Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 8, 2025

This PR contains the following updates:

Package Change Age Confidence Type Update
@nuxt/eslint-config (source) 1.9.0 -> 1.10.0 age confidence devDependencies minor
@types/node (source) 22.18.1 -> 22.19.1 age confidence devDependencies minor
bumpp 10.2.3 -> 10.3.1 age confidence devDependencies minor
danielroe/provenance-action v0.1.0 -> v0.1.1 age confidence action patch
fontaine (source) ^0.6.0 -> ^0.7.0 age confidence dependencies minor
lint-staged 16.1.6 -> 16.2.7 age confidence devDependencies minor
magic-string 0.30.18 -> 0.30.21 age confidence dependencies patch
pnpm (source) 10.21.0 -> 10.23.0 age confidence packageManager minor
rollup (source) 4.50.1 -> 4.53.3 age confidence devDependencies minor
typescript (source) 5.9.2 -> 5.9.3 age confidence devDependencies patch

Release Notes

nuxt/eslint (@​nuxt/eslint-config)

v1.10.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
antfu-collective/bumpp (bumpp)

v10.3.1

Compare Source

No significant changes

    View changes on GitHub

v10.3.0

Compare Source

   🚀 Features
    View changes on GitHub
danielroe/provenance-action (danielroe/provenance-action)

v0.1.1

Compare Source

compare changes

🚀 Enhancements
  • Add support for bun.lock (#​12)
📖 Documentation
  • Use @main constraint for example (237ceea)
❤️ Contributors
unjs/fontaine (fontaine)

v0.7.0

Compare Source

compare changes

🚀 Enhancements
  • fontaine: Add option for per-family fallback fonts (#​533)
  • fontaine,fontless: Category-aware default fallbacks (#​674)
🔥 Performance
🩹 Fixes
💅 Refactors
  • Extract core utilities in preparation for fontless (#​627)
📖 Documentation
  • Add basic README for fontless (74151f3)
  • Replace invalid playground link (#​543)
  • Refine fontless homepage (#​575)
  • Update readme to reflect proper fallback name (#​629)
📦 Build
🏡 Chore
✅ Tests
🤖 CI
  • Build project before running knip (a7a8ddd)
  • Remove forced corepack installation (ba923c5)
  • Add provenance action to check for downgrades in provenance (7a5d474)
  • Fix workflow (#​641)
  • Rename provenance workflow (#​640)
  • Tweak pkg-pr-new workflow (49284f0)
  • Update release tag patterns (9131ffe)
❤️ Contributors
lint-staged/lint-staged (lint-staged)

v16.2.7

Compare Source

Patch Changes
  • #​1711 ef74c8d Thanks @​iiroj! - Do not display a "failed to spawn" error message when a task fails normally. This message is reserved for when the task didn't run because spawning it failed.

v16.2.6

Compare Source

Patch Changes

v16.2.5

Compare Source

Patch Changes
  • #​1687 9e02d9d Thanks @​iiroj! - Fix unhandled promise rejection when spawning tasks (instead of the tasks themselves failing). Previously when a task failed to spawn, lint-staged also failed and the backup stash might not have been automatically restored.

v16.2.4

Compare Source

Patch Changes

v16.2.3

Compare Source

Patch Changes
  • #​1669 27cd541 Thanks @​iiroj! - When using --fail-on-changes, automatically hidden (partially) unstaged changes are no longer counted to make lint-staged fail.

v16.2.2

Compare Source

Patch Changes
  • #​1667 699f95d Thanks @​iiroj! - The backup stash will not be dropped when using --fail-on-changes and there are errors. When reverting to original state is disabled (via --no-revert or --fail-on-changes), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually.

    Additionally, the example for using the backup stash manually now uses the correct backup hash, if available:

    % npx lint-staged --fail-on-changes
    ✔ Backed up original state in git stash (c18d55a3)
    ✔ Running tasks for staged files...
    ✖ Tasks modified files and --fail-on-changes was used!
    ↓ Cleaning up temporary files...
    
    ✖ lint-staged failed because `--fail-on-changes` was used.
    
    Any lost modifications can be restored from a git stash:
    
      > git stash list --format="%h %s"
      c18d55a3 On main: lint-staged automatic backup
      > git apply --index c18d55a3

v16.2.1

Compare Source

Patch Changes
  • #​1664 8277b3b Thanks @​iiroj! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is readonly string[] and can't be mutated. Thanks @​outslept!

    export default {
    ---  "*": (files: string[]) => void console.log('staged files', files)
    +++  "*": (files: readonly string[]) => void console.log('staged files', files)
    }
  • #​1654 70b9af3 Thanks @​iiroj! - This version has been published from GitHub Actions using Trusted Publishing for npm packages.

  • #​1659 4996817 Thanks @​iiroj! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are package.json files in the working directory. This situation might happen when running lint-staged for a single package in a monorepo.

  • #​1654 7021f0a Thanks @​iiroj! - Return the caret semver range (^) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to lint-staged. This was changed in 16.2.0 after the vulnerability issues with chalk and debug, which were also removed in the same version.

    Given the recent vulnerabilities in the npm ecosystem, it's best to be very careful when updating dependencies.

v16.2.0

Compare Source

Minor Changes
  • #​1615 99eb742 Thanks @​iiroj! - Added a new option --fail-on-changes to make lint-staged exit with code 1 when tasks modify any files, making the precommit hook fail. This is similar to the git diff --exit-code option. Using this flag also implies the --no-revert flag which means any changes made by tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.

  • #​1611 cd05fd3 Thanks @​rlorenzo! - Added a new option --continue-on-error so that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.

  • #​1637 82fcc07 Thanks @​iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.

  • #​1647 a5ecc06 Thanks @​iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, the DEBUG environment variable is no longer supported — use the --debug to enable debugging

  • #​1636 8db2717 Thanks @​iiroj! - Added a new option --hide-unstaged so that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags --hide-unstaged --no-hide-partially-staged isn't meaningful and behaves the same as just --hide-unstaged.

    Thanks to @​ItsNickBarry for the idea and initial implementation in #​1552.

  • #​1648 7900b3b Thanks @​iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.

Patch Changes
Rich-Harris/magic-string (magic-string)

v0.30.21

Compare Source

v0.30.19

Compare Source

Bug Fixes
Features
  • replace(All) support replacement for functions when the first parameter is a string (#​304) (fd1d887)
pnpm/pnpm (pnpm)

v10.23.0: pnpm 10.23

Compare Source

Minor Changes

  • Added --lockfile-only option to pnpm list #​10020.

Patch Changes

  • pnpm self-update should download pnpm from the configured npm registry #​10205.
  • pnpm self-update should always install the non-executable pnpm package (pnpm in the registry) and never the @pnpm/exe package, when installing v11 or newer. We currently cannot ship @pnpm/exe as pkg doesn't work with ESM #​10190.
  • Node.js runtime is not added to "dependencies" on pnpm add, if there's a engines.runtime setting declared in package.json #​10209.
  • The installation should fail if an optional dependency cannot be installed due to a trust policy check failure #​10208.
  • pnpm list and pnpm why now display npm: protocol for aliased packages (e.g., foo npm:[email protected]) #​8660.
  • Don't add an extra slash to the Node.js mirror URL #​10204.
  • pnpm store prune should not fail if the store contains Node.js packages #​10131.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.22.0: pnpm 10.22

Compare Source

Minor Changes

  • Added support for trustPolicyExclude #​10164.

    You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:

    trustPolicy: no-downgrade
    trustPolicyExclude:
      - [email protected]
      - [email protected] || 5.102.1
  • Allow to override the engines field on publish by the publishConfig.engines field.

Patch Changes

  • Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #​10179.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite
rollup/rollup (rollup)

v4.53.3

Compare Source

2025-11-19

Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests

v4.53.2

Compare Source

2025-11-10

Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests

v4.53.1

Compare Source

2025-11-07

Bug Fixes
Pull Requests

v4.53.0

Compare Source

2025-11-07

Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests

v4.52.5

Compare Source

2025-10-18

Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests

v4.52.4

Compare Source

2025-10-03

Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests

v4.52.3

Compare Source

2025-09-27

Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests

v4.52.2

Compare Source

2025-09-23

Bug Fixes
  • Fix Android build crashing due to failed dlopen (#​6109)
Pull Requests

v4.52.1

Compare Source

2025-09-23

Bug Fixes
  • Opt-out of dynamic import optimization when using top-level await to effectively prevent deadlocks (#​6121)
Pull Requests

v4.52.0

Compare Source

2025-09-19

Features
  • Add option output.onlyExplicitManualChunks to turn off merging additional dependencies into manual chunks (#​6087)
  • Add support for x86_64-pc-windows-gnu platform (#​6110)
Pull Requests

v4.51.0

Compare Source

2025-09-19

Features
  • Support ROLLUP_FILE_URL_OBJ placeholder to inject file URLs into the generated code (#​6108)
Bug Fixes
  • Improve OpenHarmony build to work in more situations (#​6115)
Pull Requests

v4.50.2

Compare Source

2025-09-15

Bug Fixes
  • Resolve an issue where unused destructured array pattern declarations would conflict with included variables (#​6100)
Pull Requests
microsoft/TypeScript (typescript)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:


Configuration

📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from danielroe as a code owner September 8, 2025 12:50
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 282cfde to 3483e6a Compare September 13, 2025 10:53
@renovate renovate bot changed the title chore(deps): update dependency magic-string to v0.30.19 chore(deps): update all non-major dependencies Sep 13, 2025
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from a5a4120 to 2a0437f Compare September 19, 2025 22:36
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 3372bf1 to c9da2f2 Compare September 28, 2025 14:08
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 28 times, most recently from 077c186 to 1ed0177 Compare November 23, 2025 02:52
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 1ed0177 to d178653 Compare November 23, 2025 06:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant