Skip to content

chore(deps): update all non-major dependencies - #73

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch
Oct 14, 2026
Merged

chore(deps): update all non-major dependencies#73
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@rsbuild/core (source) ^2.2.2 → ^2.2.13 age confidence devDependencies patch
@types/node (source) 24.13.3 → 24.19.2 age confidence devDependencies minor
node 24.19.0 → 24.21.0 age confidence uses-with minor
pnpm (source) 11.24.0 → 11.28.5 age confidence packageManager minor
pnpm/action-setup v6.0.10 → v6.1.0 age confidence action minor
rstack (source) ^0.7.2 → ^0.8.3 age confidence devDependencies minor 0.8.4
uuid ^14.0.2 → ^14.0.3 age confidence devDependencies patch

Release Notes

web-infra-dev/rsbuild (@​rsbuild/core)

v2.2.13

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.12...v2.2.13

v2.2.12

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.11...v2.2.12

v2.2.11

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.10...v2.2.11

v2.2.10

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.9...v2.2.10

v2.2.9

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.8...v2.2.9

v2.2.8

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Refactor 🔨
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.7...v2.2.8

v2.2.7

Compare Source

What's Changed

New Features 🎉
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.6...v2.2.7

v2.2.6

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.5...v2.2.6

v2.2.5

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.4...v2.2.5

v2.2.4

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.3...v2.2.4

v2.2.3

Compare Source

What's Changed

Bug Fixes 🐞
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.2.2...v2.2.3

actions/node-versions (node)

v24.21.0: 24.21.0

Compare Source

Node.js 24.21.0

v24.20.0: 24.20.0

Compare Source

Node.js 24.20.0

pnpm/pnpm (pnpm)

v11.28.5: pnpm 11.28.5

Compare Source

This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.

Patch Changes
Security

  • pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with version+integrity.

  • Lockfile verification now checks the tarballs inside a variations resolution against the registry. A name@version lockfile entry with an empty variations resolution is now rejected.

  • pnpm audit signatures now verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification.

  • pnpm now rejects a git dependency whose lockfile repository is empty, begins with -, or contains a null byte. Git can no longer read such a value as a command-line option pnpm/tasks#84.

  • A git dependency with a #path: subpath can no longer reach files outside the repository through a symlink in the subpath.

  • pnpm pack, pnpm publish, and installs of git and local directory dependencies now leave out files that a directory symlink or a bundleDependencies entry points to outside the package directory pnpm/tasks#83 pnpm/tasks#93.

  • pnpm deploy with deployAllFiles now rejects symlinks that point outside the package directory. Local package installs with this setting apply the same check.

  • pnpm no longer hangs on a package archive with a negative PAX record length or an entry of 4 GiB or more pnpm/tasks#78 pnpm/tasks#79.

  • Large package downloads and large files inside gzip and bzip2 package archives now use bounded memory during installation. Package manifests and archive metadata larger than 64 MiB are rejected. pnpm publish also rejects manifests and README files larger than 64 MiB in pre-built tarballs before reading them into memory.

  • Two URL or local path dependencies no longer share a virtual store directory when one URL has +, #, :, or ? where the other has /. Such dependencies, including git dependencies pinned with #, now get a hash suffix on their directory name.

  • pnpm licenses now removes terminal control characters from package metadata in table output.

  • The warnings about ignored project .npmrc registry and auth settings no longer print the username and password of a URL-scoped key such as //user:password@registry.example.com/:_authToken.

Installing and resolving dependencies

  • Dependency resolution reads cached registry metadata faster. The metadata cache moved to <cache-dir>/v12/, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when --offline is set #​13512.

  • pnpm install now fails with ERR_PNPM_UNSUPPORTED_PROTOCOL when a dependency uses a specifier with a protocol pnpm does not support, such as Yarn's patch:. pnpm linked such a dependency to a directory that does not exist #​16590.

  • When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before, pnpm install and pnpm dedupe kept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies of vue pnpm/tasks#61.

  • pnpm add and pnpm install now keep the peer dependencies that pnpm-lock.yaml records for a package they did not update. A registry whose metadata disagrees with the package's package.json, for example by omitting peerDependenciesMeta, made pnpm add and pnpm dedupe write different lockfiles, so pnpm dedupe --check failed after pnpm add #​16615.

Configuration

  • pnpm config get and pnpm config list with --global or --location=global now show only the global configuration. Both flags included the project's .npmrc before. --location=global also included the project's pnpm-workspace.yaml. pnpm config get --global failed when the global bin directory was not in PATH #​16598.

  • pnpm now prints config warnings, such as an unset environment variable in .npmrc, when loading the config fails.

  • pnpm now fails when httpProxy or httpsProxy in pnpm-workspace.yaml or the global configuration is not a string.

  • pnpm dlx now uses the release entry of nodeDownloadMirrors from the workspace configuration when downloading Node.js runtimes #​11281. Mirrors for other channels, such as rc and nightly, still apply only from the global configuration.

Commands

  • pnpm run and pnpm exec now forward --config.* command-line flags to the install started by verifyDepsBeforeRun pnpm/tasks#60.

  • pnpm dlx with --package but no command now fails with 'pnpm dlx' requires a command to run. Before, it installed the package and then crashed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot merged commit 05d45d7 into main Oct 14, 2026
3 checks passed
@renovate
renovate Bot deleted the renovate/all-minor-patch branch October 14, 2026 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants