Skip to content

fix(deps): update all non-major dependencies - #150

Merged
json-derulo merged 1 commit into
mainfrom
renovate/all-minor-patch
Oct 18, 2026
Merged

fix(deps): update all non-major dependencies#150
json-derulo merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@angular/build 21.2.26 → 21.2.27 age confidence
@angular/cdk 22.2.2 → 22.2.3 age confidence
@angular/cli 21.2.26 → 21.2.27 age confidence
@angular/common (source) 22.2.2 → 22.2.3 age confidence
@angular/compiler (source) 22.2.2 → 22.2.3 age confidence
@angular/compiler-cli (source) 22.2.2 → 22.2.3 age confidence
@angular/core (source) 22.2.2 → 22.2.3 age confidence
@angular/forms (source) 22.2.2 → 22.2.3 age confidence
@angular/material 22.2.2 → 22.2.3 age confidence
@angular/platform-browser (source) 22.2.2 → 22.2.3 age confidence
@angular/router (source) 22.2.2 → 22.2.3 age confidence
oxfmt (source) 0.72.0 → 0.73.0 age confidence
oxlint (source) 1.87.0 → 1.88.0 age confidence
pnpm (source) 12.11.2 → 12.13.0 age confidence
vitest (source) 5.0.3 → 5.0.4 age confidence

Release Notes

angular/angular-cli (@​angular/build)

v21.2.27

Compare Source

@​angular/cli
Commit Type Description
2e1742adf fix update zod to 4.6.6
angular/components (@​angular/cdk)

v22.2.3

Compare Source

cdk
Commit Type Description
a307978dc fix a11y: treat inert elements as non-focusable (#​33846)
material
Commit Type Description
e0c2d4df7 fix chips: implement touch-target pattern/styles on chip component (#​33614)
angular/angular (@​angular/common)

v22.2.3

Compare Source

common
Commit Type Description
fafec77b5d fix harden param encoding against prototype pollution
compiler
Commit Type Description
54f3de517c fix check @boundary blocks in the control flow content projection diagnostic
5e50658fd2 fix compare the operand in ReadTemporaryExpr.isEquivalent
b6f9cc5d70 fix do not scope comments placed inside of a selector
35a02f8097 fix harden JIT against prototype pollution
08075e8aa0 fix support dots in class binding names
c7a72c2bf2 fix support popover property bindings
compiler-cli
Commit Type Description
fa21d083fe fix inline tcb when depending on local directive
core
Commit Type Description
b5208f9fc3 fix avoid deleting idle bucket created during another bucket's drain
90af679c3b fix do not swallow compilation errors in computeStandaloneComponentScope
eca5fa4665 fix don't crash initEventReplay when two apps share an APP_ID
e59a2303df fix error when destroying embedded view with animations
a23941fe75 fix keep activeConsumer and currentInjector constant using Store helper
913ae7421f fix skip nested tick from onMicrotaskEmpty while a tick is running
forms
Commit Type Description
cc515b8b23 perf use addEventListener to avoid unconditional CD scheduling on blur
migrations
Commit Type Description
d04f214d04 fix normalize .d.ts paths in output migration field IDs
router
Commit Type Description
f9a4f751f0 fix check abort signal state on subscribe
oxc-project/oxc (oxfmt)

v0.73.0

Compare Source

🚀 Features
  • a495e82 oxfmt: Support associations config to specify language over filepath (#​27437) (leaysgur)
  • 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#​27386) (leaysgur)
📚 Documentation
oxc-project/oxc (oxlint)

v1.88.0

Compare Source

🚀 Features
  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#​27346) (Mikhail Baev)
pnpm/pnpm (pnpm)

v12.13.0: pnpm 12.13.0

Compare Source

This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.

Minor Changes

  • Added the pnpm profile command to view and update registry user profile settings.

  • Added pnpm token to list, create, and revoke authentication tokens on the registry.

  • Added the storeIndexFormat setting. Set it to files to keep a store's package index as one file per package instead of the SQLite index.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt index.db.

  • Added the nodePackageMap setting, which groups the package-map settings. nodePackageMap.mode: write-only writes node_modules/.package-map.json for other tools without making Node.js load it. mode: load also makes Node.js load the map, like nodeExperimentalPackageMap: true. nodePackageMap.type replaces nodePackageMapType. The old settings still work #​14937.

    nodePackageMap:
  mode: write-only
  type: loose
Patch Changes
Setting up pnpm

  • pnpm setup now works when pnpm was installed with npm on macOS. It installed pnpm from npm's bin directory and left a $PNPM_HOME/bin/pnpm that could not run #​16855.

  • pnpm runs again after pnpm setup when globalShims enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #​16874.

  • A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that rust-toolchain.toml names. It used to install the MSVC toolchain.

Installing packages

  • On macOS, pnpm install no longer fails with ERR_PNPM_LOCKFILE_WRITE_FILE when the project is on a virtiofs or SMB share. pnpm now falls back to a regular fsync when the file system rejects a full sync #​16846.

  • On macOS, pnpm install, pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.

  • pnpm install now puts the executables of a Python build backend's requirements on the PATH while the backend runs. Projects built with uv_build now install. Before, they failed with "uv-build was not properly installed".

  • Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

  • pnpm-lock.yaml no longer records the tarball URL of a package installed from a scoped registry, such as one set by @types:registry=, when pnpm can rebuild the URL from that registry #​16866.

Packing, auditing, and pipelines

  • pnpm pack and pnpm publish now pack only package.json, the README, the license, and the files named in main and bin when files is an empty array. They used to pack every file in the package #​16889.

  • pnpm audit and pnpm audit signatures no longer check runtimes installed through devEngines.runtime, such as node@runtime:24.21.0, against the npm package of the same name. pnpm audit signatures reported these runtimes as having an invalid registry signature #​16869.

  • pnpm pipeline now runs the root's tasks when pnpm-workspace.yaml lists only the root in packages or omits packages, as pnpm -r run does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, pnpm pipeline now reports that no projects are selected #​16849.

Performance

  • pnpm install resolves Python dependencies faster. With --lockfile-only, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.

  • A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.

  • pnpm install with enableModulesDir: false now verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.12.1: pnpm 12.12.1

Compare Source

This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Patch Changes

  • pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

  • pnpm dist-tag add, rm, and ls now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.

  • Added the tool: protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. pnpm add bun@tool:1.3.0, pnx node@tool:22, and pnx yarn@tool:4 work like the runtime: spelling, which stays supported as an alias. A lockfile written for runtime: stays up to date when package.json switches to tool:, and the other way around.

    A named registry can no longer be called tool.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.12.0: pnpm 12.12.0

Compare Source

This release shares task results and dependency builds through a remote cache, adds the addMissingPeerTypes setting, and lets pnpm add --config and pnpm update manage configuration dependencies. It also fixes dangerouslyAllowAllBuilds running the build scripts of packages that allowBuilds denies.

Minor Changes

  • pnpm pipeline can share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache.

    The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new remoteCache setting, which names the server and holds the signing keys. pnpm pipeline --report records the run under the organization remoteCache.org names.

  • Added the addMissingPeerTypes setting, which links the @types package of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends on react gets the project's @types/react linked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on #​15689.

  • pnpm add --config and pnpm update now handle configuration dependencies the way they handle other dependencies #​16814.

    pnpm add --config saves a version range in pnpm-workspace.yaml by the same rules as pnpm add, so pnpm add --config my-config@latest saves a range such as ^1.2.0. It also resolves the package again when pnpm-lock.yaml already locks an older version.

    pnpm update updates configuration dependencies within their ranges, and pnpm update --latest moves them to their latest version. A selector such as pnpm update my-config updates only the configuration dependencies it names.

Patch Changes

  • A package set to false in allowBuilds no longer runs its build scripts when dangerouslyAllowAllBuilds is true. The two settings together now allow every build except the denied ones. Previously, dangerouslyAllowAllBuilds ignored the denials.

  • pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an .npmrc file, or _auth, or a pnpm-workspace.yaml it could not parse, stopped every command, pnpm --version included.

  • pnpm update and pnpm why accept --depth Infinity again. They failed with invalid value 'Infinity' for '--depth <DEPTH>' #​16817.

  • pnpm deploy without injectWorkspacePackages now binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed with ERR_PNPM_DEPLOY_AMBIGUOUS_PEER whenever other packages in the deployed graph depended on different versions of that peer #​16807.

  • pnpm deploy --legacy no longer fails with ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER when a workspace dependency of the deployed project declares a workspace: peer dependency that the project does not depend on itself. pnpm now copies that peer from the workspace into the deploy directory.

    An auto-installed peer declared with workspace: now always resolves to the workspace project. Previously, workspace:* and workspace:^1.0.0 peers could be installed from the registry #​16806.

  • Repeat installs no longer resolve again when an injected workspace package lists a dependency also as a peer dependency.

  • Sped up frozen installs of unchanged injected workspace packages that use hardlinks.

  • Sped up workspace discovery with subtree exclusions such as !generated/**.

  • A key under a registry URL in the _auth setting that does not start with @ is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds an authToken object but lacks its @, such as org for @org, is still an error.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude
vitest-dev/vitest (vitest)

v5.0.4

Compare Source

   🚀 Features
   🐞 Bug Fixes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 4am on sunday,before 4am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 73c2c45 to c88eac5 Compare October 18, 2026 05:59
@json-derulo
json-derulo merged commit 0b134ab into main Oct 18, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@json-derulo