Update all non-major dependencies - #633

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovaterenovateBot commented Nov 10, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence

Release Notes

actions/checkout (actions/checkout)

v5.1.0

Compare Source

v5.0.1

Compare Source

davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)

v2.13.0

Compare Source

Features

v2.12.2

Compare Source

Bug Fixes

v2.12.1

Compare Source

Bug Fixes

v2.12.0

Compare Source

Features

v2.11.2

Compare Source

Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)

v2.11.1

Compare Source

Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)

v2.11.0

Compare Source

Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)

v2.10.0

Compare Source

Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)

v2.9.3

Compare Source

Bug Fixes

v2.9.2

Compare Source

Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)

v2.9.1

Compare Source

Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)

v2.9.0

Compare Source

Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)

v22.23.2: 22.23.2

Compare Source

Node.js 22.23.2

v22.23.1: 22.23.1

Compare Source

Node.js 22.23.1

v22.23.0: 22.23.0

Compare Source

Node.js 22.23.0

v22.22.3: 22.22.3

Compare Source

Node.js 22.22.3

v22.22.2: 22.22.2

Compare Source

Node.js 22.22.2

v22.22.1: 22.22.1

Compare Source

Node.js 22.22.1

v22.22.0: 22.22.0

Compare Source

Node.js 22.22.0

pnpm/pnpm (pnpm)

v10.34.5: pnpm 10.34.5

Compare Source

Patch Changes

  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Bit

Gold Sponsors

SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx

v10.34.4: pnpm 10.34.4

Compare Source

Patch Changes

  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.

  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.

  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.

  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.

Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx

v10.34.3: pnpm 10.34.3

Compare Source

⚠️ Security fix — environment variables in a project .npmrc (action may be required)

Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:

  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.

This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).

Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.

If your authentication broke after upgrading, move the token out of the committed .npmrc:

# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"

Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.

See https://pnpm.io/npmrc for full migration details.

Patch Changes

  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.

Platinum Sponsors

Bit

Gold Sponsors

SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx

v10.34.2: pnpm 10.34.2

Compare Source

⚠️ Security fix — environment variables in a project .npmrc (action may be required)

Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:

  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.

This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).

Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.

If your authentication broke after upgrading, move the token out of the committed .npmrc:

# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"

Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.

See https://pnpm.io/npmrc for full migration details.

Patch Changes

  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.

Platinum Sponsors

Bit

Gold Sponsors

SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx

v10.34.1: pnpm 10.34.1

Compare Source

Patch Changes

  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Bit

Gold Sponsors

SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx

v10.34.0: pnpm 10.34

Compare Source

Minor Changes

  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.

    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.

    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.

    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.

Patch Changes

  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovaterenovateBot added the dependencies Pull requests that update a dependency file label Nov 10, 2025
@github-actions

github-actionsBot commented Nov 10, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

Coverage Report

StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action

@renovaterenovateBot changed the title chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from fed6b87 to 30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot changed the title chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch from 30aa1c4 to eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch from eb759ac to d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from 402ae98 to cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from 4977ab4 to 9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch from 9cf3f9f to f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from 6a4f754 to 1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from 6147258 to ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch from ea3a246 to 97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 3 times, most recently from 7cbb734 to 269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 4 times, most recently from 91db823 to ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from aaddafb to 465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from 98f065d to 92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 4 times, most recently from f19dbeb to 83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot changed the title chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from 8e0ca5b to 721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 5 times, most recently from 39decbc to 10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from 379e5f4 to b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 4 times, most recently from 5314833 to 47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from f117124 to d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 2 times, most recently from daa18f6 to 3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch from 3feab5f to 1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch from 1a78b05 to d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch 4 times, most recently from 13854bd to 22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed the renovate/all-minor-patch branch from 22bece9 to 3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Update all non-major dependencies - #633
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Open
Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Conversation
@renovate
@renovaterenovateBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence
Release Notes
actions/checkout (actions/checkout)
v5.1.0
Compare Source
v5.0.1
Compare Source
davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)
v2.13.0
Compare Source
Features
v2.12.2
Compare Source
Bug Fixes
v2.12.1
Compare Source
Bug Fixes
v2.12.0
Compare Source
Features
v2.11.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)
v2.11.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)
v2.11.0
Compare Source
Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)
v2.10.0
Compare Source
Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)
v2.9.3
Compare Source
Bug Fixes
v2.9.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)
v2.9.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)
v2.9.0
Compare Source
Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)
v22.23.2: 22.23.2
Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1
Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0
Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3
Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2
Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1
Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0
Compare Source
Node.js 22.22.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5
Compare Source
Patch Changes
  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.4: pnpm 10.34.4
Compare Source
Patch Changes
  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.3: pnpm 10.34.3
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.2: pnpm 10.34.2
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.1: pnpm 10.34.1
Compare Source
Patch Changes
  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.0: pnpm 10.34
Compare Source
Minor Changes
  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.
    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
Patch Changes
  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
  • Branch creation

    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Nov 10, 2025
@github-actions
github-actionsBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Coverage Report
StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
fed6b87 to
30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
30aa1c4 to
eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
eb759ac to
d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
402ae98 to
cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
4977ab4 to
9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
9cf3f9f to
f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6a4f754 to
1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6147258 to
ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
ea3a246 to
97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7cbb734 to
269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
91db823 to
ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aaddafb to
465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98f065d to
92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
f19dbeb to
83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot
changed the title
chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
8e0ca5b to
721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
39decbc to
10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
379e5f4 to
b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
5314833 to
47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
f117124 to
d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
daa18f6 to
3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
3feab5f to
1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
1a78b05 to
d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
13854bd to
22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
22bece9 to
3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all non-major dependencies - #633
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Open
Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Conversation
@renovate
@renovaterenovateBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence
Release Notes
actions/checkout (actions/checkout)
v5.1.0
Compare Source
v5.0.1
Compare Source
davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)
v2.13.0
Compare Source
Features
v2.12.2
Compare Source
Bug Fixes
v2.12.1
Compare Source
Bug Fixes
v2.12.0
Compare Source
Features
v2.11.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)
v2.11.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)
v2.11.0
Compare Source
Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)
v2.10.0
Compare Source
Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)
v2.9.3
Compare Source
Bug Fixes
v2.9.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)
v2.9.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)
v2.9.0
Compare Source
Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)
v22.23.2: 22.23.2
Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1
Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0
Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3
Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2
Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1
Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0
Compare Source
Node.js 22.22.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5
Compare Source
Patch Changes
  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.4: pnpm 10.34.4
Compare Source
Patch Changes
  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.3: pnpm 10.34.3
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.2: pnpm 10.34.2
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.1: pnpm 10.34.1
Compare Source
Patch Changes
  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.0: pnpm 10.34
Compare Source
Minor Changes
  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.
    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
Patch Changes
  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
  • Branch creation

    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Nov 10, 2025
@github-actions
github-actionsBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Coverage Report
StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
fed6b87 to
30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
30aa1c4 to
eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
eb759ac to
d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
402ae98 to
cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
4977ab4 to
9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
9cf3f9f to
f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6a4f754 to
1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6147258 to
ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
ea3a246 to
97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7cbb734 to
269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
91db823 to
ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aaddafb to
465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98f065d to
92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
f19dbeb to
83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot
changed the title
chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
8e0ca5b to
721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
39decbc to
10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
379e5f4 to
b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
5314833 to
47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
f117124 to
d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
daa18f6 to
3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
3feab5f to
1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
1a78b05 to
d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
13854bd to
22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
22bece9 to
3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all non-major dependencies - #633
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Open
Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Conversation
@renovate
@renovaterenovateBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence
Release Notes
actions/checkout (actions/checkout)
v5.1.0
Compare Source
v5.0.1
Compare Source
davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)
v2.13.0
Compare Source
Features
v2.12.2
Compare Source
Bug Fixes
v2.12.1
Compare Source
Bug Fixes
v2.12.0
Compare Source
Features
v2.11.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)
v2.11.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)
v2.11.0
Compare Source
Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)
v2.10.0
Compare Source
Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)
v2.9.3
Compare Source
Bug Fixes
v2.9.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)
v2.9.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)
v2.9.0
Compare Source
Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)
v22.23.2: 22.23.2
Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1
Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0
Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3
Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2
Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1
Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0
Compare Source
Node.js 22.22.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5
Compare Source
Patch Changes
  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.4: pnpm 10.34.4
Compare Source
Patch Changes
  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.3: pnpm 10.34.3
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.2: pnpm 10.34.2
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.1: pnpm 10.34.1
Compare Source
Patch Changes
  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.0: pnpm 10.34
Compare Source
Minor Changes
  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.
    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
Patch Changes
  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
  • Branch creation

    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Nov 10, 2025
@github-actions
github-actionsBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Coverage Report
StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
fed6b87 to
30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
30aa1c4 to
eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
eb759ac to
d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
402ae98 to
cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
4977ab4 to
9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
9cf3f9f to
f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6a4f754 to
1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6147258 to
ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
ea3a246 to
97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7cbb734 to
269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
91db823 to
ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aaddafb to
465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98f065d to
92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
f19dbeb to
83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot
changed the title
chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
8e0ca5b to
721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
39decbc to
10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
379e5f4 to
b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
5314833 to
47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
f117124 to
d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
daa18f6 to
3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
3feab5f to
1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
1a78b05 to
d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
13854bd to
22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
22bece9 to
3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Update all non-major dependencies - #633
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Open
Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Conversation
@renovate
@renovaterenovateBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence
Release Notes
actions/checkout (actions/checkout)
v5.1.0
Compare Source
v5.0.1
Compare Source
davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)
v2.13.0
Compare Source
Features
v2.12.2
Compare Source
Bug Fixes
v2.12.1
Compare Source
Bug Fixes
v2.12.0
Compare Source
Features
v2.11.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)
v2.11.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)
v2.11.0
Compare Source
Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)
v2.10.0
Compare Source
Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)
v2.9.3
Compare Source
Bug Fixes
v2.9.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)
v2.9.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)
v2.9.0
Compare Source
Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)
v22.23.2: 22.23.2
Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1
Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0
Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3
Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2
Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1
Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0
Compare Source
Node.js 22.22.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5
Compare Source
Patch Changes
  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.4: pnpm 10.34.4
Compare Source
Patch Changes
  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.3: pnpm 10.34.3
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.2: pnpm 10.34.2
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.1: pnpm 10.34.1
Compare Source
Patch Changes
  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.0: pnpm 10.34
Compare Source
Minor Changes
  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.
    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
Patch Changes
  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
  • Branch creation

    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Nov 10, 2025
@github-actions
github-actionsBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Coverage Report
StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
fed6b87 to
30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
30aa1c4 to
eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
eb759ac to
d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
402ae98 to
cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
4977ab4 to
9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
9cf3f9f to
f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6a4f754 to
1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6147258 to
ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
ea3a246 to
97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7cbb734 to
269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
91db823 to
ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aaddafb to
465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98f065d to
92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
f19dbeb to
83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot
changed the title
chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
8e0ca5b to
721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
39decbc to
10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
379e5f4 to
b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
5314833 to
47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
f117124 to
d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
daa18f6 to
3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
3feab5f to
1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
1a78b05 to
d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
13854bd to
22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
22bece9 to
3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all non-major dependencies - #633
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Open
Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Conversation
@renovate
@renovaterenovateBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence
Release Notes
actions/checkout (actions/checkout)
v5.1.0
Compare Source
v5.0.1
Compare Source
davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)
v2.13.0
Compare Source
Features
v2.12.2
Compare Source
Bug Fixes
v2.12.1
Compare Source
Bug Fixes
v2.12.0
Compare Source
Features
v2.11.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)
v2.11.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)
v2.11.0
Compare Source
Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)
v2.10.0
Compare Source
Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)
v2.9.3
Compare Source
Bug Fixes
v2.9.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)
v2.9.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)
v2.9.0
Compare Source
Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)
v22.23.2: 22.23.2
Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1
Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0
Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3
Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2
Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1
Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0
Compare Source
Node.js 22.22.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5
Compare Source
Patch Changes
  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.4: pnpm 10.34.4
Compare Source
Patch Changes
  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.3: pnpm 10.34.3
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.2: pnpm 10.34.2
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.1: pnpm 10.34.1
Compare Source
Patch Changes
  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.0: pnpm 10.34
Compare Source
Minor Changes
  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.
    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
Patch Changes
  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
  • Branch creation

