Skip to content

Update all dependencies - #1619

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies
Open

Update all dependencies#1619
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies

Conversation

@renovate

@renovate renovate Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@kobalte/core (source) 0.13.12 → 0.13.13 age confidence
@solidjs/start (source) 2.0.0 → 2.0.3 age confidence
@typescript-eslint/eslint-plugin (source) 8.65.0 → 8.67.0 age confidence
@typescript-eslint/parser (source) 8.65.0 → 8.67.0 age confidence
eslint (source) 10.7.0 → 10.9.0 age confidence
eslint-plugin-solid ^0.14.5 → ^0.16.0 age confidence
globals 17.7.0 → 17.11.0 age confidence
pnpm (source) 11.20.0 → 11.23.0 age confidence
solid-js (source) 1.9.14 → 1.9.15 age confidence
typescript-eslint (source) 8.65.0 → 8.67.0 age confidence
vite (source) 8.2.1 → 8.2.2 age confidence

Release Notes

kobaltedev/kobalte (@​kobalte/core)

v0.13.13

Patch Changes

  • cb89022: ## v0.13.13 (August 10, 2026)

    New features

    Bug fixes

    • Defer aria-hidden in ariaHideOutside to avoid focus warning (#​700)
    • Tabs: Skip indicator animation on initial render (#​704)
    • Prevent default in selection escape handler only when empy disallowEmptySelection (#​708)
    • Tooltip: button type (#​708)
    • Combobox: clear input on blur (#​708)
    • Select: call onChange only when changed (#​708)
    • Set form control label for attribute during ssr (#​708)
solidjs/solid-start (@​solidjs/start)

v2.0.3

Compare Source

Patch Changes
  • 91fc972: Prefix production entry scripts, stylesheets, modulepreloads, and serialized manifest paths with Vite's configured base URL.

v2.0.2

Compare Source

Patch Changes
  • e21fadf: fix potentially incomplete first chunk for chunk readers
  • d78288f: Declare an explicit Content-Type: text/plain; charset=utf-8 on seroval-stream server function responses (success and error paths) so intermediaries cannot content-sniff a type onto them

v2.0.1

Compare Source

Patch Changes
  • fd5e2ae: Delegate vite preview to Nitro when its preview plugin is active, including for static builds that intentionally have no server entry.
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.67.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

Compare Source

🩹 Fixes
  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#​12617)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#​12588)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#​12607)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#​12591)
  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#​12590)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.67.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

eslint/eslint (eslint)

v10.9.0

Compare Source

v10.8.1

Compare Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

v10.8.0

Compare Source

Features

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)
solidjs-community/eslint-plugin-solid (eslint-plugin-solid)

v0.16.0

Compare Source

The complete Solid 2.0 lint surface: version-aware rules, new v2 / v2-strict configs, and a
full set of 2.0-specific rules, all vetted against the official Solid 2.0 templates (which lint
clean with zero errors and zero warnings under the v2 config).

Features
  • settings.solid.version. Rules can now read the targeted Solid major version from ESLint
    settings (settings: { solid: { version: 2 } }). Unset means the permissive dual-version
    behavior from 0.15. The new configs preset it; any custom config can opt in with one line.
  • New v2 config (eslint-plugin-solid/configs/v2, also solid.configs.v2): what the
    official Solid 2.0 templates ship. Sets the version setting, switches existing rules to strict
    2.0 semantics, and enables the new 2.0 rules — errors are reserved for near-certain bugs,
    heuristics stay warnings.
  • New v2-strict config (eslint-plugin-solid/configs/v2-strict): everything in v2 plus
    the plugin's strongest opinions (see below).
  • New rule solid/removed-api (error in v2): flags removed/renamed 1.x APIs with
    autofixes where mechanical (onMount→onSettled, batch→flush, mergeProps→merge,
    unwrap→snapshot, equalFn→isEqual, getListener→getObserver,
    classList={{...}}→class={{...}}, "solid-js/web"→"@solidjs/web",
    "solid-js/store"→"solid-js") and prescriptive migration messages otherwise
    (createResource, on, Suspense→Loading, Index→<For keyed={false}>, produce, etc.).
    Lists verified against the Solid 2.0 RC source.
  • New rule solid/no-single-arg-create-effect (error in v2): Solid 2.0 requires the split
    createEffect(compute, effect) form. The single-argument 1.x form produces no TS compile error
    on a bare statement call and only throws at runtime in dev mode; this rule is the build-time
    hard stop for the most commonly reproduced AI mistake.
  • New rule solid/no-accessor-as-prop (error in v2): <div title={count} /> silently
    renders a stringified function. Fires on any expression that statically resolves to a function
    in a value-typed DOM attribute, with a message that states the fix (count → count()).
    Event handlers, ref, children, namespaced attributes, components, and custom elements are
    exempt.
  • New rule solid/prefer-structured-class (warning in v2, error in v2-strict): nudges
    manually-built class strings (concatenation with conditionals, conditional template literals,
    .join(" ")) toward the structured array/object ClassValue forms that Solid 2.0 accepts
    natively. Static strings and plain interpolation are untouched.
  • New rule solid/no-module-scope-reactive-primitive (error in v2-strict only): reactive
    state at module scope is shared across SSR requests. createRoot-wrapped module state is the
    deliberate escape hatch and is not flagged.
  • New rule solid/prefer-onSettled-for-side-effects (warning in v2-strict only): flags
    side-effectful setup (timers, global listeners, observers) in component bodies, where it also
    runs during SSR; suggests onSettled. Never flags onCleanup itself.
  • New rule solid/no-restated-default-options (error in v2-strict only, autofixable):
    removes restated defaults like <For keyed={true}> and <Show keyed={false}>.
  • Version-2 behavior in existing rules (active when settings.solid.version is 2):
    • solid/no-unknown-namespaces inverts its premise: namespaces are no longer reserved in 2.0,
      so any colon-name is a legal literal attribute — but the formerly-special prefixes use:,
      attr:, bool:, on:, and oncapture: are flagged as near-certain 1.x migration bugs with
      per-prefix guidance. prop: remains the only special namespace.
    • solid/event-handlers graduates from style to correctness: only camelCase onClick is an
      event handler in 2.0; a lowercase onclick with a function value is a listener that will
      never fire (autofixed to camelCase for known DOM events). Lowercase names with static string
      values are legitimate literal attributes and are no longer flagged. onDoubleClick (which
      lowercases to a nonexistent DOM event) is autofixed to onDblClick.
    • solid/imports requires the 2.0 export locations: store exports from core "solid-js", web
      exports from "@solidjs/web". The legacy solid-js/store / solid-js/web subpaths are
      solid/removed-api's territory, avoiding double reports.
    • solid/jsx-no-undef auto-imports the 2.0 control-flow components (For, Repeat, Show,
      Switch, Match, Errored, Loading, Reveal); Index is no longer suggested.
    • solid/reactivity delegates its uncalled-signal-in-DOM-attribute case to
      solid/no-accessor-as-prop so a node never gets two reports.
    • solid/no-react-deps self-gates off (a dependency array in the second argument is already a
      type and runtime error in 2.0).
  • Template vetting. A fixture test runs the v2 config over sources copied from the official
    Solid 2.0 templates in CI, and test/lint-templates.mjs sweeps a local solidjs/templates
    checkout. All eleven solid-v2/* templates lint clean.

v0.15.0

Compare Source

The revival release: Solid 2.0 support and a modernized toolchain.

Breaking Changes

  • ESLint v9 and v10 only. The eslint peer dependency range is now ^9.0.0 || ^10.0.0. Support for ESLint v6–v8 has been dropped.
  • Flat config only. The legacy eslintrc-style plugin:solid/recommended and plugin:solid/typescript configs have been removed, matching ESLint v10's removal of the eslintrc system. Use eslint-plugin-solid/configs/recommended / eslint-plugin-solid/configs/typescript, or the configs on the root export (solid.configs.recommended / solid.configs.typescript). The configs["flat/recommended"] and configs["flat/typescript"] names from 0.14.x still work as aliases.
  • Node.js 22+ required. The engines.node field is now >=22.0.0 (Node 20 reached end-of-life in April 2026).

Features

  • Solid 2.0 API support in solid/reactivity. The rule now recognizes, alongside the 1.x APIs: createProjection, createOptimistic, createOptimisticStore, merge, omit, isPending, latest, resolve, deep, repeat, flush, action, onSettled, createTrackedEffect, createErrorBoundary, createLoadingBoundary, createRevealOrder, function-form createSignal(fn) / createStore(fn), split effects (createEffect(compute, effect)), async computations (e.g. createMemo(async () => ...)), and <For>'s keyed prop callback shapes. Imports from @solidjs/signals are recognized as Solid imports. Callsites whose meaning differs between 1.x and 2.0 are resolved permissively so that neither interpretation warns.
  • New readAfterAwait warning in solid/reactivity. In async computations (async createMemo, function-form derived primitives), reactive reads placed after the first await or yield are not tracked—in 1.x they behave like reads in an event handler, and in 2.0 they can observe unpredictable mid-transition state. The rule now reports these reads specifically and suggests reading the value before the computation suspends.
  • solid/imports understands Solid 2.0 export locations. createStore, reconcile, and store types imported from core solid-js (their 2.0 home) are no longer flagged.
  • Oxlint support. The plugin runs under Oxlint's jsPlugins without modification; see the README for setup.

Internal

  • Removed the ESLint v6–v8 test matrix; tests run against typescript-eslint, Babel, and espree parsers on ESLint 10.
  • Toolchain updated: pnpm 11, typescript-eslint 8.67, vitest 4, TypeScript 5.9; CI tests Node 22/24/26.
  • CI publishing switched from a stored npm token to npm Trusted Publishing (OIDC).
  • Fixed silently-broken docs generation (auto-generated CASES sections regenerate again).

Full Changelog: solidjs-community/eslint-plugin-solid@v0.14.5...v0.15.0

sindresorhus/globals (globals)

v17.11.0

Compare Source

v17.10.0

Compare Source

v17.9.0

Compare Source

v17.8.0

Compare Source

pnpm/pnpm (pnpm)

v11.23.0: pnpm 11.23

Compare Source

Minor Changes

  • pnpm config get and pnpm config list now show the settings pnpm acts on under their documented names:

    • registries shows the registries pnpm resolves from, merged across every source (.npmrc, pnpm-workspace.yaml, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare @ scope. Built-in routes are included — the @jsr scope and the npmjs and gh prefixes — unless pointed elsewhere. Previously pnpm config get registries printed undefined.
    • update and audit show the effective sections, whichever spelling set them. The deprecated internal spellings (updateConfig, auditConfig, auditLevel) are no longer listed.
    • catalogs shows the complete resolved catalog set — the singular catalog block is its default entry — whichever spelling declared it.
    • The registry and @scope:registry entries show the merged routes rather than raw .npmrc values, so they always agree with the registries view.

  • Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level pnpm-workspace.yaml (where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example, globalShims is a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project's pnpm-workspace.yaml, previously ignored silently, are now reported the same way. pnpm config get <key> and pnpm get <key> no longer print config-load warnings, so a script capturing the value gets the value alone.

  • The importPackage pnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on #​14101.

  • node_modules/.modules.yaml no longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it.

    It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use: pnpm list, pnpm why, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one.

    They now use the configured registries, like every other command already did.

  • When enableGlobalVirtualStore is on, every process pnpm spawns for the project (pnpm run, pnpm exec, lifecycle scripts) now receives a NODE_PATH pointing at the project's hoisted node_modules, plus a NODE_OPTIONS --import flag that registers a resolve hook restoring NODE_PATH lookups for ESM imports. Dependencies that import undeclared ("phantom") packages keep resolving under the global virtual store — for both CommonJS and ESM — without installing the @pnpm/plugin-esm-node-path config dependency pnpm/pnpm#9618. Tools run by pnpm dlx resolve such dependencies too: the JS CLI passes them the same environment, while the Rust CLI's dlx cache is self-contained, so its layout already exposes them.

  • A registry can now declare that its abbreviated metadata carries the time field, so resolutionMode: time-based reads the full metadata document only from the registries that need it:

    resolutionMode: time-based
registries:
  https://npm.internal.example/:
    supportsTimeField: true

    registry.npmjs.org omits time from abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing: registrySupportsTimeField answered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed a time field npmjs does not serve. The answer is now per registry, and registrySupportsTimeField remains the answer for every registry that does not declare one.

    The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf.

  • A pnpr resolve request now carries the client's registries the way the registries setting declares them — keyed by URL, with the scopes routed to each, the bare-specifier prefix each answers to, and each one's serverType — in place of the prefix map it used to send.

    The server routes them through the same inversion the config reader runs, so a pnpr-served install resolves a scoped dependency from the registry that scope is routed to, which it previously could not: only the default registry and the prefix-addressed ones reached the server. A declared serverType reaches it too, so the tarball URLs pnpr omits from the lockfile match the ones the client reconstructs.

    Built-in scope routes the project has not pointed elsewhere are not declared, so a pnpr server's allowlist is not asked about npm.jsr.io on requests that resolve no JSR package.

    A registry a request only declares is no longer refused up front for being off the server's allowlist — a client describes its whole configuration, including scopes a given resolve never reaches, so a stray @scope:registry in a developer's ~/.npmrc no longer fails every install against a pnpr server that does not serve it. The boundary moves to the fetch itself: an origin the resolve does reach is refused before the request leaves the server, with the same message.

    This changes the resolve and verify-lockfile request bodies. A pnpr server and its clients have to be on matching versions; the protocol is still experimental and unversioned.

  • The registries setting now declares a registry once, keyed by its URL, with everything about that registry in the entry: how it lays out tarball URLs, the scopes routed to it, and the bare-specifier prefix it answers to.

    registries:
  https://artifactory.example.com/artifactory/api/npm/npm-virtual/:
    serverType: artifactory
    scopes: ['@acme', '@acme-internal']
    prefix: work
    • serverType tells pnpm how the registry lays out its tarball URLs, which decides whether a URL can be omitted from pnpm-lock.yaml:
      • undeclared (the default) — strict. Only the exact canonical URL is treated as reconstructible.
      • npm — the registry behaves like registry.npmjs.org, which also serves a scoped package from its percent-encoded path. Declare this for a faithful mirror or caching proxy of the public registry so its tarball URLs can be omitted too.
      • artifactory — JFrog Artifactory repeats the scope in a scoped package's tarball filename (@acme/widget/-/@acme/widget-1.0.0.tgz) where the npm registry strips it (@acme/widget/-/widget-1.0.0.tgz). Declaring it lets pnpm rebuild that URL, so it is omitted from pnpm-lock.yaml instead of being written out for every scoped package pnpm/get-npm-tarball-url#16.
    • scopes lists the @-prefixed scopes that resolve from this registry. A bare '@' is the scope-less default registry, the one the registry setting names.
    • prefix is the alias a dependency addresses this registry by, as in "foo": "work:^1.0.0".

    The layout is never inferred from the registry URL, so nothing changes unless you declare it; registry.npmjs.org continues to behave as npm without being declared. Because the lockfile depends on serverType, it is read from pnpm-workspace.yaml only — a serverType in the global config.yaml is ignored, so one developer's machine cannot shape a lockfile their collaborators read back with a different layout. Credentials are rejected in this setting, in a key as well as in a field, and still belong in .npmrc. An entry that routes nothing to itself and matches no configured registry is reported as a warning rather than silently ignored.

Migrating

The older registries shape, a map of <scope>: <url> strings, still works and needs no change:

registries:
  '@acme': https://npm.acme.example/

namedRegistries is deprecated in favor of the prefix field, and is still read for prefixes registries does not declare.

toLockfileResolution and isCanonicalRegistryTarballUrl now take their registry and layout as an options object rather than positional arguments, so @pnpm/lockfile.utils and @pnpm/resolving.tarball-url get a major bump.

  • An install that had to re-hash store files to verify them now reports it. If that cost more than a second, it says how long — The integrity of N files was checked in 2.5s. — and if it was quick but covered more than a thousand files, it names the cause instead: their timestamps changed since the store recorded them, which a backup tool, an antivirus scan or a copied store can do.

  • Added virtualStoreType, which names where the virtual store lives — one store per machine, or one per project:

    virtualStoreType: global   # or: project

    It is the canonical spelling of enableGlobalVirtualStore, which keeps working. When a project sets both, virtualStoreType wins. It can also be set through PNPM_CONFIG_VIRTUAL_STORE_TYPE and read back with pnpm config get virtualStoreType. The default is unchanged — project, so the shared store stays opt-in.

    The setting is independent of nodeLinker. isolated and pnp both work with either store type, and hoisted writes no virtual store at all, so it is unaffected.

Patch Changes

  • pnpm add --allow-build now adds to the allowBuilds entries already in pnpm-workspace.yaml instead of replacing them #​13872.

  • Kept pending build approvals available after removing an unrelated dependency.

  • pnpm approve-builds now removes onlyBuiltDependencies, onlyBuiltDependenciesFile, neverBuiltDependencies, and ignoredBuiltDependencies from pnpm-workspace.yaml when it writes allowBuilds. Those settings were replaced by allowBuilds in pnpm 11 and silently ignored since, so a workspace migrated from pnpm 10 kept them around looking active.

  • pnpm audit no longer reports a patched version that was never published or is deprecated. The inferred patched range (e.g. >=4.17.24 from <=4.17.23) is now checked against the registry packument, and the report is corrected to the lowest non-deprecated published version that satisfies it (e.g. >=4.18.1 when 4.17.24 does not exist and 4.18.0 is deprecated). When no published version satisfies the range, the report shows Patched versions: None. This also prevents pnpm audit --fix from adding overrides or minimumReleaseAgeExclude entries for patches that do not exist #​13824.

    pnpm audit --fix and pnpm audit --fix update no longer add a minimumReleaseAgeExclude entry when the registry packument shows that the minimum patched version was never published. Previously such entries were written for versions that do not exist, which would have let a later publish of that version bypass the minimumReleaseAge gate #​11563.

    The --json output of pnpm audit now returns patched_versions: null for advisories whose inferred patch is not available (never published, skipped, yanked, or deprecated), making it easier for tooling to distinguish "no fix available" from "fix available at version X".

  • Fixed pnpm patch-commit in project and edit paths containing non-ASCII characters.

  • The package and bump pickers of pnpm change now size their page from the terminal height instead of always showing 7 rows. They fall back to 7 rows when the terminal height is unknown pnpm/pnpm#13815.

  • Canceling a pnpm change prompt with Ctrl-c no longer prints a stack trace. It reports Change canceled and exits with a success status, like the other interactive commands #​13814.

  • Re-fetch full registry metadata when minimumReleaseAge is enabled and an abbreviated packument's time map omits timestamps for some versions. This prevents mature versions from being filtered out and resolution from falling back to the lowest matching version pnpm/pnpm#13741.

  • A config dependency carrying an inline integrity (the <version>+<integrity> form, or the object form without a tarball) now takes its tarball URL from the registry's packument instead of deriving it from the registry URL, so migrating one costs an extra metadata request. On a registry that serves tarballs from a path pnpm cannot derive, GitLab's group endpoint for one, installing such a config dependency failed with a 404 while the same package installed fine as a regular dependency #​13765.

  • Fixed PNPM_CONFIG_NODE_VERSION being ignored when setting the Node.js version used for compatibility checks.

  • A custom fetcher can no longer replace the archive integrity that pnpm-lock.yaml pins: the locked value is restored after a canFetch or fetch hook rewrites the resolution, and delegating a locked archive to a directory or git source now fails instead of installing unverified content.

    The Rust CLI now also loads the pnpmfiles named by the pnpmfile setting (a single path or an ordered list), and hands custom fetchers native localTarball and remoteTarball callbacks — including on a fresh install that has to compute a missing tarball integrity, which is then reused by later offline installs. File maps a fetcher returns are accepted only when they match what those native callbacks extracted.

  • Fixed an issue where running pnpm dedupe --check in projects with nodeLinker: hoisted would cause dependencies to be moved out of node_modules into node_modules/.ignored.

  • pnpm deploy --prod and pnpm deploy --no-optional no longer list the excluded dependency groups in the deployed package.json and pnpm-lock.yaml. The deployed lockfile referenced packages that the deploy left out of its graph, so installing in the deploy directory afterwards created dangling symlinks #​13623.

  • Don't treat files like license16.json as a package license when deciding if the workspace LICENSE file should be included in the packed package.

  • pnpm exec --recursive --no-reporter-hide-prefix no longer prints a blank prefixed line after each chunk of a command's output, and no longer splits a line in two when it straddles a chunk boundary.

  • Fixed 404 errors when installing from a registry that serves scoped packages only from a percent-encoded path, such as GitHub Enterprise Server. Outside registry.npmjs.org, a tarball URL that encodes the scope separator as %2f or %2F is no longer mistaken for one that pnpm can rebuild from the package name, version, and registry, so it is kept in pnpm-lock.yaml and requested verbatim on the next install #​13534.

  • Fixed trustPolicyExclude and minimumReleaseAgeExclude being ignored when set to a single string instead of a list. The value was read one character at a time, so the exclusion never matched the package it named — and a * anywhere in it matched every package, silently switching the policy off.

  • pnpm init now pins the exact pnpm version instead of a ^ range, and records it in the packageManager field alongside devEngines.packageManager. Corepack reads only packageManager and accepts nothing but an exact version, so it rejected the generated package.json with "expected a semver version" pnpm/pnpm#13969. A package created inside an existing workspace is still left unpinned — it follows the pin at the workspace root — and --no-init-package-manager still scaffolds a manifest without any pin. In pnpm 12, pnpm init also honors initType and its --init-type flag, so the manifest it writes is the same one pnpm 11 writes.

  • Fixed an issue where package overrides were written into the metadata cache, causing removed overrides to keep applying on subsequent installs pnpm/pnpm#13918.

  • On Windows, upgrading pnpm no longer leaves a stale pnpm.ps1 behind. PowerShell resolves pnpm.ps1 ahead of pnpm.cmd, so a shim written by an older installation kept running the previous version. Linking the pnpm CLI's bins now deletes it #​13919.

  • Fixed an inconsistency where minimumReleaseAgeExclude (and trustPolicyExclude) wildcard/bare-name rules behaved differently in the evaluator and normalizer. A bare rule now consistently evaluates as matching every version, preventing unexpected behavior and silent widening of version policy exemptions when pnpm rewrites the workspace manifest pnpm/pnpm#13725.

  • A frozen install no longer rewrites the packageManagerDependencies block of pnpm-lock.yaml. When the pnpm version pinned by devEngines.packageManager (or by packageManager) is missing from the lockfile or no longer matches it, --frozen-lockfile now fails with ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE instead of resolving the version and saving it, so a manifest whose pin was bumped without regenerating the lockfile can no longer pass CI #​14009.

  • A git dependency installed over HTTPS from a hosted repository now keeps its branch, tag, or version range in the specifier recorded in package.json. It was written back without one, so the next pnpm update moved the dependency to the repository's default branch #​13999.

  • Fixed `pnpm update --gl

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 2 workspace projects
? Verifying lockfile against supply-chain policies (689 entries)...
✓ Lockfile passes supply-chain policies (689 entries in 8.2s)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 33, reused 0, downloaded 0, added 0
Progress: resolved 37, reused 0, downloaded 0, added 0
Progress: resolved 168, reused 0, downloaded 0, added 0
Progress: resolved 208, reused 0, downloaded 0, added 0
Progress: resolved 217, reused 0, downloaded 0, added 0
Progress: resolved 219, reused 0, downloaded 0, added 0
Progress: resolved 222, reused 0, downloaded 0, added 0
Progress: resolved 235, reused 0, downloaded 0, added 0
Progress: resolved 439, reused 0, downloaded 0, added 0
Progress: resolved 462, reused 0, downloaded 0, added 0
Progress: resolved 581, reused 0, downloaded 0, added 0
Progress: resolved 661, reused 0, downloaded 0, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 1 version does not meet the minimumReleaseAge constraint:
  eslint-plugin-solid@0.16.0 was published at 2026-08-20T22:13:20.292Z, within the minimumReleaseAge cutoff (2026-08-16T17:11:50.030Z)

@bolt-new-by-stackblitz

bolt-new-by-stackblitz Bot commented Aug 9, 2026

Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@netlify

netlify Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown

❌ Deploy Preview for solid-docs failed. Why did it fail? →

Name Link
🔨 Latest commit ed0751a
🔍 Latest deploy log https://app.netlify.com/projects/solid-docs/deploys/6a8b29ea90801800087146e9

@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 7 times, most recently from 3ff6aca to 0762c60 Compare August 18, 2026 14:57
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 6 times, most recently from 16bd3ba to 0ce9d2a Compare August 21, 2026 02:15
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch from 0ce9d2a to ed0751a Compare August 23, 2026 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants