chore(deps): update all non-major dependencies - #446
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
9c4e39b to
5bfebea
Compare
5bfebea to
7804f68
Compare
renovate
Bot
changed the title
7804f68 to
2d975ff
Compare
2d975ff to
0104ff1
Compare
0104ff1 to
8120e32
Compare
8120e32 to
5ec9f5e
Compare
5ec9f5e to
efcb3b7
Compare
efcb3b7 to
1a61aec
Compare
1a61aec to
cf8e7f8
Compare
cf8e7f8 to
2b13cf8
Compare
6132302 to
360e116
Compare
360e116 to
aa97a8b
Compare
aa97a8b to
714cf9d
Compare
714cf9d to
bdbb60c
Compare
bdbb60c to
9343bf3
Compare
9343bf3 to
fb7fea7
Compare
fb7fea7 to
556aaae
Compare
commit: |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
📦 Package Size🟢 3 size metrics smaller 📚 22 runtime dependencies (no change)
All tracked output (27)
Runtime dependencies (22)
Baseline: main_@_5052a9fd___2026-08-22 · gzip is the comparison metric · changes below 16 B gzip are ignored |
This PR contains the following updates:
^9.2.0→^9.3.0^4.10.0→^4.11.0^0.143.0→^0.146.0^10.0.0→^10.1.0^4.4.2→^4.4.3^4.4.2→^4.4.3^7946.0.0→^7946.0.16^3.65.4→^3.65.5^3.58.1→^3.65.5^1.9.0→^1.9.22^26.1.2→^26.2.0^0.1.0→^0.3.03.3.1→3.4.0^3.3.1→^3.4.0^3.3.1→^3.4.03.3.1→3.4.0v0.0.9-mp→v0.0.9^12.1.1→^12.2.1^10.8.0→^10.9.0^0.17.1→^0.20.0^20.11.1→^20.11.6^1.1.0→^1.2.2^6.1.0→^6.5.0^6.0.0→^6.5.024→24.19.0^2.0.11→^2.0.1211.20.0→11.22.0^1.413.0→^1.418.10^1.0.0→^1.418.10^4.62.4→^4.62.5^4.4.2→^4.4.3^3.3.1→^3.4.0^3.3.1→^3.4.03.3.1→3.4.0^8.1.5→^8.2.2^4.1.10→^4.1.11^3.3.9→^3.3.11Release Notes
antfu/eslint-config (@antfu/eslint-config)
v9.3.0Compare Source
🚀 Features
🐞 Bug Fixes
eslint-plugin-erasable-syntax-onlyas optional peer - by @KazariAI in #859 (01642)View changes on GitHub
nuxt/ui (@nuxt/ui)
v4.11.0Compare Source
Features
iconin items (#6726) (07f3fe8)experimental.componentDetection(#6731) (3a568b5)Bug Fixes
scrollable(#6786) (5afbd5c)baseinapplyUnstyled(#6825) (3e89ea7)classfrompropswith the component class (#6842) (731ff26)prefers-reduced-motion(#6742) (735b264)Performance Improvements
oxc-project/oxc (@oxc-project/types)
v0.145.0🐛 Bug Fixes
0c68b7festree: EmitdecoratorsonFormalParameterRest(#25582) (camc314)v0.144.0💥 BREAKING CHANGES
44fd320ast: [BREAKING] Split TS external modules & Namespace Declarations (#25284) (camc314)paypal/paypal-js (@paypal/paypal-js)
v10.1.0Compare Source
Minor Changes
d9c0200: NarrowPayPalMessagesSession.fetchContentto returnPromise<MessageContent>(previouslyPromise<MessageContent | null>). The evergreen SDK never resolves tonull— on an API error it returns an empty sentinelMessageContent(emptymessageItems) so the<paypal-message>element recognizes the error state and collapses. Existing=== nullchecks against the result become dead code but continue to compile.Patch Changes
09f2994: Fix incomplete prototype-pollution protection inprocessOptions. Theenvironmentoption was still read via destructuring, which reads through the prototype chain, soObject.prototype.environment = "sandbox"could downgrade a production checkout to the sandbox SDK URL.environmentis now read with ahasOwnPropertyguard, matching the existingsdkBaseUrlprotection.v10.0.3Compare Source
Patch Changes
4619c74: Adding v6 types for Venmo vault-without-payment (SavePayment)v10.0.2Compare Source
Patch Changes
cfcb985: Add adefaultexport condition to the./sdk-v6subpath so bundlers/tracers (e.g. @vercel/nft) resolve it correctly and don't fall back to the v5 entry.v10.0.1Compare Source
Patch Changes
d7f697b: Migrates Vitest to v4.983beb7: Add v6 web component DOM element types so non-React TypeScript integrations get strongly-typed access to the PayPal SDK custom elements.HTMLElementTagNameMapis augmented for<paypal-button>,<venmo-button>,<paypal-pay-later-button>,<paypal-credit-button>,<paypal-basic-card-button>,<paypal-basic-card-container>,<paypal-message>, and<apple-pay-button>(registered by Apple's Apple Pay JS SDK).7d44dcc: AddvaultSetupTokentoOnApproveDataand expandcreateVaultSetupTokenandonApproveJSDoc to cover Venmo vault-without-purchase flows.shikijs/shiki (@shikijs/langs)
v4.4.3Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
unjs/unhead (@unhead/bundler@>=3)
v3.4.0Compare Source
🚀 Features
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
v3.3.2Compare Source
🐞 Bug Fixes
aboutlinks to homepage - by @harlan-zw in #933 (430b1)🏎 Performance
View changes on GitHub
Hebilicious/reproduire (Hebilicious/reproduire)
v0.0.9Compare Source
compare changes
antfu-collective/bumpp (bumpp)
v12.2.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v12.2.0Compare Source
🚨 Breaking Changes
ReleaseType&#​39;conventional-prerelease&#​39;- by @DonBLong in #109 (a098d)🚀 Features
View changes on GitHub
eslint/eslint (eslint)
v10.9.0Compare Source
v10.8.1Compare Source
Bug Fixes
18eb0a7fix: prevent ASI hazard inno-unused-labelsautofix (#21173) (dongkyu lee)151ba3ffix: false positives ingetter-returnandaccessor-pairs(#21163) (Grit)6898df9fix: ignore meta-property names inid-denylist(#21166) (Pixel)4d7db66fix: ignore meta-property names inid-match(#21167) (Pixel)677214efix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)Documentation
7d0cbf8docs: Update README (GitHub Actions Bot)0a05812docs: add missing backticks tono-duplicate-imports.js(#21183) (Lee Daeun)678c90bdocs: Update README (GitHub Actions Bot)8a10424docs: Update README (GitHub Actions Bot)69bb948docs: Update README (GitHub Actions Bot)Chores
0a14800chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])05adcb1test: fix failing ecosystem test foreslint-plugin-unicorn(#21191) (Lazizbek Ergashev)5611035test: add error locations info tono-void(#21185) (Lee Daeun)ee47333ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])f131c03chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)1f6eddechore: update ecosystem plugins (#21182) (ESLint Bot)d3266fbchore: unpinwebpackdependency (#21172) (Francesco Trotta)65a6519chore: add allowScripts field to package.json (#21092) (GiHoon Noh)22e5256ci: addtriage:nolabel to Dependabot PRs (#21141) (lumir)55c9038ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])7280e78chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])eddbad6test: fix failing ecosystem test foreslint-plugin-unicorn(#21156) (Francesco Trotta)60a178dchore: update ecosystem plugins (#21150) (ESLint Bot)f9f61dctest: add error locations tono-unreachable(#21151) (JIYEON)d086293test: add error locations tono-undef(#21147) (JIYEON)cc01b67test: add error locations tono-useless-catch(#21144) (devoil)688e75echore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)7c1e175test: add error locations torequire-await(#21145) (Grit)588a26dtest: add error locations tono-extra-label(#21139) (dongkyu lee)059aa89test: add error locations tono-useless-concat(#21140) (dongkyu lee)5a452a8test: add error locations tono-const-assign(#21138) (dongkyu lee)harlan-zw/eslint-plugin-harlanzw (eslint-plugin-harlanzw)
v0.20.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v0.19.2Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.19.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.19.0Compare Source
🚀 Features
View changes on GitHub
v0.18.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.18.0Compare Source
🚀 Features
View changes on GitHub
capricorn86/happy-dom (happy-dom)
v20.11.6Compare Source
👷♂️ Patch fixes
v20.11.5Compare Source
v20.11.4Compare Source
v20.11.3Compare Source
👷♂️ Patch fixes
v20.11.2Compare Source
👷♂️ Patch fixes
Rich-Harris/magic-string (magic-string)
v1.2.2Compare Source
Bug Fixes
hasChangedreports a change when an edit spans a chunk boundary (#331) (811de46)Performance Improvements
hasChanged(#328) (e324bc4)v1.2.1Compare Source
Bug Fixes
v1.2.0Compare Source
Features
1.1.1 (2026-08-12)
Bug Fixes
v1.1.1Compare Source
Features
1.1.1 (2026-08-12)
Bug Fixes
maplibre/maplibre-gl-js (maplibre-gl)
v6.5.0Compare Source
✨ Features and improvements
ImageSource.setWarpandImageSource.getWarp, choosing between aauto,perspectiveand aflatwarp of the image (#8172) (by @HarelM)🐞 Bug fixes
v6.4.1[Compare Source](https://redirect.github.com/maplibre/maplibre-gl-js/compar
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.