    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Nov 10, 2025
@github-actions
github-actionsBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Coverage Report
StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
fed6b87 to
30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
30aa1c4 to
eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
eb759ac to
d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
402ae98 to
cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
4977ab4 to
9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
9cf3f9f to
f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6a4f754 to
1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6147258 to
ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
ea3a246 to
97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7cbb734 to
269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
91db823 to
ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aaddafb to
465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98f065d to
92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
f19dbeb to
83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot
changed the title
chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
8e0ca5b to
721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
39decbc to
10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
379e5f4 to
b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
5314833 to
47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
f117124 to
d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
daa18f6 to
3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
3feab5f to
1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
1a78b05 to
d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
13854bd to
22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
22bece9 to
3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all non-major dependencies - #633
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Open
Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Conversation
@renovate
@renovaterenovateBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence
Release Notes
actions/checkout (actions/checkout)
v5.1.0
Compare Source
v5.0.1
Compare Source
davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)
v2.13.0
Compare Source
Features
v2.12.2
Compare Source
Bug Fixes
v2.12.1
Compare Source
Bug Fixes
v2.12.0
Compare Source
Features
v2.11.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)
v2.11.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)
v2.11.0
Compare Source
Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)
v2.10.0
Compare Source
Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)
v2.9.3
Compare Source
Bug Fixes
v2.9.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)
v2.9.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)
v2.9.0
Compare Source
Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)
v22.23.2: 22.23.2
Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1
Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0
Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3
Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2
Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1
Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0
Compare Source
Node.js 22.22.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5
Compare Source
Patch Changes
  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.4: pnpm 10.34.4
Compare Source
Patch Changes
  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.3: pnpm 10.34.3
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.2: pnpm 10.34.2
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.1: pnpm 10.34.1
Compare Source
Patch Changes
  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.0: pnpm 10.34
Compare Source
Minor Changes
  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.
    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
Patch Changes
  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
  • Branch creation

