chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #386 · nuxt/hints

renovate · 2026-09-21T03:39:59Z

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	`^24.13.4` → `^24.19.0`
@vue/test-utils	`^2.5.0` → `^2.5.1`
devalue	`^5.9.2` → `^5.9.4`
eslint (source)	`^10.10.0` → `^10.11.0`
html-validate (source)	`^11.15.0` → `^11.16.1`
magic-string	`^1.3.1` → `^1.4.2`
oxc-parser (source)	`^0.149.0` → `^0.152.0`
pnpm (source)	`10.34.5+sha512.a4ee05f2f73658255bd6a89859c065a45c28a57daefae2c893a168ee2b73168c37b91e83e57ea67654ad03f03031746430e8bce38e362e042605fb8abc80192e` → `10.34.6`
prettier (source)	`^3.9.6` → `^3.9.9`
sass-embedded	`^1.104.1` → `^1.105.0`
unplugin (source)	`^3.3.0` → `^3.4.0`
vue (source)	`^3.5.42` → `^3.5.43`

Release Notes

vuejs/test-utils (@vue/test-utils)

`v2.5.1`

Compare Source

What's Changed

fix: generic SFC findComponent types by @simonyang08 in #2934
fix: share config across builds by @cexbrayat in #2937

New Contributors

@simonyang08 made their first contribution in #2934

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

sveltejs/devalue (devalue)

`v5.9.4`

Compare Source

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

`v5.9.3`

Compare Source

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
8f8d78e: fix: validate revived backing buffers before constructing typed arrays
46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

eslint/eslint (eslint)

`v10.11.0`

Compare Source

html-validate/html-validate (html-validate)

`v11.16.1`

Compare Source

Bug Fixes

deps: update dependency ignore to v7.0.10 (b3540ce)
fix serialization error when jest or vitest worker got an autofixable result (69b9728), closes #372

`v11.16.0`

Compare Source

Features

api: unified HtmlValidate.autofix() and deprecate all other variants (40c67f0)
rules: add minSectioningRootInitialRank option to heading-level (7b9629f)

Bug Fixes

deps: update dependency ignore to v7.0.9 (0337345)

Rich-Harris/magic-string (magic-string)

`v1.4.2`

Compare Source

Bug Fixes

keep the outro when splitting a removed chunk (#358) (2a665f6)
skip empty matches inside removed content in replaceAll (#359) (2eb0f6f)

Performance Improvements

look up removed content without scanning every chunk (#357) (ca9e867)

`v1.4.1`

Compare Source

Bug Fixes

flush the shared encoder buffer at the end of every drain (#356) (f682ccf)

`v1.4.0`

Compare Source

Bug Fixes

don't resurrect removed content in replace/replaceAll (#352) (c847b0e)

Features

add affinity option to move() (#351) (f849b39)
bundle: add toMagicString() to flatten a Bundle into a MagicString (#353) (3a7c7b0)

Performance Improvements

encode mappings incrementally in generateMap to cut peak memory (#350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

carry trimStart and trimEnd into the outro and intro (#348) (07d2fcb)
preserve inserts anchored to the edges of a removed range (#282) (#349) (bd7ee85)
return an empty slice when the end index resolves to zero (#346) (5531971)
treat moving a range to where it already sits as a no-op (#347) (22ed11b)

1.3.1 (2026-09-10)

`v1.3.2`

Compare Source

Bug Fixes

don't resurrect removed content in replace/replaceAll (#352) (c847b0e)

Features

add affinity option to move() (#351) (f849b39)
bundle: add toMagicString() to flatten a Bundle into a MagicString (#353) (3a7c7b0)

Performance Improvements

encode mappings incrementally in generateMap to cut peak memory (#350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

carry trimStart and trimEnd into the outro and intro (#348) (07d2fcb)
preserve inserts anchored to the edges of a removed range (#282) (#349) (bd7ee85)
return an empty slice when the end index resolves to zero (#346) (5531971)
treat moving a range to where it already sits as a no-op (#347) (22ed11b)

1.3.1 (2026-09-10)

oxc-project/oxc (oxc-parser)

`v0.152.0`

🚀 Features

f585cb4 napi: Add threadless WASI builds (#26898) (Boshen)

🐛 Bug Fixes

5186328 parser: Handle HTML comment values (#22933) (Boshen)

📚 Documentation

d775315 parser: Document AST property order (#27038) (Boshen)

`v0.151.0`

🚀 Features

1fac655 coverage: Support new TypeScript fixture layout (#26226) (camc314)

pnpm/pnpm (pnpm)

`v10.34.6`

Compare Source

prettier/prettier (prettier)

`v3.9.9`

Compare Source

diff

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by @fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

`v3.9.8`

Compare Source

`v3.9.7`

Compare Source

Support Angular 22.2
Fix regressions in v3.9

🔗 Changelog

sass/embedded-host-node (sass-embedded)

`v1.105.0`

Compare Source

Add support for first-class modules. These can be accessed using the new
meta.load() and meta.get-module() functions, and may be passed as the
$module argument to numerous eisting sass:meta functions.
Add the meta.css() mixin, which includes CSS from a first-class module.

JS API

Add a SassModule class and a corresponding Value.assertModule() method.

Dart API

Add a SassModule class and a corresponding Value.assertModule() method.

unjs/unplugin (unplugin)

`v3.4.0`

Compare Source

🐞 Bug Fixes

Add missing optional peer deps - by @sxzz (e499d)
Disallow string filters for resolveId - by @sxzz (b7b5f)

View changes on GitHub

vuejs/core (vue)

`v3.5.43`

Compare Source

Bug Fixes

compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
shared: preserve comment-like text in style values (#15471) (b9456cb)
suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-09-21T03:40:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@types/node@24.13.4 ⏵ 24.19.0		⁺¹	⁺¹
unplugin@3.3.0 ⏵ 3.4.0		⁺¹
oxc-parser@0.149.0 ⏵ 0.152.0		⁺¹	^-1
sass-embedded@1.104.1 ⏵ 1.105.1		⁺¹	^-1
@vue/test-utils@2.5.0 ⏵ 2.5.1	⁺¹	⁺¹	⁺²
devalue@5.9.2 ⏵ 5.9.4	⁺¹	⁺¹
eslint@10.10.0 ⏵ 10.11.0	⁺¹
magic-string@1.3.1 ⏵ 1.4.2	⁺¹	⁺¹	^-1
html-validate@11.15.0 ⏵ 11.16.1	⁺¹	⁺¹
prettier@3.9.6 ⏵ 3.9.9		⁺¹

View full report

renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 893c074 to a45af11 Compare September 29, 2026 21:29

chore(deps): update all non-major dependencies

20fe45f

renovate Bot force-pushed the renovate/all-minor-patch branch from a45af11 to 20fe45f Compare September 30, 2026 23:47

Navigation Menu

chore(deps): update all non-major dependencies - #386

chore(deps): update all non-major dependencies#386
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

Patch Changes

Patch Changes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Performance Improvements

Bug Fixes

Bug Fixes

Features

Performance Improvements

1.3.2 (2026-09-15)

Bug Fixes

1.3.1 (2026-09-10)

Bug Fixes

Features

Performance Improvements

1.3.2 (2026-09-15)

Bug Fixes

1.3.1 (2026-09-10)

🚀 Features

🐛 Bug Fixes

📚 Documentation

🚀 Features

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

JS API

Dart API

🐞 Bug Fixes

Bug Fixes

Configuration

Uh oh!

socket-security Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Sep 21, 2026 •

edited

Loading

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by @fisker)

socket-security Bot commented Sep 21, 2026 •

edited

Loading