Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@swissquote/crafty	1.29.0 → 1.30.1			devDependencies	minor
@swissquote/crafty-preset-eslint	1.29.0 → 1.30.1			devDependencies	minor
@swissquote/crafty-preset-images-simple	1.29.0 → 1.30.1			devDependencies	minor
@swissquote/crafty-preset-postcss	1.29.0 → 1.30.1			devDependencies	minor
@swissquote/crafty-runner-gulp	1.29.0 → 1.30.1			devDependencies	minor
node	22.22.3-alpine → 22.23.1-alpine			final	minor
sharp (source, changelog)	^0.34.0 → ^0.35.0			dependencies	minor	0.35.3
yarn (source)	4.16.0 → 4.17.0			packageManager	minor

---

Release Notes

swissquote/crafty (@​swissquote/crafty)

v1.30.1: 1.30.1

Compare Source

Bug fixes

• Fixed crafty cssLint crashing with ERR_MODULE_NOT_FOUND for resolve-from when upgrading to 1.30.0. The package was declared only as a devDependency in crafty-preset-stylelint and resolved at runtime only when hoisted transitively by another package in the consumer's tree. It is now vendored directly into crafty-preset-stylelint, matching the pattern already used by crafty-preset-eslint (#​3175).

Tool updates

• Vitest: 4.1.7 → 4.1.8

Full changelog

v1.30.0...v1.30.1

v1.30.0

Compare Source

Vitest support

Crafty now ships @swissquote/crafty-preset-vitest, a first-class preset for running tests with Vitest as an alternative to Jest (#​3110).

It follows the same patterns as crafty-preset-jest: crafty test is the single entry point, crafty ide generates the IDE-facing config, and crafty test --coverage produces LCOV output and a SonarQube-compatible test execution report out of the box.

Crafty supports exactly one active test runner per project. If both Jest and Vitest presets are configured, Crafty will fail with a clear error.

ESLint 10

crafty-preset-eslint and eslint-plugin-swissquote have been migrated from ESLint 9 to ESLint 10 (#​3076).

ESLint 10 release notes

Bug fixes

• Fixed crafty watch crash (minimatch_1.default is not a function) in the TypeScript + webpack + fork-ts-checker path. The minimatch wrapper is now exported correctly as a callable default (#​3132).
• Fixed crafty watch crash (stream.push() after EOF) when using crafty-preset-postcss + crafty-runner-gulp (#​3161).
• Restored the init() feature in PostCSS's Processor configuration that was inadvertently dropped during the ESM conversion (#​3151).
• Fixed a Stylelint rule that was not correctly matching CSS property names (#​3127).

Internal

• Removed ts-loader from the Rspack runner; TypeScript is now handled directly by the SWC-based Rspack transform (#​3149).
• Several internally-bundled package forks converted to ESM, and parts of the PostCSS loader made async to support ESM PostCSS plugins (#​3114).
• Added a build benchmark suite (#​3156).
• Security update for the tmp dependency (#​3148).
• Yarn upgraded to 4.15.0.

Tool updates

• ESLint: 9.39.4 → 10.4.1
• typescript-eslint: 8.59.3 → 8.60.1
• webpack: 5.106.2 → 5.107.2
• Rspack: 2.0.2 → 2.0.6
• Vitest: introduced at 4.1.7
• babel: 7.29.0 → 7.29.7
• SWC: 1.15.33 → 1.15.40
• postcss: 8.5.14 → 8.5.15

Thanks for the bug reports and contributions

Thanks to @​AndreySushkovich for the vitest contribution and to @​saniaBarish, Georgios Andreas Nellas, and Quentin Walter for the extensive tests and reproducible bug reports

Full changelog

v1.29.0...v1.30.0

nodejs/node (node)

v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

Commits

• [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #​63940
• [eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #​64004

v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
• (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
• (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
• (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
• (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
• (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
• (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
• (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
• (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
• (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
• (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

• [38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
• [ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
• [ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #​63711
• [a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #​62891
• [0f48583512] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #​62891
• [38c869fc05] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #​61136
• [290667c84f] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #​59790
• [c9f3da76aa] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #​58786
• [60890be563] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #​57269
• [5024c7d5d8] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #​63820
• [7f4eb5af2e] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #​63820
• [ebb4ec78a8] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #​62656
• [5763d40826] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #​63045
• [c551a51d0c] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
• [0a22d40180] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
• [c79968e108] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
• [0c37bff2ff] - http2: fix DEP0194 message (KaKa) #​58669
• [ea5dc6b529] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #​58293
• [9b6af26132] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
• [28dcd38864] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
• [2f62693801] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
• [1662a3ea09] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
• [718d5d0e2c] - test: skip test-fs-utimes-y2K38 on armv7 (Richard Lau) #​63836
• [041185b61f] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #​62238
• [fd890ba01d] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
• [39d1d09684] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
• [2197a47144] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

lovell/sharp (sharp)

v0.35.2

Compare Source

v0.35.1

Compare Source

• TypeScript: Ensure type definitions are published for both ESM and CJS.
  #​4537

• WebAssembly: Ensure wrapper file is published.
  #​4538

v0.35.0

Compare Source

• Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

• Breaking: Remove install script from package.json file.
  Compiling from source is now opt-in via the build script.

• Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

• Breaking: Add limitInputChannels with a default value of 5.

• Breaking: Remove deprecated failOnError constructor property.

• Breaking: Remove deprecated paletteBitDepth from metadata response.

• Breaking: Remove deprecated properties from sharpen operation.

• Breaking: Rename format.jp2k as format.jp2 for API consistency.

• Upgrade to libvips v8.18.3 for upstream bug fixes.

• Remove experimental status from WebAssembly binaries.

• Add prebuilt binaries for FreeBSD (WebAssembly).

• Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

• Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

• Add AVIF/HEIF tune option for control over quality metrics.
  #​4227

• Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps.
  #​4314

• Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer.
  #​4355

• Require prebuilt binaries using static paths to aid code bundling.
  #​4380

• TypeScript: Ensure FormatEnum keys match reality.
  #​4475

• Add margin option to trim operation.
  #​4480
  @​eddienubes

• Ensure HEIF primary item is used as default page/frame.
  #​4487

• Add image Media Type (MIME Type) to metadata response.
  #​4492

• Add withDensity to set output density in EXIF metadata.
  #​4496

• Improve pkg-config path discovery.
  #​4504

• Add WebP exact option for control over transparent pixel colour values.

• Add support for ECMAScript Modules (ESM).
  #​4509
  @​florian-lefebvre

v0.34.5

Compare Source

• Upgrade to libvips v8.17.3 for upstream bug fixes.

• Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

• Support building from source with npm v12+, deprecate --build-from-source flag.
  #​4458

• Add support for BigTIFF output.
  #​4459
  @​throwbi

• Improve error messaging when only warnings issued.
  #​4465

• Simplify ICC processing when retaining input profiles.
  #​4468

v0.34.4

Compare Source

• Upgrade to libvips v8.17.2 for upstream bug fixes.

• Ensure TIFF subifd and OpenSlide level input options are respected (regression in 0.34.3).

• Ensure autoOrient occurs before non-90 angle rotation.
  #​4425

• Ensure autoOrient removes existing metadata after shrink-on-load.
  #​4431

• TypeScript: Ensure KernelEnum includes linear.
  #​4441
  @​BayanBennett

• Ensure unlimited flag is passed upstream when reading TIFF images.
  #​4446

• Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
  #​4451

• Add sharp-libvips rpath for yarn v5 support.
  #​4452
  @​arcanis

yarnpkg/berry (yarn)

v4.17.0: v4.17.0

Compare Source

What's Changed

• Adds support for package map generation by @​arcanis in #​7184
• fix: add catalog settings to yarnrc schema by @​cyphercodes in #​7179
• docs: clarify background job exit codes by @​StantonMatt in #​7167
• fix: explain peer-default dependencies in why by @​StantonMatt in #​7168
• Docs: fix npmMinimalAgeGate default by @​clemyan in #​7181
• feat(plugin-npm): allow npmMinimalAgeGate per npmScope by @​erlandasz in #​7156

New Contributors

• @​cyphercodes made their first contribution in #​7179
• @​StantonMatt made their first contribution in #​7167
• @​erlandasz made their first contribution in #​7156

Full Changelog: https://github.com/yarnpkg/berry/compare/@yarnpkg/cli/4.16.0...@​yarnpkg/cli/4.17.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.