Skip to content

chore(deps): update all non-major dependencies - #552

Merged
renovate[bot] merged 1 commit into
masterfrom
renovate/all-minor-patch
Aug 9, 2026
Merged

chore(deps): update all non-major dependencies#552
renovate[bot] merged 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@types/node (source) 26.1.2 → 26.2.0 age confidence
@typescript-eslint/parser (source) 8.65.0 → 8.66.0 age confidence
astro (source) 7.1.6 → 7.2.0 age confidence
eslint (source) 10.8.0 → 10.8.1 age confidence
pnpm (source) 11.20.0 → 11.21.0 age confidence
typescript-eslint (source) 8.65.0 → 8.66.0 age confidence

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.66.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

withastro/astro (astro)

v7.2.0

Compare Source

Minor Changes

  • #​17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

    This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

    astro preview --background

    When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

    astro preview status
astro preview logs
astro preview logs --follow
astro preview stop

    If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

    To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

  • #​17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

    Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

    // astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  logger: {
-    entrypoint: new URL('./src/logger.js', import.meta.url),
+    entrypoint: './src/logger.js',
  },
});

    Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #​17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    import type { AstroPrerenderer, PrerenderResult } from 'astro';

const prerenderer: AstroPrerenderer = {
  name: 'my-adapter:prerenderer',
  getStaticPaths,
  async render(request, { routeData }): Promise<PrerenderResult> {
    const { response, metadata } = await renderInRuntime(request, routeData);
    return { response, metadata };
  },
};

    This is a non-breaking widening: prerenderers that return a bare Response continue to work unchanged, and in-process prerenderers can keep returning a Response since the build collects their metadata directly.

  • #​16871 90c98ae Thanks @​adamchal! - Adds session: false in astro.config to opt out of session support. Projects that do not set session: false see no behavior change.

    import { defineConfig } from 'astro/config';

export default defineConfig({
  session: false,
});

    The session runtime and dependencies (unstorage) are now tree-shaken out of the SSR bundle for any project where no session driver is wired via:

    • session: false
    • no session config at all
    • a session config without a driver

    Useful for serverless/edge runtimes where cold-start parse time is sensitive.

  • #​17084 961bbe5 Thanks @​matthewp! - Adds experimental support for incremental static builds with experimental.incrementalBuild.

    When enabled, Astro can skip regenerating static pages from dynamic routes when both the page's module dependencies and its data cache key are unchanged from the previous build. This currently applies to pages returned from getStaticPaths() that include a cacheKey.

    // astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    incrementalBuild: true,
  },
});

    Return a cacheKey for each generated page from getStaticPaths():

    ---
export async function getStaticPaths() {
  const posts = await fetchPosts();

  return posts.map((post) => ({
    params: { slug: post.slug },
    props: { post },
    cacheKey: post.digest,
  }));
}
---

    For incremental builds to skip rendering in CI, Astro's cache directory must be preserved between builds. Astro empties the output directory on each build and restores skipped pages from the cache directory, so only that directory needs to persist. For the default config, cache and restore node_modules/.astro/ before running astro build.

    See the experimental incremental static builds documentation for more information.

  • #​17084 961bbe5 Thanks @​matthewp! - Adds the optional digest property to content collection entries.

    Loaders can provide an opaque digest value that changes when an entry changes. This is now reflected in the CollectionEntry type returned by getCollection() and getEntry(), making it easier to detect content changes without re-hashing large entry bodies.

    ---
import { getCollection } from 'astro:content';

const posts = await getCollection('blog');

for (const post of posts) {
  console.log(post.digest);
}
---

    The property is optional because not every loader provides a digest. See incremental static builds for how digest can be used as a cacheKey.

Patch Changes

  • #​17534 5a5337e Thanks @​florian-lefebvre! - Improves logger.entrypoint reference docs

  • #​17529 d52a787 Thanks @​QVinto! - Fixes astro dev crashing with Invalid URL when --host is set to a specific non-loopback address

    Vite only reports a local URL for loopback hosts. When the dev server was started with --host <custom-address> bound to a specific non-loopback address (a LAN or Tailscale IP, for example), the URL was reported under network and local was empty, so writing the dev lock file threw Invalid URL and killed a server that had already started successfully.

    The lock file URL now falls back to the network URL, and a server that exposes no URL at all is left untracked rather than being taken down by lock file bookkeeping.

  • #​17566 296248c Thanks @​astrobot-houston! - Fixes fontProviders.googleicons() returning the full icon font (~3.9MB) instead of only the requested glyphs when multiple experimental.glyphs are specified

  • #​17560 ef45de1 Thanks @​astrobot-houston! - Fixes Astro.url.pathname for non-index pages when using build.format: 'preserve'. Previously, a page like src/pages/about-me.astro would output to dist/about-me.html but Astro.url.pathname would incorrectly return /about-me/ instead of /about-me.html.

  • #​17573 0089f83 Thanks @​astrobot-houston! - Fixes a Content Layer build crash that could occur when another dependency causes an older version of neotraverse to be hoisted to the project root

  • #​17571 116f700 Thanks @​astrobot-houston! - Fixes cookies set via Astro.cookies.set() inside a custom 404.astro or 500.astro error page being silently dropped from the final response

  • #​17579 3ea55ce Thanks @​bluwy! - Supports the devEngines field in package.json when detecting the package manager for install commands

  • #​17422 e4e2037 Thanks @​jiwonyoon-dev! - Fixes popover being rendered as popover="true"/popover="false" on custom elements (tag names containing a hyphen). Per the Popover API, the attribute only accepts "auto", "manual", or being absent, so boolean values are now always rendered as a bare popover attribute (or omitted), regardless of the tag name.

eslint/eslint (eslint)

v10.8.1

Compare Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

pnpm/pnpm (pnpm)

v11.21.0: pnpm 11.21

Compare Source

Minor Changes

  • Added interactive group selection to pnpm update --global --interactive.

  • Running pnpm setup, pnpm self-update, or a command that modifies the global installation (such as pnpm add --global) through sudo now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with ERR_PNPM_SUDO_NOT_SUPPORTED in pnpm v12. Read-only global commands (such as pnpm bin --global) are unaffected.

Patch Changes

  • Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists pnpm/pnpm#11701.

  • Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.

  • Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from pnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.

  • Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in pnpm-lock.yaml directly, reusing the same check the pnpm.overrides fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.

  • Fixed a CI regression where github:owner/repo dependencies (and other shorthand Git specifiers) would fail to install with Permission denied (publickey) on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. git+ssh:// or git@host:...):

    • The repository visibility probe (an HTTP HEAD request) now retries transient failures such as 429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.
    • For non-SSH specifiers, anonymous HTTPS git ls-remote access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
    • When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
    • A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. codeload.github.com, which would fail to download for a private repository); it stays a regular git resolution so installs can use ambient Git credentials such as credential helpers and tokens.

    Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

    Fixes pnpm/pnpm#13276.

  • ng build and nuxt build now work under the global virtual store: pnpm's built-in compatibility extensions add the tslib dependency that @angular/build uses without declaring and the unplugin dependency that @nuxt/vite-builder v4 uses without declaring.

  • Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated by their resolved link targets.

  • An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and pendingBuilds entries for removed packages are dropped instead of staying pending forever.

  • The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #​13071.

  • Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an ! exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.

  • Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in pnpm-lock.yaml and the install proceeds from the existing resolution. Every other case still falls back to a full resolution.

  • Adding, editing, or removing an entry in patchedDependencies no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in pnpm-lock.yaml and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while allowUnusedPatches is off, so ERR_PNPM_UNUSED_PATCH is still reported.

  • Resolving a private git repository no longer blocks on an interactive credential prompt: git ls-remote now fails fast with an authentication error when git has no credentials for the repository #​13522.

  • Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same ERR_PNPM_NO_OFFLINE_META condition used by offline resolution.

  • POSIX shell shims now follow symbolic links before computing basedir, preventing execution failures when a shim is invoked via an external symlink on PATH #​13405.

  • The automatic packageManager version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command #​13619.

  • Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip dist.signatures) no longer break the automatic packageManager version switch and pnpm self-update #​13147. When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from registry.npmjs.org and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a shasum), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.

  • pnpm fetch, and any install run with virtualStoreOnly, no longer writes a .pnp.cjs loader under nodeLinker: pnp. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and node_modules/.package-map.json were already skipped; the PnP loader now follows the same rule.

  • Prevent pnpm from removing project files when modulesDir resolves to the project root.

  • Speed up installs after adding ignoredOptionalDependencies patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again.

  • When a failed install re-copies a bin script from the store, rerunning pnpm install now reapplies the executable bit to the bin instead of leaving it non-executable #​12742.

  • pnpm root -g and pnpm bin -g now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with --global in a project that pins a package manager (e.g. via the packageManager field) printed a warning like [WARN] Using --global skips the package manager check for this project ahead of the path, breaking programs that capture the output as a path #​13672.

    In pnpm 12, pnpm root -g and pnpm prefix -g are now supported (they previously failed with ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED / ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED), and the reporter output of dlx, create, config, sbom, with, store, prefix, root, and bin goes to stderr, matching pnpm 11.

  • pnpm setup no longer makes Node.js print a MODULE_TYPELESS_PACKAGE_JSON warning about dist/worker.js on every command. The package.json it writes next to a standalone executable now declares "type": "module".

  • pnpm update without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or --latest resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next pnpm install --frozen-lockfile rejected with ERR_PNPM_OUTDATED_LOCKFILE #​12764.

  • pnpm version -r --json now outputs [] instead of human-readable text when no pending changes exist pnpm/pnpm#13217.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
typescript-eslint/typescript-eslint (typescript-eslint)

v8.66.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Aug 3, 2026
@changeset-bot

changeset-bot Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a4f1c47

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 5855337 to 453c45c Compare August 6, 2026 16:42
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies to v8.66.0 chore(deps): update all non-major dependencies Aug 6, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 453c45c to 9d3a554 Compare August 7, 2026 20:35
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9d3a554 to a4f1c47 Compare August 9, 2026 17:05
@renovate
renovate Bot merged commit 8be317c into master Aug 9, 2026
1 check passed
@renovate
renovate Bot deleted the renovate/all-minor-patch branch August 9, 2026 20:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants