chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #446 · nuxt/scripts

renovate · 2025-04-05T00:27:07Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@antfu/eslint-config	`^9.0.0` → `^9.1.0`	pnpm.catalog.default	minor
@nuxt/ui (source)	`^4.8.1` → `^4.9.0`	pnpm.catalog.default	minor
@paypal/paypal-js (source)	`^9.7.0` → `^9.8.0`	pnpm.catalog.default	minor
@shikijs/langs (source)	`^4.1.0` → `^4.3.0`	pnpm.catalog.default	minor
@shikijs/themes (source)	`^4.1.0` → `^4.3.0`	pnpm.catalog.default	minor
@types/google.maps (source)	`^3.65.0` → `^3.65.2`	pnpm.catalog.default	patch
@types/google.maps (source)	`^3.58.1` → `^3.65.2`	peerDependencies	minor
@types/node (source)	`^25.9.1` → `^25.9.4`	pnpm.catalog.default	patch
@types/youtube (source)	`^0.2.0` → `^0.3.0`	pnpm.catalog.default	minor
@types/youtube (source)	`^0.1.0` → `^0.3.0`	peerDependencies	minor
@vue/test-utils	`^2.4.10` → `^2.4.11`	pnpm.catalog.default	patch
Hebilicious/reproduire	`v0.0.9-mp` → `v0.0.9`	action	patch
actions/checkout	`v6.0.1` → `v6.0.3`	action	patch
actions/stale	`v10.0.0` → `v10.3.0`	action	minor
eslint (source)	`^10.4.1` → `^10.6.0`	pnpm.catalog.default	minor
happy-dom	`^20.9.0` → `^20.10.6`	pnpm.catalog.default	minor
oxc-parser (source)	`^0.134.0` → `^0.137.0`	pnpm.catalog.default	minor
playwright-core (source)	`^1.60.0` → `^1.61.1`	pnpm.catalog.default	minor
pnpm (source)	`11.5.0` → `11.9.0`	packageManager	minor
posthog-js (source)	`^1.378.1` → `^1.395.0`	pnpm.catalog.default	minor
posthog-js (source)	`^1.0.0` → `^1.395.0`	peerDependencies	minor
rollup (source)	`^4.60.4` → `^4.62.2`	pnpm.catalog.default	minor
shiki (source)	`^4.1.0` → `^4.3.0`	pnpm.catalog.default	minor
unhead-v3-fixture>@unhead/vue (source)	`^3.0.0` → `^3.1.6`	pnpm-workspace.overrides	minor
unplugin (source)	`^3.0.0` → `^3.2.0`	pnpm.catalog.default	minor
vitest (source)	`^4.1.7` → `^4.1.9`	pnpm.catalog.default	patch
vue (source)	`^3.5.35` → `^3.5.39`	pnpm.catalog.default	patch
vue-tsc (source)	`^3.3.3` → `^3.3.5`	pnpm.catalog.default	patch

Release Notes

antfu/eslint-config (@antfu/eslint-config)

`v9.1.0`

Compare Source

🚀 Features

Update deps - by @antfu (ff246)

🐞 Bug Fixes

Update deps and scope unicorn rules - by @antfu (82078)

View changes on GitHub

nuxt/ui (@nuxt/ui)

`v4.9.0`

Compare Source

Features

Calendar: add month and year selection (#6582) (ca3c72e)
ChatMessages: expose registerMessageRef (#6275) (f99778e)
components: allow hiding icon with false (#6597) (09eb639)
ContentSearch/DashboardSearch: forward input config to command palette (#6312) (5199b7e)
FileUpload: expose removeFile in slots (#6492) (4da3a5d)
locale: add Latvian language (#6552) (fa52538)
Modal/Slideover: add leave and enter events (#6596) (006324a)
module: add theme.unstyled option (#6551) (a2a8bc9)
PinInput: add separator prop (#6392) (89b30e8)
ScrollArea: add shadow prop (#6561) (d850ae6)
Select/SelectMenu: use multiple in theme (#6554) (f66eb65)
Sidebar: add transition prop (#6484) (af80a67)
theme: allow replacing slot classes with a function (#6562) (ea576e2)
theme: uniformize focus styles across components (#6576) (b026ca2)
useTour: new composable (#6557) (dc05151)
vite: add root option to override .nuxt-ui directory location (#6595) (cccb3d5)

Bug Fixes

CommandPalette: only scroll to highlighted item when focused (#6579) (02259a6)
Link: set default for locale prop (#6563) (e9ab758)
module: remove inline script in SPA mode for strict CSP (#6577) (7225e9f)
ProseCodeCollapse: cap root max-height instead of toggling pre height (#6565) (52d3c45)
ProseKbd: type default slot as VNode[] (52367b1)
SelectMenu: bind id and aria attributes on trigger (#6572) (c3bef7a)
Select: open menu on label click (#6575) (e8d18c3)
Tabs: render active indicator during SSR (#6570) (9e5b8a6)
templates: resolve vite root to an absolute path for #build aliases (#6586) (238e291)

`v4.8.2`

Compare Source

Bug Fixes

Form: support setting the name attribute (#6539) (f8186e2)
InputMenu/SelectMenu: re-highlight first item when items change (#6538) (0414dd0)
InputNumber/InputDate/InputTime/Calendar: restore locale prop (#6546) (ed2f955)
module: merge custom variants into AppConfig type (#6531) (f0571c3)

paypal/paypal-js (@paypal/paypal-js)

`v9.8.0`

Compare Source

Minor Changes

0ff45b7: Consolidating the shared GooglePay types to paypal-js package.

Patch Changes

9007a82: Add optional submit options to CardFields submit() method, including billingAddress and name fields for 3DS authentication support
6e1de75: Fix a typescript bug that was making .start options required.
164d373: Update paypal one time payment session start options to be optional.

shikijs/shiki (@shikijs/langs)

`v4.3.0`

Compare Source

🚀 Features

stream: Add svelte renderer - by @CNSeniorious000 and Anthony Fu (via agent) in #1291 (2d18a)

View changes on GitHub

`v4.2.0`

Compare Source

🚀 Features

Add @shikijs/stream and @shikijs/magic-move packages - by @antfu in #1283 (d031f)

🐞 Bug Fixes

transformers: Handle YAML comment prefixes correctly for v3 - by @AkaHarshit in #1266 (f694a)
vitepress-twoslash: Scroll blocking on mobile viewports - by @micaiguai in #1262 (9e0e8)

View changes on GitHub

vuejs/test-utils (@vue/test-utils)

`v2.4.11`

Compare Source

compare changes

🩹 Fixes

Drop legacy Mutation Event listener entries (#2844)
Handle setData() correctly for components using both setup() and data() (#2846)
Export GlobalMountOptions type (#2851)
Set spec-compliant event.code on keydown/keyup (#2850)

❤️ Contributors

Cédric Exbrayat (@cexbrayat)
Renato de Leão (@renatodeleao)
Matt Van Horn (@mvanhorn)
Carsten Brachem (@cbrachem)
Ahmad Hanan (@AhmadHannan037)
Paul Cochrane (@paultcochrane)
Arpit Jain (@arpitjain099)

Hebilicious/reproduire (Hebilicious/reproduire)

`v0.0.9`

Compare Source

compare changes

actions/checkout (actions/checkout)

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

actions/stale (actions/stale)

`v10.3.0`

Compare Source

What's Changed

Bug Fix

Enhancement: ignore stale labeling events by @shamoon in #1311

Dependency Updates

Upgrade dependencies (@actions/core, @octokit/plugin-retry, @typescript-eslint) by @Copilot in #1335

New Contributors

@shamoon made their first contribution in #1311

Full Changelog: actions/stale@v10...v10.3.0

`v10.2.0`

Compare Source

What's Changed

Bug Fix

Fix checking state cache (fix #1136) and switch to Octokit helper methods by @itchyny in #1152

Dependency Updates

Upgrade js-yaml from 4.1.0 to 4.1.1 by @dependabot in #1304
Upgrade lodash from 4.17.21 to 4.17.23 by @dependabot in #1313
Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @chiranjib-swain in #1312

New Contributors

@itchyny made their first contribution in #1152

Full Changelog: actions/stale@v10...v10.2.0

`v10.1.1`

Compare Source

What's Changed

Bug Fix

Add Missing Input Reading for only-issue-types by @Bibo-Joshi in #1298

Improvement

Improves error handling when rate limiting is disabled on GHES. by @chiranjib-swain in #1300

Dependency Upgrades

Upgrade eslint-config-prettier from 8.10.0 to 10.1.8 by @dependabot in #1276
Upgrade @types/node from 20.10.3 to 24.2.0 and document breaking changes in v10 by @dependabot in #1280
Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot in #1291
Upgrade actions/checkout from 4 to 6 by @dependabot in #1306

New Contributors

@chiranjib-swain made their first contribution in #1300

Full Changelog: actions/stale@v10...v10.1.1

`v10.1.0`

Compare Source

What's Changed

Add only-issue-types option to filter issues by type by @Bibo-Joshi in #1255

New Contributors

@Bibo-Joshi made their first contribution in #1255

Full Changelog: actions/stale@v10...v10.1.0

eslint/eslint (eslint)

`v10.6.0`

Compare Source

Features

b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

a83683d docs: Update README (GitHub Actions Bot)
f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
bea49f7 docs: Update README (GitHub Actions Bot)
e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
3eb3d9b docs: Update README (GitHub Actions Bot)
c5bb59c docs: Update README (GitHub Actions Bot)
eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

`v10.5.0`

Compare Source

Features

5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)
2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)
732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)
f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)
bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)
c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

8ae1b5b docs: Update README (GitHub Actions Bot)
ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)
f99b47a docs: Update README (GitHub Actions Bot)
acf03d4 docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)

Chores

b18bf58 chore: update ecosystem plugins (#20959) (ESLint Bot)
c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)
243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)
217b2a9 test: add unit tests for ParserService (#20949) (Taejin Kim)
72003e7 test: add location information to error messages in max-statements (#20945) (lumir)
7797c26 refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)
67c46fa chore: update ecosystem plugins (#20938) (ESLint Bot)
95d8c7a chore: update dependency @eslint/json to v2 (#20934) (renovate[bot])
cf9e496 chore: update @arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)
fb6d396 test: run type tests with TypeScript 7 (#20868) (sethamus)

capricorn86/happy-dom (happy-dom)

`v20.10.6`

Compare Source

👷‍♂️ Patch fixes

Await NodeJS internal ReadableStream promise during teardown - By @capricorn86 in task #2217

`v20.10.5`

Compare Source

👷‍♂️ Patch fixes

Adds cache to query selector parser - By @capricorn86 in task #2142
- The selector parser degraded in performance in v20.6.3 to solve more complex selectors
- Parsing is still a bit slower, but the cache will hopefully mitigate most of the problem

`v20.10.4`

Compare Source

👷‍♂️ Patch fixes

Coerce null qualifiedName to empty string in createDocument - By @Firer in task #2206

`v20.10.3`

Compare Source

👷‍♂️ Patch fixes

Fix "~=" attribute selector matching hyphenated substrings in CSS selectors - By @mixelburg in task #2194

`v20.10.2`

Compare Source

👷‍♂️ Patch fixes

Updates external dependencies - By @capricorn86 in task #2163

`v20.10.1`

Compare Source

`v20.10.0`

Compare Source

🎨 Features

Adds support for setting a canvas adapter for handling the canvas rendering using the browser setting canvasAdapter - By @RAprogramm and @capricorn86 in task #241
Adds new package @happy-dom/node-canvas-adapter - By @RAprogramm and @capricorn86 in task #241
- @happy-dom/node-canvas-adapter is a pluggable canvas adapter for Happy DOM using node-canvas.
Adds support for loading image files when enabling the browser setting enableImageFileLoading - By @capricorn86 in task #241
Adds support for loading image data URLs - By @capricorn86 in task #241
Adds support for ImageData - By @capricorn86 in task #241
Adds support for ImageBitmap - By @capricorn86 in task #241
Adds support for Window.createImageBitmap() - By @capricorn86 in task #241

oxc-project/oxc (oxc-parser)

`v0.137.0`

💥 BREAKING CHANGES

7a76cd3 estree: [BREAKING] Make whether to include TS fields a runtime option (#23574) (overlookmotel)

🚀 Features

53509a8 minifier: Treeshake pure typed arrays and Set/Map array literals (#23469) (Dunqing)

🐛 Bug Fixes

ae02b4e ci/parser: Use minimal for vitest reporter (#23457) (camc314)

`v0.136.0`

⚡ Performance

da1a6c6 diagnostics: Migrate to allocation-optimized oxc-miette (#23094) (Boshen)

`v0.135.0`

microsoft/playwright (playwright-core)

`v1.61.1`

Compare Source

`v1.61.0`

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
Supported expect.soft.poll(...).
New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
New -G command line shorthand for --grep-invert.

🛠️ Other improvements

Playwright now supports Ubuntu 26.04.
HAR and trace recordings now include WebSocket requests.

Browser Versions

Chromium 149.0.7827.55
Mozilla Firefox 151.0
WebKit 26.5

This version was also tested against the following stable channels:

Google Chrome 149
Microsoft Edge 149

pnpm/pnpm (pnpm)

`v11.9.0`

Compare Source

`v11.8.0`

Compare Source

Minor Changes

c112b61: Added a --dry-run option to pnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, no node_modules) and always exits with code 0. This mirrors the preview semantics of npm install --dry-run #7340.
179ebc4: pnpm run --no-bail now exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of --no-bail consistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursive pnpm run --no-bail always exited with code 0, even when a script failed #8013.
0474a9c: Added support for generating Node.js package maps at node_modules/.package-map.json during isolated and hoisted installs. Added the node-experimental-package-map setting to inject the generated map into pnpm-managed Node.js script environments, and the node-package-map-type setting to choose between standard and loose package maps.
dcededc: pnpm sbom now marks components reachable only through devDependencies with CycloneDX scope: "excluded" and the cdx:npm:package:development property. The excluded scope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by @cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installed optionalDependencies) omit scope and default to required.
1495cb0: Added per-package SBOM generation with --out and --split flags. Use --out out/%s.cdx.json to write one SBOM per workspace package to individual files, or --split for NDJSON output

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2025-04-05T00:27:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
scripts-docs	Error		Jun 27, 2026 11:40pm
scripts-playground	Ready	Preview, Comment	Jun 27, 2026 11:40pm

pkg-pr-new · 2025-07-16T18:29:18Z

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts@446

commit: 0665051

vercel · 2025-11-25T02:47:14Z

    "@nuxt/image": "^1.11.0",
    "@nuxt/scripts": "workspace:*",
-    "@nuxt/ui": "4.0.0",
+    "@nuxt/ui": "4.2.1",


Suggested change

"@nuxt/ui": "4.2.1",

"@nuxt/ui": "^4.2.1",

The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.

View Details

Analysis

Inconsistent version pinning for @nuxt/ui dependency

What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.

How to reproduce:

cat docs/package.json | grep -A 15 '"dependencies"'

Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:

"@nuxt/content": "^3.8.2"

"@nuxt/fonts": "^0.12.1"

"@nuxthq/studio": "^2.2.1"

All other 10 dependencies also use ^ prefix

Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.

Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.

vercel · 2026-01-15T00:37:21Z

-    "posthog-js": "^1.0.0"
+    "@types/youtube": "^0.1.2",
+    "@unhead/vue": "^2.1.2",
+    "posthog-js": "^1.321.2"


Suggested change

"posthog-js": "^1.321.2"

"posthog-js": "^1.0.0"

The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).

View Details

Analysis

Overly restrictive posthog-js peer dependency breaks backward compatibility

What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.

How to reproduce:

# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint) npm install @nuxt/scripts # After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2

Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"

Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:

Code only uses posthog.init() and basic config options (api_host, capture_pageview, disable_session_recording) available since 1.0.0

The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes

Peer dependencies should be permissive to maximize compatibility

Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible

This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.

socket-security · 2026-04-29T17:16:38Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@typescript-eslint/eslint-plugin` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@antfu/eslint-config@9.1.0` → `npm/@typescript-eslint/eslint-plugin@8.62.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.62.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `eslint-plugin-jsdoc` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@antfu/eslint-config@9.1.0` → `npm/eslint-plugin-jsdoc@63.0.9` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-jsdoc@63.0.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `happy-dom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/happy-dom@20.10.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/happy-dom@20.10.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

socket-security · 2026-06-12T21:06:27Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@20.10.6
	@types/youtube@0.1.2 ⏵ 0.3.0
	@shikijs/themes@4.3.0
	shiki@4.3.0
	@shikijs/langs@4.3.0
	vitest@4.1.9
	@types/google.maps@3.65.2
	playwright-core@1.61.1
	@types/node@25.9.4
	@antfu/eslint-config@9.1.0
	@vue/test-utils@2.4.11
	vue-tsc@3.3.5
	eslint@10.6.0
	rollup@4.62.2
	@paypal/paypal-js@9.8.0

View full report

renovate Bot force-pushed the renovate/all-minor-patch branch from 9c4e39b to 5bfebea Compare April 5, 2025 00:30

vercel Bot deployed to Preview – scripts-playground April 5, 2025 00:37 View deployment

vercel Bot deployed to Preview – scripts-docs April 5, 2025 00:40 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 5bfebea to 7804f68 Compare April 6, 2025 09:08

renovate Bot changed the title ~~chore(deps): update resolutions typescript to v5.8.3~~ chore(deps): update all non-major dependencies Apr 6, 2025

vercel Bot deployed to Preview – scripts-docs April 6, 2025 09:10 View deployment

vercel Bot deployed to Preview – scripts-playground April 6, 2025 09:12 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 7804f68 to 2d975ff Compare April 7, 2025 04:48

vercel Bot deployed to Preview – scripts-docs April 7, 2025 04:51 View deployment

vercel Bot deployed to Preview – scripts-playground April 7, 2025 04:53 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 2d975ff to 0104ff1 Compare April 7, 2025 08:22

vercel Bot deployed to Preview – scripts-playground April 7, 2025 08:24 View deployment

vercel Bot deployed to Preview – scripts-docs April 7, 2025 08:26 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 0104ff1 to 8120e32 Compare April 7, 2025 15:15

vercel Bot deployed to Preview – scripts-playground April 7, 2025 15:17 View deployment

vercel Bot deployed to Preview – scripts-docs April 7, 2025 15:20 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 8120e32 to 5ec9f5e Compare April 7, 2025 18:22

vercel Bot deployed to Preview – scripts-docs April 7, 2025 18:29 View deployment

vercel Bot deployed to Preview – scripts-playground April 7, 2025 18:31 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 5ec9f5e to efcb3b7 Compare April 8, 2025 08:39

vercel Bot deployed to Preview – scripts-playground April 8, 2025 08:42 View deployment

vercel Bot deployed to Preview – scripts-docs April 8, 2025 08:44 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from efcb3b7 to 1a61aec Compare April 10, 2025 00:28

vercel Bot deployed to Preview – scripts-playground April 10, 2025 00:30 View deployment

vercel Bot deployed to Preview – scripts-docs April 10, 2025 00:33 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 1a61aec to cf8e7f8 Compare April 10, 2025 09:47

vercel Bot deployed to Preview – scripts-playground April 10, 2025 09:50 View deployment

vercel Bot deployed to Preview – scripts-docs April 10, 2025 09:52 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from cf8e7f8 to 2b13cf8 Compare April 11, 2025 01:12

vercel Bot deployed to Preview – scripts-playground April 16, 2025 07:26 View deployment

vercel Bot had a problem deploying to Preview – scripts-docs April 16, 2025 07:27 Failure

renovate Bot force-pushed the renovate/all-minor-patch branch from 6132302 to 360e116 Compare April 16, 2025 14:05

vercel Bot deployed to Preview – scripts-playground April 16, 2025 14:07 View deployment

vercel Bot had a problem deploying to Preview – scripts-docs April 16, 2025 14:08 Failure

renovate Bot force-pushed the renovate/all-minor-patch branch from 360e116 to aa97a8b Compare April 17, 2025 00:59

vercel Bot deployed to Preview – scripts-playground April 17, 2025 01:02 View deployment

vercel Bot had a problem deploying to Preview – scripts-docs April 17, 2025 01:03 Failure

renovate Bot force-pushed the renovate/all-minor-patch branch from aa97a8b to 714cf9d Compare April 17, 2025 08:46

vercel Bot deployed to Preview – scripts-playground April 17, 2025 08:48 View deployment

vercel Bot had a problem deploying to Preview – scripts-docs April 17, 2025 08:49 Failure

renovate Bot force-pushed the renovate/all-minor-patch branch from 714cf9d to bdbb60c Compare April 17, 2025 18:14

vercel Bot had a problem deploying to Preview – scripts-docs April 17, 2025 18:15 Failure

vercel Bot deployed to Preview – scripts-playground April 17, 2025 18:17 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from bdbb60c to 9343bf3 Compare April 18, 2025 20:28

vercel Bot had a problem deploying to Preview – scripts-docs April 18, 2025 21:10 Failure

vercel Bot deployed to Preview – scripts-playground April 18, 2025 21:12 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 9343bf3 to fb7fea7 Compare April 21, 2025 12:46

vercel Bot deployed to Preview – scripts-playground April 21, 2025 12:48 View deployment

vercel Bot had a problem deploying to Preview – scripts-docs April 21, 2025 12:49 Failure

renovate Bot force-pushed the renovate/all-minor-patch branch from fb7fea7 to 556aaae Compare April 21, 2025 16:40

vercel Bot deployed to Preview – scripts-playground April 21, 2025 16:42 View deployment

vercel Bot had a problem deploying to Preview – scripts-docs April 21, 2025 16:43 Failure

vercel Bot reviewed Sep 20, 2025

View reviewed changes

Comment thread pnpm-lock.yaml Outdated

vercel Bot reviewed Nov 25, 2025

View reviewed changes

vercel Bot reviewed Jan 15, 2026

View reviewed changes

chore(deps): update all non-major dependencies

0665051

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies#446

chore(deps): update all non-major dependencies#446
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Apr 5, 2025 •

edited

Loading

Uh oh!

vercel Bot commented Apr 5, 2025 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jul 16, 2025 •

edited

Loading

Uh oh!

Uh oh!

vercel Bot Nov 25, 2025

Uh oh!

vercel Bot Jan 15, 2026

Uh oh!

socket-security Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Apr 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🚀 Features

🐞 Bug Fixes

Features

Bug Fixes

Bug Fixes

Minor Changes

Patch Changes

🚀 Features

🚀 Features

🐞 Bug Fixes

🩹 Fixes

❤️ Contributors

What's Changed

Bug Fix

Dependency Updates

New Contributors

What's Changed

Bug Fix

Dependency Updates

New Contributors

What's Changed

Bug Fix

Improvement

Dependency Upgrades

New Contributors

What's Changed

New Contributors

Features

Bug Fixes

Documentation

Chores

Features

Documentation

Chores

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

⚡ Performance

🔑 WebAuthn passkeys

🗃️ Web Storage

New APIs

Network

Browser and Screencast

Test runner

🛠️ Other improvements

Browser Versions

Minor Changes

Configuration

Uh oh!

vercel Bot commented Apr 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

vercel Bot Nov 25, 2025

Choose a reason for hiding this comment

Analysis

Inconsistent version pinning for @nuxt/ui dependency

Uh oh!

vercel Bot Jan 15, 2026

Choose a reason for hiding this comment

Analysis

Overly restrictive posthog-js peer dependency breaks backward compatibility

Uh oh!

socket-security Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented Apr 5, 2025 •

edited

Loading

vercel Bot commented Apr 5, 2025 •

edited

Loading

pkg-pr-new Bot commented Jul 16, 2025 •

edited

Loading

socket-security Bot commented Apr 29, 2026 •

edited

Loading

socket-security Bot commented Jun 12, 2026 •

edited

Loading