Skip to content

Repository navigation

chore(deps): update all non-major dependencies - #424

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#424
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@oxlint/plugins (source) ^1.87.0 → ^1.91.0 age confidence pnpm.catalog.default minor 1.92.0
@tanstack/query-core (source) ^5.104.5 → ^5.106.1 age confidence pnpm.catalog.default minor 5.107.1 (+1)
@vitejs/plugin-react (source) ^6.1.2 → ^6.2.1 age confidence pnpm.catalog.default minor
@vue/language-core (source) ^3.3.13 → ^3.3.14 age confidence pnpm.catalog.default patch
eslint (source) ^10.13.0 → ^10.14.0 age confidence pnpm.catalog.default minor
globals ^17.13.0 → ^17.14.0 age confidence pnpm.catalog.default minor
nx (source) 24.0.2 → 24.0.4 age confidence pnpm.catalog.default patch 24.0.5
oxfmt (source) ^0.72.0 → ^0.76.0 age confidence pnpm.catalog.default minor 0.77.0
oxlint (source) ^1.87.0 → ^1.91.0 age confidence pnpm.catalog.default minor 1.92.0
oxlint-tsgolint ^7.0.2003 → ^7.0.2006 age confidence pnpm.catalog.default patch
pnpm (source) 12.14.0 → 12.18.0 age confidence packageManager minor
pnpm (source) >=12.14.0 → >=12.18.0 age confidence engines minor
semver ^7.8.5 → ^7.8.6 age confidence pnpm.catalog.default patch
tsdown (source) ^0.23.1 → ^0.23.5 age confidence pnpm.catalog.default patch 0.23.7
typescript-eslint (source) ^8.72.0 → ^8.72.1 age confidence pnpm.catalog.default patch
vite (source) ^8.3.4 → ^8.3.6 age confidence pnpm.catalog.default patch
vitest (source) ^5.0.5 → ^5.1.0 age confidence pnpm.catalog.default minor
vue (source) ^3.5.44 → ^3.5.45 age confidence pnpm.catalog.default patch
zizmorcore/zizmor-action v0.8.0 → v0.8.1 age confidence action patch

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

TanStack/query (@​tanstack/query-core)

v5.106.1

Compare Source

No changes in this release.

v5.106.0

Compare Source

No changes in this release.

v5.105.3

Compare Source

Patch Changes

  • #​11537 3f4de1b - Prevent a cancelled retry from pausing the query when its retry delay expires.

  • #​12497 969e580 - Allow static queries without data to refetch after reset, invalidation, or an explicit refetch. A query is static only when it has data.

v5.105.2

Compare Source

Patch Changes

  • #​10969 2ee2fd9 - Fix infinite queries to respect a reduced maxPages limit when fetching in either direction.

  • #​12480 8d0dc27 - Exclude status from the filters accepted by QueryClient.isMutating, useIsMutating, and injectIsMutating. These APIs always count mutations with status: 'pending'.

  • #​12442 e69cac6 - Handle the rejection of a paused refetch started by refetchQueries with throwOnError, so cancelling it later no longer causes an unhandled CancelledError.

  • #​12447 f2215d2 - Use () => void instead of the DOM-only VoidFunction type in addConsumeAwareSignal, so the published declarations type-check without the DOM lib.

  • #​10777 86e7957 - Fix shallowEqualObjects to compare own property keys and values and ignore inherited properties. Objects with different own keys now compare as unequal, including when the differing values are undefined.

  • #​12489 b6576b3 - Keep all callers of an in-flight query waiting for the replacement fetch when invalidation cancels it, including after repeated invalidations.

  • #​12481 af0e0ef - Prevent cancelled streamed queries from writing to the cache or starting a delayed stream, even when the stream does not consume the abort signal.

  • #​11788 05d9b6a - Clear isPaused on a mutation that can start once its onMutate resolves, so it is no longer dehydrated and resumed a second time while its request is in flight.

v5.105.1

Compare Source

Patch Changes

  • #​12406 6f8a48d - Reduce temporary allocations when checking tracked result properties for observer notifications.

  • #​12390 18e54bf - Exclude fetchStatus from the filters accepted by QueryClient.isFetching, useIsFetching, and injectIsFetching. These APIs always count queries with fetchStatus: 'fetching'.

v5.105.0

Compare Source

No changes in this release.

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.2.1

Compare Source

Fix refreshInclude and refreshExclude options not working (#​1543)

Fix mistake from #​1516

v6.2.0

Compare Source

Add refreshInclude and refreshExclude options (#​1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#​1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#​1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

vuejs/language-tools (@​vue/language-core)

v3.3.14

Compare Source

language-core
  • fix: isolate template virtual code from setup control flow (d31557b)
  • fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)
  • fix: avoid TS2454 from the withDotValue assertion (c774144)
  • fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)
  • fix: avoid never slot props for dynamic slot names in generic components (7957e7f)
  • fix: omit emitted events from inherited attrs of generic components (2d94d89)
  • fix: check bindings of generic directive hooks (0cb7d92)
  • fix: wrap the v-model assignment target in parentheses (9bb1dc9)
  • fix: type the $event parameter of inline handlers explicitly (d3b42a1)
  • fix: type unknown components without diagnostic filters (b3909a3)
  • fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)
  • fix: declare component context vars before slot code (b7c773d)
  • fix: avoid non-null assertion in JS slot codegen (5633525)
  • fix: restore tag navigation for barrel imports (6358d15)
  • fix: map the whole hyphenated directive name in the auto-import access (beb0151)
language-service
  • fix: prevent crash on malformed html.customData configuration (3961653)
typescript-plugin
  • fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @​johnsoncodehk, @​lazerg, @​ValentinYoushkevich, @​so1ve, @​WangKepeople

eslint/eslint (eslint)

v10.14.0

Compare Source

Features

  • d23a7f9 feat: fix property descriptor handling in func-name-matching (#​21400) (xbinaryx)

Bug Fixes

Documentation

  • 0f94f47 docs: remove zh-hans from docs language switcher (#​21437) (lumir)
  • dab466e docs: Update README (GitHub Actions Bot)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#​21452) (Pixel)
  • 7697550 docs: Update README (GitHub Actions Bot)
  • 0c699d5 docs: Remove Tidelift commercial support (#​21416) (Milos Djermanovic)
  • 0880666 docs: update loadESLint() documentation for v10 (#​21374) (Minseon Kim)
  • e06fe87 docs: Revise AI acknowledgment options in PR template (#​21414) (Nicholas C. Zakas)

Chores

  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#​21462) (Francesco Trotta)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#​21450) (renovate[bot])
  • a031c40 chore: update ecosystem plugins (#​21445) (ESLint Bot)
  • 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#​21429) (Milos Djermanovic)
  • 276021d chore: update github/codeql-action action to v4.39.0 (#​21432) (renovate[bot])
  • 449724e chore: update ecosystem plugins (#​21420) (ESLint Bot)
  • 8ffeb8c chore: update dependency prettier to v3.9.10 (#​21417) (renovate[bot])
sindresorhus/globals (globals)

v17.14.0

Compare Source

nrwl/nx (nx)

v24.0.4

Compare Source

24.0.4 (2026-11-03)

🩹 Fixes
  • angular-rspack: respect component style minification (#​37722, #​37713)
  • core: stop findImports when the jsx lexer stalls on multi-byte chars (#​37695, #​37687)
  • core: prune task results before hash planning (#​37714)
  • core: keep cache restores and stores inside task outputs (#​37661)
  • core: harden git handling in nx import (#​37663)
  • core: verify and pin the nx versions that init and configure-ai-agents install (#​37665)
  • core: keep nx cloud credentials and task arguments out of analytics and urls (#​37667)
  • core: only serve the graph to local same-origin requests (#​37668)
  • core: hash uncovered node_modules reads and keep env out of runtime input logs (#​37670)
  • core: remove the duplicate redactUrlCredentials import (#​37733)
  • js: include yarn patch checksum in the external node hash (#​37709)
  • js: keep a workspace-root rootDir through the typescript plugin tsconfig cache (#​37701, #​37700)
  • linter: correct converted eslint report paths and cache inferred reports (#​37677, #​37610)
  • maven: only apply build state paths inside the workspace or build directory (#​37671)
  • misc: patch HTTP, XML and archive dependencies (#​37693)
  • misc: widen picomatch dependency from 4.0.4 to ^4.0.7 (#​37698)
  • release: treat git and commit-derived input as data in nx release (#​37666)
❤️ Thank You

v24.0.3

Compare Source

24.0.3 (2026-10-30)
🩹 Fixes
  • angular-rspack: print diagnostic positions and full warning text (#​37637, #​37431)
  • core: fix entryWhenNoChanges from adding empty lines to changelogs (#​36516)
  • core: detect package manager from workspace root in pnpm workspaces (#​35003, #​32579)
  • core: resolve workspace-provided packages from the workspace root (#​37272)
  • core: recover project dependencies after configuration errors (#​37611)
  • core: fail run-commands tasks whose command cannot start (#​37628)
  • core: report continuous dependency inputs in nx show target --json (#​37649)
  • core: report skipped tasks and count summaries against the run total (#​37626)
  • core: load angular.json projects for nx executors converted to builders (#​37645, #​33651)
  • core: keep claude md nx block that imports agents md (#​37646)
  • core: honor NO_PROXY forms and NODE_EXTRA_CA_CERTS in readyWhen url probes (#​37676)
  • core: support pnpm global virtual store installs in nx migrate (#​37653, #​37392)
  • core: recover from native cache load failures (#​37652)
  • core: bump undici to 7.30.1 to patch security advisories (#​37685, #​37331)
  • dotnet: pass configuration parameter for dotnet test and clean (#​36222)
  • graph: reset graph on external select all (#​36944)
  • graph: use current nx brand favicon in graph client (#​37655)
  • js: keep root tsconfig references to non-project tsconfig files (#​37266)
  • js: exclude node_modules from tailwind dependency glob patterns (#​37657, #​37343)
  • linter: reuse the project graph under bun lint (#​37641)
  • misc: read nx.dev agent skills from generated/.agents/skills (#​37681)
  • nextjs: make inferred build depend on dependency typecheck in ts solution setups (#​37647, #​36757)
  • nx-cloud: hand the nx-cloud bin's command line to the bundle's runCLI (#​37605)
  • nx-cloud: declare nx logout's URL argument and --all (#​37579)
  • nx-plugin: keep create-package e2e package managers consistent (#​37651)
  • rspack: warn when the ignored transformers option is set (#​37643, #​36875)
  • testing: exclude all generated jest config extensions from the production named input (#​37070, #​36978)
  • testing: make atomized jest targets run only their own test file (#​37625)
  • webpack: convert webpack configs of projects served by the js node executor (#​37644, #​36389)
❤️ Thank You
oxc-project/oxc (oxfmt)

v0.76.0: oxfmt v0.76.0

Compare Source

💥 BREAKING CHANGES
  • 296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#​28273) (Yuji Sugiura)
🚀 Features
  • 336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#​28389) (Yuji Sugiura)
  • 0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#​28388) (Yuji Sugiura)
  • 44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#​28272) (Yuji Sugiura)
  • 36e5ddb oxfmt: Add debug span for reading files (#​28204) (leaysgur)
🐛 Bug Fixes
  • dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#​28710) (Yuji Sugiura)
  • fef809a formatter_htmlish: Handle XHTML (#​28703) (leaysgur)
  • f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#​28382) (Yuji Sugiura)
  • fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#​28381) (Yuji Sugiura)
  • e738dae formatter: Quote keys added in an HTML event handler with single quotes (#​28380) (Yuji Sugiura)
  • 2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#​28379) (Yuji Sugiura)
  • f00862b formatter: Keep parens around a generic function type in a type assertion (#​28173) (vidigoat)
  • 9ead5c4 formatter: Handle this.b and super.b like foo.b (#​28200) (leaysgur)
  • 72a54cf formatter: Break parens of (a + b)[c] like (a + b).c (#​28199) (leaysgur)
  • b8f4f34 formatter: Print x.b and x.#b samely (#​28193) (leaysgur)
  • 9ddccb7 formatter: Keep parens for private field (#​28188) (leaysgur)
⚡ Performance
  • b6f1ac9 formatter_markdown: Bump parser to 0.0.4 and skip unread work (#​28713) (leaysgur)
  • 633ee96 formatter_css: Use u32 spans (#​28708) (leaysgur)
  • f680ee1 formatter_yaml: Use multiline flag for flow scalars (#​28707) (leaysgur)
  • ff7c203 formatter_css: Avoid repeated scans and allocations in values (#​28706) (leaysgur)
  • 7cd46cb formatter_htmlish: Search script end tags by < in embedded (#​28704) (leaysgur)
  • 46f8efd formatter_graphql: Print block string lines borrowed from the source (#​28701) (leaysgur)
  • dce1485 formatter_htmlish: Skip escaping attr values without the chosen quote (#​28700) (leaysgur)
  • e9392c8 formatter_core: Search line terminators with memchr (#​28699) (leaysgur)
  • ceb26be formatter_htmlish: Use char to escape attr quotes (#​28697) (leaysgur)
  • 8239dac parser: Replace dragonbox_ecma with zmij_ecma (#​28282) (Boshen)
📚 Documentation
  • 303d9e8 formatter: Strengthen start-token-no-double-parens rationale (#​28711) (Yuji Sugiura)
  • a82ce83 oxfmt: Update unclassified divergence (#​28685) (Yuji Sugiura)
  • 7f18c20 formatter_htmlish: Note class and srcset are formatted with embeddedLanguageFormatting: off (#​28465) (Yuji Sugiura)
  • 01ed68a oxfmt,formatter_htmlish,formatter: Clean up behavior comments (#​28384) (Yuji Sugiura)
  • a363c27 formatter_css,formatter_yaml: Point parser citations at AGENTS.md (#​28466) (Yuji Sugiura)
  • 6586050 formatter_core: Document tab width in text width policy (#​28393) (leaysgur)
  • 49fbffb formatter_core: Tighten FORMATTER_POLICY (#​28206) (leaysgur)

v0.75.0: oxfmt v0.75.0

Compare Source

🐛 Bug Fixes
  • 5042019 formatter: Keep fill layout for array with comment after [ (#​28170) (leaysgur)
  • 9d37ff6 formatter: Use position-based comment checks for concise arrays (#​28169) (leaysgur)
  • 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#​28103) (vidigoat)
  • 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#​28168) (leaysgur)
  • a5314a1 formatter: Keep ; before in and instanceof class members (#​28166) (leaysgur)
  • 3a56e7c formatter: Keep closing HTML comments at the start of a line (#​28064) (Cameron)
  • 23d23d6 formatter_markdown: Honor range ignore inside directives (#​28164) (leaysgur)
  • 5f1fd3d formatter: Measure width heuristics by display width (#​28098) (leaysgur)
  • a5a52cf formatter: Keep parens around private in expressions (#​28096) (leaysgur)
  • 999496e formatter: Measure a short key by its display width (#​28026) (vidigoat)
  • 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#​28025) (vidigoat)
  • 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#​27989) (leaysgur)
  • eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#​27987) (leaysgur)
⚡ Performance
  • 1ed93af data_structures: Copy short strings without a memcpy call (#​27953) (leaysgur)
  • 7948f0b formatter_core: Shrink FormatElement to 16B (#​28012) (leaysgur)
  • 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#​27963) (leaysgur)
📚 Documentation

v0.74.0: oxfmt v0.74.0

Compare Source

🐛 Bug Fixes
  • e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#​27957) (leaysgur)
  • 782ab6e linter: Search string values without UTF-8 conversion (#​26716) (Dunqing)
  • a5d8184 jsdoc: Parse code spans after quotes in descriptions (#​27955) (leaysgur)
  • 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#​27948) (leaysgur)
  • 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#​27947) (leaysgur)
  • 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#​27946) (leaysgur)
  • c22a9b2 formatter: Treat static block with only empt

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@changeset-bot

changeset-bot Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: eecc0ea

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

@nx-cloud

nx-cloud Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.

View your CI Pipeline Execution ↗ for commit eecc0ea

Command Status Duration Result
nx affected --targets=test:sherif,test:docs,tes... ❌ Failed 13s View ↗
nx run-many --target=build ✅ Succeeded 6s View ↗

☁️ Nx Cloud last updated this comment at 2026-11-08 14:47:29 UTC

@coderabbitai

coderabbitai Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 0b51b191-13a7-48fd-bc22-4f38745e867a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@pkg-pr-new

pkg-pr-new Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
@tanstack/eslint-config

npm i https://pkg.pr.new/@tanstack/eslint-config@424

@tanstack/oxfmt-config

npm i https://pkg.pr.new/@tanstack/oxfmt-config@424

@tanstack/oxlint-config

npm i https://pkg.pr.new/@tanstack/oxlint-config@424

@tanstack/publish-config

npm i https://pkg.pr.new/@tanstack/publish-config@424

@tanstack/typedoc-config

npm i https://pkg.pr.new/@tanstack/typedoc-config@424

@tanstack/vite-config

npm i https://pkg.pr.new/@tanstack/vite-config@424

commit: eecc0ea

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from a2b0f46 to d97ff5a Compare October 26, 2026 13:37
@socket-security

socket-security Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednx@​24.0.2 ⏵ 24.0.46610092 +1100100
Updatedtypescript-eslint@​8.72.0 ⏵ 8.72.11001007498100
Updated@​tanstack/​query-core@​5.104.5 ⏵ 5.107.196 +110076 +198 +1100
Updatedvitest@​5.0.5 ⏵ 5.1.098 +110079 +199100
Updatedvite@​8.3.5 ⏵ 8.3.6991008298100
Updatedglobals@​17.13.0 ⏵ 17.14.010010086 +191 -4100
Updatedoxfmt@​0.72.0 ⏵ 0.76.09410088 +195 -1100
Updatedtsdown@​0.23.1 ⏵ 0.23.798 +110088 +197 +2100
Updatedvue@​3.5.44 ⏵ 3.5.459910091 +198 +1100
Updated@​vitejs/​plugin-react@​6.1.2 ⏵ 6.2.1100 +1100100 +195100
Updatedeslint@​10.13.0 ⏵ 10.14.097 +110010095 -1100
Updated@​vue/​language-core@​3.3.13 ⏵ 3.3.14100100100 +197 +3100

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from d6f9b2f to cef273d Compare November 2, 2026 21:35
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 3ef5c9c to 88fc800 Compare November 3, 2026 01:46
@renovate
renovate Bot requested a review from a team as a code owner November 3, 2026 01:46
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from aeb2cb9 to a3c5659 Compare November 5, 2026 14:59
@socket-security

socket-security Bot commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
Low adoption: npm @yuku-toolchain/darwin-arm64

Location: Package overview

From: pnpm-lock.yaml → npm/tsdown@0.23.7 → npm/@yuku-toolchain/darwin-arm64@0.27.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/darwin-arm64@0.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Low adoption: npm @yuku-toolchain/darwin-x64

Location: Package overview

From: pnpm-lock.yaml → npm/tsdown@0.23.7 → npm/@yuku-toolchain/darwin-x64@0.27.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/darwin-x64@0.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Low adoption: npm @yuku-toolchain/linux-arm64

Location: Package overview

From: pnpm-lock.yaml → npm/tsdown@0.23.7 → npm/@yuku-toolchain/linux-arm64@0.27.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/linux-arm64@0.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Low adoption: npm @yuku-toolchain/win32-arm64

Location: Package overview

From: pnpm-lock.yaml → npm/tsdown@0.23.7 → npm/@yuku-toolchain/win32-arm64@0.27.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/win32-arm64@0.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Low adoption: npm @yuku-toolchain/win32-x64

Location: Package overview

From: pnpm-lock.yaml → npm/tsdown@0.23.7 → npm/@yuku-toolchain/win32-x64@0.27.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/win32-x64@0.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 140edf7 to e351a25 Compare November 8, 2026 00:10
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from e351a25 to 29cb346 Compare November 8, 2026 02:34
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 29cb346 to eecc0ea Compare November 8, 2026 14:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants