Update all non-major dependencies#90
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
March 16, 2026 01:11
8163bc0 to
1c12805
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
March 23, 2026 01:53
1bda63e to
bf19dac
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
March 30, 2026 18:06
dbd899c to
7cee584
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
April 13, 2026 00:31
8885033 to
e1d03a1
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
April 20, 2026 10:05
3b379aa to
dcaf67a
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
April 27, 2026 17:54
212d23e to
f04993d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
May 4, 2026 22:41
c9c50c5 to
65ad638
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
May 11, 2026 21:25
f551dcd to
3b2292d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
May 18, 2026 20:38
af560e1 to
37e4bcb
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
May 25, 2026 01:39
37e4bcb to
9206254
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
June 8, 2026 11:53
ae5bc9e to
11358ff
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
June 15, 2026 21:12
8f15cb5 to
a6fe410
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
June 22, 2026 17:41
71b067f to
b5ac54c
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
July 6, 2026 02:10
1383639 to
8c6fe34
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
July 6, 2026 17:51
8c6fe34 to
0446f7a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.19.10→^1.20.1^4.3.0→^4.3.2^25.8.0→^25.9.4^19.2.14→^19.2.17^9→^9.39.416.2.6→16.2.10^1.16.0→^1.23.016.2.6→16.2.1011.1.2→11.9.0^8.5.14→^8.5.16^3.8.3→^3.9.4^1.4.3→^1.6.1^19.2.6→^19.2.7^19.2.6→^19.2.7^4.8.0→^4.13.0^0.34.5→^0.35.3^4.3.0→^4.3.2^4.91.0→^4.107.0Release Notes
opennextjs/opennextjs-cloudflare (@opennextjs/cloudflare)
v1.20.1Compare Source
Patch Changes
#1297
780a21cThanks @james-elicx! - fix: disable response compression for skew protection API requestsAvoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.
v1.20.0Compare Source
Minor Changes
#1290
46c50fcThanks @james-elicx! - feature: add opt-in batch upload viarclonefor fast R2 cache population.Key Changes:
Optional
rcloneUpload: Install the optionalrclone.jspeer dependency and pass--rcloneto opt in torclonebased batch uploads.R2_ACCESS_KEY_IDR2_SECRET_ACCESS_KEYCF_ACCOUNT_IDExplicit Opt-in: The existing worker-based population path remains the default.
rcloneis only loaded when--rcloneis used for a remote cache.Clear Errors: The CLI reports missing credentials or a missing
rclone.jsinstallation when the option is used.Usage:
Install
rclone.js, then add the secrets in a.env/.dev.varsfile in your project root:pnpm add rclone.js pnpm approve-builds # select rclone.js pnpm rebuild rclone.js R2_ACCESS_KEY_ID=your_key R2_SECRET_ACCESS_KEY=your_secret CF_ACCOUNT_ID=your_account opennextjs-cloudflare deploy --rcloneYou can also set the environment variables for CI builds.
Notes:
rclonemay not be supported on all platforms.Patch Changes
#1289
eef243fThanks @thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges runBucketCachePurge.alarm()passed its tag bindings toSqlStorage.execas asingle array.
exec(query, ...bindings)is variadic over its bindings, so for amulti-tag
DELETE ... WHERE tag IN (?, ?, …)the binding count (1) disagreedwith the placeholder count (N) and
execthrew "Wrong number of parameterbindings" on every flush. On-demand
revalidateTagpurges therefore neverreached the Cloudflare cache, and with
bypassTagCacheOnCacheHitenabled pagesserved stale until the ISR TTL expired.
Spread the bindings, normalise the
INSERTto the same variadic form, andtighten the drain loop's guard from
while (tags.length >= 0)(which neverexits via the condition) to
while (tags.length > 0).#1291
51439b1Thanks @james-elicx! - fix: disable response compression when provisioning R2 cache bucketsAvoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.
v1.19.11Compare Source
Patch Changes
#1270
802047eThanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mappingWorker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing
/_next/static/*requests to return 404 on past deployments. Versions are now filtered to those withworkers/triggered_byin{upload, version_upload}.Closes #1230
tailwindlabs/tailwindcss (@tailwindcss/postcss)
v4.3.2Compare Source
Fixed
auto-rows-*andauto-cols-*utilities (e.g.auto-rows-12andauto-cols-16) (#20229)@tailwindcss/cliin--watchmode from crashing on Windows when@sourcepoints to a directory that doesn't exist (#20242)@tailwindcss/vitefrom crashing in Deno v2.8.x whencontext.parentURLis not a valid URL (#20245)@tailwindcss/cliin--watchmode rebuilds when the input CSS file changes in an ignored directory (#20246)@variantrules used inaddBase(…)to use custom variants defined later (#20247)@tailwindcss/vitefrom crashing during HMR when scanned files or directories are deleted (#20259)font-sizeinstead ofcolordeclarations fortext-[--spacing(…)](#20260)@sourcepatterns from scanning unrelated sibling files and folders (#20263)%]…[%in.tt,.tt2, and.txfiles (#20269)p.text-black[condition](#20269)@position-tryrules from triggering unknown at-rule warnings when optimizing CSS (#20277)--opacitytheme values (#20287)@tailwindcss/postcsswhen used with newer PostCSS patch releases (#20289)v4.3.1Compare Source
Added
--silentoption to suppress output in@tailwindcss/cli(#20100)Fixed
Module#registerHooksinstead ofModule#registeron Node 26+ (#20028)@applyto be used with CSS mixins (#19427)not-*correctly negates@containerqueries, includingstyle(…)queries (#20059)drop-shadow-*color utilities work with custom shadow values containingcalc(…)(#20080)@tailwindcss/vite(#20103)@tailwindcss/webpackcan be installed in Rspack projects without requiringwebpackas a peer dependency (#20027)calc(…)expressions (e.g.px-[calc(1rem+0px)]→px-[calc(1rem+0)]) (#20127)left-[99999px]→left-[99999px], notleft-24999.75) (#20130)@tailwindcss/cliin--watchmode recovers when a tracked dependency is deleted and restored (#20137)@tailwindcss/clibinaries are ignored when scanning for class candidates (#20139)addClass(…)andremoveClass(…)calls (#20198)@variantto be used insideaddBase(#19480)@sourceglobs with symlinks are preserved (#20203)@sourcerules can re-include files excluded by earlier@source notrules (#20203)@utilityrules (#20205)inset-shadow-noneand other inset shadows work correctly (#20208)@sourcedirectories are scanned even when ignored by git (#20214)@sourceglobs ending in**/*preserve dynamic path segments to avoid scanning too many files (#20217)calc(…)divisions when the result would require high precision (e.g.w-[calc(100%/3.5)]→w-[calc(100%/3.5)], notw-[28.571428571428573%]) (#20221)@tailwindcss/postcss(#20228)Changed
0instead ofcalc(var(--spacing) * 0)for spacing utilities likem-0andleft-0(#20196)var(--spacing)instead ofcalc(var(--spacing) * 1)for spacing utilities likem-1andleft-1(#20196)vercel/next.js (eslint-config-next)
v16.2.10Compare Source
v16.2.9Compare Source
Empty release to ensure
next@latestpoints at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.v16.2.8Compare Source
Release with no changes in an attempt to fix
next@latestpointing at a prerelease version.v16.2.7Compare Source
Core Changes
playwright-coreto resolve_finishedPromiseonrequestFailed(#93920)router.querycorruption withbasePath+rewrites(#93917)FormDataentries (#94240)Credits
Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!
lucide-icons/lucide (lucide-react)
v1.23.0: Version 1.23.0Compare Source
What's Changed
paper-bagicon by @dkast in #4023New Contributors
Full Changelog: lucide-icons/lucide@1.22.0...1.23.0
v1.22.0Compare Source
v1.21.0: Version 1.21.0Compare Source
What's Changed
versionscripts in package scripts by @ericfennis in #4479broken-boneicon by @Patolord in #4131New Contributors
Full Changelog: lucide-icons/lucide@1.20.0...1.21.0
v1.20.0: Version 1.20.0Compare Source
What's Changed
square-arrow-*icons by @jguddas in #3926search-icons by @jamiemlaw in #4099save-checkicon by @Konixy in #3120tag-plusandtag-xicons by @adam-kov in #3980banknote-checkicon by @mfjramirezf in #3956clock-arrow-inicon by @jguddas in #2403summaryicon by @jpjacobpadilla in #3114user-round-arrow-inicon by @jguddas in #2283clock-arrow-outicon by @jguddas in #2404pencil-sparklesicon by @jennieboops in #4445New Contributors
Full Changelog: lucide-icons/lucide@1.19.0...1.20.0
v1.19.0: Version 1.19.0Compare Source
What's Changed
star-*icons by @RajnishKMehta in #3918save-penicon by @vaporvee in #4179wrench-officon by @nilsjonsson in #4434adicon by @jamiemlaw in #4323eye-dashedicon by @karsa-mistmere in #4415save-plusicon by @jwlinqx in #4448list-sort-descendingicon by @ericfennis in #4457wallet-cardsicon by @jguddas in #3888podiumicon by @jguddas in #2124New Contributors
Full Changelog: lucide-icons/lucide@1.18.0...1.19.0
v1.18.0: Version 1.18.0Compare Source
What's Changed
play-officon by @Ahmed-Dghaies in #4412@nextfrom installation instructions for@lucide/svelteby @alecglassford in #4432webcam-officon by @jordan-burnett in #4242New Contributors
Full Changelog: lucide-icons/lucide@1.17.0...1.18.0
v1.17.0: Version 1.17.0Compare Source
What's Changed
martiniicon by @jamiemlaw in #4335globe-checkby @Barakudum in #4342parasolicon by @karsa-mistmere in #4347Full Changelog: lucide-icons/lucide@1.16.0...1.17.0
vercel/next.js (next)
v16.2.10Compare Source
v16.2.9Compare Source
Empty release to ensure
next@latestpoints at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.v16.2.8Compare Source
Release with no changes in an attempt to fix
next@latestpointing at a prerelease version.v16.2.7Compare Source
Core Changes
playwright-coreto resolve_finishedPromiseonrequestFailed(#93920)router.querycorruption withbasePath+rewrites(#93917)FormDataentries (#94240)Credits
Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!
pnpm/pnpm (pnpm)
v11.9.0Compare Source
Minor Changes
bae694f: Some registries generate tarballs on-demand and cannot provide an integrity checksum in their package metadata. In that case pnpm now computes the integrity from the downloaded tarball and stores it in the lockfile, so the entry is verifiable on subsequent installs instead of being written without an integrity (which would fail the next install). This also applies to--lockfile-only: the tarball is downloaded so its integrity can be computed. A lockfile entry that is still missing its integrity is rejected as aERR_PNPM_MISSING_TARBALL_INTEGRITYlockfile verification violation (the install fails closed) rather than being silently re-fetched.6c35a43: Added--exclude-peerstopnpm sbom. Withauto-install-peers(the default), peer dependencies resolve into the lockfile and are otherwise indistinguishable from the package's own dependencies. The flag drops peer dependencies (and any transitive subtree reachable only through them) from the SBOM. CycloneDX 1.7 has no scope or relationship that expresses "consumer-provided peer", so omission is the only spec-clean handling. The flag name matchespnpm list --exclude-peers; note the SBOM flag prunes a peer's exclusive subtree, which is stricter thanpnpm list(which only hides leaf peers).Patch Changes
25a829e:pnpm audit --fixnow writes a single combinedminimumReleaseAgeExcludeentry per package (e.g.axios@0.18.1 || 0.21.1) instead of one entry per version, matching the format documented for the setting. Existing per-version entries inpnpm-workspace.yamlare merged into the combined form rather than left as duplicates. Installs that auto-collect immature versions intominimumReleaseAgeExcludenow report the same combined entries, so the "Added N entries" message matches what is written to the manifest #12534.1cbb5f2: Fixed non-deterministic peer resolution that could add or remove an optional transitive peer — for example@babel/core, reached throughstyled-jsx— from a package's peer-dependency suffix across otherwise identical installs, churning the lockfile and causing intermittentpnpm dedupe --checkfailures in CI. When a package's children are resolved by one occurrence (the "owner") and reused by a deeper consumer, whether that consumer inherited the owner's missing peers depended on whether the owner's resolution had finished yet — a race under concurrent resolution. The decision is now a function of the dependency graph's structure rather than resolution-completion order.d577eea: Fixed a Windows flakiness inpnpm dlxwhere a failed install could surface a spuriousEBUSY: resource busy or lockederror. The cleanup of a partially-populated dlx cache is now best-effort with retries and no longer masks the original error.ec7cf70: Shortened thepnpm dlxcache path so deep dependency trees no longer overflow Windows'MAX_PATH, which could make a dependency's lifecycle script fail withspawn cmd.exe ENOENT.05b95ab: Fixedpnpmhanging (and crashing with an unhandled promise rejection) when a non-retryable network error such asSELF_SIGNED_CERT_IN_CHAINoccurs while fetching from a registry. The error is now rejected through the returned promise instead of being thrown inside the detached retry callback.d3f68e2: Fix apnpm auditperformance regression on lockfiles that contain dependency cycles. The reachable-vulnerability pruning added in pnpm 11.5.1 only memoized acyclic subtrees, so any node whose subtree touched a cycle — together with all of its ancestors — was recomputed on every query, making the path walk quadratic. Reachability is now computed once per node using Tarjan's strongly-connected-components algorithm, so cyclic graphs are handled in linear time #12212.The audit path walk also no longer recurses, so a deeply nested dependency graph can no longer overflow the call stack, and the install path to each finding is tracked without per-node copying, keeping memory linear in the graph depth.
322f88f: Fix failed optional dependency updates so they don't rewrite unrelated dependency specs #11267.1488db1: WhenenableGlobalVirtualStoreis toggled on for a project that was previously installed without it, stale hoisted symlinks undernode_modules/.pnpm/node_modulesare now replaced instead of being left pointing at the old per-project virtual store location #9739.6545793: Fixedpnpm install --ignore-workspaceoverwriting theallowBuildsmap inpnpm-workspace.yaml. The ignored builds of a package with a build script were auto-populated intoallowBuildseven though--ignore-workspacewas passed, clobbering committedtrue/falsevalues with theset this to true or falseplaceholder #12469.fbdc0eb: FixedminimumReleaseAgeExcludeandtrustPolicyExcludeso multiple exact-version entries for the same package behave the same as a single||disjunction entry. Previously only the first matching rule's versions were honored, so a config like[form-data@4.0.6, form-data@2.5.6]could still flagform-data@2.5.6as violatingminimumReleaseAge, while[form-data@4.0.6 || 2.5.6]worked as expected #12463.fa7004b: The in-memory package metadata cache is now populated on the exact-version disk fast path, so repeated resolutions of the same package within one install no longer re-read and re-parse the on-disk metadata. In large monorepos this brings the time for adding a new package down from minutes to seconds. The in-memory cache key now also includes the registry, so a package of the same name served by two different registries in a single install can no longer share a cache slot and resolve the wrong tarball.0a154b1: Fixedpnpm patchdropping the package name (and leaking internal option fields) when the patched dependency resolves to a single git-hosted version.4d3fe4b: The pnpr resolver endpoints moved under the reserved/-/pnprnamespace:POST /v1/resolveis nowPOST /-/pnpr/v0/resolveandPOST /v1/verify-lockfileis nowPOST /-/pnpr/v0/verify-lockfile. The capability handshake atGET /-/pnpradvertises protocol version0to match. This keeps every pnpr-proprietary route in npm's reserved namespace, so it can never collide with a package path.0ec878d: Removing a runtime dependency now removes the matchingdevEngines.runtimeorengines.runtimeentry that was materialized from it. Blank runtime selectors are normalized tolatest.17e7f2c:pnpm sbomnow emits a CycloneDXissue-trackerexternal reference for components (and the root) whosepackage.jsondeclares abugsURL. Email-onlybugsentries are skipped, since the reference requires a URL.a84d2a1: Add@pnpm/resolving.tarball-url, which builds and recognizes the canonical npm tarball URL of a package. It vendorsgetNpmTarballUrl(previously the externalget-npm-tarball-urlpackage) and addsisCanonicalRegistryTarballUrl, the predicate the lockfile writer uses to decide whether a tarball URL is derivable from name+version+registry (and can therefore be omitted frompnpm-lock.yaml).Exposing
isCanonicalRegistryTarballUrllets a custom resolver (pnpmfileresolvers) fronting a proxy that serves tarballs on a non-canonical path (e.g. an ephemerallocalhost:<port>) rewrite the resolved tarball to the canonical form, so nothing host-specific is persisted to the lockfile. Previously this logic was private to@pnpm/lockfile.utils.Two correctness fixes are included while consolidating the logic: the scoped-package unescape now handles uppercase
%2Fas well as%2f(percent-encoding is case-insensitive), and protocol-insensitive comparison strips only a leadinghttp(s)://scheme instead of splitting on the first://(which could truncate URLs containing a later://).852d537: Lockfile verification no longer reports a registry metadata fetch failure (for example a403/401on a private registry, or a network error) asERR_PNPM_TARBALL_URL_MISMATCH. When the registry can't be reached to verify an entry, the install now aborts with the registry's own fetch error (such asERR_PNPM_FETCH_403, which already explains the authentication situation) instead of mislabeling a transport failure as lockfile tampering. Registry fetch errors no longer leak basic-auth credentials embedded in the registry URL (https://user:pass@host/) into their message.v11.8.0Compare Source
Minor Changes
c112b61: Added a--dry-runoption topnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, nonode_modules) and always exits with code 0. This mirrors the preview semantics ofnpm install --dry-run#7340.179ebc4:pnpm run --no-bailnow exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of--no-bailconsistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursivepnpm run --no-bailalways exited with code 0, even when a script failed #8013.0474a9c: Added support for generating Node.js package maps atnode_modules/.package-map.jsonduring isolated and hoisted installs. Added thenode-experimental-package-mapsetting to inject the generated map into pnpm-managed Node.js script environments, and thenode-package-map-typesetting to choose betweenstandardandloosepackage maps.dcededc:pnpm sbomnow marks components reachable only throughdevDependencieswith CycloneDXscope: "excluded"and thecdx:npm:package:developmentproperty. Theexcludedscope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by@cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installedoptionalDependencies) omitscopeand default torequired.1495cb0: Added per-package SBOM generation with--outand--splitflags. Use--out out/%s.cdx.jsonto write one SBOM per workspace package to individual files, or--splitfor NDJSON output to stdout. WhConfiguration
📅 Schedule: (UTC)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.