fix: bump non-breaking dependencies to latest

[aversini]

Automated non-major dependency bump (deps-train).

package.json

• @versini/dev-dependencies-common 14.0.15 → 14.0.16
• turbo 2.10.13 → 2.11.3
• pnpm 11.27.0 → 11.27.1

packages/static-server/package.json

• @fastify/static 10.1.3 → 10.1.4
• fastify 5.12.4 → 5.12.5
• fs-extra 11.4.0 → 11.4.1

packages/secret/package.json

• fs-extra 11.4.0 → 11.4.1

packages/search/package.json

• fs-extra 11.4.0 → 11.4.1

packages/npmrc/package.json

• fs-extra 11.4.0 → 11.4.1

packages/bundlesize/package.json

• fs-extra 11.4.0 → 11.4.1

Transitive refresh (pnpm update) — 23 package(s) moved

Show transitive changes

• @babel/parser 7.29.8 → 7.29.9
• @fastify/proxy-addr 5.1.0 → 5.1.1
• @oxc-project/types 0.149.0 → 0.151.0
• @rolldown/binding-android-arm-eabi 1.2.8 → 1.2.10
• @rolldown/binding-android-arm64 1.2.8 → 1.2.10
• @rolldown/binding-darwin-arm64 1.2.8 → 1.2.10
• @rolldown/binding-darwin-x64 1.2.8 → 1.2.10
• @rolldown/binding-freebsd-x64 1.2.8 → 1.2.10
• @rolldown/binding-linux-arm-gnueabihf 1.2.8 → 1.2.10
• @rolldown/binding-linux-arm64-gnu 1.2.8 → 1.2.10
• @rolldown/binding-linux-arm64-musl 1.2.8 → 1.2.10
• @rolldown/binding-linux-ppc64-gnu 1.2.8 → 1.2.10
• @rolldown/binding-linux-s390x-gnu 1.2.8 → 1.2.10
• @rolldown/binding-linux-x64-gnu 1.2.8 → 1.2.10
• @rolldown/binding-linux-x64-musl 1.2.8 → 1.2.10
• @rolldown/binding-openharmony-arm64 1.2.8 → 1.2.10
• @rolldown/binding-win32-arm64-msvc 1.2.8 → 1.2.10
• @rolldown/binding-win32-x64-msvc 1.2.8 → 1.2.10
• ast-v8-to-istanbul 1.0.6 → 1.0.7
• fast-uri 4.1.5 → 4.2.1
• get-east-asian-width 1.6.0 → 1.7.0
• lru-cache 11.5.2 → 11.5.3
• rolldown 1.2.8 → 1.2.10

---

What changed

@versini/dev-dependencies-common 14.0.15 → 14.0.16

dev-dependencies-common: v14.0.16

14.0.16 (2026-09-24)

Bug Fixes

• bump non-breaking dependencies to latest (#934) (4f82cb8)

compare 14.0.15…14.0.16 · npm

turbo 2.10.13 → 2.11.3

Turborepo v2.11.3

What's Changed

Changelog

• chore: Release Turborepo 2.11.2 by @github-actions[bot] in chore: Release Turborepo 2.11.2 vercel/turborepo#14107
• refactor: Remove experimental Cargo compile cache by @anthonyshew in refactor: Remove experimental Cargo compile cache vercel/turborepo#14110
• refactor: Remove clap from turborepo-types by @anthonyshew in refactor: Remove clap from turborepo-types vercel/turborepo#14111
• chore: Use canary turbo for Vercel builds by @anthonyshew in chore: Use canary turbo for Vercel builds vercel/turborepo#14112
• refactor: Extract turborepo-tracing crate by @anthonyshew in refactor: Extract turborepo-tracing crate vercel/turborepo#14113
• refactor: Remove Run boundaries extension by @vercel-gh-bot-2[bot] in refactor: Remove Run boundaries extension vercel/turborepo#14114
• refactor: Relocate child spawning to turborepo-process by @vercel-gh-bot-3[bot] in refactor: Relocate child spawning to turborepo-process vercel/turborepo#14115
• docs: Drop stale support-policy entry from getting-started nav by @Neekoras in docs: Drop stale support-policy entry from getting-started nav vercel/turborepo#14116
• refactor: Move CLI configuration overrides into CLI by @anthonyshew in refactor: Move CLI configuration overrides into CLI vercel/turborepo#14119
• fix: Avoid microfrontend polyrepo warnings by @anthonyshew in fix: Avoid microfrontend polyrepo warnings vercel/turborepo#14118
• refactor: Add run and execution selector DTOs by @anthonyshew in refactor: Add run and execution selector DTOs vercel/turborepo#14120
• chore: Release Turborepo 2.11.3-canary.1 by @github-actions[bot] in chore: Release Turborepo 2.11.3-canary.1 vercel/turborepo#14121
• test: Reuse Go cache in invalidation test

…notes truncated.

Turborepo v2.11.2

What's Changed

Changelog

• chore: Release Turborepo 2.11.1 by @github-actions[bot] in chore: Release Turborepo 2.11.1 vercel/turborepo#14104
• fix: Restore repeatable CLI flags by @anthonyshew in fix: Restore repeatable CLI flags vercel/turborepo#14106

Full Changelog: vercel/turborepo@v2.11.1...v2.11.2

Turborepo v2.11.1

What's Changed

Changelog

• chore: Release Turborepo 2.11.0 by @github-actions[bot] in chore: Release Turborepo 2.11.0 vercel/turborepo#14102
• docs: Add Turborepo 2.11 release post by @anthonyshew in docs: Add Turborepo 2.11 release post vercel/turborepo#13652
• fix: Allow esbuild builds for pnpm generators by @anthonyshew in fix: Allow esbuild builds for pnpm generators vercel/turborepo#14103

Full Changelog: vercel/turborepo@v2.11.0...v2.11.1

Turborepo v2.11.0

What's Changed

Changelog

• release(turborepo): 2.10.0 by @github-actions[bot] in release(turborepo): 2.10.0 vercel/turborepo#13131
• docs: Add Turborepo 2.10 release post and update docs by @anthonyshew in docs: Add Turborepo 2.10 release post and update docs vercel/turborepo#13096
• perf: Avoid normalizing git index path joins by @anthonyshew in perf: Avoid normalizing git index path joins vercel/turborepo#12944
• chore: Remove tbx package by @anthonyshew in chore: Remove tbx package vercel/turborepo#13133
• feat: Migrate TUI virtual terminals from vt100 to Ghostty by @anthonyshew in feat: Migrate TUI virtual terminals from vt100 to Ghostty vercel/turborepo#13135
• chore: Add examples maintenance agent by @anthonyshew in chore: Add examples maintenance agent vercel/turborepo#13136
• chore: Remove a few pre-push hooks by @anthonyshew in chore: Remove a few pre-push hooks vercel/turborepo#13137
• ci: Making sure Zig works in releases by @anthonyshew in ci: Making sure Zig works in releases vercel/turborepo#13138
• release(turborepo): 2.10.1-canary.1 by @github-actions[bot] in release(turborepo): 2.10.1-canary.1 vercel/turborepo#13139
• fix: Support Corepack packageManager integrity hashes by @gwagjiug in fix: Support Corepack packageManager integrity hashes vercel/turborepo#13123
• fix(env): Add XDG_DATA_* to pass-through by @vercel[bot] in fix(env): Add XDG_DATA_* to pass-through vercel/turborepo#13145
• release(turborepo): 2.10.1-canary.2 by @github-actions[bot] in release(turborepo): 2.10.1-canary.2 vercel/turborepo#13147
• feat: Support devEngines.packageManager by @lachieh in feat: Support devEngines.packageManager vercel/turborepo#12388
• feat: S

…notes truncated.

compare 2.10.13…2.11.3 · npm

pnpm 11.27.0 → 11.27.1

pnpm 11.27.1

Patch Changes

• pn, pnpx, and pnx now run the pnpm installed alongside them. They used to look pnpm up on PATH. That failed when the directory holding them was not on PATH, and it silently handed the call to an unrelated pnpm when one came first there #14803.

• The @zkochan/cmd-shim package is now available as @pnpm/bins.cmd-shim.

• pnpm cache list-registries now prints the registry URL, matching pnpm cache view. It printed https%3A+registry.npmjs.org before and prints https://registry.npmjs.org/ now #15046.

• pnpm deploy no longer installs the dependencies of the workspace root project into the deploy directory #6437.

• Install warnings no longer carry the text of a package's deprecation notice. The warning names the deprecated package and version, and the pnpm:deprecation event no longer carries the notice either. pnpm view still shows it on request.

  A deprecation warning now names the newest version of the package that is not deprecated, and says when reaching it means widening the range you declared:

  WARN  deprecated foo@1.0.0. 2.3.1 is not deprecated, outside the range you declared.
  

  pnpm works this out from the metadata it already fetched, so it costs no extra request. An install that reuses the lockfile without fetching metadata names no version.

  pnpm strips c

…notes truncated.

compare 11.27.0…11.27.1 · npm

@fastify/static 10.1.3 → 10.1.4

v10.1.4

This is a security release for GHSA-r799-r9gc-m956 (CVE-2026-90982).

It fixes a route guard and allowedPath bypass on case-insensitive filesystems. Users should upgrade to @fastify/static 10.1.4.

Full Changelog: fastify/fastify-static@v10.1.3...v10.1.4

compare 10.1.3…10.1.4 · npm

fastify 5.12.4 → 5.12.5

v5.12.5

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in [Backport 5.x] perf: reduce content-type parser overhead fastify/fastify#7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in [Backport 5.x] perf: avoid redundant request-part reads during validation fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

compare 5.12.4…5.12.5 · npm

fs-extra 11.4.0 → 11.4.1

releases · npm