fix(deps): update all non-major dependencies#112
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
fix(deps): update all non-major dependencies#112renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
08595de to
5f212ef
Compare
b6fb25b to
f55440d
Compare
f55440d to
1fa3af4
Compare
1fa3af4 to
b8f91f3
Compare
a781695 to
8d9a52e
Compare
f4df708 to
1a0994d
Compare
7a70566 to
46f7b6a
Compare
2450b8f to
b68778a
Compare
977e633 to
9c088c2
Compare
9c088c2 to
6004f0d
Compare
6004f0d to
cc9b7a3
Compare
d7aae4d to
713bbdb
Compare
2060140 to
f92f101
Compare
f92f101 to
3452541
Compare
3452541 to
9a9a347
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.28.5→7.28.6v5.1.1→v5.1.25.5.4→5.5.510.5.1→10.8.04.17.21→4.18.18.4.*→8.5.*8.5.6→8.5.103.6.2→3.8.31.94.1→1.99.016.0.6→16.0.716.25.0→16.26.16.12.1→6.14.05.0.1→5.1.010.2.0→10.4.03.2.0→3.3.0Release Notes
babel/babel (@babel/eslint-parser)
v7.28.6Compare Source
v7.28.6 (2026-01-12)
Thanks @kadhirash and @kolvian for your first PRs!
🐛 Bug Fix
babel-cli,babel-code-frame,babel-core,babel-helper-check-duplicate-nodes,babel-helper-fixtures,babel-helper-plugin-utils,babel-node,babel-plugin-transform-flow-comments,babel-plugin-transform-modules-commonjs,babel-plugin-transform-property-mutators,babel-preset-env,babel-traverse,babel-typesbabel-plugin-transform-regeneratortransform-regeneratorcorrectly handles scope (@liuxingbaoyu)babel-plugin-transform-react-jsx💅 Polish
babel-core,babel-standalone🏠 Internal
babel-plugin-bugfix-v8-static-class-fields-redefine-readonly,babel-plugin-proposal-decorators,babel-plugin-proposal-import-attributes-to-assertions,babel-plugin-proposal-import-wasm-source,babel-plugin-syntax-async-do-expressions,babel-plugin-syntax-decorators,babel-plugin-syntax-destructuring-private,babel-plugin-syntax-do-expressions,babel-plugin-syntax-explicit-resource-management,babel-plugin-syntax-export-default-from,babel-plugin-syntax-flow,babel-plugin-syntax-function-bind,babel-plugin-syntax-function-sent,babel-plugin-syntax-import-assertions,babel-plugin-syntax-import-attributes,babel-plugin-syntax-import-defer,babel-plugin-syntax-import-source,babel-plugin-syntax-jsx,babel-plugin-syntax-module-blocks,babel-plugin-syntax-optional-chaining-assign,babel-plugin-syntax-partial-application,babel-plugin-syntax-pipeline-operator,babel-plugin-syntax-throw-expressions,babel-plugin-syntax-typescript,babel-plugin-transform-async-generator-functions,babel-plugin-transform-async-to-generator,babel-plugin-transform-class-properties,babel-plugin-transform-class-static-block,babel-plugin-transform-dotall-regex,babel-plugin-transform-duplicate-named-capturing-groups-regex,babel-plugin-transform-explicit-resource-management,babel-plugin-transform-exponentiation-operator,babel-plugin-transform-json-strings,babel-plugin-transform-logical-assignment-operators,babel-plugin-transform-nullish-coalescing-operator,babel-plugin-transform-numeric-separator,babel-plugin-transform-object-rest-spread,babel-plugin-transform-optional-catch-binding,babel-plugin-transform-optional-chaining,babel-plugin-transform-private-methods,babel-plugin-transform-private-property-in-object,babel-plugin-transform-regexp-modifiers,babel-plugin-transform-unicode-property-regex,babel-plugin-transform-unicode-sets-regex🏃♀️ Performance
babel-plugin-transform-react-jsx__source,__self(@liuxingbaoyu)Committers: 7
easingthemes/ssh-deploy (easingthemes/ssh-deploy)
v5.1.2Compare Source
prettier/eslint-plugin-prettier (eslint-plugin-prettier)
v5.5.5Compare Source
Patch Changes
#772
7264ed0Thanks @BPScott! - Bump prettier-linter-helpers dependency to v1.0.1#776
77651a3Thanks @aswils! - fix: bump synckit for yarn PnP ESM issuevuejs/eslint-plugin-vue (eslint-plugin-vue)
v10.8.0Compare Source
Minor Changes
eslint-parser-vuev10.3.0) (#2962)Promisefunctions tovue/no-async-in-computed-properties(#3020)ignoreVBindObjectoption tovue/attributes-order(#3012)allowEmptyAliasoption tovue/valid-v-for(#3011)destructure: "only-when-assigned"option tovue/define-props-destructuringand changed default value fromdestructure: "always"todestructure: "only-when-assigned"(#3009)Patch Changes
vue/no-unused-varsto detect components passed as slot props (#3008)v10.7.0Compare Source
Minor Changes
-errorconfig variants, with all rules' severity set toerror:strongly-recommended-error,recommended-error,vue2-strongly-recommended-error,vue2-recommended-error(along with their flat config equivalents) (#2796)vue/no-literals-in-templaterule (#3000)vue/no-undef-directivesrule (#2990)ignoreEOLCommentsoption tovue/no-multi-spacesrule (#2989)vue/no-negated-v-if-conditionsuggestion to autofix (#2984)Patch Changes
vue/define-props-destructuringrule when imported types are passed todefineProps(#2995)DirectiveModifiers(#2996)nodeOpsandpatchProp(#2986)v10.6.2Compare Source
Patch Changes
vue/no-duplicate-class-namesand correctly detect duplicates in combining expressions (#2980)TSImportTypeinvue/script-indentrule (#2969)vue/prefer-use-template-ref(#2982)v10.6.1Compare Source
Patch Changes
<template>in vue/no-multiple-template-root rule (#2964)v10.6.0Compare Source
Minor Changes
Updated
vue/no-import-compiler-macrosto clarify that macros are not allowed outside<script setup>(#2938)Added new
vue/no-duplicate-class-namesrule (#2934)Patch Changes
Fixed
vue/no-v-htmlrule to allow ignoring call expressions (#2950)Improved
vue/define-macros-ordererror messages to distinguish between macro placement and ordering issues (#2953)Updated dependency postcss-selector-parser to v7.1.0 (#2947)
lodash/lodash (lodash)
v4.18.1Compare Source
Bugs
Fixes a
ReferenceErrorissue inlodashlodash-eslodash-amdandlodash.templatewhen using thetemplateandfromPairsfunctions from the modular builds. See #6167 (comment)These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
lodash: lodash/lodash@4.18.0-npm...4.18.1-npmlodash-es: lodash/lodash@4.18.0-es...4.18.1-eslodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amdlodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packagesv4.18.0Compare Source
v4.18.0
Full Changelog: lodash/lodash@4.17.23...4.18.0
Security
_.unset/_.omit: Fixed prototype pollution viaconstructor/prototypepath traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Nowconstructorandprototypeare blocked unconditionally as non-terminal path keys, matchingbaseSet. Calls that previously returnedtrueand deleted the property now returnfalseand leave the target untouched._.template: Fixed code injection viaimportskeys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. Thevariableoption was validated againstreForbiddenIdentifierCharsbutimportsKeyswas left unguarded, allowing code injection via the sameFunction()constructor sink.importskeys containing forbidden identifier characters now throw"Invalid imports option passed into _.template".Docs
_.templatein threat model and API docs (#6099)lower > upperbehavior in_.random(#6115)_.compactjsdoc (#6090)lodash.*modular packagesDiff
We have also regenerated and published a select number of the
lodash.*modular packages.These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:
v4.17.23Compare Source
containerbase/php-prebuild (php)
v8.5.5Compare Source
Bug Fixes
v8.5.4Compare Source
Bug Fixes
v8.5.3Compare Source
Bug Fixes
v8.5.2Compare Source
Bug Fixes
v8.5.1Compare Source
Bug Fixes
v8.5.0Compare Source
Bug Fixes
postcss/postcss (postcss)
v8.5.10Compare Source
</style>in non-bundler cases (by @TharVid).v8.5.9Compare Source
v8.5.8Compare Source
Processor#version.v8.5.7Compare Source
prettier/prettier (prettier)
v3.8.3Compare Source
v3.8.2Compare Source
v3.8.1Compare Source
v3.8.0Compare Source
diff
🔗 Release note
v3.7.4Compare Source
diff
LWC: Avoid quote around interpolations (#18383 by @kovsu)
TypeScript: Fix comment inside union type gets duplicated (#18393 by @fisker)
TypeScript: Fix unstable comment print in union type comments (#18395 by @fisker)
v3.7.3Compare Source
diff
API: Fix
prettier.getFileInfo()change that breaks VSCode extension (#18375 by @fisker)An internal refactor accidentally broke the VSCode extension plugin loading.
v3.7.2Compare Source
diff
JavaScript: Fix string print when switching quotes (#18351 by @fisker)
JavaScript: Preserve quote for embedded HTML attribute values (#18352 by @kovsu)
TypeScript: Fix comment in empty type literal (#18364 by @fisker)
v3.7.1Compare Source
diff
API: Fix performance regression in doc printer (#18342 by @fisker)
Prettier 3.7.1 can be very slow when formatting big files, the regression has been fixed.
v3.7.0Compare Source
diff
🔗 Release Notes
sass/dart-sass (sass)
v1.99.0Compare Source
Add support for parent selectors (
&) at the root of the document. These areemitted as-is in the CSS output, where they're interpreted as the scoping
root.
User-defined functions named
calcorclampare no longer forbidden. Ifsuch a function exists without a namespace in the current module, it will be
used instead of the built-in
calc()orclamp()function.User-defined functions whose names begin with
-and end with-expression,-url,-and,-or, or-notare no longer forbidden. These wereoriginally intended to match vendor prefixes, but in practice no vendor
prefixes for these functions ever existed in real browsers.
User-defined functions named
EXPRESSION,URL, andELEMENT, those thatbegin with
-and end with-ELEMENT, as well as the same names with somelowercase letters are now deprecated, These are names conflict with plain CSS
functions that have special syntax.
See the Sass website for details.
In a future release, calls to functions whose names begin with
-and endwith
-expressionand-urlwill no longer have special parsing. For now,these calls are deprecated if their behavior will change in the future.
See the Sass website for details.
Calls to functions whose names begin with
-and end with-progid:...aredeprecated.
See the Sass website for details.
v1.98.0Compare Source
Command-Line Interface
--watchmode.Dart API
const Logger.defaultLoggerfield. This provides a logger that emits tostandard error or the browser console, but automatically chooses whether to
use terminal colors.
JavaScript API
Fix a crash when manually constructing a
SassCalculationfor'calc'withan argument that can't be simplified.
Properly emit deprecation warnings as text rather than
StringBufferobjectswhen running in a browser.
Emit colored warnings and other messages on the console when running in a
browser.
v1.97.3Compare Source
could cause outer style rules to be omitted.
v1.97.2Compare Source
v1.97.1Compare Source
v1.97.0Compare Source
display-p3-linearcolor space.v1.96.0Compare Source
zero denominator units) to be emitted to CSS. These are now emitted as
calc()expressions, which now support complex units in plain CSS.v1.95.1Compare Source
v1.95.0Compare Source
Add support for the CSS-style
if()function. In addition to supporting theplain CSS syntax, this also supports a
sass()query that takes a Sassexpression that evaluates to
trueorfalseat preprocessing time dependingon whether the Sass value is truthy. If there are no plain-CSS queries, the
function will return the first value whose query returns true during
preprocessing. For example,
if(sass(false): 1; sass(true): 2; else: 3)returns
2.The old Sass
if()syntax is now deprecated. Users are encouraged to migrateto the new CSS syntax.
if($condition, $if-true, $if-false)can be changed toif(sass($condition): $if-true; else: $if-false).See the Sass website for details.
Plain-CSS
if()functions are now considered "special numbers", meaning thatthey can be used in place of arguments to CSS color functions.
Plain-CSS
if()functions andattr()functions are now considered "specialvariable strings" (like
var()), meaning they can now be used in place ofmultiple arguments or syntax fragments in various CSS functions.
v1.94.3Compare Source
%expressions followed by whitespace.v1.94.2Compare Source
Command-Line Interface
--fatal-deprecation <version>no longer emits warnings aboutdeprecations that are obsolete.
Dart API
Deprecation.forVersionnow excludes obsolete deprecations from the set itreturns.
JS API
fatalDeprecationswhen aVersionispassed.
Node.js Embedded Host
async compilation.
webpack/sass-loader (sass-loader)
v16.0.7Compare Source
stylelint/stylelint (stylelint)
v16.26.1Compare Source
It fixes numerous false positive bugs, including many in the
declaration-property-value-no-unknownrule for the latest CSS specifications.*-no-unknownfalse positives for latest specs by integrating@csstools/css-syntax-patches-for-csstree(#8850) (@romainmenke).at-rule-no-unknownfalse positives for@function(#8851) (@jeddy3).declaration-property-value-no-unknownfalse positives forattr(),if()and custom functions (#8853) (@jeddy3).function-url-quotesfalse positives when URLs require quoting (#8804) (@taearls).selector-pseudo-element-no-unknownfalse positives for::scroll-button()(#8856) (@Mouvedia).v16.26.0Compare Source
It adds 1 feature and fixes 2 bugs.
customSyntaxwith function export (#8834) (@silverwind).custom-property-no-missing-var-functionfalse positives for style query inif()function (#8813) (@sajdakabir).media-feature-range-notationfalse positives for multiple queries andexcept: exact-value(#8832) (@jeddy3).stylelint-scss/stylelint-scss (stylelint-scss)
v6.14.0Compare Source
dollar-variable-no-missing-interpolationreport namespaced variables in custom properties (#1225).function-disallowed-listcheck disallowed functions inside@returnexpressions (#1214).dollar-variable-no-missing-interpolationfix false positive for variables already inside interpolation (#1213).Full Changelog: stylelint-scss/stylelint-scss@v6.13.0...v6.14.0
v6.13.0Compare Source
at-mixin-argumentless-call-parentheseshandle mixin calls with content block arguments (#1185).at-function-pattern,at-mixin-pattern,dollar-variable-pattern,percent-placeholder-patternadd support for arguments in custom messages (#1187).dollar-variable-no-missing-interpolationcheck for CSS custom properties, add autofix, rule documentation improvements (#1195).dollar-variable-colon-space-afterprevent TypeError for dynamically created nodes (#1159).load-partial-extensionadd missing link to docs (#1202).context.fix(#1206).stylelintpeer dependency version to^16.8.2(required by autofix callback) (#1206).Full Changelog: stylelint-scss/stylelint-scss@v6.12.1...v6.13.0
webpack/stylelint-webpack-plugin (stylelint-webpack-plugin)
v5.1.0Compare Source
Bug Fixes
fix: remove skipLibCheck
fix: upgrade stylelint version
fix: npm audit
refactor: coverage and dead code
ci: add stylelint 17.x
Features
5.0.1 (2024-05-24)
Bug Fixes
vuejs/vue-eslint-parser (vue-eslint-parser)
v10.4.0Compare Source
⚙️ Changes
no-useless-assignmentby @ota-meshi in #288Full Changelog: vuejs/vue-eslint-parser@v10.3.0...v10.4.0
v10.3.0Compare Source
✨ Enhancements
⚙️ Infrastructure Updates
vitestby @9romise in #269tsdownby @9romise in #266Full Changelog: vuejs/vue-eslint-parser@v10.2.0...v10.3.0
WordPress/WordPress-Coding-Standards (wp-coding-standards/wpcs)
v3.3.0Compare Source
Added
readonlyanonymous classes (PHP 8.3) to theWordPress.Security.EscapeOutputsniff. Props [@rodrigoprimo]. #2559WordPress.Security.EscapeOutputsniff. #2563Universal.Attributes.BracketSpacingandUniversal.Attributes.DisallowAttributeParentheses. #2646Changed
PHP_CodeSnifferversion to 3.13.4 (was 3.13.0). #2630PHPCSExtraversion to 1.5.0 (was 1.4.0). #2646minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to6.6. #2656WordPress.DB.DirectDatabaseQuerywill now recognize more caching functions, like thewp_cache_*_multiple()functions as added in WordPress 6.0 and thewp_cache_*_salted()functions as added in WordPress 6.9. #2654WordPress.NamingConventions.PrefixAllGlobalshas been updated to recognize pluggable functions introduced in WP up to WP 6.9.0. #2652WordPress.WP.ClassNameCasehas been updated to recognize classes introduced in WP up to WP 6.9.0. #2652WordPress.WP.DeprecatedFunctionsnow detects functions deprecated in WordPress up to WP 6.9.0. #2652WordPress.WP.DeprecatedParametersnow detects parameters deprecated in WordPress up to WP 6.9.0. #2652WordPress.Security.ValidatedSanitizedInput: improved the clarity of the error message for theInputNotValidatederror code. Props [@rodrigoprimo]. #2642testVersionrecommendations for PHPCompatibility. Props [@johnjago]. #2471minimum_wp_versionandtestVersionrecommendations. #2608Deprecated
Removed
wp_kses_allowed_html()from the list of escaping functions. #2566This affects the
WordPress.Security.EscapeOutputsniff.Fixed
WordPress.DB.DirectDatabaseQuery: false positive when function call to caching functions did not use the canonical function name. Props [@rodrigoprimo]. #2613WordPress.DB.DirectDatabaseQuery: potential false negative when a class property or constant would mirror the name of one of the caching functions. Props [@rodrigoprimo]. #2615WordPress.DB.PreparedSQL: false positive for correctly escaped SQL snippets when the function call did not use the canonical function name. Props [@rodrigoprimo]. #2570WordPress.DB.PreparedSQLPlaceholders: improved handling of fully qualified calls to global functions. Props [@rodrigoprimo]. #2569WordPress.Security.EscapeOutput: expanded protection against false positives for*::class. Props [@rodrigoprimo]. #2605WordPress.Security.NonceVerification: false positive when nonce checking function call did not use the canonical function name. Props [@rodrigoprimo]. #2572WordPress.WP.EnqueuedResourceParameters: the sniff could cause a PHP 8.5 deprecation notice if the code under scan contained one of the deprecated type casts. #2573WordPress.WP.EnqueuedResourceParameters: improved recognition of non-lowercase and fully qualifiedtrue/false/nullwhen passed as the$verparameter value. Props [@rodrigoprimo]. #2630Configuration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.