chore(deps): update all non-major dependencies #97
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.13.2->^4.19.0^10.1.1->^10.3.1^9.28.0->^9.37.0^16.1.0->^16.2.418->18.20.810.11.1->10.18.2^2.13.0->^2.13.1^4.19.4->^4.20.6^5.8.3->^5.9.3^3.2.1->^3.2.4Release Notes
antfu/eslint-config (@antfu/eslint-config)
v4.19.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v4.18.0Compare Source
🚀 Features
View changes on GitHub
v4.17.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v4.16.2Compare Source
No significant changes
View changes on GitHub
v4.16.1Compare Source
🐞 Bug Fixes
eslint-plugin-command- by @antfu (195da)View changes on GitHub
v4.16.0Compare Source
🚀 Features
View changes on GitHub
v4.15.0Compare Source
🚀 Features
View changes on GitHub
v4.14.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.14.0Compare Source
🐞 Bug Fixes
eslint-plugin-import-x- by @antfu (db5a3)View changes on GitHub
v4.13.3Compare Source
No significant changes
View changes on GitHub
antfu-collective/bumpp (bumpp)
v10.3.1Compare Source
No significant changes
View changes on GitHub
v10.3.0Compare Source
🚀 Features
--releasefor release type - by @luoling8192 in #97 (5af7b)View changes on GitHub
v10.2.3Compare Source
🐞 Bug Fixes
-aalias support for--all- by @kingyue737 in #93 (7c0bb)View changes on GitHub
v10.2.2Compare Source
🐞 Bug Fixes
View changes on GitHub
v10.2.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v10.2.0Compare Source
🚀 Features
View changes on GitHub
eslint/eslint (eslint)
v9.37.0Compare Source
v9.36.0Compare Source
v9.35.0Compare Source
v9.34.0Compare Source
v9.33.0Compare Source
v9.32.0Compare Source
v9.31.0Compare Source
v9.30.1Compare Source
v9.30.0Compare Source
v9.29.0Compare Source
lint-staged/lint-staged (lint-staged)
v16.2.4Compare Source
Patch Changes
#1682
0176038Thanks @iiroj! - Update dependencies, including[email protected]with bug fixes.#1671
581a54eThanks @iiroj! - Speed up execution by only importing theyamldepedency if using YAML configuration files.v16.2.3Compare Source
Patch Changes
27cd541Thanks @iiroj! - When using--fail-on-changes, automatically hidden (partially) unstaged changes are no longer counted to make lint-staged fail.v16.2.2Compare Source
Patch Changes
#1667
699f95dThanks @iiroj! - The backup stash will not be dropped when using--fail-on-changesand there are errors. When reverting to original state is disabled (via--no-revertor--fail-on-changes), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually.Additionally, the example for using the backup stash manually now uses the correct backup hash, if available:
v16.2.1Compare Source
Patch Changes
#1664
8277b3bThanks @iiroj! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions isreadonly string[]and can't be mutated. Thanks @outslept!export default { --- "*": (files: string[]) => void console.log('staged files', files) +++ "*": (files: readonly string[]) => void console.log('staged files', files) }#1654
70b9af3Thanks @iiroj! - This version has been published from GitHub Actions using Trusted Publishing for npm packages.#1659
4996817Thanks @iiroj! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there arepackage.jsonfiles in the working directory. This situation might happen when running lint-staged for a single package in a monorepo.#1654
7021f0aThanks @iiroj! - Return the caret semver range (^) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to lint-staged. This was changed in 16.2.0 after the vulnerability issues withchalkanddebug, which were also removed in the same version.Given the recent vulnerabilities in the npm ecosystem, it's best to be very careful when updating dependencies.
v16.2.0Compare Source
Minor Changes
#1615
99eb742Thanks @iiroj! - Added a new option--fail-on-changesto make lint-staged exit with code 1 when tasks modify any files, making theprecommithook fail. This is similar to thegit diff --exit-codeoption. Using this flag also implies the--no-revertflag which means any changes made my tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.#1611
cd05fd3Thanks @rlorenzo! - Added a new option--continue-on-errorso that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.#1637
82fcc07Thanks @iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.#1647
a5ecc06Thanks @iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, theDEBUGenvironment variable is no longer supported — use the--debugto enable debugging#1636
8db2717Thanks @iiroj! - Added a new option--hide-unstagedso that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags--hide-unstaged --no-hide-partially-stagedisn't meaningful and behaves the same as just--hide-unstaged.Thanks to @ItsNickBarry for the idea and initial implementation in #1552.
#1648
7900b3bThanks @iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.Patch Changes
#1633
7f9e485Thanks @dependabot! - Bumps listr2 from 9.0.3 to 9.0.4.#1626
99d5a9bThanks @iiroj! - Due to recent phishing attacks, for example [email protected] was released with malware. To avoid lint-staged's users being at risk the direct dependencies are pinned to exact versions, instead of allowing future patch versions with the caret (^) range.#1588
035bbf2Thanks @outslept! - Increase performance by listing staged files and searching for configuration concurrently.#1645
deba3adThanks @iiroj! - Remove chalk as a dependency due to recent malware issue; read more at chalk/chalk#656.If you are having trouble with ANSI color codes when using lint-staged, you can try setting either
FORCE_COLOR=trueorNO_COLOR=trueenv variables.v16.1.6Compare Source
Patch Changes
e93578eThanks @iiroj! - Try to improve terminating of subprocess of tasks by usingSIGKILL, and only callingpidtreewhen the the main task process has a known pid.v16.1.5Compare Source
Patch Changes
4e3ce22Thanks @srsatt! - Detect the git repo's top-level directory correctly when in a worktree.v16.1.4Compare Source
Patch Changes
90b37b0Thanks @iiroj! - Add anothertypesfield topackage.jsonto make even more sure NPM detects that lint-staged includes built-in TypeScript type definitions.v16.1.3Compare Source
Patch Changes
7ea700bThanks @dword-design! - Add thetypesfield topackage.jsonto make sure NPM detects lint-staged includes built-in TypeScript type definitions.v16.1.2Compare Source
Patch Changes
#1570
a7c0c88Thanks @ItsNickBarry! - When using--diff-filterwith theDoption to include deleted staged files, lint-staged no longer tries to stage the deleted files, unless they're no longer deleted. Previously this caused an error fromgit addlikefatal: pathspec 'deleted-file' did not match any files.38f942eThanks @iiroj! - Removed an extraneous log entry that printedshouldHidePArtiallyStagedFilesto console output.v16.1.1Compare Source
Patch Changes
#1565
3686977Thanks @iiroj! - Lint-staged now explicitly warns about potential data loss when using--no-stash.#1571
02299a9Thanks @iiroj! - Function tasks (introduced in v16.0.0) only received the staged files matching the conpmnfigured glob, instead of all staged files.#1563
bc61c74Thanks @iiroj! - This version fixes incorrect behavior where unstaged changes were committed when using the--no-stashoption. This happened because--no-stashimplied--no-hide-partially-staged, meaning unstaged changes to files which also had other staged changes were added to the commit by lint-staged; this is no longer the case.The previous (incorrect) behavior can still be achieved by using both options
--no-stash --no-hide-partially-stagedat the same time.actions/node-versions (node)
v18.20.8: 18.20.8Compare Source
Node.js 18.20.8
v18.20.7: 18.20.7Compare Source
Node.js 18.20.7
v18.20.6: 18.20.6Compare Source
Node.js 18.20.6
v18.20.5: 18.20.5Compare Source
Node.js 18.20.5
v18.20.4: 18.20.4Compare Source
Node.js 18.20.4
v18.20.3: 18.20.3Compare Source
Node.js 18.20.3
v18.20.2: 18.20.2Compare Source
Node.js 18.20.2
v18.20.1: 18.20.1Compare Source
Node.js 18.20.1
v18.20.0: 18.20.0Compare Source
Node.js 18.20.0
v18.19.1: 18.19.1Compare Source
Node.js 18.19.1
v18.19.0: 18.19.0Compare Source
Node.js 18.19.0
v18.18.2: 18.18.2Compare Source
Node.js 18.18.2
v18.18.1: 18.18.1Compare Source
Node.js 18.18.1
v18.18.0: 18.18.0Compare Source
Node.js 18.18.0
v18.17.1: 18.17.1Compare Source
Node.js 18.17.1
v18.17.0: 18.17.0Compare Source
Node.js 18.17.0
v18.16.1: 18.16.1Compare Source
Node.js 18.16.1
v18.16.0: 18.16.0Compare Source
Node.js 18.16.0
v18.15.0: 18.15.0Compare Source
Node.js 18.15.0
v18.14.2: 18.14.2Compare Source
Node.js 18.14.2
v18.14.1: 18.14.1Compare Source
Node.js 18.14.1
v18.14.0: 18.14.0Compare Source
Node.js 18.14.0
v18.13.0: 18.13.0Compare Source
Node.js 18.13.0
v18.12.1: 18.12.1Compare Source
Node.js 18.12.1
v18.12.0: 18.12.0Compare Source
Node.js 18.12.0
v18.11.0: 18.11.0Compare Source
Node.js 18.11.0
v18.10.0: 18.10.0Compare Source
Node.js 18.10.0
v18.9.1: 18.9.1Compare Source
Node.js 18.9.1
v18.9.0: 18.9.0Compare Source
Node.js 18.9.0
v18.8.0: 18.8.0Compare Source
Node.js 18.8.0
v18.7.0: 18.7.0Compare Source
Node.js 18.7.0
v18.6.0: 18.6.0Compare Source
Node.js 18.6.0
v18.5.0: 18.5.0Compare Source
Node.js 18.5.0
v18.4.0: 18.4.0Compare Source
Node.js 18.4.0
v18.3.0: 18.3.0Compare Source
Node.js 18.3.0
v18.2.0: 18.2.0Compare Source
Node.js 18.2.0
v18.1.0: 18.1.0Compare Source
Node.js 18.1.0
pnpm/pnpm (pnpm)
v10.18.2Compare Source
Patch Changes
pnpm outdated --longshould work #10040.pnpm dlxshould request the full metadata of packages, whenminimumReleaseAgeis set #9963.EPIPEerrors when piping output to other commands #10027.v10.18.1Compare Source
Patch Changes
--lockfile-onlyis used #8320.pnpm setupcreates a command shim to the pnpm executable. This is needed to be able to runpnpm self-updateon Windows #5700.pnpm install, pnpm produced false positive warnings for "skip adding to the default catalog because it already exists". This warning now only prints when usingpnpm add --save-catalogas originally intended.v10.18.0Compare Source
Minor Changes
Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.
Added configuration options for warning thresholds:
fetchWarnTimeoutMsandfetchMinSpeedKiBps.Warning messages are displayed when requests exceed time thresholds or fall below speed minimums
Related PR: #10025.
Patch Changes
minimumReleaseAgeconfiguration #10030.cleanupUnusedCatalogsconfiguration when removing dependent packages.scriptShellis set tofalse#8748.pnpm dlxshould not fail whenminimumReleaseAgeis set #10037.v10.17.1Compare Source
Patch Changes
minimumReleaseAgesetting, print this information out in the error message #9974.state.jsoncreation path when executingpnpm patchin a workspace project #9733.minimumReleaseAgeis set and thelatesttag is not mature enough, prefer a non-deprecated version as the newlatest#9987.v10.17.0Compare Source
Minor Changes
The
minimumReleaseAgeExcludesetting now supports patterns. For instance:Related PR: #9984.
Patch Changes
minimumReleaseAgecheck, when the package is requested by exact version and the packument is loaded from cache #9978.minimumReleaseAgeis set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #9979.v10.16.1Compare Source
Patch Changes
v10.16.0Compare Source
Minor Changes
There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.
The new setting is called
minimumReleaseAge. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, settingminimumReleaseAge: 1440ensures that only packages released at least one day ago can be installed.If you set
minimumReleaseAgebut need to disable this restriction for certain dependencies, you can list them under theminimumReleaseAgeExcludesetting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:Related issue: #9921.
Added support for
finders#9946.In the past,
pnpm listandpnpm whycould only search for dependencies by name (and optionally version). For example:prints the chain of dependencies to any installed instance of
minimist:What if we want to search by other properties of a dependency, not just its name? For instance, find all packages that have
react@17in their peer dependencies?This is now possible with "finder functions". Finder functions can be declared in
.pnpmfile.cjsand invoked with the--find-by=<function name>flag when runningpnpm listorpnpm why.Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our
.pnpmfile.cjs:Now we can use this finder function by running:
pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph.
It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder:
Every matched package will also print out the license from its
package.json:Patch Changes
nodeVersionis not set to an exact semver version #9934.pnpm publishshould be able to publish a.tar.gzfile #9927.pnpm runreturn a non-zero exit code #9626.v10.15.1Compare Source
Patch Changes
.pnp.cjscrash when importing subpath #9904.v10.15.0Compare Source
Minor Changes
cleanupUnusedCatalogsconfiguration. When set totrue, pnpm will remove unused catalog entries during installation #9793.@*/pnpm-plugin-*#9780.pnpm config getnow prints an INI string for an object value #9797.pnpm config getnow accepts property paths (e.g.pnpm config get catalog.react,pnpm config get .catalog.react,pnpm config get 'packageExtensions["@​babel/parser"].peerDependencies["@​babel/types"]'), andpnpm config setnow accepts dot-leading or subscripted keys (e.g.pnpm config set .ignoreScripts true).pnpm config get --jsonnow prints a JSON serialization of config value, andpnpm config set --jsonnow parses the input value as JSON.Patch Changes
pnpm createcommand, must verify whether the node version is supported even if a cache already exists #9775.*/*to theAcceptheader to avoid getting a 406 error on AWS CodeArtifact #9862.pnpm dlx pkg --helpdoesn't pass--helptopkg#9823.v10.14.0Compare Source
Minor Changes
Added support for JavaScript runtime resolution
Declare Node.js, Deno, or Bun in
devEngines.runtime(insidepackage.json) and let pnpm download and pin it automatically.Usage example:
{ "devEngines": { "runtime": { "name": "node", "version": "^24.4.0", "onFail": "download" (we only support the "download" value for now) } } }How it works:
pnpm installresolves your specified range to the latest matching runtime version.Why this is better:
useNodeVersionandexecutionEnv.nodeVersion)executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.devEngines.runtimesetting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.Related PR: #9755.
Add
--cpu,--libc, and--ostopnpm install,pnpm add, andpnpm dlxto customizesupportedArchitecturesvia the CLI #7510.Patch Changes
pnpm adddownloads packages whoselibcdiffer frompnpm.supportedArchitectures.libc.dlxto parse CLI flags and options between thedlxcommand and the command to run or between thedlxcommand and--#9719.Configuration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.