chore(deps): update npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@nestjs/common (source)	11.1.8 -> 11.1.9
@nestjs/core (source)	11.1.8 -> 11.1.9
@nestjs/platform-express (source)	11.1.8 -> 11.1.9
@swc/core (source)	1.15.1 -> 1.15.3
@types/node (source)	24.10.0 -> 24.10.1
@types/react (source)	19.2.2 -> 19.2.6
@types/react-dom (source)	19.2.2 -> 19.2.3
core-js (source)	3.46.0 -> 3.47.0
emnapi	1.7.0 -> 1.7.1
file-type	21.0.0 -> 21.1.1
lerna (source)	9.0.0 -> 9.0.1
lint-staged	16.2.6 -> 16.2.7
pnpm (source)	10.20.0 -> 10.23.0

---

Release Notes

nestjs/nest (@​nestjs/common)

v11.1.9

Compare Source

v11.1.9 (2025-11-14)

Bug fixes

• core
  • #​15865 fix(core): make get() throw for implicitly request-scoped trees (@​JoeNutt)

Enhancements

• common
  • #​15863 feat(common): add method options to @​sse decorator (@​TomerSteinberg)

Dependencies

• platform-fastify
  • #​15899 chore(deps): bump fastify from 5.6.1 to 5.6.2 (@​dependabot[bot])

Committers: 4

• Rami (@​JoeNutt)
• Rhynel Algopera (@​dev-rhynel)
• Tomer Steinberg (@​TomerSteinberg)
• WuMingDao (@​WuMingDao)

swc-project/swc (@​swc/core)

v1.15.3

Compare Source

Bug Fixes

• (es/codegen) Restore missing top-level comments (#​11302) (0998c93)

• (es/codegen) Emit comments of all nodes (#​11314) (387ee0f)

• (es/minifier) Prevent compress.comparisons from transforming expressions with side effects (#​11256) (58a9d81)

• (es/minifier) Remove unused arrow functions in dead code elimination (#​11319) (88c6ac7)

• (es/parser) Make the span of Program start at input start (#​11199) (b56e008)

• (es/plugin) Use #[cfg] to avoid compilation error (#​11316) (f615cdb)

• (es/quote) Replace usage of swc_atoms with swc_core::atoms (#​11299) (c1e32fa)

Miscellaneous Tasks

• (es/transformer) Determine project structure (#​11306) (58f2602)

Performance

• (es/compat) Merge regexp pass into Transformer (#​11307) (440b391)

• (es/compat) Merge export_namespace_from to Transformer (#​11309) (7a528ce)

Refactor

• (es/transfomer) Prevent breaking change (#​11308) (45827fa)

v1.15.2

Compare Source

Bug Fixes

• (bindings/es) Respect filename option from print() (#​11264) (0d4d2d9)

Features

• (es/minifier) Drop empty constructors during minification (#​11250) (2cea7dd)

• (es/visit) Add context parameter to VisitMutHook trait (#​11254) (8645d0d)

Performance

• (es/parser) Inline skip_space (afb824a)

• (es/parser) Eliminate the outer loop of skip_block_comment (#​11261) (e41c0ac)

• (es/plugin) Use shared tokio runtime to avoid creation overhead (#​11267) (707026b)

zloirock/core-js (core-js)

v3.47.0

Compare Source

• Changes v3.46.0...v3.47.0 (117 commits)
• JSON.parse source text access proposal :
  • Built-ins:
    • JSON.isRawJSON
    • JSON.parse
    • JSON.rawJSON
    • JSON.stringify
  • Moved to stable ES, November 2025 TC39 meeting
  • Added es. namespace modules, /es/ and /stable/ namespaces entries
  • Reworked JSON.stringify internals
• Iterator sequencing proposal:
  • Built-ins:
    • Iterator.concat
  • Moved to stable ES, November 2025 TC39 meeting
  • Added es. namespace modules, /es/ and /stable/ namespaces entries
• Joint iteration proposal:
  • Built-ins:
    • Iterator.zip
    • Iterator.zipKeyed
  • Moved to stage 3, November 2025 TC39 meeting
  • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
• Fixed increasing .size in URLSearchParams.prototype.append polyfill in IE8-
• Compat data improvements:
  • Iterator.concat marked as shipped in FF147
  • Map upsert proposal features marked as shipped in Safari 26.2
  • Math.sumPrecise marked as shipped in Safari 26.2
  • Uint8Array.{ fromBase64, prototype.setFromBase64 } marked as fixed in Safari 26.2
  • Missed Explicit Resource Management features added in Bun 1.3.0
  • Added Oculus Quest Browser 41 compat data mapping
  • Added Electron 40 compat data mapping

toyobayashi/emnapi (emnapi)

v1.7.1

Compare Source

What's Changed

• move Node-API version detection by @​toyobayashi in #​182
• feat: support SharedArrayBuffer in napi_create_dataview by @​toyobayashi in #​183

Full Changelog: toyobayashi/emnapi@v1.7.0...v1.7.1

sindresorhus/file-type (file-type)

v21.1.1

Compare Source

• Fix handling of partial Gunzip file (#​783) 710e053

---

v21.1.0

Compare Source

• Add support for .tar.gz (gunzipped tarball file) (#​763) eda03a7
• Add support for Windows registry (.reg) files 0db61ec 7d2ddcf
• Add support for Windows registry hive file (.dat) (#​767) f8d62be
• Fix: Handle partial unzip (#​773) 7ad3a90

---

lerna/lerna (lerna)

v9.0.1

Compare Source

Bug Fixes

• expand version range to include nx v22.x (#​4242) (0cca286)

lint-staged/lint-staged (lint-staged)

v16.2.7

Compare Source

Patch Changes

• #​1711 ef74c8d Thanks @​iiroj! - Do not display a "failed to spawn" error message when a task fails normally. This message is reserved for when the task didn't run because spawning it failed.

pnpm/pnpm (pnpm)

v10.23.0: pnpm 10.23

Compare Source

Minor Changes

• Added --lockfile-only option to pnpm list #​10020.

Patch Changes

• pnpm self-update should download pnpm from the configured npm registry #​10205.
• pnpm self-update should always install the non-executable pnpm package (pnpm in the registry) and never the @pnpm/exe package, when installing v11 or newer. We currently cannot ship @pnpm/exe as pkg doesn't work with ESM #​10190.
• Node.js runtime is not added to "dependencies" on pnpm add, if there's a engines.runtime setting declared in package.json #​10209.
• The installation should fail if an optional dependency cannot be installed due to a trust policy check failure #​10208.
• pnpm list and pnpm why now display npm: protocol for aliased packages (e.g., foo npm:is-odd@3.0.1) #​8660.
• Don't add an extra slash to the Node.js mirror URL #​10204.
• pnpm store prune should not fail if the store contains Node.js packages #​10131.

Platinum Sponsors

Gold Sponsors

v10.22.0: pnpm 10.22

Compare Source

Minor Changes

• Added support for trustPolicyExclude #​10164.

  You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:

  trustPolicy: no-downgrade
  trustPolicyExclude:
    - chokidar@4.0.3
    - webpack@4.47.0 || 5.102.1

• Allow to override the engines field on publish by the publishConfig.engines field.

Patch Changes

• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #​10179.

Platinum Sponsors

Gold Sponsors

v10.21.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "before 10am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.