chore(deps): update js-dependencies by renovate[bot] · Pull Request #106 · gsong/ccmcp

renovate · 2026-01-07T20:37:38Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	`2.5.11` → `2.5.13`
@types/node (source)	`22.20.1` → `22.20.2`
@types/react (source)	`19.2.18` → `19.3.0`
actions-up	`1.18.0` → `1.19.0`
pnpm (source)	`12.0.0` → `12.4.1`
react (source)	`19.2.8` → `19.3.0`
tsdown (source)	`^0.22.14` → `^0.23.0`
tsx (source)	`4.23.12` → `4.23.13`
zod (source)	`4.5.1` → `4.6.1`

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.13`

Compare Source

Patch Changes

#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
```
/* Invalid */
@import 'foo.css';

.my-style {
  color: red;
}

/* Valid */
@import 'foo.css' layer(base);

@layer base {
  .my-style {
    color: red;
  }
}
```
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
```
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
```
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.
#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.
#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.
#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.
#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
```
const kibibyte = 2 ^ 10; // 8, not 1024
```
#11670 4969ee1 Thanks @ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.
#11676 840a52a Thanks @dyc3! - Fixed #11672 and #11671 by disabling the experimental capitalized-call and effect-dependency checks in useReactCompiler, matching their exclusion from upstream's recommended lint preset. Valid calls such as Intl.NumberFormat() and captures of variables declared inside effects no longer produce these diagnostics.
#11660 49485ed Thanks @ematipico! - Fixed #11653: Astro template suppression comments ({/* biome-ignore lint: reason */}) now suppress matching HTML lint diagnostics on the following line when full HTML support is enabled.
#11664 9a73b9c Thanks @dyc3! - Improved the performance of useRegexpExec.
#11661 5341b3f Thanks @ematipico! - Fixed #7479. noUnusedVariables now treats Unicode escapes in identifiers as the same binding as their decoded spelling.

#11630 62e1fc5 Thanks @dyc3! - Fixed the HTML formatter inserting whitespace between adjacent Svelte expressions when their combined length exceeds the line width.

 <span>
-  {head.median - base.median >= 0 ? "+" : "−"}
-  {formatMs(Math.abs(head.median - base.median))}
+  {head.median - base.median >= 0 ? "+" : "−"}{formatMs(Math.abs(head.median - base.median))}
 </span>

#11658 ed4bfa4 Thanks @fredrikblau! - Fixed #11644: useHeadingContent no longer reports headings that render their text with a directive: set:html and set:text in Astro files, v-html and v-text in Vue files.
```
<h1 set:html={heading} />
<h2 set:text={heading}></h2>
```
```
<template>
  <h1 v-html="heading"></h1>
  <h2 v-text="heading"></h2>
</template>
```
#11613 47d7383 Thanks @ematipico! - Improved the performance of Biome Formatter up to ~50% in some cases.
#11655 fd8fc74 Thanks @ematipico! - Fixed #6974, where noUnusedPrivateClassMembers incorrectly reported TypeScript private constructor properties read through object destructuring from this as unused.
#11618 21a10cf Thanks @siketyan! - Fixed #11605: Type inference now infers the type of an unannotated callback parameter from the signature of the function the callback is passed to, and honours explicit type arguments on call expressions. This improves type-aware analysis for noBaseToString, noFloatingPromises, noMisleadingReturnType, noMisusedPromises, noUnnecessaryConditions, noUnsafePlusOperands, noUselessTypeConversion, useArrayFind, useArraySortCompare, useAwaitThenable, useDisposables, useExhaustiveSwitchCases, useIncludes, useNullishCoalescing, useRegexpExec, and useStringStartsEndsWith. For example, noFloatingPromises can now detect Promises reached through such parameters:
```
interface Context {
  doSomething(): Promise<void>;
}

declare function test(callback: (ctx: Context) => Promise<void>): void;

test(async (ctx) => {
	ctx.doSomething(); // now reported as a floating promise
});
```
#11698 b019982 Thanks @denbezrukov! - Fixed parsing of unquoted CSS URLs beginning with @ or !, such as url(@/assets/icon.svg) and url(!font.woff2). Preserved escaped and non-ASCII whitespace in raw URLs during formatting.
```
-background-image: url(image\);
+background-image: url(image\ );
```
#11622 c23e4c7 Thanks @Netail! - Added the nursery rule noUnsafeIframeSandbox, which reports iframe elements whose sandbox attribute combines allow-scripts and allow-same-origin, since that combination lets the embedded document remove its own sandboxing.
```
<iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />
```
#11606 de0528f Thanks @dyc3! - Added the recommended noSvelteAtHtmlTags nursery rule, which reports Svelte {@html} tags that render unescaped HTML.
#11670 4969ee1 Thanks @ematipico! - Fixed #6782: GritQL plugins now match captured JSX component names against code snippets such as React.Fragment.
#11687 09d97d9 Thanks @hori-design! - Fixed #11678: useReactCompiler no longer panics on files that contain non-ASCII characters. This bumps the React Compiler version.
#11595 a64d757 Thanks @dyc3! - Added the nursery Vue-domain rule useVueBaseImport rule, which enforces importing Vue APIs from vue instead of internal @vue/* packages.
#11675 353cbae Thanks @dyc3! - Fixed useReactCompiler silently producing no diagnostics in WebAssembly builds, including the playground.
#11625 ea20e5a Thanks @denbezrukov! - Improved linting performance for large CSS and JSON files.
#11670 4969ee1 Thanks @ematipico! - Fixed #7527: suppression actions for diagnostics emitted on comments are now inserted before the diagnostic comment. In particular, suppressing noTsIgnore now places the biome-ignore comment before @ts-ignore.
#11655 fd8fc74 Thanks @ematipico! - Fixed #8629, where noUnusedPrivateClassMembers incorrectly reported used private TypeScript method overload signatures as unused.
#11669 579f401 Thanks @denbezrukov! - Improved the performance of noExcessiveLinesPerFile when skipBlankLines is false.

