Skip to content

chore(deps): update all non-major dependencies - #875

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#875
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
MatteoGabriele/agentscan-action action minor v2.5.0 → v2.7.0 age confidence
bumpp devDependencies minor 12.2.2 → 12.3.0 age confidence
danielroe/uppt action patch v0.6.9 → v0.6.13 age confidence
html-validate (source) dependencies minor ~11.11.0 → ~11.21.0 age confidence
lint-staged devDependencies minor 17.4.1 → 17.6.0 17.6.1 age confidence
pnpm (source) devEngines.packageManager minor 12.9.1 → 12.21.0 age confidence

Release Notes

MatteoGabriele/agentscan-action

v2.7.0

Compare Source

Detection library update (@​unveil/identity)

Full Changelog: MatteoGabriele/agentscan-action@v.2.6.0...v2.7.0

antfu-collective/bumpp (bumpp)

v12.3.0

Compare Source

   🚀 Features
    View changes on GitHub

v12.2.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
danielroe/uppt

v0.6.13

Compare Source

🩹 Fixes
  • pack: Pack workspaces in dependency order (#​98)
❤️ Contributors

v0.6.12

Compare Source

compare changes

🚀 Enhancements
  • pr: Allow customising release pr title (#​92)
  • Support publishing to multiple dist-tags (#​91)
  • Add support for custom PR preambles (#​83)
❤️ Contributors

v0.6.11

Compare Source

compare changes

🚀 Enhancements
  • Add nightly publishing (#​75)
  • Respect hand-edited release pr versions (00ffbe0)
  • pr: Run on pushes to release branches (800be04)
🩹 Fixes
  • publish: Tolerate E403 when republishing nightlies (3934767)
  • pr: Tighten hand-edited version pinning and surface warnings (113eb4c)
  • pr: Paginate open release PR lookups and keep updating PRs with extra commits (6ec2714)
💅 Refactors
  • Sync lockstep release branches via syncReleaseBranch (c777f2b)
❤️ Contributors

v0.6.10

Compare Source

compare changes

🚀 Enhancements
  • pr: Treat revert commits as release-worthy (#​70)
🩹 Fixes
  • pr,release: Use correct diff link + strip pending timetable line (6959b96)
🏡 Chore
  • Pin README example to v0.6.9 (e01133f)
  • Add back zizmor-ignore comment (83d5a78)
✅ Tests
  • Add some additional tests (d79b75d)
🤖 CI
  • Use pnpm/setup and devEngines (#​64)
  • Replace agentscan action with the github app (511fe92)
❤️ Contributors
html-validate/html-validate (html-validate)

v11.21.1

Compare Source

Bug Fixes
  • rules: skip omitted end tags (1f92180)

v11.21.0

Compare Source

Features
  • api: add getAriaRoles() method to Rule class (b6c3efc)
  • api: add getAriaVersion() method to Rule class (721e669)

v11.20.1

Compare Source

Bug Fixes
  • api: fix missing @html-validate/w3c-data types (741d28a)

v11.20.0

Compare Source

Features
  • api: add Rule.isValidAriaRole() and Rule.getAriaRoleData() helpers (14bf2f7)
  • config: load aria data based on configured aria configuration property (8cce6fb)
Bug Fixes
  • require </p> as last child of <a> and other excluded parents (f98b3b8), closes #​377

v11.19.0

Compare Source

Features
  • rules: improve autofix for element-case (a032674)
  • rules: new option ignoreForeign to element-case (default true) (5e3ce87)
Bug Fixes
  • rules: do not report element-case errors for implicit tags (a8c730e)

v11.18.0

Compare Source

Features
Bug Fixes
  • deps: update dependency ignore to v7.0.13 (bfdcf98)
  • deps: update dependency ignore to v7.0.14 (f5c35f5)
  • html5: validate height attribute on <canvas> (79f51ea), closes #​336
  • html5: validate width attribute on <canvas> (c8d7251), closes #​336

v11.17.0

Compare Source

Features
  • api: add ErrorFixer.renameTag() (68a3454)
  • api: add related to Message for secondary elements (9d76007)
  • dom: add HtmlElement.startTagLocation and endTagLocation (1fae6dc)
  • rules: suggest multiple elements in prefer-native-element (829addd)
Bug Fixes
  • dom: handle quoted strings and whitespace in selector combinators (a23ffa2), closes #​355
  • lexer: match </script> end tag case-insensitively (6b93d63), closes #​375
  • lexer: match </style> end tag case-insensitively (c6e5ee7), closes #​375
  • lexer: match </textarea> end tag case-insensitively (6c75f7a), closes #​375
  • lexer: match </title> end tag case-insensitively (49ef906), closes #​375
  • lexer: match script, style, textarea and title start tags case-insensitively (f4fffd1), closes #​375
  • parser: match html end tags case-insensitively (ededae8), closes #​374
  • parser: match retained svg desc and title end tags case-insensitively (337d006), closes #​375
  • rules: ignore role matching implicit role in prefer-native-element (c7d51af), closes #​373

v11.16.4

Compare Source

Bug Fixes
  • config: disable cache in FlatConfigLoader when configOverride is given (28da344), closes #​369
  • dom: handle empty attribute selector (8a467b9), closes #​356
  • rules: unrecognized-char-ref flags legacy references without semicolon (b467b84), closes #​312
  • rules: report error on <label> when empty or hidden instead of on <input> (8e70f82), closes #​290

v11.16.3

Compare Source

Bug Fixes
  • add @__NO_SIDE_EFFECTS__ annotation to define* helpers for better treeshaking (f44b9b3)
  • html5: allow color attribute on <link> (b0ab7f9)
  • html5: allow fetchpriority attribute on <link> (d04875f)
  • html5: allow hreflang attribute on <link> (13f73c0)
  • html5: allow media attribute on <link> (3b22eb0)
  • html5: allow sizes attribute on <link> (3a99da7)
  • html5: allow type attribute on <link> (0b298e7), closes #​371

v11.16.2

Compare Source

Bug Fixes
  • cli: handle writing formatter output directly to file descriptors (8014966)
  • deps: update dependency ignore to v7.0.11 (c227d47)
  • deps: update dependency ignore to v7.0.12 (b1f84d7)

v11.16.1

Compare Source

Bug Fixes
  • deps: update dependency ignore to v7.0.10 (b3540ce)
  • fix serialization error when jest or vitest worker got an autofixable result (69b9728), closes #​372

v11.16.0

Compare Source

Features
  • api: unified HtmlValidate.autofix() and deprecate all other variants (40c67f0)
  • rules: add minSectioningRootInitialRank option to heading-level (7b9629f)
Bug Fixes
  • deps: update dependency ignore to v7.0.9 (0337345)

v11.15.0

Compare Source

Features
  • api: add new insertTextBefore() and insertTextAfter() methods to ErrorFixer (ac6ca62)

v11.14.0

Compare Source

Features
  • api: add fixableErrorCount and fixableWarningCount to Report object (5bad2dd)
  • api: add fixableErrorCount and fixableWarningCount to Result object (edc169f)
  • cli: stylish and codeframe formatters output number of fixable errors and warnings (6f230fc)
  • deps: support vitest v5 (9bc1709)

v11.13.0

Compare Source

Features
  • api: expose autofixCollectEdits for integrations to support autofix (b7de9fa)

v11.12.0

Compare Source

Features
  • api: add new removeText() method to ErrorFixer (3484ed3)
  • rules: add suggestions to no-redundant-for (6798b9c)
  • rules: make missing-doctype autofixable (2c4c2e7)
  • rules: make no-raw-characters autofixable (b7e28aa)
  • rules: make script-type autofixable (e15cb1a)
  • rules: make tel-non-breaking autofixable (d91bc8c)
Bug Fixes
  • deps: update dependency ignore to v7.0.7 (77151ba)
  • deps: update dependency ignore to v7.0.8 (17b64af)
lint-staged/lint-staged (lint-staged)

v17.6.0

Compare Source

Minor Changes

  • #​1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'

export default defineConfig({
  '*': {
    title: 'Fail if PDF files are committed',
    task: async (filepaths, { log }) => {
      const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
      if (pdfFiles.length > 0) {
        log('PDF files should not be committed: %s', pdfFiles)
        throw new Error('Failed')
      }
    },
  },
})

  • #​1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

  • #​1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

  • #​1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

    import { defineConfig } from 'lint-staged/config'

export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})

  • #​1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

  • #​1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

v17.5.1

Compare Source

Patch Changes

  • #​1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

    A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

v17.5.0

Compare Source

Minor Changes
  • #​1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.
Patch Changes

  • #​1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

  • #​1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

  • #​1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

pnpm/pnpm (pnpm)

v12.21.0: pnpm 12.21

Compare Source

pnpm 12.21.0 lets pnpm store add prepare tarball and git dependencies for offline installs. It also makes repeated installs keep their peer dependency choices and fixes several lockfile.format: v13, nodeLinker: hoisted, and pnpm deploy failures. If a pnpr server refuses a setting, pnpm now resolves locally.

Minor Changes
  • pnpm store add run in a project now prepares downloaded tarballs for every lockfile entry that pins them. Besides registry packages, pnpm install --offline --frozen-lockfile can then install dependencies on a tarball URL and dependencies on a git host such as GitHub whose lockfile entry records an integrity.
Patch Changes
Installs that failed

  • pnpm now reads a lockfile with a mapping key longer than 1,024 characters written as 'key':, without the ? marker. Before, pnpm install and other commands failed on such a lockfile with ERR_PNPM_BROKEN_LOCKFILE.

  • With lockfile.format: v13, pnpm install no longer fails to create or rewrite the lockfile when a package declares many of its dependencies as peers.

  • Fixed pnpm deploy failing with lockfile.format: v13 when injected workspace packages have hashed peer bindings.

  • Frozen installs with v13 lockfiles now accept valid peer dependencies of injected workspace packages that use catalogs.

  • Fixed injected workspace packages that depend on themselves linking to a nonexistent directory.

  • pnpm install with frozenStore enabled no longer fails with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD when nodeLinker is hoisted. pnpm fetch with nodeLinker: hoisted no longer populates global virtual store links or modifies linked agent skills, and it preserves an existing hoisted node_modules directory #​18037.

  • A requirements.txt beside a pyproject.toml that declares [tool.uv.workspace] without a [project] table no longer makes that directory a Python project. pnpm install stopped there with an error when the directory had a .venv that pnpm did not create #​18023.

Peer dependencies

  • Repeated installs no longer change the peer dependency providers that the previous install chose. This covers adding, updating, or removing a dependency, projects that use different ranges of one dependency, dependency cycles, and injected dependencies with autoInstallPeers: false pnpm/tasks#221.

    An unchanged install keeps a valid locked peer provider even when a direct dependency provides another compatible version. Explicit pnpm add and pnpm update requests take precedence over it.

  • Workspace projects that select different versions of a peer provider no longer share one copy of the package that depends on it. This affected peers reached through an aliased dependency or a peer dependency cycle.

  • A removed dependency no longer comes back as a peer provider. Before, a direct dependency removed with autoInstallPeers: false could be restored from an old peer resolution, and a removed one could still supply its old peer context.

  • With nodeLinker: hoisted and autoInstallPeers: false, pnpm install no longer creates duplicate copies of a package whose resolved peers are identical. A package also no longer loads a copy of its dependency that was resolved with different peer versions #​18003.

  • pnpm deploy now binds optional peers declared only in peerDependenciesMeta for linked workspace packages. The deployed manifest and lockfile also retain these peers when filtering dependency groups.

Running scripts

  • Scripts now stop when pnpm's process group is killed while they are starting.

  • Bin shims in the global virtual store no longer include the hoisted modules directory of the project that installed them #​18035.

  • pnpm pipeline now rebuilds local packages and reruns build scripts after it restores a shared Cargo build cache with Cargo 1.100 or newer. Before, a worktree could reuse build-script output from the worktree that created the cache.

pnpr

  • If the pnpr server refuses a setting the install uses, or cannot return the lockfile format pnpm reads, pnpm install and pnpm update print a warning and resolve locally. Cargo and Python resolution also fall back to resolving locally. pnpm now rejects a pnpr resolution of npm dependencies that does not name its lockfile format.

  • pnpm install with pnprServer now limits the size of the server's resolve and lockfile verification responses. An oversized response ends the request with an error.

  • pnpm now displays pnpr error codes and reasons when remote requests fail.

Other commands and settings

  • pnpm setup and the install script now support PowerShell as the login shell on Linux and macOS. They add PNPM_HOME to PATH in profile.ps1 under $XDG_CONFIG_HOME/powershell or ~/.config/powershell #​18026.

  • A lockfileDir setting that points at the default lockfile directory now installs the same way as leaving it unset pnpm/tasks#275.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit Cloudflare

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude Syntax

v12.20.0: pnpm 12.20

Compare Source

pnpm 12.20.0 records the specifiers of local directory dependencies in the experimental v13 lockfile and fixes several nodeLinker: hoisted, peer dependency, and overrides bugs. The bundled node-gyp no longer ships the undici version that security scanners flag. Remote resolution and shared build caches no longer work with pnpr 0.1.0-alpha.19 or older.

Minor Changes
  • With lockfile.format: v13, pnpm install records the dependency specifiers of local directory packages. Frozen installs reject changed specifiers even when the locked versions still satisfy them.
Patch Changes
Upgrading and security

  • Remote resolution, shared build caches, and release notes no longer work with pnpr 0.1.0-alpha.19 or older. pnpm now reads the capabilities a pnpr server advertises under pnpr.protocols. Installs fail when the server does not confirm the requested resolution and verification policies.

  • The node-gyp bundled with pnpm no longer ships undici 6, which security scanners flag for CVE-2026-84947. On Node.js 26, node-gyp downloads through a proxy or with a custom CA file no longer crash with "invalid onError method" #​17941.

Resolving dependencies

  • Version-selector overrides entries such as "ms@^2.0.0": "2.1.1" now apply to dependencies declared with the catalog: protocol when the catalog entry's range matches the selector #​17922.

  • A root overrides entry that points a package at a workspace: path, such as workspace:./packages/foo, now also applies when a registry package depends on that package pnpm/tasks#270.

  • Git dependencies now accept npm's :: separator between fragment parameters, such as github:owner/repo#v1.0.0::path:packages/foo. Before, pnpm read the whole fragment as a branch name and failed to resolve it #​17827.

  • pnpm dedupe now keeps a locked runtime version, from devEngines.runtime or from a dependency's engines.runtime, when the declared range still admits it. pnpm dedupe --check no longer fails each time a newer Node.js release in the range comes out #​17984.

  • With autoInstallPeersFromHighestMatch, conflicting non-semver peer dependencies now remain missing, and identical non-semver peer specifiers are preserved. Preferred registry versions no longer replace local paths or protocol-prefixed specifiers when pnpm installs missing peers pnpm/tasks#272.

Hoisted node linker
  • With nodeLinker: hoisted, a package now keeps its nested copy of a dependency that it resolved at a version other than the top-level one, including a peer dependency its parent supplies. Before, pnpm could remove that copy as a duplicate or give the top-level slot to a peer variant found deeper in the graph. The package then loaded the top-level version.
Lockfile and peer dependency graphs

  • Fixed pnpm install keeping stale peer bindings after dependency changes. Required dependencies no longer remain marked optional when another workspace project removes a shared package pnpm/tasks#221.

  • Repeated installs now keep the same dependency links when packages form cycles with several peer dependency variants pnpm/tasks#221.

  • Fixed writing lockfile.format: v13 for dependency cycles with missing, optional, or transitive peers. Frozen installs also accept unchanged injected packages whose peers use catalogs. With --no-optional, frozen installs reject required catalog children recorded only as optional dependencies pnpm/tasks#221.

  • pnpm deploy preserves an injected workspace package's resolved dependencies when they differ from the workspace project's own dependencies. This also applies to packages with publishConfig.directory pnpm/tasks#221.

Running scripts and runtimes

  • Scripts that pnpm runs in a process group of their own are now ended when pnpm is killed right after starting them. A parallel run that was killed before pnpm registered its scripts left all of them running.

  • When a command name matches no script and pnpm falls back to running it as a command, the install that runs before scripts now runs once. Its errors and warnings print once #​17977.

  • Failed downloads by project-aware global runtime commands now explain which configuration applies. Node.js failures also list the global mirror settings and environment variables to check.

Other commands and settings

  • Fixed pnpm occasionally crashing on the first HTTPS request, mostly on Windows virtual machines under load. pnpm now seeds TLS randomness from the operating system's random number generator pnpm/tasks#239.

  • Fixed pnpm deprecate, pnpm undeprecate, and pnpm unpublish failing with revision conflicts when a registry cache serves stale package metadata.

  • pnpm sbom now reports malformed workspace manifests. Before, it omitted their packages pnpm/tasks#59.

  • Fixed pnpm store status reporting approved builds of git dependencies as modified when the store contains legacy build metadata.

  • pnpm now recognizes Capawesome Cloud and RWX as CI environments.

Platinum Sponsors

config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from danielroe as a code owner September 7, 2026 03:52
@netlify

netlify Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for html-validator ready!

Name Link
🔨 Latest commit 9371789
🔍 Latest deploy log https://app.netlify.com/projects/html-validator/deploys/6af9f60f5fdda1dd98cfc94b
😎 Deploy Preview https://deploy-preview-875--html-validator.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 7f74c57 to 8853482 Compare September 14, 2026 07:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from ddcaa9c to 2aa5221 Compare September 23, 2026 02:23
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 4f2a78f to 9356d8a Compare October 4, 2026 00:33
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from e077c4e to b304af3 Compare October 6, 2026 10:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 4ae347a to a841d10 Compare October 21, 2026 21:27
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from b9417a0 to 189a8f1 Compare October 29, 2026 03:52
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 4074f1d to 7152ebc Compare November 9, 2026 10:22
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from ec67463 to 7fc674f Compare November 10, 2026 07:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe Awaiting requested review from danielroe danielroe is a code owner

Assignees

No one assigned

Labels

chore dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants