Skip to content

fix(deps): update non-major (npm) - #397

Open
renovate[bot] wants to merge 1 commit into
dev/v2.1from
renovate/non-major-npm
Open

fix(deps): update non-major (npm)#397
renovate[bot] wants to merge 1 commit into
dev/v2.1from
renovate/non-major-npm

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@biomejs/biome (source) 2.5.10 → 2.5.11 age confidence
@types/node (source) 26.2.0 → 26.4.0 age confidence
@types/react-dom (source) 19.2.4 → 19.2.5 age confidence
fumadocs-core 16.15.1 → 16.15.4 age confidence
fumadocs-ui 16.15.1 → 16.15.4 age confidence
knip (source) 6.32.2 → 6.34.0 age confidence
lefthook 2.1.10 → 2.1.12 age confidence
next (source) 16.3.2 → 16.3.4 age confidence
posthog-js (source) 1.418.10 → 1.422.5 age confidence
sharp (source, changelog) 0.35.3 → 0.35.4 age confidence
turbo (source) 2.10.11 → 2.10.12 age confidence

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.11

Compare Source

Patch Changes

  • #​11499 9743d0c Thanks @​scs0209! - Fixed #​11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #​11437 88f805e Thanks @​Princesseuh! - Fixed #​9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #​11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #​11507 e2fc036 Thanks @​dyc3! - Fixed #​11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #​11398 afc4615 Thanks @​dyc3! - Fixed #​11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #​11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #​11458 a7cd286 Thanks @​dyc3! - Fixed #​11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #​11515 382b15d Thanks @​dyc3! - Fixed #​11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #​11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #​11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #​11407 6ef52b0 Thanks @​1678092075! - Fixed #​11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #​11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

  • #​11462 18883b7 Thanks @​dyc3! - Fixed #​10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

  • #​11476 3270ca4 Thanks @​dyc3! - Fixed #​10330: Vue interpolation delimiters now stay attached to whitespace-sensitive element boundaries and adjacent inline siblings, wrapping their expression when needed to fit the configured line width. Interpolations followed by text now also converge after one formatting pass.

    -<v-btn v-if="store.state.user" variant="text" to="/my-rooms"
-  >{{ $t("nav.my-rooms") }}</v-btn
->
+<v-btn v-if="store.state.user" variant="text" to="/my-rooms">{{
+  $t("nav.my-rooms")
+}}</v-btn>

  • #​11191 3e5367f Thanks @​ematipico! - Added the nursery rule noUndeclaredCustomProperties, which reports references to custom properties that are not defined in available CSS, static HTML-like style attributes, or JSX string style attributes.

    For example, the following snippet triggers the rule:

    a { color: var(--undefined-color); }

  • #​11435 7754894 Thanks @​levrik! - Fixed: Variables and imports used as custom Vue directives are no longer reported as unused.

    For example:

    <script setup>
const vHighlight = {
  mounted: (element) => {
    element.style.color = "red";
  },
};
</script>

<template>
  <p v-highlight>Hello</p>
</template>

  • #​11501 e6acded Thanks @​aminya! - Improved the performance of useArraySortCompare by skipping type inference for calls to unrelated methods.

  • #​11467 66b282c Thanks @​dyc3! - Fixed #​11464: Biome now parses parenthesized object literals returned from arrow functions when they contain a conditional expression and a nested arrow function.

  • #​11456 db9aa2a Thanks @​dyc3! - Fixed #​10278: Marked the fix for noThisInStatic as unsafe by default.

  • #​11502 652aedb Thanks @​levrik! - noGlobalAssign no longer reports assignments to a Vue <script setup> binding from a template expression, when the binding's name happens to match a built-in global (e.g. open, parent, top).

    For example, this no longer triggers a diagnostic:

    <script setup>
const open = defineModel();
</script>

<template>
  <button @click="open = !open">Toggle</button>
</template>
webpro-nl/knip (knip)

v6.34.0: Release 6.34.0

Compare Source

v6.33.0: Release 6.33.0

Compare Source

v6.32.3: Release 6.32.3

Compare Source

evilmartians/lefthook (lefthook)

v2.1.12

Compare Source

vercel/next.js (next)

v16.3.4

Compare Source

v16.3.3

Compare Source

PostHog/posthog-js (posthog-js)

v1.422.5

Compare Source

1.422.5

Patch Changes

v1.422.4

Compare Source

1.422.4

Patch Changes
  • #​4626 3c650a1 Thanks @​nandinitiw! - Re-translate popover surveys when the display language changes while the survey is on screen, either from a browser languagechange event or from identify() updating the language person property. In-progress answers are preserved. $survey_questions[].question and $survey_language on survey sent / survey dismissed now report the text and language the user saw when they answered, not the language active when the event fired. Feedback-button (widget) surveys are unchanged.
    (2026-08-28)
  • Updated dependencies [3c650a1]:

v1.422.3

Compare Source

1.422.3

Patch Changes
  • #​4669 d0279e5 Thanks @​posthog! - Autocapture no longer throws a RangeError into the host page when it sorts element attributes. It now sorts attribute keys with a plain lexical comparator instead of localeCompare, which can throw on browsers with faulty ICU data.
    (2026-08-28)
  • Updated dependencies [d0279e5]:

v1.422.2

Compare Source

1.422.2

Patch Changes
  • #​4665 d5ef459 Thanks @​fasyy612! - Session replay can now bound DOM mutation bytes with an opt-in budget. Set __mutationBytesBucketSize (e.g. 1MB) to enable: mutations beyond the sustained budget (__mutationBytesRefillRate, default 25KB/s) are dropped and the recording resyncs with a full snapshot, keeping recordings from apps with very high DOM churn playable. Off by default.
    (2026-08-28)
  • Updated dependencies [d5ef459]:

v1.422.1

Compare Source

v1.422.0

Compare Source

1.422.0

Minor Changes
  • #​4658 db8687c Thanks @​posthog! - Report $sdk_debug_replay_throttled_mutations_dropped on captured events, counting the attribute changes the session recorder discarded during that session. The recorder throttles elements that change hundreds of times a second, and a discarded class or style change never reaches the player — so a recording can keep showing an element the live page had already hidden. Query this property to see whether your app is affected.
    (2026-08-27)

v1.421.2

Compare Source

1.421.2

Patch Changes

  • #​4653 712223a Thanks @​posthog! - Fix request timeouts never firing on pages where a browser extension makes Error.prototype.name non-writable
    (2026-08-27)

  • #​4036 718beee Thanks @​emmayusufu! - Fix logs.captureConsoleLogs set in init() not enabling console autocapture, capture console calls made before the logs script loads, and drop captured console records when the user opts out
    (2026-08-27)

  • #​4036 718beee Thanks @​emmayusufu! - Fix session replay and posthog-js leaving each other's console wrapper in the call path when either one stops
    (2026-08-27)

  • Updated dependencies [718beee, 712223a]:

v1.421.1

Compare Source

1.421.1

Patch Changes

  • #​4657 9c09bd4 Thanks @​marandaneto! - Use the best available compression for browser feature flag requests, preferring gzip when supported.
    (2026-08-27)

  • #​4520 362d081 Thanks @​veksa! - Drop sourcesContent from the source maps published to npm. The maps themselves still ship, so downstream source-map chaining and the //# sourceMappingURL references are unaffected — only the copy of our TypeScript sources embedded in each map is gone, taking the package from 40.8 MB to 17.4 MB unpacked. CDN artifacts are built separately and keep their inlined sources.
    (2026-08-27)

  • Updated dependencies [7902e44, e899b1c]:

v1.421.0

Compare Source

1.421.0

Minor Changes
  • #​4655 4f80973 Thanks @​robbie-c! - Add the 2026-08-30 config defaults. These defaults enable sanitized JSON-LD replay events.
    (2026-08-26)
Patch Changes

v1.420.0

Compare Source

1.420.0

Minor Changes
  • #​4640 0d2cf49 Thanks @​robbie-c! - Add opt-in Schema.org JSON-LD capture to session replay through session_recording.captureJsonLd. When enabled, the recorder emits sanitized JSON-LD as custom replay events and excludes all script elements from replay snapshots.
    (2026-08-26)
Patch Changes

  • #​4635 ab1383a Thanks @​robbie-c! - Capture paste interactions with clipboard autocapture without collecting pasted text.
    (2026-08-26)

  • #​4594 1d88b4e Thanks @​posthog! - Fix session replay playback ending when a recording contains a shadow host the browser refuses. The player now skips that one subtree instead of aborting the rebuild.
    (2026-08-26)

  • Updated dependencies [ab1383a, 0d2cf49]:

v1.419.4

Compare Source

1.419.4

Patch Changes

  • #​4592 ca540f9 Thanks @​dustinbyrne! - Add typed stable-name lookup for installed browser extensions and use it when independently loaded survey code resolves feature flags.
    (2026-08-25)

  • #​4533 53fcb2d Thanks @​dustinbyrne! - Fix console log autocapture silently failing when an older posthog-js core loads a newer logs bundle.
    (2026-08-25)

  • #​4476 ed4dd97 Thanks @​posthog! - fix(browser): refresh configured feature flags when a hidden tab becomes visible

    Feature flags now own their automatic refresh timer and visibility listener.
    Hidden tabs reload due flags when they become visible. The existing five-minute
    default and remote_config_refresh_interval_ms behavior remain unchanged. (2026-08-25)

  • Updated dependencies [53fcb2d, ca540f9, ed4dd97]:

v1.419.3

Compare Source

v1.419.2

Compare Source

1.419.2

Patch Changes

  • #​4645 cb7cc12 Thanks @​turnipdabeets! - Type declarations no longer import the JSX namespace from react, so they typecheck against @types/react back to the declared 16.8.0 floor. Component return types are now spelled ReactElement<any, any>, which is the definition of JSX.Element — the same type, so consuming code is unaffected.

    JSX only became an exported member of the react types module in @types/react@18.2.6, so projects on older React types previously saw TS2305: Module '"react"' has no exported member 'JSX' when checking these declarations with skipLibCheck: false. (2026-08-25)

v1.419.1

Compare Source

1.419.1

Patch Changes

  • #​4638 d166e54 Thanks @​github-actions! - Declare react and @types/react as optional peer dependencies so the posthog-js/react entry point can resolve React on strict node_modules layouts — pnpm and bun isolated linkers backed by a global store, where the package is installed outside the project tree and Node's directory walk never reaches the app's React.

    Projects that do not import posthog-js/react are unaffected: the peers are optional, so npm, pnpm, yarn, and bun install them only when React is already present and emit no unmet-peer warnings. (2026-08-25)

v1.419.0

Compare Source

1.419.0

Minor Changes
  • #​4598 334159b Thanks @​posthog! - Web vitals now capture attribution by default for INP and LCP, so a slow interaction or paint arrives with the target element and phase breakdown that make it diagnosable. CLS stays without attribution by default, because its attribution holds detached DOM nodes and can leak memory in single-page apps. Set capture_performance.web_vitals_attribution to false to opt out, true for every metric, or an array to name the metrics. The captured metric also drops the empty entries array and bounds attribution to a small set of useful fields, and the attributed INP observer no longer collects the processedEventEntries we never read.
    (2026-08-25)
Patch Changes

v1.418.17

Compare Source

1.418.17

Patch Changes

v1.418.16

Compare Source

1.418.16

Patch Changes
  • #​4607 7ec4f0d Thanks @​posthog! - Drop exceptions thrown by user scripts the browser injects into every page (Firefox for iOS, Chrome for iOS) instead of reporting them as the page's own errors. Set error_tracking.captureExtensionExceptions: true to keep capturing them.
    (2026-08-24)
  • Updated dependencies [7ec4f0d]:

v1.418.15

Compare Source

1.418.15

Patch Changes

v1.418.14

Compare Source

1.418.14

Patch Changes

v1.418.13

Compare Source

1.418.13

Patch Changes

  • #​4418 be2161d Thanks @​posthog! - feat: add granular automatic pageview options for SPA navigation

    capture_pageview now accepts an object with path, search, and hash options. Each selected URL component triggers a $pageview when it changes, including direct hash changes used by hash-based routers. The existing 'history_change' option continues to capture pathname changes. (2026-08-24)

  • Updated dependencies [be2161d]:

v1.418.12

Compare Source

1.418.12

Patch Changes
  • #​4501 9e853c1 Thanks @​posthog! - Session replay: fixed a stale element left rendered in the player when a mutation re-added a node id with changed attributes. Affects both useVirtualDom modes.
    (2026-08-24)

v1.418.11

Compare Source

1.418.11

Patch Changes

  • #​4603 ca030a6 Thanks @​martinfrancois! - Stop adding PostHog's optional feature scripts, such as the session replay recorder and exception autocapture, to the page more than once. Sites that proxy PostHog through their own domain, by setting api_host to a path like /ingest rather than a full URL, ended up with the same <script> tag three or four times: the check meant to spot the duplicate compared the browser's resolved absolute URL against the relative one, so it never matched. The network tab showed a single request either way, because the browser served the repeats from its cache, which is why this was easy to miss. Nothing measurable got slower as a result, so this is a correctness fix rather than a speed one.
    (2026-08-24)

  • #​4453 325870a Thanks @​posthog! - When session replay is waiting on a trigger, debug mode now names the conditions that haven't matched yet (for example buffering: URL condition not matched, or the named trigger group whose condition is pending) instead of only reporting buffering. Enable it with posthog.debug(). Logged once per change, not once per flush.
    (2026-08-24)

lovell/sharp (sharp)

v0.35.4

Compare Source

:::note[Dependency versions]
https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3
:::

vercel/turborepo (turbo)

v2.10.12: Turborepo v2.10.12

Compare Source

What's Changed

Changelog

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EMISSINGTARGET
npm error Missing target in lock file: "docs" is referenced by "node_modules/docs" but does not exist.
npm error To fix:
npm error 1. rm package-lock.json
npm error 2. npm install
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-04T02_42_59_092Z-debug-0.log

@vercel

vercel Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sockguard-website Ready Ready Preview Aug 31, 2026 7:05pm

@renovate
renovate Bot force-pushed the renovate/non-major-npm branch from 97043a6 to a06d98c Compare August 31, 2026 15:40
@renovate
renovate Bot force-pushed the renovate/non-major-npm branch from a06d98c to 6cfe94d Compare August 31, 2026 19:04
@renovate
renovate Bot force-pushed the renovate/non-major-npm branch from 6cfe94d to 8849d7a Compare September 3, 2026 11:20
@vercel

vercel Bot commented Sep 3, 2026

Copy link
Copy Markdown

Deployment failed for project sockguard-website with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit

@renovate
renovate Bot force-pushed the renovate/non-major-npm branch 3 times, most recently from 9e0c464 to 4b586cf Compare September 3, 2026 23:03
@renovate
renovate Bot force-pushed the renovate/non-major-npm branch from 4b586cf to 388af58 Compare September 4, 2026 02:43
@renovate
renovate Bot changed the base branch from dev/v2.0 to dev/v2.1 September 4, 2026 02:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@scttbnsn scttbnsn Awaiting requested review from scttbnsn scttbnsn is a code owner
@ALARGECOMPANY ALARGECOMPANY Awaiting requested review from ALARGECOMPANY ALARGECOMPANY is a code owner
@biggest-littlest biggest-littlest Awaiting requested review from biggest-littlest biggest-littlest is a code owner

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants