chore(deps): bump the pnpm-dependencies group across 1 directory with 13 updates by dependabot[bot] · Pull Request #193 · AlienCommons/aliencommons

dependabot · 2026-11-02T09:25:03Z

Bumps the pnpm-dependencies group with 13 updates in the / directory:

Package	From	To
@types/node	`26.6.2`	`26.6.6`
knip	`6.38.0`	`6.44.0`
turbo	`2.11.4`	`2.11.10`
vite-plus	`0.3.3`	`1.4.0`
vue-tsc	`3.3.11`	`3.3.14`
fastify	`5.12.5`	`5.12.7`
@nuxt/icon	`2.5.1`	`2.6.2`
@pinia/nuxt	`1.0.2`	`1.0.3`
nuxt	`4.5.2`	`4.6.3`
pinia	`4.0.3`	`4.1.0`
vue	`3.5.43`	`3.5.44`
vue-router	`5.3.1`	`5.4.0`
@playwright/test	`1.63.0`	`1.64.1`

Updates @types/node from 26.6.2 to 26.6.6

Commits

See full diff in compare view

Updates knip from 6.38.0 to 6.44.0

Release notes

Sourced from knip's releases.

Release 6.44.0

Clarify that custom entry still adds entry files from package.json (#2206) (4099ddeef28406ed8c9b798cf5ce525241818642) - thanks @MannXo!

Resolve expanded package scripts against the directory of their manifest (#2209) (9d8464dd7335b9898a17a0db59c3c33a7ae460f4) - thanks @fixfon!

Track exports through namespace member chains of any depth (#2210) (75697027e89e176c16e3d567cff3d6e016d0e9f0) - thanks @fixfon!

Do not treat Windows drive letters as package names (#2217) (d412c5be3a5c2d69583ce54b32e033813c1d2972) - thanks @Cherry!

Generate built-in compilers list from source (#2216) (d6f594cc767fa41c6f94cf49bfa0302be4b9de40) - thanks @abrahamguo!

Update to pnpm@^11 + pnpm dedupe (ef5b819eddbb0b4ff92804524aca590797a199fc)

Stop growing and rewriting the analysis cache on warm runs (close #2213) (54b02dd84181867f41f98a6c80209dad32fa3da6)

Use entry in plugins that do not resolve their config files (0b0e3285e3a440650b86a776b5e2a1fc1816bca8)

Reuse graph reachability for incremental sessions (#2190) (38d926a652e820a375fe59d04ba0980393882153) - thanks @jakeleventhal!

fix: reload discovered configuration in watch sessions (#2211) (cefef30891c4428635e5cfc7b147faa42857247d) - thanks @jakeleventhal!

Keep editor sessions and views current (#2215) (cfe91abb5e6064230a71926f0d7565fce94486c0) - thanks @jakeleventhal!

Add Lingui plugin (#2212) (611e7dbe1c6675612e457324aae411bf4cda5b11) - thanks @clean99!

Update dependency bun to v1.4.4 (#2219) (3f35bbdf863057f69f237ab507053271019fc315) - thanks @renovate[bot]!

Read CSpell configuration from package.json (#2228) (86ab963cf3cd279a8b8af3a3f0098d24762c59cb) - thanks @clean99!

Ignore file discovery order in session configuration test (51a8d33dbe04e76da8f2e2ed24d8943d0e9e15fe)

Fix strict mode for caught optional peer imports (#2218) (e535f40b8cacea80c830282544975f0be2191323) - thanks @jay23606!

Add kysely-codegen plugin (#2223) (a50e8423d28406bd20c213334d3aac4857c1cce0) - thanks @clean99!

Add PurgeCSS plugin (#2224) (668aea696a217d7c537791771be6044fc5ae375b) - thanks @clean99!

Document plugin args and path bases, issue key order and real-world fixes (8e48df60c4502c66d9daba87d5f436898ae60116)

Add Mastra plugin (#2227) (dd4e1f72de127eb8328dd941fa4492034f29d69d) - thanks @ashokram-si!

Count findPackageJSON() bare specifiers as dependencies (#2235) (d4e387b31235d49fe755acb79553b385aa0de4c9) - thanks @abrahamguo!

Add universal hooks file to SvelteKit entries (#2237) (f286584f168d27255769bd9529b49a3518e4f788) - thanks @APX403!

Attribute extended tsconfig plugins correctly (#2230) (8d1d1d1e54204287b8321a0a5d50cbfa4562759e) - thanks @gioboa!

Resolve reporter in the Mocha plugin (#2232) (c413715a334be72094a02af0dbb37e36e878e262) - thanks @X-Guardian!

Read nyc.config.cjs and nyc.config.mjs in the nyc plugin (#2240) (724c3c9bd44d9919f35fa5b5be955fa3b6c9339d) - thanks @SwastikTripathi!

Read hidden .biome.json and .biome.jsonc in the Biome plugin (#2239) (dde22a754d9cd7a4e98aaeef6b0ad8b22b14040d) - thanks @SwastikTripathi!

fix: narrow Remix plugin enabler to @remix-run/dev (#2242) (5e10c52abfe21839dc9bd515fd900ff035fac170) - thanks @gioboa!

Document alsoReferenceOwner on Input (387e97f0988da93d74df53ad46a906db3d29dba8)

Document path bases and the dir option per input type (98180d375b154663d8c9b967c9b8b54c0de06927)

Emit the Gatsby production entries from resolveConfig (c224f16c629cec5ec56ce06b8bcf9207255ba69f)

Emit the TanStack Router entry files from resolveConfig (c2598a3dae1e9616191d88d81eafcde6ab0f5b82)

Discover Marko tag files when only marko-tag.json files exist (c264697fab8c0783f2e23c983aacb1d4178953fc)

Remove the static public/sw.js production entry from the vite-plugin-pwa plugin (b3f9a56216195e279ec73935f0de1e6ff490230c)

Keep absolute build.lib.entry paths in the Vitest plugin (5d974fa1bdfe3bbc696645139cc04bb963d5f9d9)

Resolve Vite alias targets from the workspace without prefixing absolute paths (8f93e9d3425e47d9933baec078d1cdf9ad8a49ca)

Keep absolute testDir paths in the Playwright plugin (4e3e6b3d8b978a7f4a99438c661a86a93c73745d)

Keep absolute stories paths in the Storybook plugin (321decc499e3ec15b75c4abace3a58a0cd8f6b50)

Resolve an absolute basePath in the Karma plugin (64e8b1bbe28e0c0f9f80112683b5c5f51f7d4512)

Keep absolute local plugin paths in the Docusaurus plugin (058930d9eb30490c796af1ee8bab3682e852dae2)

Keep absolute local plugin paths in the Serverless Framework plugin (0176d78dec4cd8ba9204c61c3c0ec7385a02ae9c)

Resolve Nx run-commands cwd from the workspace root (39c08aab2149cf11f74c60195b3fdf0bcadc29f2)

Resolve package specifiers in Marko tag definitions (168ee52857cf646ac0f1b18528bf6867fdd10c4f)

Keep absolute include paths in the Taskfile plugin (7945ec15a327bd65ad6ed00809ba4f12b3f3d814)

Resolve Lefthook root from the repository root (f28fae68d56c527f9c6388d983344e5694e5a906)

Pass specifiers with dir instead of absolutizing them in the webpack, Nx and textlint plugins (1ad804d6f24f55c28ffd9d306b1bb43175064429)

Drop redundant relative calls on entry patterns in the rstest and Marko plugins (9096f254bade552cdd556255157dd440ee634b27)

Use toAbsolute in the Jasmine, Lunaria and electron-vite plugins (b4266efef59359dcb2632b97a7c6335f9d47251d)

Mark inputs from the start script as production (2fb10243bb1385060d8f94204081f750405460ec)

Mark inputs from scripts in production files as production (af469e9c88bd87e3b71b8d010abf069115cf2a19)

... (truncated)

Commits

0d14731 Release knip@6.44.0
153ba1e Escape pipes in symbols in the markdown reporter (#2254)
624da93 Detect SWC plugins in options set directly on a webpack rule (#2252)
acbbbf5 Support pnpm workspace config includes (#2238)
e118ef4 Treat packageExtensions peers as optional (#2246)
1a58eb5 Add --output-file option to write reporter output to a file (#2243)
5d10668 Let core resolve script entries from dir in the Playwright, Railway and mis...
381e3e3 Parse MCP server commands against their cwd
98d0b98 Parse GitHub Actions step scripts against their working directory
2070464 Pin the scope of negations and workspace exclusions for plugin entry patterns...
Additional commits viewable in compare view

Updates turbo from 2.11.4 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

fix: Allow non-recursive Turbo commands in root tasks by @sahyl in vercel/turborepo#14814

chore: Release Turborepo 2.11.9 by @github-actions[bot] in vercel/turborepo#14824

chore(deps): Update dependency @vercel/geistdocs to v2 by @vercel-gh-bot-4[bot] in vercel/turborepo#14417

chore: Update with-gatsby example by @vercel-gh-bot-3[bot] in vercel/turborepo#14796

fix: Avoid pnpm batch-shim shutdown hangs on Windows by @sahyl in vercel/turborepo#14819

chore(deps): Update dependency @vercel/geistdocs to v2.11.0 by @vercel-gh-bot-3[bot] in vercel/turborepo#14832

fix: Exclude tool-managed directories from local dependency inputs by @PedroRosalba in vercel/turborepo#14696

fix: Match git's text=auto binary detection in file hashing by @PedroRosalba in vercel/turborepo#14697

fix: Drop @react-router/dev from Remix match list by @Pcmhacker-piro in vercel/turborepo#14800

fix: Match package configuration files and directory inputs in task-level affected detection by @PedroRosalba in vercel/turborepo#14804

fix: Parse pnpm 8 single-project lockfiles by @PedroRosalba in vercel/turborepo#14806

fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @PedroRosalba in vercel/turborepo#14805

docs: Generate the sitemap from Geistdocs sources by @molebox in vercel/turborepo#14865

fix: Restore cached symlinks when outputs are already on disk by @PedroRosalba in vercel/turborepo#14807

chore: Remove CODEOWNERS file by @anthonyshew with @Copilot in vercel/turborepo#14810

feat: Enable WebMCP for Turborepo docs by @anthonyshew in vercel/turborepo#14828

fix: Exit quietly when turbo ls output is piped to a closed reader by @drakeo338 in vercel/turborepo#14868

fix: Distrust compromised eMudhra intermediate certificates by @anthonyshew in vercel/turborepo#14876

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

chore: Release Turborepo 2.11.8 by @github-actions[bot] in vercel/turborepo#14789

perf: Prefetch Cargo metadata during lazy graph construction by @anthonyshew in vercel/turborepo#14497

perf: Compute Berry lockfile closures once across workspaces by @anthonyshew in vercel/turborepo#14499

perf: Check cache hit outputs in place instead of on the blocking pool by @anthonyshew in vercel/turborepo#14524

perf: Speed up Berry lockfile loading by @anthonyshew in vercel/turborepo#14500

perf: Parse bun.lock without building a JSON syntax tree by @anthonyshew in vercel/turborepo#14502

perf: Skip the dry run cache batch window when there is no remote cache by @anthonyshew in vercel/turborepo#14505

perf: Emit lockfile closures pre-sorted and cheapen closure interning by @anthonyshew in vercel/turborepo#14525

perf: Reuse configuration derived from turbo.json between the shim and the CLI by @anthonyshew in vercel/turborepo#14521

feat: Report locked tools-only setup plans by @anthonyshew in vercel/turborepo#14483

perf: Compute Bun lockfile closures once across workspaces by @anthonyshew in vercel/turborepo#14501

perf: Reuse open parent directories when restoring cache archives by @anthonyshew in vercel/turborepo#14506

perf: Skip dropping the run right before turbo run exits by @anthonyshew in vercel/turborepo#14507

perf: Match literal input exclusions without compiling globs by @anthonyshew in vercel/turborepo#14510

perf: Copy pruned package files in parallel by @anthonyshew in vercel/turborepo#14512

feat: Report proposed first-lock and refresh setup plans by @anthonyshew in vercel/turborepo#14571

perf: Compress large cache archives with multithreaded zstd by @anthonyshew in vercel/turborepo#14698

perf: Read tracked file stats from directory listings on Windows by @anthonyshew in vercel/turborepo#14633

... (truncated)

Commits

e521641 publish 2.11.10 to registry
aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
b42cc68 chore: Remove CODEOWNERS file (#14810)
921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
d926d6a fix: Match package configuration files and directory inputs in task-level aff...
Additional commits viewable in compare view

Updates vite-plus from 0.3.3 to 1.4.0

Release notes

Sourced from vite-plus's releases.

vite-plus v1.4.0

Vite+ 1.4 runs TypeScript and JavaScript files with vpx, and vp migrate can move tsx scripts to it. It also adds vp check --deny-warnings and vp pm team, and installs the global CLI's dependencies from a lockfile published with each release.

Features

vpx <file> runs a TypeScript or JavaScript file on the project's Node.js with the oxc-node loader that ships with Vite+, and vpx --watch <file> reruns it when a file it uses changes. In package.json scripts, the vpx bin of the vite-plus package runs scripts without the global CLI and runs package binaries only from node_modules/.bin, pointing to vp dlx for anything not installed (docs) (#2936, #3164), by @Brooooooklyn and @fengmk2.

vp migrate offers to move tsx scripts to vpx: tsx a.ts, npx tsx a.ts, node --import tsx a.ts, and tsx watch a.ts in package.json scripts, lint-staged tasks, and #!/usr/bin/env tsx shebangs become vpx a.ts or vpx --watch a.ts. A project already on Vite+ gets the offer with vp migrate --full (docs) (#3179), by @fengmk2.

vp check --deny-warnings fails the check on lint warnings, so CI no longer needs a separate vp lint --deny-warnings run (docs) (#3075), by @acalvino4.

vp pm team creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun (#3040), by @jong-kyung.

Security: vp no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades (RUSTSEC-2026-0382, RUSTSEC-2026-0383), and it ships tokio 1.54.1, which fixes a race in tokio::time::Interval (RUSTSEC-2026-0384) (#3159, #3202), by @wan9chi and @fengmk2.

vp pm registry commands (login, logout, whoami, owner, token, dist-tag, deprecate, search, ping, and publish) run pnpm's own commands on pnpm 11 and later (token from 12.13.0), and vp pm owner and vp pm publish run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm (#3044), by @jong-kyung.

The installer and vp upgrade install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to resolve them again if that installation fails (docs) (#3117), by @fengmk2.

Upgrade the bundled tools (#3133, #3158, #3175), by @voidzero-guard[bot] and @fengmk2:

vite@8.3.4 to vite@8.3.5, with fixes for bundled dev mode, chunk import maps, CSS url() values containing %, and subpath imports with several # characters.

rolldown@1.2.14 to rolldown@1.2.15, with fixes for this.resolve recursion between plugins using skipSelf: true, strict execution order, and chunk import maps.

oxlint@1.88.0 to oxlint@1.89.0, with rule fixes that report cases missed before, for example in prefer-const, no-param-reassign, and sort-imports.

oxfmt@0.73.0 to oxfmt@0.74.0, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown.

The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.

vpx scripts run on oxc-node@1.0.0.

@vitejs/devtools 0.8 is accepted as a peer dependency, alongside 0.7.

Fixes & Enhancements

The standalone vp executable binary size is ~30% smaller (#3086), by @fengmk2.

VP_SETUP_NODE_VERSION selects the Node.js version the installer uses for the CLI's dependencies, so setup-vp can use the project's version and avoid downloading a second Node.js in CI (docs) (#3087), by @fengmk2.

When tasks miss the cache, vp run finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again (vite-task#871), by @magurotuna.

Cached tasks no longer miss the cache when only pnpm's node_modules/.modules.yaml differs, for example after installing with another pnpm version, with --ignore-scripts, or on glibc and musl machines (vite-task#850), by @wan9chi.

vp run in a package that sits inside a workspace folder but is not listed in its pnpm-workspace.yaml packages or package.json workspaces runs that package's own tasks with its own packageManager, instead of treating the enclosing workspace as its root (vite-task#859), by @liangmiQwQ.

A mistyped or misplaced task setting fails with an error that names it, such as unknown field outputs, instead of data did not match any variant of untagged enum UserTaskDefinition (vite-task#815), by @tlq5l.

vp run no longer panics on scripts that contain non-ASCII characters, such as echo こんにちは, and no longer cuts those commands off in its output (vite-task#861), by @magurotuna.

In cached tasks on Linux and macOS, programs that pass -1 as a directory descriptor, such as ps -p <pid> from procps-ng 4.0.6 and later, no longer abort (vite-task#862), by @magurotuna.

On Linux, cached tasks such as pnpm dlx no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup (vite-task#854), by @fengmk2.

On Windows, vp run and the global vpx wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately (#3167), by @fengmk2.

vp migrate and the prefer-vite-plus-imports lint autofix leave vite/rolldown and vite/rolldown/* imports unchanged, instead of rewriting them to vite-plus/rolldown subpaths that vite-plus does not export (#3070, #3191), by @Crimson341 and @Dunqing.

vp migrate keeps existing .nvmrc files instead of converting them to .node-version, so nvm, fnm, and other tools that read .nvmrc keep working and the selected Node.js version does not change (#3126), by @liangmiQwQ.

vp migrate converts Oxlint configs that extends shared JSON files into TypeScript modules imported through lint.extends, so the inherited rules keep applying after migration (#3097), by @fengmk2.

vp migrate skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting (#3118), by @0froq.

vp migrate keeps the workspace members declared in package.json workspaces when it selects pnpm for a project without a lockfile, so recursive commands still include them (#2863), by @SaKaNa-Y.

vp migrate no longer reports unawaited-assertion for a local assertion promise that the function later awaits or returns (#3180), by @fengmk2.

pnpm create vite-plus and yarn create vite-plus no longer fail during dependency installation when vp is not on PATH, and no longer run a different global vp version for installation, formatting, and hooks (#3181), by @fengmk2.

vp create and vp migrate resolve the npm registry and credentials as npm does: a .npmrc above the project is no longer read, userconfig and globalconfig are honored, and registry hosts in credential keys match regardless of case (#3124), by @liangmiQwQ.

vp pack and vp create find the monorepo root the same way as vp run and vp install, and vp pack at a monorepo root without a vite.config no longer picks up a config from the directory above (#3101), by @liangmiQwQ.

defineConfig keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as vike(), work under Vite+ (#3154), by @liangmiQwQ.

vp dev with experimental.bundledDev no longer fails with ERR_MODULE_NOT_FOUND when no separate rolldown package is installed, and no longer picks up the runtime of an unrelated installed rolldown (#3111), by @fengmk2.

With nodeShimMode: system_first, vp node and vp env exec run the system tool that the shell would find, instead of downloading and running the managed Node.js (#3100), by @liangmiQwQ.

VP_NODE_VERSION=22 and other partial versions resolve to an exact release in vp env install, vp env exec, and vp env clean, instead of failing with a 404 download error (#3038), by @Dev-next-gen.

vp env pin and vp env unpin show the file and field they changed. Package-manager pins from a workspace member update the workspace root package.json, and the help and guide now say so (#3103), by @SaKaNa-Y.

In PowerShell, a bare -- reaches vp again, so vp create vite -- --template react-ts forwards --template to create-vite (#3083), by @fengmk2.

Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ env.nu calls, such as update. Run vp env setup again to regenerate env.nu (#3123), by @naokihaba.

Package-manager commands reject options that the selected version would silently ignore, such as --dry-run or --provenance with an npm whose version is unknown, instead of running without them (#3122), by @jong-kyung.

... (truncated)

Commits

102fe8e release: v1.4.0 (#3201)
b2abe27 fix(create): run child commands without a global vp (#3181)
c891e5d feat(migrate): migrate tsx scripts to vpx (#3179)
0a96bd9 fix(lint): keep vite/rolldown imports in prefer-vite-plus-imports (#3191)
cbb9fee fix(migrate): recognize awaited local assertion promises (#3180)
74c8d18 refactor(cli): share clap error diagnostics (#3172)
2162b28 feat(deps): upgrade upstream dependencies (#3175)
f8d9da8 fix(cli): keep own properties of promise plugins in defineConfig (#3154)
0445f73 refactor(migrate): remove redundant git hooks wrapper (#3173)
13ac064 fix(vpx): handle --experimental-config-file and Windows Ctrl+C (#3167)
Additional commits viewable in compare view

Updates vue-tsc from 3.3.11 to 3.3.14

Release notes

Sourced from vue-tsc's releases.

v3.3.14

language-core

fix: isolate template virtual code from setup control flow (d31557b)

fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)

fix: avoid TS2454 from the withDotValue assertion (c774144)

fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)

fix: avoid never slot props for dynamic slot names in generic components (7957e7f)

fix: omit emitted events from inherited attrs of generic components (2d94d89)

fix: check bindings of generic directive hooks (0cb7d92)

fix: wrap the v-model assignment target in parentheses (9bb1dc9)

fix: type the $event parameter of inline handlers explicitly (d3b42a1)

fix: type unknown components without diagnostic filters (b3909a3)

fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)

fix: declare component context vars before slot code (b7c773d)

fix: avoid non-null assertion in JS slot codegen (5633525)

fix: restore tag navigation for barrel imports (6358d15)

fix: map the whole hyphenated directive name in the auto-import access (beb0151)

language-service

fix: prevent crash on malformed html.customData configuration (3961653)

typescript-plugin

fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @johnsoncodehk, @lazerg, @ValentinYoushkevich, @so1ve, @WangKepeople

v3.3.13

language-core

fix: generate setup macros without static imports (85f665e)

vscode

fix: avoid registerHooks on buggy Node versions (7e0d6c4)

Contributors: @KazariEX, @serkodev

v3.3.12

language-core

security: improved handling of untrusted Vue files (cea0698)

feat: infer first parameter type of default factory for defineModel (1be73b8)

feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)

fix: keep union props when using withDefaults (084f30f)

fix: keep inference-only props string single-line with block comments (55ca36f)

fix: support calling template bindings without .value (7ad4a94)

fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)

... (truncated)

Changelog

Sourced from vue-tsc's changelog.

3.3.14 (2026-10-30)

language-core

fix: isolate template virtual code from setup control flow (d31557b)

fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)

fix: avoid TS2454 from the withDotValue assertion (c774144)

fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)

fix: avoid never slot props for dynamic slot names in generic components (7957e7f)

fix: omit emitted events from inherited attrs of generic components (2d94d89)

fix: check bindings of generic directive hooks (0cb7d92)

fix: wrap the v-model assignment target in parentheses (9bb1dc9)

fix: type the $event parameter of inline handlers explicitly (d3b42a1)

fix: type unknown components without diagnostic filters (b3909a3)

fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)

fix: declare component context vars before slot code (b7c773d)

fix: avoid non-null assertion in JS slot codegen (5633525)

fix: restore tag navigation for barrel imports (6358d15)

fix: map the whole hyphenated directive name in the auto-import access (beb0151)

language-service

fix: prevent crash on malformed html.customData configuration (3961653)

typescript-plugin

fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @johnsoncodehk, @lazerg, @ValentinYoushkevich, @so1ve, @WangKepeople

3.3.13 (2026-10-10)

language-core

fix: generate setup macros without static imports (85f665e)

vscode

fix: avoid registerHooks on buggy Node versions (7e0d6c4)

Contributors: @KazariEX, @serkodev

3.3.12 (2026-10-02)

language-core

security: improved handling of untrusted Vue files (cea0698)

feat: infer first parameter type of default factory for defineModel (1be73b8)

feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)

fix: keep union props when using withDefaults (084f30f)

... (truncated)

Commits

df80037 v3.3.14
d31557b fix(language-core): isolate template virtual code from setup control flow (#6...
b3909a3 fix(language-core): type unknown components without diagnostic filters (fix #...
845975c chore: bump @volar/* to 2.4.30
0cb7d92 fix(language-core): check bindings of generic directive hooks (#6291)
f2d92d3 v3.3.13 (#6263)
cea0698 v3.3.12 (#6234)
d4d4139 fix(language-core): stop typedef jsdoc from leaking into emitted dts
045a6a7 fix(component-meta): stop checking JS Vue files as TS (#6231)
a59da36 fix(tsc): prevent watch mode crash on incremental build (#6213)
Additional commits viewable in compare view

Updates fastify from 5.12.5 to 5.12.7

Release notes

Sourced from fastify's releases.

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

Fix for GHSA-389g-gv7q-r4x8

What's Changed

[Backport 5.x] types: restrict route lookup methods by @github-actions[bot] in fastify/fastify#7048

[Backport 5.x] perf: decode string bodies once instead of per chunk by @github-actions[bot] in fastify/fastify#7053

[Backport 5.x] perf: avoid resetting the level of request child loggers by @github-actions[bot] in fastify/fastify#7058

[Backport 5.x] fix: resolve reply.mediaType from raw response headers by @github-actions[bot] in fastify/fastify#7067

[Backport 5.x] perf: use a FIFO cache for parsed content-types by @github-actions[bot] in fastify/fastify#7072

[Backport 5.x] fix(validation): lowercase header names in propertyNames enum/const by @mcollina in fastify/fastify#7104

[Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of storing it by @github-actions[bot] in fastify/fastify#7087

[Backport 5.x] fix: remove error when HTTP QUERY request has empty body by @github-actions[bot] in fastify/fastify#7060

[Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 by @github-actions[bot] in fastify/fastify#7094

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

Commits

9f40003 Bumped v5.12.7
16469b9 Bumped v5.12.6
63496de [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)
20b55d4 [Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)
38d2b63 [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...
3241fbd [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...

… 13 updates Bumps the pnpm-dependencies group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.6` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.38.0` | `6.44.0` | | [turbo](https://github.com/vercel/turborepo) | `2.11.4` | `2.11.10` | | [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `0.3.3` | `1.4.0` | | [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.11` | `3.3.14` | | [fastify](https://github.com/fastify/fastify) | `5.12.5` | `5.12.7` | | [@nuxt/icon](https://github.com/nuxt/icon) | `2.5.1` | `2.6.2` | | [@pinia/nuxt](https://github.com/vuejs/pinia) | `1.0.2` | `1.0.3` | | [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `4.5.2` | `4.6.3` | | [pinia](https://github.com/vuejs/pinia) | `4.0.3` | `4.1.0` | | [vue](https://github.com/vuejs/core) | `3.5.43` | `3.5.44` | | [vue-router](https://github.com/vuejs/router) | `5.3.1` | `5.4.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` | Updates `@types/node` from 26.6.2 to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `knip` from 6.38.0 to 6.44.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.44.0/packages/knip) Updates `turbo` from 2.11.4 to 2.11.10 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.11.4...v2.11.10) Updates `vite-plus` from 0.3.3 to 1.4.0 - [Release notes](https://github.com/voidzero-dev/vite-plus/releases) - [Commits](https://github.com/voidzero-dev/vite-plus/commits/v1.4.0/packages/cli) Updates `vue-tsc` from 3.3.11 to 3.3.14 - [Release notes](https://github.com/vuejs/language-tools/releases) - [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md) - [Commits](https://github.com/vuejs/language-tools/commits/v3.3.14/packages/tsc) Updates `fastify` from 5.12.5 to 5.12.7 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.5...v5.12.7) Updates `@nuxt/icon` from 2.5.1 to 2.6.2 - [Release notes](https://github.com/nuxt/icon/releases) - [Commits](nuxt/icon@v2.5.1...v2.6.2) Updates `@pinia/nuxt` from 1.0.2 to 1.0.3 - [Release notes](https://github.com/vuejs/pinia/releases) - [Commits](https://github.com/vuejs/pinia/compare/@pinia/nuxt@1.0.2...@pinia/nuxt@1.0.3) Updates `nuxt` from 4.5.2 to 4.6.3 - [Release notes](https://github.com/nuxt/nuxt/releases) - [Commits](https://github.com/nuxt/nuxt/commits/v4.6.3/packages/nuxt) Updates `pinia` from 4.0.3 to 4.1.0 - [Release notes](https://github.com/vuejs/pinia/releases) - [Commits](vuejs/pinia@v4.0.3...v4.1.0) Updates `vue` from 3.5.43 to 3.5.44 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.43...v3.5.44) Updates `vue-router` from 5.3.1 to 5.4.0 - [Release notes](https://github.com/vuejs/router/releases) - [Commits](vuejs/router@v5.3.1...v5.4.0) Updates `@playwright/test` from 1.63.0 to 1.64.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.63.0...v1.64.1) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-dependencies - dependency-name: knip dependency-version: 6.44.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pnpm-dependencies - dependency-name: turbo dependency-version: 2.11.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-dependencies - dependency-name: vite-plus dependency-version: 1.4.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: pnpm-dependencies - dependency-name: vue-tsc dependency-version: 3.3.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-dependencies - dependency-name: fastify dependency-version: 5.12.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-dependencies - dependency-name: "@nuxt/icon" dependency-version: 2.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-dependencies - dependency-name: "@pinia/nuxt" dependency-version: 1.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-dependencies - dependency-name: nuxt dependency-version: 4.6.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-dependencies - dependency-name: pinia dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-dependencies - dependency-name: vue dependency-version: 3.5.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-dependencies - dependency-name: vue-router dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-dependencies - dependency-name: "@playwright/test" dependency-version: 1.64.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pnpm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-09T09:22:22Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026

dependabot Bot requested a review from Typogalaxy as a code owner November 2, 2026 09:25

dependabot Bot added the javascript Pull requests that update javascript code label Nov 2, 2026

github-actions Bot added the frontend This changes files in app/frontend/. label Nov 2, 2026

dependabot Bot closed this Nov 9, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/dev/pnpm-dependencies-c21d7d4022 branch November 9, 2026 09:22

Navigation Menu

Repository navigation

chore(deps): bump the pnpm-dependencies group across 1 directory with 13 updates - #193

chore(deps): bump the pnpm-dependencies group across 1 directory with 13 updates#193
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/pnpm-dependencies-c21d7d4022

dependabot Bot commented on behalf of github Nov 2, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 6.44.0

Turborepo v2.11.10

What's Changed

Changelog

Turborepo v2.11.9

What's Changed

Changelog

vite-plus v1.4.0

Features

Fixes & Enhancements

v3.3.14

language-core

language-service

typescript-plugin

v3.3.13

language-core

vscode

v3.3.12

language-core

3.3.14 (2026-10-30)

language-core

language-service

typescript-plugin

3.3.13 (2026-10-10)

language-core

vscode

3.3.12 (2026-10-02)

language-core

v5.12.7

v5.12.6

⚠️ Security Release

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 2, 2026 •

edited

Loading