chore(deps): update all non-major dependencies#41
Merged
Conversation
18f9271 to
1cfbabc
Compare
e76aa08 to
c0cb349
Compare
c0cb349 to
2b5e0e0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.34.56→2.34.582.34.64(+5)0.135.0→0.136.00.138.0(+1)0.27.0→0.27.111.4.0→11.5.111.5.211.4.0→11.5.111.5.254.6.1→54.7.154.10.2(+5)0.1.23→0.1.244.95.0→4.96.04.98.0(+1)Release Notes
aws/aws-cli (awscli)
v2.34.58Compare Source
v2.34.57Compare Source
vercel-labs/agent-browser (npm:agent-browser)
v0.27.1Compare Source
Improvements
vitalscommand output formatting for better readability (#1404)Documentation
pnpm/pnpm (pnpm)
v11.5.1Compare Source
Patch Changes
pnpm auditperformance by pruning non-vulnerable lockfile subtrees and stopping path enumeration once vulnerable findings reach the path cap.npm_config_user_agentfor root lifecycle scripts during headless installs.integrityfield of a remote (non-registry) tarball dependency when its lockfile entry is rebuilt. Re-resolving such a dependency without re-fetching it (for example viapnpm update, or when another dependency changes) produced a resolution with no integrity — URL/tarball resolvers only learn the integrity after the tarball is downloaded — so the previously recorded integrity was dropped, making later installs fail withERR_PNPM_MISSING_TARBALL_INTEGRITY#12067.repositoryfield into the{ type, url }object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a stringrepositorywith a 500 Internal Server Error duringpnpm publish#12099.@typescript-eslint/eslint-pluginpeer-depends on both@typescript-eslint/parserandtypescript, and@typescript-eslint/parserpeer-depends ontypescript), pnpm no longer reuses a hoisted instance of the shared peer that was resolved against a different version #12079.v11.5.0Compare Source
Minor Changes
Added a new
hoistingLimitssetting fornodeLinker: hoistedinstalls, mirroring yarn'snmHoistingLimits. It acceptsnone(the default — hoist as far as possible),workspaces(hoist only as far as each workspace package), ordependencies(hoist only up to each workspace package's direct dependencies). Originally proposed in #6468, closing #6457.Replaced
enquirerwith@inquirer/promptsfor all interactive prompts. Fixes theupdate -iscrolling overflow bug where long choice lists were clipped in the terminal #6643.User-facing changes:
pnpm update -i/pnpm update -i --latest: Scrolling now works correctly when many packages are available; the new library uses visual-line-aware pagination viausePaginationpnpm audit --fix -i: Same scrolling fix for vulnerability selectionpnpm approve-builds: Interactive build approval prompts updatedpnpm patch: Version selection and "apply to all" prompts updatedpnpm patch-remove: Patch removal selection updatedpnpm publish: Branch confirmation prompt updatedpnpm login: Credential prompts updatedpnpm run/pnpm exec(withverifyDepsBeforeRun=prompt): Confirmation prompt updatedVim-style
j/kkeys still work for up/down navigation in all interactive prompts.Internal: The
OtpEnquirerandLoginEnquirerDI interfaces changed from{ prompt }to{ input }/{ input, password }respectively. Plugins or custom builds that inject their own enquirer mock will need to update.Staged publishes are now recognized in the trust scale. When a package version's registry metadata carries an
approverfield, it is treated as the strongest trust evidence (ranked above trusted publishers and provenance attestations), since staged publishes require 2FA publish approvals. This prevents false-positive trust downgrade errors when moving from a staged publish to a lower trust level #11887.Patch Changes
Fix pnpm hanging during peer resolution when an aliased install pulls in transitive packages with mutual peer cycles at different depths in the dependency tree (for example,
pnpm i nuxt@npm:nuxt-nightly@5x). Cycles whose members hit thefindHitcache instead of running their owncalculateDepPathare now short-circuited by sibling resolutions at the level where the cycle is detected, so the cached path promises no longer deadlock. #11999.Fix
pnpm dist-tag addandpnpm dist-tag rmagainst npmjs.org failing without--otpwith[ERR_PNPM_UNAUTHORIZED] You must be logged in to set dist-tag … "You must provide a one-time pass. Upgrade your client to npm@latest in order to use 2FA.". pnpm now sendsnpm-auth-type: webon dist-tag writes and surfaces the resulting OTP challenge through the existing browser-based 2FA flow (the samewithOtpHandlinghelper used bypnpm publish), so the browser opens, the user authenticates, and the dist-tag is set on retry.--otp=<code>continues to work via the classic flow.Fix
minimumReleaseAgeExcludehandling in npm resolution fast paths so excluded packages do not get pinned to stale versions. Excludes are honored consistently duringpublishedBymetadata selection and cache-mtime shortcuts.Fix the
integrityfield being dropped from the lockfile entry of a remote (non-registry) https-tarball dependency when an unrelated package is installed afterwards. URL/tarball resolvers do not return an integrity (it is only known after the tarball is downloaded), so when such a dependency was reused from the lockfile without being re-fetched, its integrity was lost. It is now carried over from the existing resolution. With pnpm's lockfile-integrity hardening, the missing integrity made subsequent--frozen-lockfileinstalls fail withERR_PNPM_MISSING_TARBALL_INTEGRITY. #12001.Skip dependency re-resolution when
pnpm-lock.yamlis missing butnode_modules/.pnpm/lock.yamlexists and still satisfies the manifest.pnpm installnow reuses the materialized snapshot to regeneratepnpm-lock.yamlinstead of walking the registry to rebuild it from scratch, turning the cache+node_modules variation into a near-no-op for users who deleted the lockfile but kept the install #11993.--frozen-lockfilestill refuses to proceed whenpnpm-lock.yamlis absent — the regenerated lockfile must be committed, so failing loudly is the correct behavior for CI.vercel/vercel (vercel)
v54.7.1Compare Source
Patch Changes
1180675: Revert "[flags] fix dep detection for build embedding (#16242)"1180675]v54.7.0Compare Source
Minor Changes
0b4e1ef: Addvercel connect revoke-tokenssubcommand to revoke tokens issued from a connector.Patch Changes
ba6e7c6: Internal: fix_deployeval grader passing--token ""in the Docker sandbox whereVERCEL_TOKENisn't in process env. Only pass--tokenwhen set; CLI falls back toauth.jsonotherwise.92988c2: Handle sensitive Environment Variable pull challenges in the CLI.3986bb0: Stop retrying intentionally aborted requests so the CLI exits promptly after a deployment is ready.64f5484: Allow SAML re-authentication to use device-code flow in non-TTY sessions.97fdbbe: [flags] fix dep detection for build embedding2d918b8]voidzero-dev/vite-plus (vite-plus)
v0.1.24: vite-plus v0.1.24Compare Source
A new
vp pm stagepublishing workflow, hardened installs and upgrades, a Node-version mismatch reinstall prompt, and the bundled vite/vitest/tsdown stack moves forward.Features
vp pm stage: a newvp pmsubcommand exposing npm's staged-publishing workflow (upload a build to a staging area without 2FA, then approve or reject it from a trusted device); it maps topnpm stage/npm stage/yarn npm ... --stagedper package manager, with an npm fallback for yarn Classic and bun (#1715), by @fengmk2vp: prompt to reinstall when up-to-date global packages were built against a different Node.js than the active one (defaults to no); adds--reinstall-node-mismatchand--ignore-node-mismatch, and skips the prompt in CI (#1666), by @liangmiQwQvp format: addformatas a visible alias ofvp fmt, so the common slipvp formatresolves correctly andvp format --init/--migrateapply the samevite.config.tswiring asvp fmt(#1727), by @semimikohFixes & Enhancements
vp install/ Node runtime download: HTTP retries now wrap the whole body stream, hash verification, and archive extraction (not just the request headers), so truncated or corrupt downloads of package managers and Node are re-fetched instead of failing on the first attempt (#1719), by @fengmk2vp upgrade --forceon Windows: install into a fresh directory before repointingcurrent, so the forced reinstall no longer fails trying to overwrite the runningvp.exe(#1714), by @fengmk2vp install -g: install global packages directly into their final prefix instead of a temp dir that gets moved, so packages whose postinstall scripts bake in absolute or relative temp paths still resolve their bins; a failed package in a multi-package install no longer removes the shims of the ones that already succeeded (#1698), by @liangmiQwQvp why: remove the-g/--globalflag, which delegated to the package manager's global mode and ignored Vite+-managed global packages;vp whystays project-scoped whilevp outdated -gkeeps using the managed global flow (#1720), by @liangmiQwQcurrentlink via PowerShell (detecting junctions, symlinks, and stale directories) instead ofcmd /c rmdir, which could fail with "The directory is not empty" (#1726), by @TheAlexLichtervp create: skip editor-config detection and package-local editor settings by default when creating a project inside an existing monorepo;--editor <name>stays an explicit opt-in and--no-editoran opt-out (#1729), by @jong-kyungvp create vite:monorepo(pnpm): keep the aliasedvite/vitestin the website app'spackage.jsonso the workspaceoverrides.vite: catalog:has a direct consumer andvp why viteresolves to@voidzero-dev/vite-plus-core; npm/yarn/bun still drop the dead-weight keys (#1728), by @fengmk2vp pack: rewrite directcreateRequire(...)("picomatch")calls in bundled tsdown output to the local bundled CJS entry, so packing no longer depends on an undeclared runtimepicomatchunder pnpmhoist: false(#1732), by @fengmk2vp migrate: resolve acatalog:husky pin from the workspace catalog (pnpm-workspace.yaml,.yarnrc.yml, orpackage.jsoncatalogs) during the git-hooks preflight, so a compatible catalog-pinned husky no longer triggers a false "could not determine husky version" warning and skips hook setup (#1710), by @fengmk2Docs
llms-full.txtpointer, install commands, and corevpcommands) for handing straight to a coding agent (#1706), by @fengmk2troubleshooting.md:vite.config.tsrelated issues are resolved by updating oxlint and oxfmt (#1708), by @leaysgurAGENTS.md(#1707), by @leaysgurChore
vpinstall: reduce retainedvpversions from 5 to 3 across the installer,vp upgrade, and the shell/PowerShell bootstrap scripts (active and previous versions stay protected for rollback); document the 3-version retention andvp upgrade --rollback(#1716), by @fengmk2.vitest-plugin-loadedfile (#1723), by @liangmiQwQbranchseer) (#1705), by @wan9chi8.0.14 → 8.0.16, vitest4.1.7 → 4.1.8, tsdown0.22.0 → 0.22.1,@vitejs/devtools0.2.0 → 0.3.1(#1713, #1735, #1737), by @voidzero-guard[bot]Bundled Versions
8.0.16f94df871.0.3a287faa0.22.14.1.81.67.00.23.00.52.0New Contributors
Welcome to our new contributor @semimikoh! 🎉
Full Changelog: voidzero-dev/vite-plus@v0.1.23...v0.1.24
Published Packages
@voidzero-dev/vite-plus-core@0.1.24@voidzero-dev/vite-plus-test@0.1.24vite-plus@0.1.24Installation
macOS/Linux:
curl -fsSL https://vite.plus | bashWindows:
Or download and run
vp-setup.exefrom the assets below.Upgrade:
cloudflare/workers-sdk (wrangler)
v4.96.0Compare Source
Minor Changes
#14087
e3c862aThanks @edmundhung! - Add support for the newweb_searchbinding kind.Cloudflare Web Search is a managed, zero-setup web discovery primitive for agents and Workers. Declare the binding as a single object in
wrangler.jsonc:{ "web_search": { "binding": "WEBSEARCH" } }There is exactly one shared web corpus, so there is no namespace, instance, or other field to specify -- only the variable name. The binding exposes a single
search()method that returns URLs and catalog metadata for a query. Web Search is discovery-only -- to read a result's content the caller invokes the globalfetch()API against the result'surl.The binding is always remote in local development: Miniflare proxies to the production Web Search service via the remote-bindings transport. Adds the
websearch.runOAuth scope towrangler login.Also adds a
wrangler websearch searchcommand for running ad-hoc queries from the CLI:--limitis optional (defaults to 10, capped at 20).--jsonprints the raw response; without it the results render as a pretty table.#13610
cbb39bdThanks @petebacondarwin! - Add support foragent_memorybindingsAgent Memory bindings allow Workers to connect to Cloudflare's Agent Memory service for storing and retrieving agent conversation state. This binding is remote-only, meaning it always connects to the Cloudflare API during
wrangler devrather than using a local simulation.To configure an
agent_memorybinding, add the following to yourwrangler.json:{ "agent_memory": [ { "binding": "MY_MEMORY", "namespace": "my-namespace" } ] }Wrangler will automatically provision the namespace during deployment if it does not already exist. Type generation via
wrangler typesis also supported.This change also adds the
agent-memory:writeOAuth scope to Wrangler's default login scopes, sowrangler logincan request the permissions needed to provision and manage Agent Memory namespaces.#13610
cbb39bdThanks @petebacondarwin! - Addwrangler agent-memory namespacecommandsThe following commands have been added for managing Agent Memory namespaces:
#14087
e3c862aThanks @edmundhung! - Add confirmation prompt towrangler containers images deletePreviously, running
wrangler containers images delete IMAGE:TAGwould delete the image immediately with no confirmation. The command now prompts for confirmation before deleting. Use-yor--skip-confirmationto bypass the prompt in non-interactive or scripted environments.#14087
e3c862aThanks @edmundhung! - Renamepipelinefield tostreamin pipeline bindings configurationThe
pipelinefield insidepipelinesbindings has been renamed tostreamto align with the updated API wire format. The oldpipelinefield is still accepted but deprecated and will emit a warning.Before:
After:
#14087
e3c862aThanks @edmundhung! - Allow pipeline, stream, and sink commands to resolve resources by name with pagination-aware lookups.#14087
e3c862aThanks @edmundhung! - Support deleting secrets viawrangler secret bulkYou can now delete secrets in bulk by setting their value to
nullin the JSON input file:{ "SECRET_TO_DELETE": null, "SECRET_TO_UPDATE": "new-value" }#14091
4c0da7bThanks @gpanders! - Add ProxyCommand support forwrangler containers sshwrangler containers sshnow automatically switches to a stdio proxy when invoked by OpenSSH'sProxyCommand, and--stdiocan force this mode. This lets users connect withssh <instance_id>when their SSH config uses Wrangler as the proxy command.#13892
13cbadbThanks @penalosa! - Remove the deprecatedexperimental.testModeoption fromunstable_devexperimental.testModepreviously only affected the defaultlogLevel(warnwhentestMode: true,logotherwise) and has been flagged for removal in its type-definition comment since it landed. It is now removed, andunstable_dev's default log level matcheswrangler dev's (log).Callers that explicitly passed
testMode: trueto get quieter logs should now setlogLevel: "warn"directly.Patch Changes
#14016
408432aThanks @petebacondarwin! - report all failing triggers from a single deploywrangler deploydeploys several kinds of trigger in parallel (routes, custom domains, schedules, queue producers/consumers, workflows). Previously, if one of those API calls failed, the first rejection short-circuited the rest, no other deployments were reported, and (in the case of custom-domain confirmation conflicts) some failures were silently logged to stdout without the deploy actually failing.wrangler deploynow waits for every trigger deployment to settle, prints every successfully-deployed target (so you still see what landed), and then throws a single error listing every trigger that failed.Note that this also turns the previously-silent "user declined to override a conflicting Custom Domain" case into a hard failure of
wrangler deploy, which matches what was always implied by the message ("Publishing to Custom Domain ... was skipped, fix conflict and try again").#14125
1103c07Thanks @dario-piotrowicz! - Bumprosie-skillsfrom0.7.6to0.8.1and bundle it into the Wrangler outputThe new version of
rosie-skillsis a pure-TypeScript rewrite that removes the previously necessary ~600kb WASM binary. The package now ships only JavaScript with one minimal dependencies (modern-tar).Additionally,
rosie-skillsis now bundled directly into Wrangler's distributable rather than kept as an external runtime dependency. This eliminates the supply chain concern raised in #14110: there is no separate package to resolve at install time, since all code is inlined into Wrangler's build output.#14135
5b5cbd3Thanks @Refaerds! - Update the generated type for browser bindings toBrowserRunWhen running
wrangler types, browser bindings were previously typed as the genericFetcher. They now generate the more specific and accurateBrowserRuntype.#14087
e3c862aThanks @edmundhung! - Bumprosie-skillspackage from 0.6.3 to 0.7.6#14087
e3c862aThanks @edmundhung! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14076
97d7d81Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14100
c647cccThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14087
e3c862aThanks @edmundhung! - Disable Sentry error reporting by defaultWRANGLER_SEND_ERROR_REPORTSnow defaults tofalseinstead of prompting on every error. The current prompt produces too many false-positive reports. Users can still opt in explicitly by settingWRANGLER_SEND_ERROR_REPORTS=true.#14087
e3c862aThanks @edmundhung! - Fixwrangler setupfailing for Vite projects without a config filewrangler setup(andwrangler deploy --experimental-autoconfig) crashed with "Could not find Vite config file to modify" for Vite projects that don't have avite.config.jsorvite.config.ts. This affected 6 of the 16create-vitetemplates:vanilla,vanilla-ts,react-swc,react-swc-ts,lit, andlit-ts.Autoconfig now creates a minimal Vite config with the Cloudflare plugin when no config file exists, instead of failing. The file extension (
.tsor.js) is chosen based on whether the project has atsconfig.json.#14087
e3c862aThanks @edmundhung! - Show helpful message with URL when browser cannot be opened in headless/container environmentsPreviously, running
wrangler login(or any command that opens a browser) in headless Linux environments withoutxdg-openinstalled would crash with a confusing "A file or directory could not be found — Missing file or directory: xdg-open" error.Now wrangler catches the error and prints a clear warning with the URL so users can copy-paste it into a browser manually.
#14087
e3c862aThanks @edmundhung! -wrangler secrets-store secret createandsecret updatenow reject secret values larger than 64 KiB (65,536 bytes) with a clear error before calling the Cloudflare API. Previously the CLI accepted them, the secret appeared insecret list, and the failure surfaced later (and confusingly) at worker deploy time as a "secret doesn't exist" error against the binding. 64 KiB is the cap enforced by the API; the CLI now enforces it at the same boundary.#14059
b64b7e4Thanks @matingathani! - Fixwrangler kv bulk getprinting "Success!" to stdout, which corrupted JSON output when piped to tools likejq#14002
e4c8fd9Thanks @danyalahmed1995! - Show a clear error for invalid API token header charactersWrangler now detects API tokens containing characters that cannot be sent in the HTTP Authorization header before making an API request. This avoids a low-level ByteString conversion error and helps users recreate or recopy the token without printing the token value.
#14132
2dffeebThanks @dario-piotrowicz! - Adapt React Router autoconfig based onv8_middlewarefuture flagThe React Router autoconfig (
wrangler setup) now detects whetherv8_middleware: trueis set in the user'sreact-router.config.ts. When it is, the generatedworkers/app.tsuses a simplified fetch handler withoutAppLoadContextmodule augmentation, and the generatedapp/entry.server.tsxomits the_loadContextparameter. Whenv8_middlewareis not set, the existingAppLoadContextpattern withenv/ctxparams is preserved.This avoids breaking projects that use the
v8_middlewarefuture flag (which changes the context API fromAppLoadContexttoRouterContextProvider), while keeping the traditional pattern for projects that haven't opted in.#14133
59e43e4Thanks @matingathani! - Fixwrangler whoamiprinting a trailing period after the api-tokens URLThe message
To see token permissions visit https://...api-tokens.ended witha period that became part of the URL when clicked in terminals or GitHub Actions
output, causing a 404. The period is removed and a comma added before "visit"
so the sentence reads naturally without a trailing period on the URL.
Updated dependencies [
e3c862a,cbb39bd,7bb5c7a,e3c862a,97d7d81,c647ccc,e3c862a,e3c862a,972d13d]:Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.