chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #1 · moeru-ai/injeca

renovate · 2026-04-16T08:29:13Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@antfu/eslint-config	`^8.2.0` → `^8.3.0`
@guiiai/logg	`>= 1` → `>= 1.2.11`
@types/node (source)	`^25.6.0` → `^25.7.0`
bumpp	`^11.0.1` → `^11.1.0`
eslint (source)	`^10.2.0` → `^10.3.0`
eslint-plugin-oxlint	`^1.60.0` → `^1.64.0`
nanoid	`>=5` → `>=5.1.11`
oxlint (source)	`^1.60.0` → `^1.64.0`
pnpm (source)	`10.33.0` → `10.33.4`
publint (source)	`^0.3.18` → `^0.3.21`
tsdown (source)	`^0.17.4` → `^0.22.0`
typescript (source)	`^6.0.2` → `^6.0.3`
vite (source)	`^8.0.8` → `^8.0.12`
vitest (source)	`^4.1.4` → `^4.1.6`

Release Notes

antfu/eslint-config (@antfu/eslint-config)

`v8.3.0`

Compare Source

🚀 Features

Make perfectionist configurable inside antfu() - by @oliver139 in #848 (ae1d6)
stylistic: Allow easy setting brace style - by @oliver139 in #846 (bd784)
svelte: Use recommended rules - by @Jungzl in #842 (6c839)

🐞 Bug Fixes

markdown: Scope user rule overrides away from md files - by @antfu and Claude Opus 4.7 (1M context) in #844 (8d25a)

View changes on GitHub

guiiai/logg (@guiiai/logg)

`v1.2.11`

Compare Source

🚀 Features

Hyperlink option - by @Neko-233 in #26 (226da)

View changes on GitHub

`v1.2.10`

Compare Source

🐞 Bug Fixes

Export - by @luoling8192 (3425f)

View changes on GitHub

`v1.2.9`

Compare Source

🚀 Features

Context - by @luoling8192 (a06d9)

View changes on GitHub

`v1.2.8`

Compare Source

No significant changes

View changes on GitHub

`v1.2.7`

Compare Source

`v1.2.6`

Compare Source

What's Changed

fix: improve stack trace filtering in createLogger by @luoling8192 in #24

Full Changelog: guiiai/logg@v1.2.5...v1.2.6

What's Changed

feat: enhance logging functionality with error stack parsing and hyperlink support by @luoling8192 in #16
chore: bump deps, lint by @luoling8192 in #17

Full Changelog: guiiai/logg@v1.0.10...v1.1.0

`v1.0.10`

Compare Source

`v1.0.9`

Compare Source

`v1.0.8`

Compare Source

`v1.0.7`

Compare Source

`v1.0.6`

Compare Source

`v1.0.5`

Compare Source

`v1.0.4`

Compare Source

`v1.0.3`

Compare Source

`v1.0.2`

Compare Source

`v1.0.1`

Compare Source

antfu-collective/bumpp (bumpp)

`v11.1.0`

Compare Source

🐞 Bug Fixes

Inherit stdio for git push to support windows SSH passphrase - by @awdr74100 in #122 (a30af)
cli: Prevent empty CLI files from overriding config-file files - by @benny123tw in #120 (4e42e)

View changes on GitHub

eslint/eslint (eslint)

`v10.3.0`

Compare Source

`v10.2.1`

Compare Source

oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)

`v1.64.0`

Compare Source

No significant changes

View changes on GitHub

`v1.63.0`

Compare Source

🐞 Bug Fixes

Ignore @typescript-eslint/consistent-type-imports for vue, astro, and svelte files - by @Sysix in #710 (e9eb2)

View changes on GitHub

`v1.62.0`

Compare Source

No significant changes

View changes on GitHub

`v1.61.0`

Compare Source

No significant changes

View changes on GitHub

ai/nanoid (nanoid)

`v5.1.11`

Compare Source

Fixed breaking Nano ID by requesting big ID.

`v5.1.10`

Compare Source

Fixed breaking Nano ID by requesting big ID (by @alanzabihi).

`v5.1.9`

Compare Source

Fixed npm package size regression.

`v5.1.8`

Compare Source

Made cusatomAlphabet 75% faster (by @saripovdenis).

`v5.1.7`

Compare Source

Added --version to CLI (by @mahmoodhamdi).
Updated nanoid.js for CDN (by @mahmoodhamdi).
Fixed docs (by @mahmoodhamdi).
Fixed customRandom types (by @oguimbal).

`v5.1.6`

Compare Source

Fixed infinite loop on 0 size for customAlphabet.

`v5.1.5`

Compare Source

Fixed latest version on npm after 3.x release.

`v5.1.4`

Compare Source

Fixed latest version on npm after 3.x release.

`v5.1.3`

Compare Source

Fixed React Native support (by @steida).

`v5.1.2`

Compare Source

Fixed module docs.

`v5.1.1`

Compare Source

Fixed opaque types support for non-secure generator.
Added JSR support.

`v5.1.0`

Compare Source

Added opaque types support (by @kossnocorp).

`v5.0.9`

Compare Source

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

`v5.0.8`

Compare Source

Reduced customAlphabet size (by @kirillgroshkov).

`v5.0.7`

Compare Source

Fixed Parcel support (by @WilhelmYakunin).

`v5.0.6`

Compare Source

Fixed React Native support.

`v5.0.5`

Compare Source

Make browser’s version faster by increasing size a little (by Samuel Elgozi).

`v5.0.4`

Compare Source

Fixed CLI docs (by @ilyaboka).

`v5.0.3`

Compare Source

Fixed CLI docs (by Chris Schmich).

`v5.0.2`

Compare Source

Fixed webcrypto import (by Divyansh Singh).

`v5.0.1`

Compare Source

Fixed Node.js 18 support.

oxc-project/oxc (oxlint)

`v1.64.0`

Compare Source

🚀 Features

fbb8f22 linter: Support ignores in overrides (#22148) (camc314)

🐛 Bug Fixes

25b7017 linter: Undocument override ignores option (#22213) (camc314)

`v1.63.0`

Compare Source

📚 Documentation

cacbc4a linter: Fix jest settings docs. (#22127) (connorshea)

`v1.62.0`

Compare Source

🚀 Features

348f46c linter: Add respectEslintDisableDirectives option (#21384) (Christian Vuerings)

🐛 Bug Fixes

8c425db linter: Allow string for jest version in config schema (#21649) (camc314)

`v1.61.1`

Compare Source

`v1.61.0`

Compare Source

🚀 Features

38d8090 linter/jest: Implemented jest version settings in config file. (#21522) (Said Atrahouch)

pnpm/pnpm (pnpm)

`v10.33.4`: pnpm 10.33.4

Compare Source

Patch Changes

Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.
Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #11341.

Platinum Sponsors

Gold Sponsors

`v10.33.3`

Compare Source

`v10.33.2`

Compare Source

`v10.33.1`: pnpm 10.33.1

Compare Source

Patch Changes

When a project's packageManager field selects pnpm v11 or newer, commands that v10 would have passed through to npm (version, login, logout, publish, unpublish, deprecate, dist-tag, docs, ping, search, star, stars, unstar, whoami, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example, pnpm version --help print npm's help on a project with packageManager: pnpm@11.0.0-rc.3 #11328.

Platinum Sponsors

Gold Sponsors

publint/publint (publint)

`v0.3.21`

Compare Source

Patch Changes

Suggest adding "sideEffects": false when bundler-oriented package fields or conditions are detected and the field is missing. (#228)

`v0.3.20`

Compare Source

Patch Changes

Suggest adding engines.node when it is missing from detected Node.js packages (#226)
Loosen "breaking change" wording in lint messages (7bb3f4f)

`v0.3.19`

Compare Source

Patch Changes

Add NESTED_PACKAGE_JSON_FIELD_IGNORED to warn when published nested package.json files define "exports" or "imports", which Node.js ignores outside the package root. (#224)
Fix internal browser directory traversal logic (#224)

rolldown/tsdown (tsdown)

`v0.22.0`

Compare Source

🚨 Breaking Changes

Drop Node.js < 22.18.0 support, make unrun optional, add tsx config loader - by @sxzz (a1042)
dts: Auto-enable dts when tsconfig declaration is true - by @sxzz in #872 (085f0)
publint: Use pkg from publint results, require publint v0.3.8+ - by @sxzz (413bb)

🚀 Features

Upgrade rolldown to 1.0.0-rc.18 - by @sxzz (66085)
Upgrade rolldown to v1.0.0 - by @sxzz (fabba)
exports: Auto-enable bin detection by default - by @sxzz in #873 (abda9)

🐞 Bug Fixes

Explicitly drop node 23 support - by @sxzz (85e65)
debug: Enhance debug logging for pack tarball - by @sxzz and Copilot (5de04)
exports: Detect types fields nested in conditional exports - by @sxzz (82fa1)
pkg: Fix duplicate configuration warning logic - by @ho991217 and @sxzz in #935 (6a0d9)

🔄 Migration Guide

Node.js version

Upgrade to Node.js 22.18.0 or later. Bun and Deno remain supported (experimental).

`unrun` is no longer bundled

If your environment relies on the unrun config loader (i.e. you're on a Node version without native TypeScript support and use the default auto loader), install it manually:

npm i -D unrun

# or, alternatively, the new tsx loader:
npm i -D tsx

If you use Node.js 22.18.0+ with native TypeScript support, no change is needed — the auto loader will pick native.

`dts` auto-enabled from tsconfig

If your tsconfig.json has compilerOptions.declaration: true but you do not want tsdown to emit .d.ts files, opt out explicitly:

// tsdown.config.ts
export default defineConfig({
  dts: false,
})

`exports.bin` auto-detection

Any entry chunk containing a shebang (e.g. #!/usr/bin/env node) now causes tsdown to write a bin field in package.json automatically. The semantics differ slightly from explicit bin: true:

Value	Single shebang	Multiple shebangs	No shebangs
(unset)	Auto-set bin	Warn, skip	Silent
`true`	Auto-set bin	Throw	Warn
`false`	No bin	No bin	No bin

To opt out entirely:

export default defineConfig({
  exports: { bin: false },
})

Links

`v0.21.10`

Compare Source

🚀 Features

Upgrade rolldown - by @sxzz (8a449)

View changes on GitHub

`v0.21.9`

Compare Source

🚀 Features

Upgrade rolldown - by @sxzz (2d74e)
config: Track transitive config dependencies for watch reload - by @sxzz in #919 (16e27)
exports: Add bin to publishConfig when devExports is enabled - by @sxzz in #911 (60592)
plugin: Add tsdownConfig and tsdownConfigResolved plugin hooks - by @sxzz in #918 (665e5)

🐞 Bug Fixes

Skip package.json writting when content is deeply equal - by @ocavue and @sxzz in #913 (d8e1c)
Skip Node.js version check in Bun - by @sxzz (38afd)
css: Detect css modules from full id for vue virtual sfc styles - by @sxzz in #917 (e6021)

View changes on GitHub

`v0.21.8`

Compare Source

🚀 Features

Upgrade rolldown - by @sxzz (7f887)
attw: Improve ignoreRules type to autocomplete known values - by @mrlubos in #892 (c8f5c)
create-tsdown: Add Vite Plus template option - by @sxzz (daed0)
exports: Add extensions option for subpath export keys - by @SinhSinhAn and @sxzz in #899 (1bb7a)
target: Add support for baseline-widely-available target - by @sxzz in #896 (d6a16)

🐞 Bug Fixes

Export type only for cjs dts re-export - by @sxzz (25510)
Exclude shim file from bundled dependency hint - by @sxzz in #909 (3f8de)
dts: Skip cjs dts reexport for non-entry chunks - by @sxzz (5fee2)

View changes on GitHub

`v0.21.7`

Compare Source

🚀 Features

Add module option for attw and publint to allow passing imported modules directly - by @sxzz (31e90)

🐞 Bug Fixes

deps: Add skipNodeModulesBundle dep subpath e2e tests and fix docs - by @sxzz (deff7)

View changes on GitHub

`v0.21.6`

Compare Source

🚀 Features

Upgrade rolldown to v1.0.0-rc.12 - by @sxzz (51292)
config:
- Pass root config to workspace config functions - by @sxzz (76169)
- Use mergeConfig for workspace config merging and support variadic overrides - by @sxzz (148aa)
dts:
- Add cjsReexport option to eliminate dual module type hazard - by @mandarini and @sxzz in #856 (875c1)
exports:
- Add bin option to auto-generate package.json bin field - by @sxzz in #869 (7ebd6)

🐞 Bug Fixes

css:
- Compile preprocessor langs in virtual CSS modules - by @sxzz in #865 (7b2e0)
- Strip .module from CSS output filenames - by @sxzz in #866 (03ade)
- Default splitting to true in unbundle mode for CSS inject - by @sxzz in #867 (a4da6)
- Split CSS plugin into pre/post phases for scoped CSS support - by @sxzz in #870 (ff0c4)
entry:
- Correctly output relative paths in logger output - by @sxzz (00050)

View changes on GitHub

`v0.21.5`

Compare Source

🚀 Features

Update rolldown to 1.0.0-rc.10 - by @wChenonly in #845 (41411)
Support typescript v6 - by @ocavue in #858 (bffc4)

🐞 Bug Fixes

css:
- Run final minification on merged CSS output - by @sxzz in #853 (475df)
- Don't override internal importer - by @Laupetin in #860 (af40e)
- Use aliased exports for CSS module keys - by @wChenonly and @sxzz in #840 (bb6de)
deps:
- External optionalDependencies by default - by @sxzz (cd24d)
- Resolve subpath extensions for packages without exports field - by @sxzz in #863 (c5150)
- Correctly resolve root @types packages for dts deep imports - by @brc-dd and @sxzz in #852 (0b276)

View changes on GitHub

`v0.21.4`

Compare Source

🚀 Features

css: Add CSS modules support - by @sxzz in #834 (2a88a)

🐞 Bug Fixes

exports: Preserve CRLF line endings in package.json - by @sxzz (a4d4e)

View changes on GitHub

`v0.21.3`

Compare Source

🚀 Features

copy: Add support for watching copy source files - by @schplitt in #721 (7c23a)

🐞 Bug Fixes

css: Watch inline CSS files in watch mode - by @sxzz (2051a)
exports: Sort inlined dependencies by package name - by @sxzz (0ec71)
publint: Support Yarn v1 - by @sxzz (4a291)
unbundle: Root should be lowest common ancestor of entry files - by @sxzz (f1823)

View changes on GitHub

`v0.21.2`

Compare Source

🚨 Breaking Changes

exe: Add exe.outDir for separate executable output dir, defaults to build - by @sxzz (d49ef)

Note: Executable is still an experimental feature and does not follow SemVer. Breaking changes may occur in any release.

🚀 Features

Add root option for controlling output directory structure - by @sxzz (bad2d)
deps: Rename onlyAllowBundle to onlyBundle - by @peaklabs-dev and @sxzz in #819 (cbd7b)

🐞 Bug Fixes

css: Skip data URIs and external URLs in CSS url() rebasing - by @sxzz (13907)

View changes on GitHub

`v0.21.1`

Compare Source

🚨 Breaking Changes

css: Move all CSS support to @tsdown/css package - by @sxzz in #809 (1b1a1)

[!IMPORTANT]
If you are using CSS features (e.g., CSS imports), you now need to manually install the @tsdown/css package:
npm install @&#8203;tsdown/css -D
# or
pnpm add @&#8203;tsdown/css -D
Note: CSS support is still an experimental feature and does not follow SemVer. Breaking changes may occur in any release.

🚀 Features

css:
- Add css.inject option to preserve CSS imports in JS output - by @sxzz and Claude Haiku 4.5 in #808 (ad745)
- Support ?inline query for CSS imports - by @sxzz in [#&#82

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added the dependencies label Apr 16, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch from 91f2638 to 57224c8 Compare April 19, 2026 06:20

renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 57cd241 to 4002be7 Compare May 7, 2026 17:32

renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from b01cb19 to a2120eb Compare May 12, 2026 03:17

chore(deps): update all non-major dependencies

b33fb38

renovate Bot force-pushed the renovate/all-minor-patch branch from a2120eb to b33fb38 Compare May 13, 2026 19:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies#1

chore(deps): update all non-major dependencies#1
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

What's Changed

What's Changed

🐞 Bug Fixes

🐞 Bug Fixes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🚀 Features

🐛 Bug Fixes

🚀 Features

v10.33.4: pnpm 10.33.4

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.33.1: pnpm 10.33.1

Patch Changes

Platinum Sponsors

Gold Sponsors

Patch Changes

Patch Changes

Patch Changes

🚨 Breaking Changes

🚀 Features

🐞 Bug Fixes

🔄 Migration Guide

Node.js version

unrun is no longer bundled

dts auto-enabled from tsconfig

exports.bin auto-detection

Links

🚀 Features

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

renovate Bot commented Apr 16, 2026 •

edited

Loading

`v10.33.4`: pnpm 10.33.4

`v10.33.1`: pnpm 10.33.1

`unrun` is no longer bundled

`dts` auto-enabled from tsconfig

`exports.bin` auto-detection