Skip to content

chore(deps): update all non-major dependencies#63

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#63
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@rsbuild/core (source) ^2.0.9 → ^2.0.15 age confidence
@rslib/core (source) ^0.22.0 → ^0.23.0 age confidence
@rslint/core ^0.6.1 → ^0.6.2 age confidence
@rstest/core (source) ^0.10.3 → ^0.10.6 age confidence
@types/node (source) ^24.12.4 → ^24.13.2 age confidence
pnpm (source) 11.5.0 → 11.7.0 age confidence
prettier (source) ^3.8.3 → ^3.8.4 age confidence

Release Notes

web-infra-dev/rsbuild (@​rsbuild/core)

v2.0.15

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.14...v2.0.15

v2.0.14

Compare Source

What's Changed

Performance 🚀
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.13...v2.0.14

v2.0.13

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.12...v2.0.13

v2.0.12

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.11...v2.0.12

v2.0.11

Compare Source

What's Changed

Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.10...v2.0.11

v2.0.10

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.0.9...v2.0.10

web-infra-dev/rslib (@​rslib/core)

v0.23.0

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Other Changes

Full Changelog: web-infra-dev/rslib@v0.22.1...v0.23.0

v0.22.1

Compare Source

What's Changed

Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rslib@v0.22.0...v0.22.1

web-infra-dev/rslint (@​rslint/core)

v0.6.2

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Refactor 🔨
Other Changes

Full Changelog: web-infra-dev/rslint@v0.6.1...v0.6.2

web-infra-dev/rstest (@​rstest/core)

v0.10.6

Compare Source

What's Changed

Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rstest@v0.10.5...v0.10.6

v0.10.5

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rstest@v0.10.4...v0.10.5

v0.10.4

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Refactor 🔨
  • refactor(core): single-source RSTEST_* env-var names by @​fi3ework in #​1387
  • refactor(core, adapters): single-source adapter cache-key & target→env logic by @​fi3ework in #​1384
  • refactor(coverage): single-source provider contract and align collect error handling by @​fi3ework in #​1385
  • refactor(core): single-source reporter map and GitHub Actions detection by @​fi3ework in #​1383
  • refactor(core): single-source test-execution runtime contracts by @​fi3ework in #​1381
  • refactor(browser): deepen core↔browser seam and close browser-mode drift hazards by @​fi3ework in #​1382
  • refactor(core): consolidate runtime primitives (file task-id, env-loader registry, scoped-restore LIFO) by @​fi3ework in #​1379
  • refactor(browser): single-source the runner dispatch method vocabulary by @​fi3ework in #​1380
  • refactor(browser): single-source the snapshot RPC method/args contract by @​fi3ework in #​1377
  • refactor(core): single-source reporter run-count derivation and CLI/init owners by @​fi3ework in #​1374
  • refactor(core): gate global setup once and co-locate run verdict by @​fi3ework in #​1371
  • refactor(core): derive hook registration signatures from RunnerAPI by @​fi3ework in #​1370
  • refactor(core): own runtime-contract grammar for chunk names and worker import hooks by @​fi3ework in #​1366
  • refactor(core, browser): deepen core↔browser seams and dedupe shared primitives by @​fi3ework in #​1362
  • refactor(core): unify dynamic-import resolver across CJS/ESM worker loaders by @​fi3ework in #​1359
  • refactor(browser): drop unused internal browser surface by @​fi3ework in #​1360
  • refactor(core): move internal browser host subpaths under ./internal by @​fi3ework in #​1358
Document 📖
Other Changes

Full Changelog: web-infra-dev/rstest@v0.10.3...v0.10.4

pnpm/pnpm (pnpm)

v11.7.0

Compare Source

Minor Changes

  • Added a new setting frozenStore (--frozen-store) that lets pnpm install run against a package store on a read-only filesystem (e.g. a Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm opens the store's SQLite index.db through the immutable=1 URI — bypassing the WAL/-shm sidecar creation that otherwise fails on a read-only directory — and suppresses every store-write path (the index.db writer and the project-registry write). Pair it with --offline --frozen-lockfile against a fully-populated store. Under the global virtual store, package directories live inside the store, so if the store is missing the build output of a package whose lifecycle scripts are approved (or that has a patch), pnpm fails up front with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD rather than crashing mid-build on a read-only write — seed the store with those builds first. Incompatible with --force and with a configured pnpr server, since both write into the store; the side-effects cache is likewise not written under frozenStore. If the store is missing its content directory, the install fails fast with ERR_PNPM_FROZEN_STORE_INCOMPLETE rather than attempting to initialize it. The read-only immutable=1 open requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes --frozen-store fails with a clear ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE error. Bin-linking also tolerates a read-only store: under the global virtual store a package's bin source lives inside the store, so the chmod that makes it executable would be refused — with EPERM/EACCES, or with EROFS on a genuinely read-only filesystem. That chmod is redundant when the seed already ships its bins executable with a normalized shebang, so it is now skipped in that case, while a non-executable bin (or one still carrying a Windows CRLF shebang) on a read-only store still errors.

  • When pacquet (the Rust port of pnpm) is declared in configDependencies, pnpm now delegates dependency resolution to it too — not just materialization — provided the installed pacquet is new enough to support full resolving installs (>= 0.11.7).

    Previously pacquet only ran in frozen-install mode: pnpm always resolved the dependency graph itself (writing pnpm-lock.yaml) and handed pacquet a finished lockfile to fetch / import / link. With pacquet >= 0.11.7, a non-frozen pnpm install (default isolated nodeLinker, plain install) is delegated to pacquet end-to-end in a single pass — pacquet resolves the manifests, writes the lockfile, and materializes node_modules. pnpm detects the capability from the installed pacquet's version; older pacquet releases keep the resolve-then-materialize split, and add / update / remove still resolve in pnpm (it has to mutate the manifests first). This remains an opt-in preview of the Rust install engine #​11723.

  • Added a new opt-in --batch flag to pnpm publish --recursive that sends all selected packages to the registry in a single PUT /-/pnpm/v1/publish request instead of one request per package. The target registry has to implement the batch publish endpoint (pnpr does); registries that don't are reported with a clear ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED error. The batch is processed all-or-nothing by pnpr: if any package in the batch fails validation, none of the packages are published.

Patch Changes

  • Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

    The fix adds two layers:

    • The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests.
    • The lockfile verification gate (verifyLockfileResolutions) now runs an always-on, policy-independent check that rejects any importer or snapshot dependency alias that is not a valid package name, failing the install early — before any fetch or filesystem work — for every node linker at once.

  • Made shared package child resolution deterministic when the same package is reached through multiple contexts. pnpm now chooses the shallowest occurrence, then importer order, then parent path, instead of letting request timing decide the child context and missing-peer report pnpm/pnpm#12358.

  • Fix garbled summary line after submitting pnpm update -i and pnpm audit --fix -i. The interactive checkbox prompt previously printed every selected choice's full table row (label, current/target versions, workspace, URL) joined by commas, producing a wall of text after pressing Enter. The summary now lists only the selected package names (or vulnerability keys) by setting an explicit short per choice; the in-progress selection UI is unchanged.

  • Prevent pnpm patch-remove from removing files outside the configured patches directory.

  • Fixed pnpm publish ignoring strictSsl: false when publishing to registries with self-signed certificates. The strictSSL option is now forwarded to libnpmpublish / npm-registry-fetch so that strict-ssl=false in .npmrc or strictSsl: false in pnpm-workspace.yaml is respected during publish, the same way it is for pnpm install pnpm/pnpm#12012.

  • Fixed Cannot destructure property 'manifest' of 'manifestsByPath[rootDir]' as it is undefined regression introduced in 11.6.0 when running pnpm add <pkg> outside a workspace on Windows. selectProjectByDir was keying the resulting ProjectsGraph by opts.dir instead of project.rootDir, so downstream manifestsByPath lookups missed when the two paths normalized differently (typically drive-letter casing). [Cannot destructure property 'manifest' of 'manifestsByPath[rootDir]' as it is undefined. pnpm/pnpm#12379](https://redirect.github.com/pnpm/pnpm/issu

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Several devDependency version strings in package.json are bumped, including @rsbuild/core, @rslib/core, @rstest/core, @types/node, and prettier. The packageManager field is updated from pnpm@11.5.0 to pnpm@11.7.0. No source code, exports, or public API declarations are changed.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The PR title 'chore(deps): update all non-major dependencies' accurately describes the main change, which is updating multiple non-major dependency versions in package.json.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description check ✅ Passed The PR description clearly details the dependency updates with version ranges and release notes from Renovate bot, directly matching the changeset.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 3ccac7d to 09e22a6 Compare June 17, 2026 15:54
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 09e22a6 to 5339ed4 Compare June 18, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants