chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/build	22.2.2 → 22.2.3
@angular/cli	22.2.2 → 22.2.3
jsdom	30.1.2 → 30.1.3
pnpm (source)	12.13.0 → 12.14.0
vitest (source)	5.0.4 → 5.0.5

---

Release Notes

angular/angular-cli (@​angular/build)

v22.2.3

Compare Source

@​angular/cli

Commit	Type	Description
3158e865f	fix	accept multi-digit array indices in ng config
bcff0e76a	fix	keep ng version working when the package manager is not installed
5570c91d2	fix	resolve package name in npm workspace members

@​schematics/angular

Commit	Type	Description
881865f36	fix	keep the workspace build version in the use-application-builder migration

@​angular-devkit/schematics

Commit	Type	Description
cf1f3b9d4	fix	avoid stack overflow when chaining many rules

@​angular/build

Commit	Type	Description
1d477d6bc	fix	add CSP nonce to stylesheet and modulepreload link elements
fbe208f83	fix	always use AOT when extracting i18n messages
c1c4216a6	fix	coalesce external watcher directories to avoid macOS FSEvents limit
792990bc2	fix	disable Vitest fsModuleCache in unit-test builder
82439399c	fix	ensure Sass importers return global Promise instances
a818de415	fix	keep Vite server file watcher disabled in Vitest watch mode
91bad469e	fix	sort discovered unit-test files for deterministic builds
e84db4af7	fix	use module.registerHooks() for in-memory ESM loader
a428021b7	perf	avoid invalidating Angular diagnostic cache on stylesheet change
b0ac394a0	perf	resolve asset patterns concurrently with bounded concurrency

@​angular/ssr

Commit	Type	Description
bd09b98fc	fix	preserve preload metadata for nested empty-path routes
a92546892	fix	preserve query parameters on relative route redirects
a2b86cc94	fix	resolve relative redirects against the parent route

jsdom/jsdom (jsdom)

v30.1.3

Compare Source

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

pnpm/pnpm (pnpm)

v12.14.0: pnpm 12.14.0

Compare Source

This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

Minor Changes

• Added the sideEffectsCache.exclude setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a remoteCache server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same name, @scope/*, and name@version patterns as minimumReleaseAgeExclude #​5271.

• pnpm login now prints the npm-notice response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.

Patch Changes

Installing packages

• pnpm install and pnpm add no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes #​16839.

• pnpm install, pnpm add and pnpm update now reuse pnpm-lock.yaml when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an overrides entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry #​16923.

• pnpm install now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With linkWorkspacePackages enabled, it used to run git ls-remote once per project #​16899.

• A filtered install, such as pnpm install --filter <pkg>, now keeps the pnpm-lock.yaml entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #​16931.

• pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install #​16901.

• An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #​16929.

Running commands and scripts

• pnpm no longer aborts with a core dump when the reader of its output has exited, as in pnpm list | head -1 or pnpm start 2>&1 | head -1. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 #​16904 pnpm/tasks#132.

• On Windows, pnpm exec, pnpm run, and commands such as pnpm nx now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited #​16930.

• Commands that do not write the project manifest now leave a missing package.json absent. This covers queries such as pnpm why and pnpm outdated, pnpm fetch, pnpm dedupe --check, and commands that exit with an error, such as pnpm rt ls. These commands used to create one from the initialization template. pnpm sbom run from a lockfile alone now reports the root component as unknown with version 0.0.0 #​16907.

• pnpm run now reports a failed script as a JSON record under --reporter=ndjson. It printed a plain [ELIFECYCLE] line to stderr.

• pnpm run no longer prints [ELIFECYCLE] Command failed with exit code N. to stderr when a script fails under --reporter=silent, --silent, or --loglevel=silent.

• pnpm pipeline --dry-run no longer writes a run report when no projects are selected. With --json it prints {"tasks": []} pnpm/tasks#126.

Packing and publishing

• pnpm pack and pnpm publish now ship the whole gitignored directory that main, browser, or bin points into, as npm does. Previously only the main and bin files themselves were packed, and a gitignored browser file was left out #​16908.

• pnpm pack and pnpm publish now honor a .npmignore or .gitignore inside a subdirectory when package.json has a files field. The package root's ignore files and those inherited from the workspace are still skipped #​16909.

Setting up pnpm and toolchains

• --registry, --https-proxy, --http-proxy, and --no-proxy now apply when pnpm resolves and downloads the pnpm version a project pins in packageManager. Before, these lookups went to https://registry.npmjs.org/, which a firewall that only allows a private registry blocks #​16911.

• On Windows, pnpm install now installs the Rust toolchain for rustup's default host, so a machine set up with rustup set default-host x86_64-pc-windows-gnu gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain #​16854.

Platinum Sponsors

Gold Sponsors

vitest-dev/vitest (vitest)

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on sunday,before 4am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.