Skip to content

Update all non-major dependencies - #4541

Merged
Hugos68 merged 1 commit into
mainfrom
renovate/all-non-major-dependencies
Jul 28, 2026
Merged

Update all non-major dependencies#4541
Hugos68 merged 1 commit into
mainfrom
renovate/all-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@iconify-json/simple-icons 1.2.90 → 1.2.91 age confidence
@lucide/astro (source) 1.25.0 → 1.27.0 age confidence
@lucide/svelte (source) 1.25.0 → 1.27.0 age confidence
@playwright/test (source) 1.61.1 → 1.62.0 age confidence
@prettier/plugin-oxc (source) 0.2.1 → 0.2.2 age confidence
@sveltejs/kit (source) 2.70.0 → 2.70.1 age confidence
@tanstack/react-start (source) 1.168.30 → 1.168.32 age confidence
astro (source) 7.1.1 → 7.1.3 age confidence
better-auth (source) 1.6.23 → 1.6.25 age confidence
lightningcss 1.32.0 → 1.33.0 age confidence
lucide-react (source) 1.25.0 → 1.27.0 age confidence
oxlint (source) 1.74.0 → 1.75.0 age confidence
package-manager-detector 1.7.0 → 1.8.0 age confidence
playwright (source) 1.61.1 → 1.62.0 age confidence
pnpm (source) 11.14.0 → 11.17.0 age confidence
postcss (source) 8.5.19 → 8.5.23 age confidence
prettier (source) 3.9.5 → 3.9.6 age confidence
react (source) 19.2.7 → 19.2.8 age confidence
react-dom (source) 19.2.7 → 19.2.8 age confidence
satori 0.28.0 → 0.29.0 age confidence
svelte (source) 5.56.6 → 5.56.8 age confidence
tsdown (source) 0.22.9 → 0.22.14 age confidence

Release Notes

lucide-icons/lucide (@​lucide/astro)

v1.27.0: Version 1.27.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

v1.26.0: Version 1.26.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

microsoft/playwright (@​playwright/test)

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}
🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});
New APIs
Browser and Context
  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.
Network
Evaluation
Command line & MCP
Reporters
  • The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:
// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});
Announcements
  • ⚠️ Debian 11 is not supported anymore.
Browser Versions
  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151
  • Microsoft Edge 151
prettier/prettier (@​prettier/plugin-oxc)

v0.2.2

Compare Source

sveltejs/kit (@​sveltejs/kit)

v2.70.1

Compare Source

Patch Changes
  • docs: update links to hooks documentation (#​16417)
TanStack/router (@​tanstack/react-start)

v1.168.32

Compare Source

Patch Changes

v1.168.31

Compare Source

Patch Changes
withastro/astro (astro)

v7.1.3

Compare Source

Patch Changes
  • #​17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

v7.1.2

Compare Source

Patch Changes

  • #​17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #​17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #​17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

better-auth/better-auth (better-auth)

v1.6.25

Compare Source

Patch Changes

v1.6.24

Compare Source

Patch Changes

  • #​10235 03dc5a0 Thanks @​ping-maxwell! - Fixes silent foreign-key and adapter-join misrouting when a user remaps a built-in model name to a string that collides with another schema key

  • #​10357 7508940 Thanks @​c-nicol! - Fixes Kysely migration generation for new-table fields that are both unique: true and index: true.

  • #​10342 bae7198 Thanks @​ping-maxwell! - Fix organization.listMembers failing with "User not found for member" for orgs with more than ~100 members by applying the same membership limit to the users query.

  • #​10336 ef4d273 Thanks @​Tushar-Khandelwal-2004! - Prevent verification callbacks from failing auth requests when cloning the request throws.

  • #​10333 99dbdd7 Thanks @​c-nicol! - Fixes Drizzle schema generation for fields that are both unique: true and index: true.

  • #​10368 086ca91 Thanks @​gaurav0107! - Force-validate the request Origin on the magic-link (/sign-in/magic-link) and email-otp (/email-otp/send-verification-otp) send endpoints, including cookieless requests, to match the built-in /sign-in/email and /sign-up/email routes. A cookieless cross-origin POST can no longer trigger a magic-link or verification-OTP email to an arbitrary address. Cookieless requests that carry no Origin (server-to-server) are unaffected.

  • #​10290 8f2dedd Thanks @​GautamBytes! - Expose the remote MCP auth client's 401 challenge headers to browser clients using CORS.

  • #​10453 4e685ee Thanks @​ping-maxwell! - OpenAPI now includes user.additionalFields and plugin user schema fields (e.g. username plugin username / displayUsername) on /sign-up/email and /update-user request bodies.

  • #​10190 3bf0e49 Thanks @​gaurav-init! - Pass the endpoint context as the second argument to beforeDeleteOrganization and afterDeleteOrganization hooks in the organization plugin, matching the signature shown in the docs and the existing databaseHooks pattern. The Stripe plugin's beforeDeleteOrganization wrapper now forwards the context to user-supplied hooks instead of dropping it.

  • #​10040 f59a0ee Thanks @​shiminshen! - Organization invitations now let the database generate their id when ID generation is delegated to the database (e.g. advanced.database.generateId: "uuid" with a UUID-capable adapter such as Postgres), matching every other model. Previously createInvitation always generated the invitation id in application code, so invitation rows received an app-generated value instead of a database-generated one while organizations, members and teams correctly deferred to the database (better-auth/better-auth#10024). A caller-provided id (e.g. via beforeCreateInvitation) is still honored.

  • #​10302 0f2cc1b Thanks @​momomuchu! - Prefer exact schema-key matches over modelName aliases in getDefaultModelName, so remapping a built-in table onto another table's schema key (e.g. user.modelName = "account") does not reroute internal adapter queries to the wrong table.

  • #​9787 ae78109 Thanks @​ping-maxwell! - Fixes an issue where useSession({ throw: true }) incorrectly excluded null from its data type.

  • #​10222 46d2bf0 Thanks @​ping-maxwell! - fix: add no-store cache-control headers to get-session route

  • #​10316 29a373e Thanks @​vinay-oppuri! - Recognize SQLite BIGINT as a valid number type in migration diffs so database-backed rate limiter columns like lastRequest no longer report spurious pending changes on every run.

  • #​10379 f6d18fa Thanks @​ping-maxwell! - fix(client): restore auth query revalidation and signal listeners after remount

  • #​5753 f23ce50 Thanks @​ping-maxwell! - feat(last-login-method): beforeStoreCookie option for GDPR compliance

  • #​10376 c4d1dda Thanks @​ping-maxwell! - Pass the request endpoint context as a third argument to verifyIdToken, so custom ID token verifiers can read request headers (for example Apple's user-agent requirement).

  • Updated dependencies [6758231, 54fab08, c4d1dda]:

parcel-bundler/lightningcss (lightningcss)

v1.33.0

Compare Source

Added

Fixed

oxc-project/oxc (oxlint)

v1.75.0

Compare Source

🚀 Features
  • dd18383 linter/node: Implement no-top-level-await rule (#​24634) (Connor Shea)
  • 16a65f2 linter/react: Implement function-component-definition rule (#​24471) (Cole Ellison)
  • 7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#​24519) (Mikhail Baev)
  • 99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#​24502) (camc314)
🐛 Bug Fixes
  • 8694167 linter/eslint/prefer-destructuring: Handle typed declarations (#​24616) (camc314)
antfu-collective/package-manager-detector (package-manager-detector)

v1.8.0

Compare Source

   🚀 Features
    View changes on GitHub
pnpm/pnpm (pnpm)

v11.17.0: pnpm 11.17

Compare Source

Minor Changes

  • Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #​13220.

    pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

    Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes

  • The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.

  • Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #​13232.

  • Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #​13164.

  • Revert script ordering change for pnpm run --sequential /regex/

  • Support the from-git argument in the pnpm version command.

  • When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors
Bit
OpenAI
Gold Sponsors
Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.16.0: pnpm 11.16

Compare Source

Minor Changes

  • The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.

  • Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.

  • Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.

  • Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:

    update:
  ignoreDeps: # was updateConfig.ignoreDependencies
    - webpack
    - "@&#8203;babel/*"

audit:
  level: high # was auditLevel
  ignore: # was auditConfig.ignoreGhsas
    - GHSA-xxxx-yyyy-zzzz

    update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

    The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

  • Fixed pnpm add --save-exact/--save-prefix and pnpm update writing a package's version with the peerDependencies range's prefix (e.g. ^19.2.7 instead of the requested 19.2.7) whenever the same package also appeared in peerDependencies. A real dependencies/devDependencies/optionalDependencies entry now takes precedence over a same-named peerDependencies entry when computing the current specifiers #​13108.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Anything related to dependency issues or updates. label Jul 27, 2026
@vercel

vercel Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated (UTC)
plus.skeleton.dev Ignored Ignored Preview Jul 28, 2026 10:00pm
themes.skeleton.dev Ignored Ignored Jul 28, 2026 10:00pm
www.skeleton.dev Ignored Ignored Preview Jul 28, 2026 10:00pm

Request Review

@changeset-bot

changeset-bot Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 9378297

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch 2 times, most recently from 9b63912 to 905eeb3 Compare July 28, 2026 02:57
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 905eeb3 to 9378297 Compare July 28, 2026 22:00
@Hugos68
Hugos68 merged commit 4751fe6 into main Jul 28, 2026
8 checks passed
@Hugos68
Hugos68 deleted the renovate/all-non-major-dependencies branch July 28, 2026 22:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Anything related to dependency issues or updates.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Hugos68