fix(deps): update all non-major dependencies #188

renovate · 2025-08-04T03:31:43Z

This PR contains the following updates:

Package	Change	Age	Confidence
@farmfe/cli	`2.0.0-nightly-20250411100807` -> `2.0.0-nightly-20250827162746`
@farmfe/core	`2.0.0-nightly-20250411141103` -> `2.0.0-nightly-20250827162746`
@types/node (source)	`^24.7.0` -> `^24.7.2`
core-js (source)	`^3.45.1` -> `^3.46.0`
esbuild	`^0.25.10` -> `^0.25.11`
pnpm (source)	`10.18.1` -> `10.18.3`
rolldown (source)	`1.0.0-beta.41` -> `1.0.0-beta.43`
tsdown	`^0.15.6` -> `^0.15.7`
unplugin-oxc	`^0.5.2` -> `^0.5.3`
vite (source)	`^7.1.9` -> `^7.1.10`
webpack	`^5.102.0` -> `^5.102.1`

Release Notes

farm-fe/farm (@farmfe/cli)

`v2.0.0-nightly-20250827162746`

Compare Source

zloirock/core-js (core-js)

`v3.46.0`

Compare Source

Changes v3.45.1...v3.46.0 (116 commits)
Map upsert stage 3 proposal:
- Fixed a FF WeakMap.prototype.getOrInsertComputed bug with callback calling before validation a key
Iterator chunking proposal:
- Built-ins:
  - Iterator.prototype.chunks
  - Iterator.prototype.windows
- Moved to stage 2.7, September 2025 TC39 meeting
- Iterator.prototype.sliding method replaced with an extra parameter of Iterator.prototype.windows method, tc39/proposal-iterator-chunking/#24, tc39/proposal-iterator-chunking/#26
Fixed Iterator.zip and Iterator.zipKeyed behavior with mode: 'longest' option, #1469, thanks @lionel-rowe
Fixed work of Object.groupBy and Iterator.zipKeyed together with Symbol polyfill - some cases of symbol keys on result null-prototype object were able to leak out to for-in
Compat data improvements:
- Map upsert proposal features marked as shipped from FF144
- Added Node 25.0 compat data mapping
- Added Deno 2.5 compat data mapping
- Updated Electron 39 compat data mapping
- Updated Opera 121+ compat data mapping
- Added Opera Android 92 compat data mapping
- Added Oculus Quest Browser 40 compat data mapping

evanw/esbuild (esbuild)

`v0.25.11`

Compare Source

Add support for with { type: 'bytes' } imports (#4292)

The import bytes proposal has reached stage 2.7 in the TC39 process, which means that although it isn't quite recommended for implementation, it's generally approved and ready for validation. Furthermore it has already been implemented by Deno and Webpack. So with this release, esbuild will also add support for this. It behaves exactly the same as esbuild's existing binary loader. Here's an example:
```
import data from './image.png' with { type: 'bytes' }
const view = new DataView(data.buffer, 0, 24)
const width = view.getInt32(16)
const height = view.getInt32(20)
console.log('size:', width + '\xD7' + height)
```
Lower CSS media query range syntax (#3748, #4293)

With this release, esbuild will now transform CSS media query range syntax into equivalent syntax using min-/max- prefixes for older browsers. For example, the following CSS:
```
@&#8203;media (640px <= width <= 960px) {
  main {
    display: flex;
  }
}
```
will be transformed like this with a target such as --target=chrome100 (or more specifically with --supported:media-range=false if desired):
```
@&#8203;media (min-width: 640px) and (max-width: 960px) {
  main {
    display: flex;
  }
}
```

pnpm/pnpm (pnpm)

`v10.18.3`

Compare Source

Patch Changes

Fix a bug where pnpm would infinitely recurse when using verifyDepsBeforeInstall: install and pre/post install scripts that called other pnpm scripts #10060.
Fixed scoped registry keys (e.g., @scope:registry) being parsed as property paths in pnpm config get when --location=project is used #9362.
Remove pnpm-specific CLI options before passing to npm publish to prevent "Unknown cli config" warnings #9646.
Fixed EISDIR error when bin field points to a directory #9441.
Preserve version and hasBin for variations packages #10022.
Fixed pnpm config set --location=project incorrectly handling keys with slashes (auth tokens, registry settings) #9884.
When both pnpm-workspace.yaml and .npmrc exist, pnpm config set --location=project now writes to pnpm-workspace.yaml (matching read priority) #10072.
Prevent a table width error in pnpm outdated --long #10040.
Sync bin links after injected dependencies are updated by build scripts. This ensures that binaries created during build processes are properly linked and accessible to consuming projects #10057.

`v10.18.2`

Compare Source

Patch Changes

pnpm outdated --long should work #10040.
Replace ndjson with split2. Reduce the bundle size of pnpm CLI #10054.
pnpm dlx should request the full metadata of packages, when minimumReleaseAge is set #9963.
pnpm version switching should work when the pnpm home directory is in a symlinked directory #9715.
Fix EPIPE errors when piping output to other commands #10027.

rolldown/rolldown (rolldown)

`v1.0.0-beta.43`

Compare Source

🚀 Features

add filterVitePlugins utility that uses to skip vite plugins using apply: "serve" (#6502) by @IWANABETHATGUY
rolldown_plugin_vite_html: align partial can inline entry logic (#6500) by @shulaoda
rolldown_plugin_vite_html: align get_imported_chunks logic (#6499) by @shulaoda
rolldown_plugin_vite_html: align HtmlTagDescriptor (#6498) by @shulaoda
rolldown_plugin_vite_html: align partial utility functions logic (#6497) by @shulaoda
rolldown_html_vite_html: align partial inject chunk asset links logic (#6496) by @shulaoda
rolldown_plugin_vite_html: align processedHtml logic (#6494) by @shulaoda
add nativeMagicString options (#6469) by @IWANABETHATGUY
rust: eagerly cleanup resources when calling close (#6483) by @hyf0
rust: verify if bundler is closed for public API (#6481) by @hyf0
replace [format] placeholder in chunk filename templates (#6476) by @elecmonkey
implement synchronous JS callback invocation for paths function (#6474) by @IWANABETHATGUY
rolldown_plugin_vite_html: align partial transform hook logic (#6471) by @shulaoda
Support output.paths (#6470) by @IWANABETHATGUY
rolldown_plugin_vite_html: align script urls handle logic (#6466) by @shulaoda
add validation for preserveEntrySignatures with includeDependenciesRecursively option (#6468) by @hyf0
rolldown_plugin_vite_html: align partial logic (#6465) by @shulaoda
background sourcemap generation for Javascript transform hooks (#6293) by @IWANABETHATGUY
rolldown_plugin_vite_html: handle style tag (#6464) by @shulaoda
rolldown_plugin_vite_html: handle inline style attribute (#6463) by @shulaoda
rolldown_plugin_vite_html: partially handle vite-ignore attribute (#6462) by @shulaoda
dev/node: expose errors of on_hmr_updatrs to node (#6454) by @hyf0
dev/node: expose errors of on_output to node (#6453) by @hyf0
dev: expose hmr errors on on_hmr_updatrs callback (#6443) by @hyf0

🐛 Bug Fixes

fallback sourcemap generation for experimental.nativeMagicString: false (#6488) by @IWANABETHATGUY
take resolve.modules into account (#6484) by @Pickachu
rolldown: increase tokio blocking threads size for watch mode (#6467) by @Brooooooklyn
use len_utf16 in magic_string CharToByteMapper (#6461) by @IWANABETHATGUY
pass advancedChunks#includeDependenciesRecursively to rust (#6448) by @hyf0
dev: should compute hmr update correctly for multiple clients (#6442) by @hyf0
allow specifying packageJsonPath in PluginContext.load (#6439) by @sapphi-red
use transform.target as default for minify target when minify: { compress: true } (#6433) by @sapphi-red

🚜 Refactor

extract background sourcemap handling into separate methods (#6501) by @IWANABETHATGUY
rust: only expose methods of Bundler for public usage (#6480) by @hyf0
dev/node: use napi object instead clss for BindingClientHmrUpdate (#6456) by @hyf0
dev/node: improve DevOnHmrUpdates API (#6455) by @hyf0

📚 Documentation

update team page and add acknowledgements page (#6495) by @hyf0
restructure website and files (#6492) by @hyf0
correct incorrect documentation about the config file (#6472) by @jsparkdev
options: experimental.strictExecutionOrder (#6450) by @hyf0
adding why-plugin-hook-filter in depth (#6446) by @IWANABETHATGUY

⚡ Performance

rolldown: replace serde JSON string escape with simd impl (#6475) by @Brooooooklyn

⚙️ Miscellaneous Tasks

docs: redirect removed path to new locations for compatibility (#6493) by @hyf0
deps: lock file maintenance npm packages (#6490) by @renovate[bot]
deps: update github-actions (major) (#6415) by @renovate[bot]
deps: update github-actions (#6489) by @renovate[bot]
rust: add comment for DiagnosticOptions#stabilize_path (#6447) by @hyf0
rust: remove unused BindingHmrOutput (#6457) by @hyf0
rolldown_plugin_vite_html: tweak utils.rs (#6460) by @shulaoda
change node version to lts (#6435) by @iiio2
rust/test: split hmr related structs into their own files (#6445) by @hyf0
deps: update crate-ci/typos action to v1.38.1 (#6452) by @renovate[bot]
rust/test: render hmr errors (#6444) by @hyf0
examples: add "type": "module" in package.json (#6441) by @iiio2

❤️ New Contributors

@Pickachu made their first contribution in #6484
@elecmonkey made their first contribution in #6476
@jsparkdev made their first contribution in #6472

`v1.0.0-beta.42`

Compare Source

🚀 Features

rolldown: oxc v0.94.0 (#6428) by @Boshen
add CLI environment flag (#6426) by @IWANABETHATGUY
dev: use RebuildStrategy#Auto by default (#6420) by @hyf0
rolldown_plugin_vite_html: introduce html plugin state (#6413) by @shulaoda
dev: expose build errors via DevOptions#on_output (#6412) by @hyf0
dev: add binding for DevOptions#rebuild_strategy (#6396) by @hyf0
dev: add RebuildStrategy::Auto to issue rebuild automatically if detecting full reload hmr update (#6395) by @hyf0
debug: inject call_id for renderChunk hook (#6392) by @hyf0
node/dev: add DevEngine#close (#6377) by @hyf0
rust/dev: add DevEngine#close (#6376) by @hyf0

🐛 Bug Fixes

rolldown_plugin_react_refresh_wrapper: register exports in next microtask (#6423) by @sapphi-red
plugin/vite-resolve: try original extension before replacing with TS variants (#6421) by @sapphi-red
node/resolve: take custom package json path into account (#6419) by @hyf0
dev: call watchChange hook (#6403) by @sapphi-red
use minify options for DCE for dce-only minify (#6402) by @sapphi-red
respect package.json type field in plugin-resolved modules (#6400) by @hyf0
returning result of this.resolve in resolveDynamicImport hook impacts bundle size (#6397) by @sapphi-red
rolldown_plugin_json: avoid generating named exports for eval and arguments (#6381) by @sapphi-red
use static property for namespace object (#6383) by @sapphi-red

🚜 Refactor

rust: improve constuction of PackageJson and remove unused fields (#6418) by @hyf0
introduce BindingResult to pass errors from rust to js (#6390) by @hyf0
rust: rename eager_rebuild to rebuild_strategy with enum (#6394) by @hyf0
rust/binding: use BindingError to cover JsError and NativeError (#6388) by @hyf0
rust/binding: rename BindingError to NativeError (#6387) by @hyf0

📚 Documentation

tweak built-in transforms section (#6384) by @sapphi-red

⚡ Performance

dev: avoid frequent setTimeout -> clearTimeout (#6375) by @sapphi-red

🧪 Testing

hmr: include generated bundle for full reloads in snapshots (#6374) by @sapphi-red
dev: add test about doing hmr with not being affected by not executed modules (#6360) by @hyf0
hmr: hmr patch file generation for this.addWatchFile (#5219) by @sapphi-red

⚙️ Miscellaneous Tasks

deps: update crate-ci/typos action to v1.38.0 (#6431) by @renovate[bot]
deps: update crate-ci/typos action to v1.37.3 (#6429) by @renovate[bot]
deps: lock file maintenance npm packages (#6417) by @renovate[bot]
deps: update github-actions (#6414) by @renovate[bot]
rust/test: sensible heading level for build snapshot of config variant (#6408) by @hyf0
rust/test: introduce SnapshotSection to organize snapshot content (#6407) by @hyf0
rust/test: extract ArtifactsSnapshot and BuildRoundOutput into standalone files (#6406) by @hyf0
rust/test: introduce ArtifactsSnapshot to make generating snapshot more clear (#6405) by @hyf0
deps: update crate-ci/typos action to v1.37.2 (#6409) by @renovate[bot]
fix GitHub casing (#6401) by @iiio2
rust: remove unused rolldown_binding_watcher crate (#6386) by @hyf0
deps: update crate-ci/typos action to v1.37.1 (#6391) by @renovate[bot]
node: rename normalizeErrors into aggregateBindingErrorsIntoError (#6389) by @hyf0
fix typos (#6382) by @sapphi-red
deps: update dependency tsdown to v0.15.6 (#6379) by @renovate[bot]
deps: update crate-ci/typos action to v1.37.0 (#6380) by @renovate[bot]
deps: update dependency rolldown-plugin-dts to v0.16.11 (#6378) by @renovate[bot]
add comment to add_watch_file that the path should be a normalized absolute path (#6371) by @sapphi-red
deps: update dependency rolldown-plugin-dts to v0.16.10 (#6373) by @renovate[bot]

rolldown/tsdown (tsdown)

`v0.15.7`

Compare Source

🚀 Features

create-tsdown: Migrate from Gugustinette/create-tsdown - by @sxzz in #535 (df36a)

🐞 Bug Fixes

publint:
- Package dir for workspace - by @sxzz (7ae61)
- With option name - by @sxzz (95550)

View changes on GitHub

vitejs/vite (vite)

`v7.1.10`

Compare Source

Bug Fixes

css: avoid duplicate style for server rendered stylesheet link and client inline style during dev (#20767) (3a92bc7)
css: respect emitAssets when cssCodeSplit=false (#20883) (d3e7eee)
deps: update all non-major dependencies (879de86)
deps: update all non-major dependencies (#20894) (3213f90)
dev: allow aliases starting with // (#20760) (b95fa2a)
dev: remove timestamp query consistently (#20887) (6537d15)
esbuild: inject esbuild helpers correctly for esbuild 0.25.9+ (#20906) (446eb38)
normalize path before calling fileToBuiltUrl (#20898) (73b6d24)
preserve original sourcemap file field when combining sourcemaps (#20926) (c714776)

Documentation

correct WebSocket spelling (#20890) (29e98dc)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20923) (a5e3b06)

webpack/webpack (webpack)

`v5.102.1`

Compare Source

Fixes

Supported extends with env for browserslist
Supported JSONP fragment format for web workers.
Fixed dynamic import support in workers using browserslist.
Fixed default defer import mangling.
Fixed default import of commonjs externals for SystemJS format.
Fixed context modules to the same file with different import attributes.
Fixed typescript types.
Improved import.meta warning messages to be more clear when used directly.
[CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

bolt-new-by-stackblitz · 2025-08-04T03:31:46Z

Run & review this pull request in StackBlitz Codeflow.

pkg-pr-new · 2025-08-04T03:32:26Z

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-vue@188

commit: da4a785

socket-security · 2025-08-08T05:13:39Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
esbuild@0.25.10 ⏵ 0.25.11	⁺⁷	⁺¹	⁺¹
rolldown@1.0.0-beta.43
@farmfe/cli@2.0.0-nightly-20250411100807 ⏵ 2.0.0-nightly-20250827162746	^-2	^-1
rimraf@6.0.1
@farmfe/core@2.0.0-nightly-20250411141103 ⏵ 2.0.0-nightly-20250827162746	^-2	^-1	⁺²
@types/node@24.7.0 ⏵ 24.7.2
prettier@3.6.2
core-js@3.45.1 ⏵ 3.46.0	⁺¹	⁺¹
sass@1.93.2
rollup@4.52.4

View full report

renovate bot added the dependencies label Aug 4, 2025

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 7340f05 to 1f546ae Compare August 5, 2025 06:37

renovate bot changed the title ~~fix(deps): update all non-major dependencies~~ chore(deps): update dependency @farmfe/core to v2.0.0-nightly-20250729025629 Aug 5, 2025

renovate bot force-pushed the renovate/all-minor-patch branch from 1f546ae to 77445f6 Compare August 5, 2025 06:39

sxzz force-pushed the main branch from 8cbbbec to 106a187 Compare August 5, 2025 07:59

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 8437f2f to 7d3db18 Compare August 5, 2025 10:23

renovate bot changed the title ~~chore(deps): update dependency @farmfe/core to v2.0.0-nightly-20250729025629~~ chore(deps): update all non-major dependencies Aug 5, 2025

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d51daac to 594d842 Compare August 7, 2025 09:05

renovate bot changed the title ~~chore(deps): update all non-major dependencies~~ fix(deps): update all non-major dependencies Aug 7, 2025

renovate bot force-pushed the renovate/all-minor-patch branch from 594d842 to d6b2f11 Compare August 8, 2025 05:13

renovate bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from 5264693 to ebfd8b3 Compare August 13, 2025 03:02

renovate bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 659f349 to 8943c1f Compare October 6, 2025 16:05

renovate bot changed the title ~~fix(deps): update all non-major dependencies~~ chore(deps): update all non-major dependencies to v2.0.0-nightly-20250827162746 Oct 6, 2025

sxzz force-pushed the main branch from d72a843 to d0ff2cc Compare October 6, 2025 16:06

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from e399d02 to a0b56bd Compare October 6, 2025 18:34

renovate bot changed the title ~~chore(deps): update all non-major dependencies to v2.0.0-nightly-20250827162746~~ chore(deps): update all non-major dependencies Oct 6, 2025

renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 5cb18b1 to d286b0b Compare October 14, 2025 00:48

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 5b694a5 to d6c9e95 Compare October 14, 2025 15:11

renovate bot changed the title ~~chore(deps): update all non-major dependencies~~ fix(deps): update all non-major dependencies Oct 14, 2025

fix(deps): update all non-major dependencies

da4a785

renovate bot force-pushed the renovate/all-minor-patch branch from d6c9e95 to da4a785 Compare October 15, 2025 02:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(deps): update all non-major dependencies #188

fix(deps): update all non-major dependencies #188

renovate bot commented Aug 4, 2025 •

edited

Loading

Uh oh!

bolt-new-by-stackblitz bot commented Aug 4, 2025

Uh oh!

pkg-pr-new bot commented Aug 4, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Aug 8, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

fix(deps): update all non-major dependencies #188

Are you sure you want to change the base?

fix(deps): update all non-major dependencies #188

Conversation

renovate bot commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

⚙️ Miscellaneous Tasks

❤️ New Contributors

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

🚀 Features

🐞 Bug Fixes

Bug Fixes

Documentation

Miscellaneous Chores

Fixes

Configuration

Uh oh!

bolt-new-by-stackblitz bot commented Aug 4, 2025

Uh oh!

pkg-pr-new bot commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Aug 4, 2025 •

edited

Loading

pkg-pr-new bot commented Aug 4, 2025 •

edited

Loading

socket-security bot commented Aug 8, 2025 •

edited

Loading