`v2.5.12`

Compare Source

Patch Changes

#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.
```
<Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />
```
#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.
```
{x && <div>text</div>}
{cond && <a></a><b></b>}
```
#11440 b88f1ea Thanks @Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.
```
{cond && <style>a { color: red }</style>}
{cond && <script>let x = {a: 1};</script>}
```
#11440 b88f1ea Thanks @Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.
#11440 b88f1ea Thanks @Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.
#11508 54f3a2e Thanks @dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:
```
Math.max(Math.max(a, b), c);
```
The fix flattens this expression to Math.max(a, b, c).
#11585 c5c8315 Thanks @Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).
#11368 52a57b3 Thanks @Austin1serb! - Fixed #6830: Biome now reports a diagnostic for excessively deep syntax instead of overflowing the native stack while releasing the parsed tree.
#11596 1fc42ed Thanks @dyc3! - Added the nursery rule noThisOutsideOfClass. The rule reports this outside class members and TypeScript functions with an explicit this parameter.
```
function Person(name) {
    this.name = name;
}
```
#11555 2516335 Thanks @dyc3! - Fixed #11529, where noFloatingPromises missed unhandled Promise chains when the imported function's module belonged to an import cycle. Cyclic modules now preserve types for exports that do not participate in recursive type dependencies.
#11518 0fee70c Thanks @HarperZ9! - Fixed #11500: the formatter now prints the declare modifier before accessibility modifiers on class properties. private declare readonly name: string is now formatted as declare private readonly name: string, matching Prettier and TypeScript's canonical modifier order.
#11580 1277af2 Thanks @ematipico! - Fixed #5091: Biome no longer moves comments next to the < of a generic, which causes invalid TypeScript syntax:
```
- Generic<// a comment
+ Generic<
+   // a comment
```
#11577 42995d2 Thanks @ematipico! - Fixed #4592. Biome no longer crashes while parsing malformed delete expressions.
#11590 67963b4 Thanks @ematipico! - Fixed #6427 so Grit plugins can use function = ... as a node argument.
#11600 a689cb5 Thanks @ematipico! - Fixed #6644: noUnusedVariables now recognizes all interface declarations in a TypeScript declaration-merging group when the interface is referenced.

The following snippet no longer triggers the rule.
```
interface Things {
    foo: string;
}

interface Things {
    bar: string;
}

export type Key = keyof Things;

interface Things {
    baz: string;
}
```
#11591 d4a0716 Thanks @ematipico! - Fixed #6615. noDuplicateProperties no longer reports declarations nested in block at-rules as duplicates of declarations in their parent block.
#11492 f2a07aa Thanks @santichausis! - Fixed #11454: noMisplacedAssertion now recognises @fast-check/vitest's test.prop(...) (and .concurrent.prop, .skip.prop, etc.) as a test function, the same way it already recognises test.each. The JS formatter picks up the same recognition, so a curried test.prop(...)(...) call is now formatted with the regular breakable argument layout used for test.each/test.for, instead of the single-line-hugging layout used for plain it/test calls.

For example, Biome no longer reports the assertion below as misplaced:
```
import { fc, test } from "@fast-check/vitest";

test.prop([fc.string()])("round-trips", (s) => {
  expect(s).toBe(s);
});
```
#11589 65742b3 Thanks @ematipico! - Fixed #4928: noUnusedVariables no longer reports a value declaration as unused when its merged namespace is referenced.
#11559 472dbc2 Thanks @levrik! - Fixed a false positive in noVueDuplicateKeys where a <script setup> variable initialized from props was reported as a duplicate of the prop it derives from. Biome now exempts any variable whose initializer references props, instead of only recognizing defineProps() and toRefs(props).

For example, Biome no longer reports foo below as a duplicate key:
```
<script setup>
import { toRef } from 'vue';
const props = defineProps(['foo']);
const foo = toRef(props, 'foo');
</script>
```
#11594 6586ceb Thanks @ematipico! - Fixed #6640. Biome no longer crashes when linting malformed for...of statements.
#11571 85b197d Thanks @ematipico! - Fixed #10838: useSortedAttributes no longer corrupts JSX attributes when nested JSX elements also require sorting.
#11533 97e76c0 Thanks @ematipico! - Fixed #11520, where the Biome scanner would start analysing dependencies multiple times, leading to long and unresponsive sessions.
#11564 18a0e1f Thanks @Netail! - Fixed the diagnostic range of noInferrableTypes so it now highlights only the type instead of including the leading : colon, spaces and comments.
#11540 124fdaa Thanks @ematipico! - Fixed #11537: noShorthandPropertyOverrides now compares declarations only within the same block. The rule no longer reports @supports feature queries and correctly checks nested, @keyframes, and @page blocks.
#11532 7ceb0ee Thanks @dyc3! - Fixed #11528: noFloatingPromises no longer reports statement-level await expressions that handle Promise values, including overloaded calls returning Promise aliases. Awaited values that resolve to arrays of Promises remain reported because their element Promises are not handled by await.
#11474 3c6412e Thanks @dyc3! - Fixed #10241. Biome no longer reports unsupported text expression diagnostics for double-curly text in vanilla HTML, and the formatter preserves adjacent curly-brace text.
#11593 6c7fd27 Thanks @dyc3! - Added the nursery rule noVueDeprecatedScopedSlots. It reports deprecated $scopedSlots references in Vue templates and component objects, and offers an unsafe replacement with $slots. For example, Biome now reports this.$scopedSlots.default inside a Vue component.
#11440 b88f1ea Thanks @Princesseuh! - Fixed the formatter crashing on an Astro or Svelte expression spanning several lines in a file with CRLF line endings, such as <p>{a +\r\n b}</p>.
#11581 f4e5ebb Thanks @dyc3! - Added the nursery rule useModernMathApis. The rule reports legacy mathematical patterns that have direct modern Math equivalents.
```
Math.sqrt(a * a + b * b);
```
#11597 a20f44a Thanks @Netail! - Added the nursery rule noBunModules, which forbids the use of Bun builtin modules (e.g. bun:sqlite, bun:ffi).
#11545 7d54688 Thanks @dyc3! - Fixed #11542: Biome now reports HTML comments between Svelte tag attributes as parse errors.
#11582 b6611dd Thanks @ematipico! - Fixed #3862. Biome now parses legacy Internet Explorer filter and -ms-filter values such as progid:DXImageTransform... and alpha(opacity=40).
#11575 65da251 Thanks @dyc3! - Improved the Tailwind parser's ability to recover from parsing failures. Whitespace now always allows the parser to recover and start parsing a new class.
#11576 0f78499 Thanks @ematipico! - Fixed #3515 and #10395, where Biome could corrupt Unicode characters while writing source received through standard input to standard output. Characters such as ⚠ and ✔ are now preserved.
#11539 0fca643 Thanks @ematipico! - Fixed #11512, where style/noDescendingSpecificity missed lower-specificity selectors after a later higher-specificity selector with the same tail selector.
#11544 040f867 Thanks @dyc3! - Fixed #11541: formatting a Svelte render tag followed by an HTML comment no longer duplicates the comment.
```
 <div>
   {@render children?.()}
   
-  
 </div>
```
#11565 ee69e0e Thanks @ematipico! - Fixed #11525. Now the configuration schema correctly provides auto-completion for linter domains.
#11583 b19390c Thanks @dyc3! - Fixed #11352: useExplicitLengthCheck no longer reports length-like properties used as value-producing || fallbacks or optional chains, and it no longer offers fixes for value-producing && checks or unsafe negations.
#11562 753e955 Thanks @ematipico! - Fixed an issue where the Biome Language Server would start with logging level set to debug. This would cause logs to grow exponentially in long sessions.
#11217 7d3ee9c Thanks @dyc3! - Fixed handling of biome-ignore format suppression comments on TypeScript declared class properties with string literal names.
```
class A {
	declare /* biome-ignore format: exercise suppression checking */ 'a-b': 0;
}
```
#11497 f5d7896 Thanks @dyc3! - Added the noInvalidFileInputAccept nursery rule. The rule reports invalid literal accept values on file inputs in JSX and HTML, and normalizes common mistakes.
```
<input type="file" accept="image/jpg" />
```
#11345 ac58958 Thanks @jakeleventhal! - Improved type inference performance by avoiding resolution of unused members in object arguments.
#11554 2d55931 Thanks @Netail! - Added the new nursery rule useReactNamingConvention, which enforces naming conventions for React values assigned from createContext, useId, and useRef. A value from createContext must be a PascalCase component name ending with Context, a value from useId must be named id or end with Id, and a value from useRef must be named ref or end with Ref.
#11491 1d6210b Thanks @dyc3! - Added the nursery rule noUnmodifiedLoopCondition, which reports variables in loop conditions that are never modified in the loop.
```
let node = getNode();
while (node) {
    process(node);
}
```

azat-io/actions-up (actions-up)

`v1.19.0`

Compare Source

compare changes

🚀 Features

Resolve updates within a prefixed tag family
(5b17230)

🐞 Bug Fixes

Detect reference type per pin instead of per action
(95876c1)
Never write back updates that were skipped
(bca48d1)
Report every skipped action regardless of skip reason
(d09c783)
Never update a reference across tag families
(87f1e86)
Recover the tag family of a sha pin from its version comment
(98a7020)
Apply tag families to update styles and modes
(332367c)
Rewrite only the reference the update was scanned from
(be33505)
Report invalid mode and style as a normal cli error
(4ba83c6)

❤️ Contributors

Azat S. (@azat-io)

pnpm/pnpm (pnpm)

`v12.4.1`: pnpm 12.4.1

Compare Source

pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under nodeLinker: hoisted. Repeat installs are faster.

Patch Changes

Installing packages

pnpm install no longer fails with Operation not permitted when the filesystem refuses a hard link or a copy-on-write clone #14722. Under packageImportMethod: auto and clone-or-copy, pnpm copies the file instead. EdenFS checkouts, which have no hard links, and rootless containers, which refuse the clone syscall, both hit this. An explicit packageImportMethod: hardlink or clone still reports the error.

pnpm also copies a package file whose store entry has reached the filesystem's limit on names for one file, 1024 on NTFS and 65000 on ext4. Such a file failed the install under packageImportMethod: hardlink, and under auto it stopped pnpm hard linking for the rest of the install.
pnpm install no longer writes a package file through a symlink left at the path it is importing to. Copying such a file overwrote whatever the link pointed at, and created that file when the link pointed nowhere. An executable package file also made the link's target executable.
Fixed pnpm install and pnpm dlx on Android. Registry requests crashed because pnpm found no system CA certificates, so pnpm uses bundled ones there #14777. Imports also failed with "Permission denied" on filesystems that deny hard links and reflinks, and now fall back to copying #14780.
pnpm install no longer fails with "Invalid cross-device link" while preserving a package's nested node_modules directory during a Docker build #14758.
pnpm install no longer fails on a package tarball that carries a file at the archive root, such as the ._* entries macOS tar adds #14701. The file is installed at the root of the package.

A file: tarball packed without the usual package/ directory is now recorded under the name and version from its own package.json. It was recorded under the alias the dependency was given, at version 0.0.0.
Under nodeLinker: hoisted, pnpm install no longer re-imports packages that are already in place. A repeat install replaced the whole node_modules tree and reported Packages: +N. A package is still imported when its directory is missing, when its package.json no longer carries the installed version, when it is a file: dependency, and when it is patched. Lifecycle scripts no longer run again for a package left in place, and pnpm rebuild and a change to allowBuilds still reach it.
pnpm install now runs a dependency's build scripts again when its side-effects cache entry has no files to restore #14717. Such builds were skipped and nothing was put in their place, so a script whose whole effect lands outside its own package directory, such as a git hook installer, never took effect. pnpm no longer publishes empty artifacts to the shared side-effects cache either.

Resolving and linking dependencies

pnpm install, pnpm add, and pnpm dedupe now apply ignoredOptionalDependencies #14729. Matching optional dependencies are left out of the lockfile and are not installed. pnpm 12 installed them whenever it resolved dependencies from scratch.
pnpm install no longer links a transitive dependency to a workspace package when linkWorkspacePackages is true and the dependency is declared with a plain version range #14781. Enabling preferWorkspacePackages does not change this. Set linkWorkspacePackages: deep to link them.
pnpm install no longer leaves dangling dependency links in workspace packages located above the workspace root #14726.
pnpm install and pnpm add no longer leave a dangling symlink in node_modules when a project starts depending directly on a package that the lockfile holds only as a transitive dependency with resolved peer dependencies #14714.
pnpm dedupe now keeps a compatible auto-installed peer when another workspace project depends on a newer major #14697. Repeated runs alternated between compatible and incompatible peer versions.
pnpm peers check no longer reports a peer dependency declared as workspace:^, workspace:~, or a bare workspace: as unmet #14770. pnpm reported these as unmet whatever version the linked workspace project supplied.

Performance

Sped up repeat installs #14540. pnpm checks the store's files only for the packages it links into node_modules, instead of every package in the lockfile. Creating the command shims in node_modules/.bin makes about 1,500 fewer filesystem calls in a 76 project workspace. Installs that use the global virtual store read their slot paths from the cache directory instead of deriving them every time. Verifying a large lockfile also allocates less memory.
Sped up pnpm install in Cargo workspaces with many member crates. Repeated installs reuse verified Cargo checksum metadata.
Installing several packages from the same Git repository and commit now downloads the source once per install #14725. Each package still runs its prepare scripts in its own copy of the checkout.

Running scripts and tasks

pnpm now passes Ctrl+C on to the script or command it started and waits for it to shut down #14723. pnpm exited first, so a script that was still writing landed on the shell prompt.
pnpm run "/pattern/" --no-bail now lets every matched script finish after one of them fails #14718. The command exits with ERR_PNPM_RUN_FAILED, and its message lists the scripts that failed in the order they were selected.
pnpm pipeline no longer fails on a project that tracks a symlink, such as a CLAUDE.md pointing at AGENTS.md #14692. Changing a symlinked input's target invalidates that task's cache, and pnpm pipeline --no-cache no longer hashes task inputs.

Commands

pnpm add -g, pnpm update -g, and pnpm remove -g no longer change global bins or install directories after reading only part of an installed package group #13796. If any declared package manifest is missing, malformed, or unreadable, pnpm now fails before it activates or removes anything and leaves the existing global installation intact.
pnpm dedupe now processes every workspace project by default, including workspaces that keep a separate lockfile per project #14732. Workspace filters select which projects it processes, and --fail-if-no-match exits with an error when no project matches.
pnpm update <name>@<version> now keeps the range operator the manifest declares #14745. Running pnpm update react@19.3.0 on "react": "^19.2.8" writes "react": "^19.3.0". A jsr: entry keeps its jsr: prefix, and a plain pnpm update now moves a jsr: range the way it moves an npm range.
pnpm --filter directory selectors now support ? wildcards and character classes such as [ab]. A * or ? wildcard no longer selects a directory whose name starts with a dot, as on pnpm 11.
pnpm deploy --legacy now prefers the dependency versions pinned in the source workspace lockfile when they still satisfy the deployed project's range #13857.
pnpm sbom now leaves out a package's author field when the manifest author name is empty or contains only whitespace #14685. In a filtered or split workspace run, only a project with no author field i

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-09-05T01:19:39Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Error: ERR_PNPM_STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE

  × updating dependencies
  ╰─▶ minimumReleaseAgeStrict cannot be combined with --no-save: approval
      would require writing to minimumReleaseAgeExclude in pnpm-
      workspace.yaml, which --no-save prevents.
  help: Drop --no-save so the exclude list can be persisted, or set
        minimumReleaseAgeStrict: false.

renovate Bot force-pushed the renovate/js-dependencies branch from 886b036 to d99f074 Compare January 8, 2026 00:38

renovate Bot changed the title ~~chore(deps): update dependency zod to v4.3.3~~ chore(deps): update dependency zod to v4.3.4 Jan 8, 2026

renovate Bot force-pushed the renovate/js-dependencies branch from d99f074 to 2d76559 Compare January 10, 2026 16:58

renovate Bot changed the title ~~chore(deps): update dependency zod to v4.3.4~~ chore(deps): update js-dependencies Jan 10, 2026

renovate Bot force-pushed the renovate/js-dependencies branch 3 times, most recently from c754ef5 to 5625293 Compare January 17, 2026 09:40

renovate Bot force-pushed the renovate/js-dependencies branch 3 times, most recently from f90edb5 to bb9ba03 Compare January 22, 2026 02:36

renovate Bot force-pushed the renovate/js-dependencies branch 5 times, most recently from a63f8ff to 241d03f Compare January 30, 2026 16:53

renovate Bot force-pushed the renovate/js-dependencies branch 2 times, most recently from b60df73 to 3233196 Compare February 3, 2026 14:51

renovate Bot force-pushed the renovate/js-dependencies branch 7 times, most recently from 7179c44 to fc1f914 Compare February 16, 2026 09:38

renovate Bot force-pushed the renovate/js-dependencies branch 6 times, most recently from a0d8dc9 to 495d69c Compare February 22, 2026 16:49

renovate Bot force-pushed the renovate/js-dependencies branch 4 times, most recently from 1583252 to b81ddcc Compare March 9, 2026 14:54

renovate Bot force-pushed the renovate/js-dependencies branch 3 times, most recently from 1c15f7e to 051092a Compare March 16, 2026 22:13

renovate Bot changed the title ~~chore(deps): update js-dependencies~~ chore(deps): update pnpm to v10.32.0 Mar 16, 2026

renovate Bot force-pushed the renovate/js-dependencies branch from 051092a to b18c396 Compare March 18, 2026 04:47

renovate Bot changed the title ~~chore(deps): update pnpm to v10.32.0~~ chore(deps): update pnpm to v10.32.1 Mar 18, 2026

renovate Bot force-pushed the renovate/js-dependencies branch from b18c396 to d4f6335 Compare March 19, 2026 18:10

renovate Bot changed the title ~~chore(deps): update pnpm to v10.32.1~~ chore(deps): update js-dependencies Mar 19, 2026

renovate Bot force-pushed the renovate/js-dependencies branch 2 times, most recently from ae6414f to 750bdd8 Compare March 25, 2026 18:42

renovate Bot force-pushed the renovate/js-dependencies branch 5 times, most recently from fc76190 to 49e21aa Compare April 6, 2026 16:57

renovate Bot force-pushed the renovate/js-dependencies branch 7 times, most recently from aacd659 to c628356 Compare April 17, 2026 02:50

renovate Bot force-pushed the renovate/js-dependencies branch 2 times, most recently from 7e1b4ca to 16d307c Compare April 22, 2026 02:58

chore(deps): update js-dependencies

b4d6886

Navigation Menu

chore(deps): update js-dependencies - #106

chore(deps): update js-dependencies#106
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/js-dependencies

renovate Bot commented Jan 7, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Sep 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.5.13

Patch Changes

v2.5.12

Patch Changes

v1.19.0

🚀 Features

🐞 Bug Fixes

❤️ Contributors

v12.4.1: pnpm 12.4.1

Patch Changes

Installing packages

Resolving and linking dependencies

Performance

Running scripts and tasks

Commands

Configuration

Uh oh!

renovate Bot commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jan 7, 2026 •

edited

Loading

`v2.5.13`

`v2.5.12`

`v1.19.0`

`v12.4.1`: pnpm 12.4.1

renovate Bot commented Sep 5, 2026 •

edited

Loading