fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/js (source)	^9.30.1 -> ^9.31.0
@shikijs/vitepress-twoslash (source)	^3.7.0 -> ^3.8.0
@types/node (source)	^22.16.0 -> ^22.16.3
baseline-browser-mapping	^2.4.4 -> ^2.5.3
bignumber.js	9.3.0 -> 9.3.1
core-js (source)	^3.43.0 -> ^3.44.0
dotenv	^17.0.1 -> ^17.2.0
eslint (source)	^9.30.1 -> ^9.31.0
lit (source)	^3.3.0 -> ^3.3.1
miniflare (source)	^4.20250617.5 -> ^4.20250709.0
open	^10.1.2 -> ^10.2.0
playwright-chromium (source)	^1.53.2 -> ^1.54.1
pnpm (source)	10.12.4 -> 10.13.1
svelte (source)	^5.35.5 -> ^5.36.0
typescript-eslint (source)	^8.35.1 -> ^8.37.0
vitepress (source)	^2.0.0-alpha.7 -> ^2.0.0-alpha.8

---

Release Notes

eslint/eslint (@​eslint/js)

v9.31.0

Compare Source

shikijs/shiki (@​shikijs/vitepress-twoslash)

v3.8.0

Compare Source

   🚀 Features

• Update grammars and themes  -  by @​antfu (4bb10)

    View changes on GitHub

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.5.3

Compare Source

What's Changed

• fix: Add main entry point to exports to support ESM resolution by @​alan-agius4 in https://github.com/web-platform-dx/baseline-browser-mapping/pull/92
  • The /legacy import path is no longer required for CommonJS context as the distinction is handled in package.json; however, the option to use /legacy has been preserved in case anyone started using it in production in the last 24 hrs.
• update tests to check module resolution rather than using relative directory.

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.5.2...v2.5.3

v2.5.2: - types bug fix

Compare Source

What's Changed

• fix: correct path of types fields in package.json by @​alan-agius4 in https://github.com/web-platform-dx/baseline-browser-mapping/pull/91

New Contributors

• Big thanks to @​alan-agius4 for their first contribution in https://github.com/web-platform-dx/baseline-browser-mapping/pull/91

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.5.1...v2.5.2

v2.5.1: - data updates

Compare Source

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.5.0...v2.5.1

v2.5.0: - Browser support, simplified dependencies!

Compare Source

✨ What's new for users?

• baseline-browser-mapping is now supported in browser contexts. Frameworks that support module resolution will now load a single JS file of ~110kb (~22kb when compressed) and allows loading from CDNs like jsdelivr and unpkg.
• Adds support for CommonJS Node environments using the /legacy export path - no shimming required!
• baseline-browser-mapping will now Issues a console warning if the current version of the module is >2 months old.

⚙️ Under the hood

• Refactors methodology for including data from web-features, @mdn/browser-compat-data and downstream-browsers.json. Instead of using direct dependencies, these modules are now pre-packaged into the exported script using daily GitHub Actions.
• Jasmine test suite and other CLI tests now included to make it easier to contribute and prevent unintended regressions - all tests can be executed together using npm run test.
• Simplifies GitHub actions and removes Dependabot - critical data updates to web-feature and @mdn/browser-compat-data are now part of the refresh_data.yml action which only creates a new version of baseline-browser-mapping if the features or browsers information from the data provider modules has changed meaningfully.
• Incoporates @​notpushkin 's simplified compareVersions() function from https://github.com/web-platform-dx/baseline-browser-mapping/pull/68
• Updates web-features to 2.41.0 and @mdn/browser-compat-data to 6.0.29.

New Contributors

• @​mrtnvh made their first contribution in https://github.com/web-platform-dx/baseline-browser-mapping/pull/64

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.4.5...v2.5.0

MikeMcl/bignumber.js (bignumber.js)

v9.3.1

Compare Source

• 11/07/25
• [BUGFIX] #​388 toPrecision fix.

zloirock/core-js (core-js)

v3.44.0

Compare Source

• Changes v3.43.0...v3.44.0 (87 commits)
• Uint8Array to / from base64 and hex stage 3 proposal:
  • Fixed several V8 bugs in Uint8Array.fromHex and Uint8Array.prototype.{ setFromBase64, toBase64, toHex }, thanks @​brc-dd
• Joint iteration stage 2.7 proposal:
  • Uses Get in Iterator.zipKeyed, following tc39/proposal-joint-iteration#43
• Iterator sequencing stage 2.7 proposal:
  • Iterator.concat no longer reuses IteratorResult object of concatenated iterators, following tc39/proposal-iterator-sequencing#26
• Iterator chunking stage 2 proposal:
  • Added built-ins:
    • Iterator.prototype.sliding
• Number.prototype.clamp stage 2 proposal:
  • clamp no longer throws an error on NaN as min or max, following tc39/proposal-math-clamp#d2387791c265edf66fbe2455eab919016717ce6f
• Fixed some cases of Set.prototype.{ symmetricDifference, union } detection
• Added missing dependencies to some entries of static Iterator methods
• Added missing /full/{ instance, number/virtual }/clamp entries
• Some minor stylistic changes
• Compat data improvements:
  • Added Electron 38 and 39 compat data mapping
  • Added Oculus Quest Browser 38 and 39 compat data mapping
  • Iterator helpers marked as fixed and updated following the latest spec changes in Safari 26.0
  • Set.prototype.{ difference, symmetricDifference, union } marked as fixed in Safari 26.0
  • SuppressedError marked as fixed in FF141
  • Error.isError marked as fixed in Node 24.3
  • setImmediate and clearImmediate marked as available from Deno 2.4
  • Math.sumPrecise marked as shipped in Bun 1.2.18
  • %TypedArray%.prototype.with marked as fixed in Bun 1.2.18

motdotla/dotenv (dotenv)

v17.2.0

Compare Source

Added

• Optionally specify DOTENV_CONFIG_QUIET=true in your environment or .env file to quiet the runtime log (#​889)
• Just like dotenv any DOTENV_CONFIG_ environment variables take precedence over any code set options like ({quiet: false})

v17.1.0

Compare Source

Added

• Add additional security and configuration tips to the runtime log (#​884)
• Dim the tips text from the main injection information text

const TIPS = [
  '🔐 encrypt with dotenvx: https://dotenvx.com',
  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
  '⚙️  enable debug logging with { debug: true }',
  '⚙️  override existing env vars with { override: true }',
  '⚙️  suppress all logs with { quiet: true }',
  '⚙️  write to custom object with { processEnv: myObject }',
  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
]

eslint/eslint (eslint)

v9.31.0

Compare Source

lit/lit (lit)

v3.3.1

Compare Source

Patch Changes

• #​4997 aea85e24 - Update README

• #​4988 6792b7ef Thanks @​ADNolan! - Adjusted the comparison to use the name property of the _$resolve function and the resolveOverrideFn in private ssr support to prevent duplicated patching of the directive class.

• #​4976 a126d8df - Fix minor regression in property converters. fromAttribute may return either null or undefined.

cloudflare/workers-sdk (miniflare)

v4.20250709.0

Compare Source

Patch Changes

• #​9881 bb09e50 Thanks @​dependabot! - chore: update dependencies of "miniflare" package

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20250705.0	1.20250708.0
  @​cloudflare/workers-types	^4.20250705.0	^4.20250708.0

• #​9894 25dbe54 Thanks @​dependabot! - chore: update dependencies of "miniflare" package

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20250708.0	1.20250709.0
  @​cloudflare/workers-types	^4.20250708.0	^4.20250709.0

• #​9876 3bdec6b Thanks @​edmundhung! - chore: update youch version

v4.20250705.0

Compare Source

Minor Changes

• #​9796 ba69586 Thanks @​simonabadoiu! - Browser Rendering local mode

Patch Changes

• #​9784 1a75f85 Thanks @​Mkassabov! - fix inspector proxy not proxying workers created via setOptions

• #​9757 395f36d Thanks @​dependabot! - chore: update dependencies of "miniflare" package

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20250617.0	1.20250705.0
  @​cloudflare/workers-types	^4.20250617.0	^4.20250705.0

• #​9855 6f344bf Thanks @​petebacondarwin! - use logger (and log level) from miniflare for asset metadata parsing/loading logs

sindresorhus/open (open)

v10.2.0

Compare Source

• Add support for Brave browser (#​362) b62b99e

---

microsoft/playwright (playwright-chromium)

v1.54.1

Compare Source

v1.54.0

Compare Source

Highlights

• New cookie property partitionKey in browserContext.cookies() and browserContext.addCookies(). This property allows to save and restore partitioned cookies. See CHIPS MDN article for more information. Note that browsers have different support and defaults for cookie partitioning.

• New option noSnippets to disable code snippets in the html report.

  import { defineConfig } from '@​playwright/test';
  
  export default defineConfig({
    reporter: [['html', { noSnippets: true }]]
  });

• New property location in test annotations, for example in testResult.annotations and testInfo.annotations. It shows where the annotation like test.skip or test.fixme was added.

Command Line

• New option --user-data-dir in multiple commands. You can specify the same user data dir to reuse browsing state, like authentication, between sessions.

  npx playwright codegen --user-data-dir=./user-data

• Option -gv has been removed from the npx playwright test command. Use --grep-invert instead.

• npx playwright open does not open the test recorder anymore. Use npx playwright codegen instead.

Miscellaneous

• Support for Node.js 16 has been removed.
• Support for Node.js 18 has been deprecated, and will be removed in the future.

Browser Versions

• Chromium 139.0.7258.5
• Mozilla Firefox 140.0.2
• WebKit 26.0

This version was also tested against the following stable channels:

• Google Chrome 140
• Microsoft Edge 140

pnpm/pnpm (pnpm)

v10.13.1

Compare Source

Patch Changes

• Run user defined pnpmfiles after pnpmfiles of plugins.

v10.13.0

Compare Source

Minor Changes

• Added the possibility to load multiple pnpmfiles. The pnpmfile setting can now accept a list of pnpmfile locations #​9702.

• pnpm will now automatically load the pnpmfile.cjs file from any config dependency named @pnpm/plugin-* or pnpm-plugin-* #​9729.

  The order in which config dependencies are initialized should not matter — they are initialized in alphabetical order. If a specific order is needed, the paths to the pnpmfile.cjs files in the config dependencies can be explicitly listed using the pnpmfile setting in pnpm-workspace.yaml.

Patch Changes

• When patching dependencies installed via pkg.pr.new, treat them as Git tarball URLs #​9694.
• Prevent conflicts between local projects' config and the global config in dangerouslyAllowAllBuilds, onlyBuiltDependencies, onlyBuiltDependenciesFile, and neverBuiltDependencies #​9628.
• Sort keys in pnpm-workspace.yaml with deep #​9701.
• The pnpm rebuild command should not add pkgs included in ignoredBuiltDependencies to ignoredBuilds in node_modules/.modules.yaml #​9338.
• Replaced shell-quote with shlex for quoting command arguments #​9381.

sveltejs/svelte (svelte)

v5.36.0

Compare Source

Minor Changes

• feat: support await in components when using the experimental.async compiler option (#​15844)

Patch Changes

• fix: silence a11y warning for inert elements (#​16339)

• chore: clean up a11y analysis code (#​16345)

v5.35.7

Compare Source

Patch Changes

• fix: silence autofocus a11y warning inside <dialog> (#​16341)

• fix: don't show adjusted error messages in boundaries (#​16360)

• chore: replace inline regex with variable (#​16340)

v5.35.6

Compare Source

Patch Changes

• chore: simplify reaction/source ownership tracking (#​16333)

• chore: simplify internal component pop() (#​16331)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.37.0

Compare Source

🚀 Features

• typescript-estree: infer tsconfigRootDir from call stack (#​11370)

❤️ Thank You

• Josh Goldberg ✨

You can read about our versioning strategy and releases on our website.

v8.36.0

Compare Source

🚀 Features

• typescript-eslint: support basePath in tseslint.config() (#​11357)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

You can read about our versioning strategy and releases on our website.

vuejs/vitepress (vitepress)

v2.0.0-alpha.8

Compare Source

Bug Fixes

• adjust glob logic to always resolve glob relative to base (5d41785), closes #​4822
• build: ignore escaped : when splitting selector in postcssIsolateStyles (#​4830) (a629b03)
• font preload not being generated in rolldown-vite (ed387e8)
• theme: remove extra slash when concatenating base with sidebar links (c8fc80e)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sapphi-red]

The lint CI will be fixed by typescript-eslint/typescript-eslint@5c5e3d5