    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Nov 10, 2025
@github-actions
github-actionsBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Coverage Report
StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
fed6b87 to
30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
30aa1c4 to
eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
eb759ac to
d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
402ae98 to
cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
4977ab4 to
9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
9cf3f9f to
f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6a4f754 to
1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6147258 to
ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
ea3a246 to
97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7cbb734 to
269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
91db823 to
ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aaddafb to
465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98f065d to
92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
f19dbeb to
83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot
changed the title
chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
8e0ca5b to
721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
39decbc to
10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
379e5f4 to
b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
5314833 to
47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
f117124 to
d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
daa18f6 to
3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
3feab5f to
1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
1a78b05 to
d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
13854bd to
22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
22bece9 to
3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Update all non-major dependencies - #633
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Open
Update all non-major dependencies#633
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/all-minor-patch
Conversation
@renovate
@renovaterenovateBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChangeAgeConfidence
actions/checkoutactionminorv5.0.0 → v5.1.0ageconfidence
davelosert/vitest-coverage-report-actionactionminorv2.8.3 → v2.13.0ageconfidence
nodeuses-withminor22.21.1 → 22.23.2ageconfidence
pnpm (source)packageManagerminor10.20.0 → 10.34.5ageconfidence
pnpm/action-setupactionminorv4.2.0 → v4.4.0ageconfidence
Release Notes
actions/checkout (actions/checkout)
v5.1.0
Compare Source
v5.0.1
Compare Source
davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)
v2.13.0
Compare Source
Features
v2.12.2
Compare Source
Bug Fixes
v2.12.1
Compare Source
Bug Fixes
v2.12.0
Compare Source
Features
v2.11.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.23 to 4.18.1 to fix high severity alert (#​610) (3c50566)
v2.11.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.23 to 4.18.1 to fix high severity alert (#​609) (d63aa97)
v2.11.0
Compare Source
Features
  • add show-uncovered-lines option to hide the Uncovered Lines column (#​605) (59b5bb7)
v2.10.0
Compare Source
Bug Fixes
  • deps-dev: bump handlebars from 4.7.8 to 4.7.9 to fix critical vulnerability (#​604) (a71558c)
  • deps: bump picomatch to 9 to fix high severity vulnerability (#​603) (f46039a)
  • deps: bump tar and npm to fix high severity alert (#​598) (4922f30)
Features
  • Add file-coverage-expanded option to expand File Coverage section by default (#​582) (479bd5d)
v2.9.3
Compare Source
Bug Fixes
v2.9.2
Compare Source
Bug Fixes
  • deps-dev: bump lodash-es from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​572) (6c3df73)
  • deps: bump tar and npm to fix high severity alert (#​574) (1068223)
v2.9.1
Compare Source
Bug Fixes
  • deps-dev: bump lodash from 4.17.21 to 4.17.23 to fix moderate vulnerability (#​573) (fd9e72f)
v2.9.0
Compare Source
Bug Fixes
  • deps-dev: bump js-yaml from 4.1.0 to 4.1.1 (#​549) (ddec910)
  • deps-dev: bump vite from 7.1.9 to 7.1.11 to fix vulnerability (#​540) (7dfcb78)
  • deps: bump glob and npm to fix security vulnerability (#​561) (b3cf99c)
  • deps: bump glob and semantic-release to fix security vuln (#​552) (6e9900f)
  • lint: Updates biome to v2 and fixes linting issues (#​558) (83c5c42)
  • Partially address body length posting failures & update actions dependencies (#​544) (541af14)
  • Update Node execution version from 20 to 24 in action.yml (#​559) (da6ce93)
  • Update Node.js to version 24 and upgrade checkout action to v6 (#​562) (e696359)
Features
  • Add threshold-icons option for customizable coverage status icons (#​557) (d75d4ee)
  • Adds file comparisons, affected file groups and configurable decimal places (#​533) (7e04bda)
actions/node-versions (node)
v22.23.2: 22.23.2
Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1
Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0
Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3
Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2
Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1
Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0
Compare Source
Node.js 22.22.0
pnpm/pnpm (pnpm)
v10.34.5: pnpm 10.34.5
Compare Source
Patch Changes
  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.4: pnpm 10.34.4
Compare Source
Patch Changes
  • 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
  • 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
    The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
  • 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
  • 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.3: pnpm 10.34.3
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
  • A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.2: pnpm 10.34.2
Compare Source
⚠️ Security fix — environment variables in a project .npmrc (action may be required)
Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  • the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
  • registry URLs in pnpm-workspace.yaml.
This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).
Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.
If your authentication broke after upgrading, move the token out of the committed .npmrc:
# Writes to your user/global config, not the repository:
pnpm config set"//registry.npmjs.org/:_authToken""$NPM_TOKEN"
Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.
See https://pnpm.io/npmrc for full migration details.
Patch Changes
  • Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
  • pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
  • Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
  • Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
  • pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.1: pnpm 10.34.1
Compare Source
Patch Changes
  • Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
Platinum Sponsors
Bit
Gold Sponsors
SanityDiscordVite
SerpApiCodeRabbitStackblitz
WorkleapNx
v10.34.0: pnpm 10.34
Compare Source
Minor Changes
  • Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
    pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.
    The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
    --force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
Patch Changes
  • Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  • Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
  • Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
  • Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
  • Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
  • Branch creation

    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Nov 10, 2025
@github-actions
github-actionsBot
commented
Nov 10, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Coverage Report
StatusCategoryPercentageCovered / Total
🟢Lines93.65% (🎯 90%)
🟰 ±0%		1033 / 1103
🟢Statements93.54% (🎯 90%)
🟰 ±0%		1043 / 1115
🟢Functions97.93% (🎯 90%)
🟰 ±0%		142 / 145
🔴Branches88.16% (🎯 90%)
🟰 ±0%		678 / 769
File Coverage
FileStmtsBranchesFunctionsLinesUncovered Lines
Unchanged Files
src/doctype-shortcut-registry.ts100%100%100%100%
src/index.ts86.66%100%71.42%86.66%79-85
src/logger.ts82.75%47.82%91.66%82.14%37-44, 93, 153-155
src/prettier.d.ts100%100%100%100%
src/printer.ts93.97%89.14%100%94.18%337, 374, 524-526, 538-547, 552-563, 612-665, 704, 790-793, 1143, 1237, 1265, 1274, 1566, 1613, 1833, 1872, 2022-2027, 2067-2071
src/options/common.ts100%100%100%100%
src/options/constants.ts100%100%100%100%
src/options/converge.ts100%82.6%100%100%
src/options/index.ts100%100%100%100%
src/options/pug-attribute-separator.ts75%100%100%75%52-54
src/options/pug-class-location.ts100%100%100%100%
src/options/pug-class-notation.ts100%100%100%100%
src/options/pug-closing-bracket-indent-depth.ts100%100%100%100%
src/options/pug-comment-preserve-spaces.ts100%100%100%100%
src/options/pug-explicit-div.ts100%100%100%100%
src/options/pug-framework.ts100%100%100%100%
src/options/pug-id-notation.ts100%100%100%100%
src/options/pug-preserve-attribute-brackets.ts100%100%100%100%
src/options/pug-preserve-whitespace.ts100%100%100%100%
src/options/pug-single-file-component-indentation.ts100%100%100%100%
src/options/pug-wrap-attributes.ts100%100%100%100%
src/options/types.ts100%100%100%100%
src/options/attribute-sorting/index.ts100%100%100%100%
src/options/attribute-sorting/utils.ts96%91.66%100%95.83%82, 94
src/options/empty-attributes/index.ts100%100%100%100%
src/options/empty-attributes/types.ts100%100%100%100%
src/options/empty-attributes/utils.ts100%100%100%100%
src/utils/angular.ts100%100%100%100%
src/utils/common.ts89.7%86.76%100%88.88%19, 27, 56, 258, 262, 269-272, 331
src/utils/script-mime-types.ts86.66%75%100%86.66%42, 49
src/utils/svelte.ts100%100%100%100%
src/utils/vue.ts100%100%100%100%
Generated in workflow #1543 for commit 3b96a23 by the Vitest Coverage Report Action
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.21.0chore(deps): update pnpm to v10.22.0Nov 12, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
fed6b87 to
30aa1c4CompareNovember 17, 2025 16:49
@renovaterenovateBot
changed the title
chore(deps): update pnpm to v10.22.0chore(deps): update all non-major dependenciesNov 17, 2025
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
30aa1c4 to
eb759acCompareNovember 23, 2025 16:28
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
eb759ac to
d1e5888CompareNovember 30, 2025 18:11
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
402ae98 to
cde6754CompareDecember 18, 2025 13:12
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
4977ab4 to
9cf3f9fCompareDecember 26, 2025 17:15
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
9cf3f9f to
f7cc53dCompareJanuary 3, 2026 01:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6a4f754 to
1838570CompareJanuary 14, 2026 04:47
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
6147258 to
ea3a246CompareJanuary 22, 2026 13:35
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
ea3a246 to
97ba3d8CompareJanuary 29, 2026 17:43
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7cbb734 to
269a769CompareFebruary 14, 2026 12:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
91db823 to
ae50a73CompareFebruary 27, 2026 00:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aaddafb to
465189bCompareMarch 6, 2026 04:53
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98f065d to
92cef28CompareMarch 11, 2026 15:19
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
f19dbeb to
83e5ae9CompareApril 4, 2026 09:11
@renovaterenovateBot
changed the title
chore(deps): update all non-major dependenciesUpdate all non-major dependenciesApr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
8e0ca5b to
721e51cCompareApril 26, 2026 13:14
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
39decbc to
10532f8CompareMay 14, 2026 05:36
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
379e5f4 to
b7420a1CompareMay 31, 2026 02:09
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
5314833 to
47e3952CompareJune 18, 2026 21:42
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
f117124 to
d643145CompareJune 24, 2026 06:03
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
daa18f6 to
3feab5fCompareJuly 14, 2026 10:27
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
3feab5f to
1a78b05CompareJuly 20, 2026 22:45
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
1a78b05 to
d6cc86bCompareJuly 30, 2026 04:44
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
13854bd to
22bece9CompareAugust 13, 2026 08:10
@renovate
renovateBotforce-pushed
the
renovate/all-minor-patch
branch
from
22bece9 to
3b96a23CompareAugust 31, 2026 16:32
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Shinigami92Shinigami92Awaiting requested review from Shinigami92Shinigami92 is a code owner

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants