yaml is missing (#​35666, #​35635)
  • core: support ${configDir} in tsconfig path alias resolution (#​36037, #​35804)
  • core: prevent non-npm devEngines pin from breaking npm registry lookups (#​36020, #​35815)
  • core: clarify nx sync remediation messaging and surface spinner output in non-tty (#​35747)
  • core: exclude direct-dependency overrides from generated package.json (#​36040, #​35675)
  • core: apply target defaults when project.json overrides an inferred run-commands target with different commands (#​36142, #​36067)
  • core: run the nx.bat wrapper for dot-nx setup on windows (#​36048)
  • core: refine the end-of-run performance report recommendations (#​36127, #​36077)
  • core: speed up bun lockfile parsing (#​36198)
  • core: set NX_CLI_SET in batch worker processes (#​36214, #​36210)
  • core: use standard utm params on performance-report links (#​36226)
  • core: preserve comments in catalog YAML updates (#​35733)
  • core: box JsonFileSet payload to keep HashInstruction small (#​36247, #​35248, #​36244, #​36152)
  • core: share workspace fileset hash results instead of deep-cloning per task (#​36244, #​34971, #​34942)
  • core: replace per-input visited clones with undo-log scoping in hash planner (#​36248, #​35071, #​36152, #​34971, #​36244, #​35248, #​36247)
  • core: intern hash instructions in a pool and plan with id lists (#​36249, #​35071, #​36152, #​36248)
  • core: add trailing space after performance report popup title (#​36259)
  • core: prevent TUI hint popup from permanently stealing focus (#​36256)
  • core: detect Codex sandbox on Linux to disable daemon and plugin isolation (#​36273)
  • core: skip projects-filtered targetDefaults when resolved without a project ([#​36281](https://redirect.github.com/nrwl/nx/pull/3628

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Jul 27, 2026
@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The pull request updates pinned GitHub Actions commits, raises the required pnpm version, and updates selected workspace catalog versions for development tools and runtime packages.

Changes

Dependency updates

Layer / File(s) Summary
Workflow action pin updates
.github/workflows/*.yml
Checkout references are updated to v7.0.1; provenance-action and zizmor-action pins are also raised.
Package manager and catalog versions
package.json, pnpm-workspace.yaml
The required pnpm version is raised to 11.17.0, and selected catalog entries are updated.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

  • TanStack/router-security#75 — Tracks overlapping pinned actions/checkout updates.
  • TanStack/workflow#11 — Tracks overlapping GitHub Actions and package dependency updates.
  • TanStack/pacer#76 — Tracks related repository dependency and workflow pin updates.
  • TanStack/state#1 — Tracks the pnpm, workflow, and catalog dependency updates.
  • TanStack/template#3 — Tracks overlapping checkout, pnpm, and catalog updates.
  • TanStack/persist#3 — Tracks the listed Renovate dependency updates.

Suggested reviewers: lachlancollins

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly summarizes the dependency updates, including package, package manager, and GitHub Actions changes.
Description check ✅ Passed The description provides detailed dependency changes and release notes, but the standard checklist and release-impact sections are not shown.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Jul 27, 2026

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@nx-cloud

nx-cloud Bot commented Jul 27, 2026

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit e867563

Command Status Duration Result
nx run-many --target=build ✅ Succeeded 8s View ↗

☁️ Nx Cloud last updated this comment at 2026-08-06 15:27:20 UTC

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

@pkg-pr-new

pkg-pr-new Bot commented Jul 27, 2026

Copy link
Copy Markdown
npm i https://pkg.pr.new/@tanstack/eslint-config@406
npm i https://pkg.pr.new/@tanstack/publish-config@406
npm i https://pkg.pr.new/@tanstack/typedoc-config@406
npm i https://pkg.pr.new/@tanstack/vite-config@406

commit: e867563

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from e6b6079 to a0232d5 Compare August 3, 2026 16:41
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 8409c97 to e867563 Compare August 6, 2026 15:15
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from e867563 to d959dc8 Compare August 6, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants