chore: update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	21.2.1 → 21.2.3
@commitlint/config-conventional (source)	21.2.0 → 21.2.3
@semantic-release/github	12.0.9 → 12.0.10
@tsconfig/node24 (source)	24.0.4 → 24.0.5
@types/node (source)	24.13.3 → 24.19.0
@vercel/ncc	0.44.1 → 0.45.0
lefthook	2.1.10 → 2.1.15
oxfmt (source)	0.59.0 → 0.71.0
oxlint (source)	1.74.0 → 1.86.0
semantic-release	25.0.8 → 25.0.9
tsx (source)	4.23.1 → 4.23.15
vite (source)	8.1.5 → 8.3.1
yaml (source)	2.9.0 → 2.9.1
zod (source)	4.4.3 → 4.6.5

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.3

Compare Source

Bug Fixes

• lint: trim trailing whitespace off the message handed to ignore matchers (#​4960) (a6f279b)

v21.2.2

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.2.3

Compare Source

Bug Fixes

• rules: report the case that matched in case rule failure messages (#​4962) (9f5f7bc)

v21.2.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

semantic-release/github (@​semantic-release/github)

v12.0.10

Compare Source

Bug Fixes

• deps: update dependency @​octokit/plugin-paginate-rest to v15 (#​1284) (a63f458)

tsconfig/bases (@​tsconfig/node24)

v24.0.5

Compare Source

vercel/ncc (@​vercel/ncc)

v0.45.0

Compare Source

Features

• update @​vercel/webpack-asset-relocator-loader to 1.10.3 (#​1342) (cb1f1f0)

evilmartians/lefthook (lefthook)

v2.1.15

Compare Source

• fix: do not pipe stdin into post-checkout git-lfs hook (#​1523) by @​rwinkelman
• fix: remove color blending (#​1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#​1485) by @​hamodywe
• test: regression for valid fish shell completion output (#​1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#​1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#​1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#​1547) by @​Yash121l

v2.1.14

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.12

Compare Source

• fix: fail the hook when staging fixed files errors (#​1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#​1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#​1508) by @​mariokresic

oxc-project/oxc (oxfmt)

v0.71.0: oxfmt v0.71.0

Compare Source

🚀 Features

• e0b1f9f oxfmt: Bump bundled Prettier version to 3.9.9 (#​27002) (leaysgur)
• 342527d oxfmt: Bump bundled Prettier version to 3.9.8 (#​26999) (leaysgur)

🐛 Bug Fixes

• eeba1db formatter: Skip test-call layout when arguments have comments (#​27119) (leaysgur)
• 1f7b8ad oxfmt: Allow repeated CLI calls in the same process (#​27051) (Liang)
• 7bcb807 formatter_markdown: Keep blank line between HTML and nested list (#​27112) (leaysgur)
• 10b10c5 formatter: Keep comments around = on their side and line (#​27041) (leaysgur)
• 9aad365 formatter: Keep comments deferred before an assignment operator (#​26997) (waltu)
• 8fbddb1 formatter/jsdoc: More alignment with original plugin (#​27039) (leaysgur)
• 50be18e formatter: Keep trailing spaces on normal block comments (#​27037) (leaysgur)
• 56d1880 formatter: Nestle adjacent block comments (#​27036) (leaysgur)
• 3be5d94 formatter: Treat /*** comments as JSDoc (#​27035) (leaysgur)
• cd45f71 formatter: Keep trailing double spaces on JSDoc lines (#​26861) (John Costa)
• fd695f4 formatter_markdown: Fix more mismatches found in ecosystem-ci repos (#​27003) (leaysgur)
• 4e77d59 formatter_markdown: Keep a math span after a kept line break from opening a block (#​27001) (leaysgur)
• 584b8b0 formatter_markdown: Keep a shape line after a multi-line inline node or link title (#​27000) (leaysgur)
• b939645 formatter_markdown: Keep a line break before an inline liquid tag under preserve (#​26998) (leaysgur)

v0.70.0: oxfmt v0.70.0

Compare Source

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#​26763) (leaysgur)

v0.69.0

Compare Source

v0.68.0

Compare Source

v0.67.0

Compare Source

🛡️ Security

• 9a612d5 deps: Update npm packages (#​26178) (renovate[bot])

v0.66.0

Compare Source

v0.65.0

Compare Source

v0.64.0

Compare Source

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#​25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#​25572) (leaysgur)

v0.63.0

Compare Source

v0.62.0

Compare Source

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#​25008) (leaysgur)

v0.61.0

Compare Source

v0.60.0

Compare Source

oxc-project/oxc (oxlint)

v1.86.0

Compare Source

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#​27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#​26958) (camc314)

v1.85.0: oxlint v1.85.0

Compare Source

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#​26763) (leaysgur)

v1.84.0

Compare Source

v1.83.0

Compare Source

v1.82.0

Compare Source

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#​26249) (camc314)

v1.81.0

Compare Source

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#​26100) (camc314)

v1.80.0

Compare Source

v1.79.0

Compare Source

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#​25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#​25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#​25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#​25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#​25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#​25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#​25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#​25516) (Boshen)

v1.78.0

Compare Source

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#​25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#​24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#​24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#​25320) (Mikhail Baev)

v1.77.0

Compare Source

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#​25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#​25110) (camc314)

v1.76.0

Compare Source

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#​24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#​24724) (Bartok)
• 016cf2a linter/oxc: Add bad-match-all-arg rule (#​24900) (camc314)
• cdc941e linter/n: Implement exports-style rule (#​24087) (Mikhail Baev)
• 1ad6f6c linter/eslint: Implement id-denylist rule (#​24632) (Mikhail Baev)

📚 Documentation

• 3ff2e0e linter: Clarify config extends types (#​24936) (Boshen)

v1.75.0

Compare Source

🚀 Features

• dd18383 linter/node: Implement no-top-level-await rule (#​24634) (Connor Shea)
• 16a65f2 linter/react: Implement function-component-definition rule (#​24471) (Cole Ellison)
• 7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#​24519) (Mikhail Baev)
• 99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#​24502) (camc314)

🐛 Bug Fixes

• 8694167 linter/eslint/prefer-destructuring: Handle typed declarations (#​24616) (camc314)

semantic-release/semantic-release (semantic-release)

v25.0.9

Compare Source

Bug Fixes

• do not expose the authenticated repository URL in EGITNOPERMISSION errors (#​4283) (8d905a5)

privatenumber/tsx (tsx)

v4.23.15

Compare Source

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

Compare Source

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#​802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

Compare Source

Bug Fixes

• cache: bound shared transform cache memory (#​835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

Compare Source

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#​829) (ed9d330), closes #​828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

Compare Source

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

Compare Source

Bug Fixes

• support nyc coverage discovery (#​710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

Compare Source

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

Compare Source

Bug Fixes

• preserve package subpath resolution (be1315e)
• preserve typeless ESM dependency exports (70dfc5e)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.7

Compare Source

Bug Fixes

• prevent tsImport cache collisions (4e5a138)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.6

Compare Source

Bug Fixes

• compose resolver URL metadata (5040762)
• preserve Node resolution with allowJs (2046d9e)
• preserve resolver URL metadata (a91df46)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.5

Compare Source

Bug Fixes

• detect the Node inspector enabled via NODE_OPTIONS (3c1d051)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.4

Compare Source

Bug Fixes

• cli: allow async process.once() signal handlers to finish (#​827) (2afc7bb)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.3

Compare Source

Bug Fixes

• preserve listenerCount overload semantics (#​823) (b6574d4)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.2

Compare Source

Bug Fixes

• watch: exit with 128 + signal number when interrupted (#​820) (0b00bc8)

---

This release is also available on:

• npm package (@​latest dist-tag)

vitejs/vite (vite)

v8.3.1

Compare Source

Bug Fixes

• deps: update all non-major dependencies (#​23482) (3c752c8)
• deps: update all non-major dependencies (#​23537) (e8990c4)
• deps: update rolldown-related dependencies (#​23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#​23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#​23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#​23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#​23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#​23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#​23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#​23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#​23566) (63567c7)
• update optimizeDeps.include comment (#​23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#​23491) (f4b4431)
• remove duplicate configurations (#​23532) (9abd99b)
• replace find with some (#​23554) (af7cdf6)

v8.3.0

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)
• devtools: enable dev server integration (#​23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#​23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#​23110) (e17d2d5)
• add top-level tsconfig option (#​23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#​23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#​23042) (a500dee)
• config: warn on named imports from JSON modules (#​23378) (472385e)
• css: minify style tag (#​23183) (8156684)
• searched params attached to workers are now preserved (#​22280) (517b97f)
• support subpath imports in dynamic import statements (#​23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#​22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#​22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#​22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#​23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #​17467) (#​23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#​23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#​23373) (a6d43bc)
• deps: update all non-major dependencies (#​23445) (fc7c104)
• html: don't inline preload link targets (fix #​13355) (#​23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#​23356) (8492422)
• shortcuts extend error (#​23447) (4ec58d1)
• config: close bundles when generation fails (#​23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#​23265) (4f9d2f4)
• deps: update all non-major dependencies (#​23337) (d550815)
• deps: update all non-major dependencies (#​23404) (238ad81)
• deps: update rolldown-related dependencies (#​23338) (76e8082)
• deps: update rolldown-related dependencies (#​23405) (b882566)
• dev: run closeBundle after buildEnd failure (#​23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#​23171) (6162968)
• utils: handle dot in srcset density descriptor (#​23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#​23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#​23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#​23357) (f794133)
• remove unnecessary comment (#​23448) (b919a1a)
• delete unused PluginContainerOptions (#​23382) (ee64401)
• use oxfmt sortImports (#​23319) (97ad042)

Code Refactoring

• delete unused esbuildPlugin (#​23381) (f40efef)
• exclude postfix from __VITE_ASSET__ (#​22886) (a6c08e1)
• remove HmrUrl concept (#​23172) (67a6807)
• use urlId of import.meta.ROLLDOWN_FILE_URL in wasm plugin (#​22962) (92bd2a7)

Tests

• add renderBuiltUrl change changes hash (#​23118) (0291408)

Beta Changelogs

8.3.0-beta.1 (2026-09-07)

See 8.3.0-beta.1 changelog

8.3.0-beta.0 (2026-09-02)

See 8.3.0-beta.0 changelog

v8.2.4

Compare Source

Please refer to CHANGELOG.md for details.

v8.2.2

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)
• devtools: enable dev server integration (#​23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#​23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#​23110) (e17d2d5)
• add top-level tsconfig option (#​23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#​23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#​23042) (a500dee)
• config: warn on named imports from JSON modules (#​23378) (472385e)
• css: minify style tag (#​23183) (8156684)
• searched params attached to workers are now preserved (#​22280) (517b97f)
• support subpath imports in dynamic import statements (#​23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#​22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#​22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#​22473) (924997a)

Bug Fixes

• handle CRLF line endings

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.