chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@oxc-project/types (source)	^0.149.0 → ^0.150.0			pnpm.catalog.default	minor
@paypal/paypal-js (source)	^11.0.0 → ^11.0.1			pnpm.catalog.default	patch	11.1.0
@paypal/paypal-js (source)	^11.0.0 → ^11.0.1			peerDependencies	patch	11.1.0
@stripe/stripe-js (source)	^9.15.0 → ^9.16.0			peerDependencies	minor
@types/node (source)	^26.5.0 → ^26.5.1			pnpm.catalog.default	patch	26.6.1 (+1)
Hebilicious/reproduire	v0.0.9-mp → v0.0.9			action	patch
happy-dom	^20.14.0 → ^20.14.5			pnpm.catalog.default	patch
magic-string	^1.2.3 → ^1.4.1			pnpm.catalog.default	minor
magicast	^0.5.4 → ^0.5.5			pnpm.catalog.default	patch
maplibre-gl (source)	^6.8.0 → ^6.9.1			pnpm.catalog.default	minor	6.10.0
maplibre-gl (source)	^6.8.0 → ^6.9.1			peerDependencies	minor	6.10.0
node	24 → 24.21.0			uses-with	minor
pnpm (source)	12.3.4 → 12.4.1			packageManager	minor	12.4.2
posthog-js (source)	^1.428.7 → ^1.433.3			pnpm.catalog.default	minor	1.433.5 (+1)
posthog-js (source)	^1.428.7 → ^1.433.3			peerDependencies	minor	1.433.5 (+1)
rollup (source)	^4.63.1 → ^4.63.3			pnpm.catalog.default	patch
unimport	^7.0.1 → ^7.0.2			pnpm.catalog.default	patch
valibot (source)	^1.4.2 → ^1.5.0			pnpm.catalog.default	minor
vite (source)	^8.2.2 → ^8.3.0			pnpm.catalog.default	minor

---

Release Notes

paypal/paypal-js (@​paypal/paypal-js)

v11.0.1

Compare Source

Patch Changes

• 39f147e: Guard the environment option against prototype pollution in validateArguments().

  processOptions() already read environment via Object.prototype.hasOwnProperty.call(), but validateArguments() (v5 loadScript) and the v6 loadCoreSdkScript validator still destructured it directly, so a polluted Object.prototype.environment was picked up before those guards ran. On the v5 path a junk value would throw and break loadScript() entirely; on the v6 path a polluted "sandbox" value would pass validation and silently load the sandbox SDK. Both validators now use an own-property check so inherited values are ignored.

• 24ccc6a: Make onApprove genuinely optional on PayPalOneTimePaymentSessionOptions (and its PayLaterOneTimePaymentSessionOptions / PayPalCreditOneTimePaymentSessionOptions aliases).

  The type intersected BasePaymentSessionOptions — where onApprove is required — and re-declared onApprove? without Omit-ing it from the base first. In a TypeScript intersection a property is optional only if it is optional in every constituent, so the ? had no effect and onApprove was required in practice (#​1020). Because the presentation mode is only chosen later at .start() (a separate call) and redirect flows legitimately have no in-page approval callback, core cannot require onApprove. It is now re-added as optional via Omit<BasePaymentSessionOptions, "onApprove">, mirroring SavePaymentSessionOptions.

• eb54388: Emit a nested dist/v6/esm/package.json with {"type":"module"} so the v6 ESM bundle is correctly signaled as an ES module.

  The v6 build outputs ESM syntax into .js files, but the package has no root "type":"module" (it can't — that would relabel the v5 CJS bundles). Under Node's resolution rules those .js files therefore default to CommonJS, so a native ESM import of @paypal/paypal-js/sdk-v6 triggers a MODULE_TYPELESS_PACKAGE_JSON warning plus a reparse penalty on modern Node, and fails to load outright on older Node or loaders without ESM syntax detection. The nested marker scopes the ESM declaration to the v6 directory only, leaving the v5 CJS artifacts untouched.

stripe/stripe-js (@​stripe/stripe-js)

v9.16.0

Compare Source

• Add Link Signup Element types (#​969)
• Add Custom Checkout tiered and package pricing types (#​966)

New features

Fixes

Changed

Hebilicious/reproduire (Hebilicious/reproduire)

v0.0.9

Compare Source

compare changes

capricorn86/happy-dom (happy-dom)

v20.14.5

Compare Source

v20.14.4

Compare Source

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #​2407

v20.14.3

Compare Source

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #​2363

v20.14.2

Compare Source

👷‍♂️ Patch fixes

• Resolve every var - By @​klaesra in task #​2344

v20.14.1

Compare Source

Rich-Harris/magic-string (magic-string)

v1.4.1

Compare Source

Bug Fixes

• flush the shared encoder buffer at the end of every drain (#​356) (f682ccf)

v1.4.0

Compare Source

Bug Fixes

• don't resurrect removed content in replace/replaceAll (#​352) (c847b0e)

Features

• add affinity option to move() (#​351) (f849b39)
• bundle: add toMagicString() to flatten a Bundle into a MagicString (#​353) (3a7c7b0)

Performance Improvements

• encode mappings incrementally in generateMap to cut peak memory (#​350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

• carry trimStart and trimEnd into the outro and intro (#​348) (07d2fcb)
• preserve inserts anchored to the edges of a removed range (#​282) (#​349) (bd7ee85)
• return an empty slice when the end index resolves to zero (#​346) (5531971)
• treat moving a range to where it already sits as a no-op (#​347) (22ed11b)

1.3.1 (2026-09-10)

v1.3.2

Compare Source

Bug Fixes

• don't resurrect removed content in replace/replaceAll (#​352) (c847b0e)

Features

• add affinity option to move() (#​351) (f849b39)
• bundle: add toMagicString() to flatten a Bundle into a MagicString (#​353) (3a7c7b0)

Performance Improvements

• encode mappings incrementally in generateMap to cut peak memory (#​350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

• carry trimStart and trimEnd into the outro and intro (#​348) (07d2fcb)
• preserve inserts anchored to the edges of a removed range (#​282) (#​349) (bd7ee85)
• return an empty slice when the end index resolves to zero (#​346) (5531971)
• treat moving a range to where it already sits as a no-op (#​347) (22ed11b)

1.3.1 (2026-09-10)

v1.3.1

Compare Source

Bug Fixes

• don't resurrect removed content in replace/replaceAll (#​352) (c847b0e)

Features

• add affinity option to move() (#​351) (f849b39)
• bundle: add toMagicString() to flatten a Bundle into a MagicString (#​353) (3a7c7b0)

Performance Improvements

• encode mappings incrementally in generateMap to cut peak memory (#​350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

• carry trimStart and trimEnd into the outro and intro (#​348) (07d2fcb)
• preserve inserts anchored to the edges of a removed range (#​282) (#​349) (bd7ee85)
• return an empty slice when the end index resolves to zero (#​346) (5531971)
• treat moving a range to where it already sits as a no-op (#​347) (22ed11b)

1.3.1 (2026-09-10)

maplibre/maplibre-gl-js (maplibre-gl)

v6.9.1

Compare Source

✨ Features and improvements

• Stop the scale control forcing a synchronous layout and rewriting its DOM on every frame of a pan or zoom (#​8403) (by @​cherenkov)
• Speed up merging adjacent symbol-placement: line features that share a label, which took time quadratic in the number of features that chain together (#​8436) (by @​cherenkov)
• Convert the fill-extrusion-rounded-corner-distance rounding distance to tile units once per tile instead of once per feature (#​8435) (by @​cherenkov)

🐞 Bug fixes

• Redraw terrain depth when DEM tiles arrive so occluded symbols and markers stay hidden (#​8447) (by @​ArcSolver)
• Fix raster tiles getting stuck at the start of a fade-in until the map moves. (#​8430) (by @​Kanahiro)
• Fix fill-extrusion-vertical-gradient disappearing over 3D terrain, where the gradient was computed from the extrusion's height above sea level instead of its own height (#​8410) (by @​ArcSolver)
• Fix missing map layers after custom layer rendering (#​8406) (by @​birkskyum)
• Fix 3D terrain reading elevation from the wrong part of a parent DEM tile while the deepest DEM tile is still loading (#​8407) (by @​ArcSolver)
• Align 3D terrain DEM sampling with hillshade and color-relief at cell centres (#​8420) (by @​ArcSolver)
• Fix setting one paint, light or sky property transitioning every property alongside it, which delayed idle even when nothing could animate and restarted transitions that were still running (#​8376) (by @​cherenkov)
• Fix fill-extrusion-rounded-corner-distance rounding every feature twice, which over-rounded the corners and inflated the vertex count (#​8429) (by @​cherenkov)
• Fix Map#project returning an incorrect on-screen point for a location behind the camera. It now returns a point outside the viewport, on the side through which the location left the screen, so DOM markers and popups are moved off-screen as expected. (#​8292) (by @​schickm)

v6.9.0

Compare Source

✨ Features and improvements

• Improved support for drawing the letters of Devanagari, Khmer, Burmese and the other complex scripts and also draws Arabic and Hebrew labels correctly without loading a right-to-left text plugin, which deprecates setRTLTextPlugin and getRTLTextPluginStatus (#​8343) (by @​HarelM)
• Read sprite and image pixels back through an OffscreenCanvas where available, removing a main-thread stall of tens of milliseconds on GPU-accelerated browsers when a sprite loads (#​8339) (by @​cherenkov)
• Skip clipping masks for layers hidden at the current zoom and stop re-binding dynamic buffers on cached vertex array binds, removing redundant WebGL calls every frame (#​8369) (by @​johncarmack1984)
• Re-render at most one stale terrain drape per frame and keep drapes that differ only by zoom while the map moves, so a finger lift over terrain no longer re-renders every tile at once (#​8368) (by @​johncarmack1984)

🐞 Bug fixes

• Fix setStyle() throwing while terrain is still loading because an intermediate render tried to compile a terrain shader before the replacement style initialized its projection (#​6824) (by @​miakh)
• Fix queued GeoJSON updateData property removals throwing after geometry-only updates or retaining previously updated values (#​8372) (by @​jokrasno)
• Treat camera options passed as undefined as not given in jumpTo, easeTo and flyTo; they were coerced to NaN (#​8373) (by @​vlumi)
• Fix a Not implemented. error that broke panning and zooming when the projection was changed while the camera was moving, on maps with terrain enabled or a transformCameraUpdate callback (#​8351) (by @​lazerg)
• Fix a map created inside a hidden container staying at the 400x300 fallback size when the container is shown before the resize observer's first notification is delivered (#​8277) (by @​spliffone)
• Fix MercatorTransform throwing when it is resized to a zero width, and skip the matrix calculation of every projection while the transform has a zero width or height (#​8374) (by @​avosa)
• Fix every style update opening a redundant sky and light transition, which kept idle from firing for the transition duration after the map was otherwise done, and could ease the sky and the light on a different curve from the layers (#​8348) (by @​cherenkov)
• Fix DOM sanitization for iframe and srcdoc (#​8396) (by @​HarelM)

actions/node-versions (node)

v24.21.0: 24.21.0

Compare Source

Node.js 24.21.0

v24.20.0: 24.20.0

Compare Source

Node.js 24.20.0

v24.19.0: 24.19.0

Compare Source

Node.js 24.19.0

v24.18.1: 24.18.1

Compare Source

Node.js 24.18.1

v24.18.0: 24.18.0

Compare Source

Node.js 24.18.0

v24.17.0: 24.17.0

Compare Source

Node.js 24.17.0

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

v24.15.0: 24.15.0

Compare Source

Node.js 24.15.0

v24.14.1: 24.14.1

Compare Source

Node.js 24.14.1

v24.14.0: 24.14.0

Compare Source

Node.js 24.14.0

v24.13.1: 24.13.1

Compare Source

Node.js 24.13.1

v24.13.0: 24.13.0

Compare Source

Node.js 24.13.0

v24.12.0: 24.12.0

Compare Source

Node.js 24.12.0

v24.11.1: 24.11.1

Compare Source

Node.js 24.11.1

v24.11.0: 24.11.0

Compare Source

Node.js 24.11.0

v24.10.0: 24.10.0

Compare Source

Node.js 24.10.0

v24.9.0: 24.9.0

Compare Source

Node.js 24.9.0

v24.8.0: 24.8.0

Compare Source

Node.js 24.8.0

v24.7.0: 24.7.0

Compare Source

Node.js 24.7.0

v24.6.0: 24.6.0

Compare Source

Node.js 24.6.0

v24.5.0: 24.5.0

Compare Source

Node.js 24.5.0

v24.4.1: 24.4.1

Compare Source

Node.js 24.4.1

v24.4.0: 24.4.0

Compare Source

Node.js 24.4.0

v24.3.0: 24.3.0

Compare Source

Node.js 24.3.0

v24.2.0: 24.2.0

Compare Source

Node.js 24.2.0

v24.1.0: 24.1.0

Compare Source

Node.js 24.1.0

v24.0.2: 24.0.2

Compare Source

Node.js 24.0.2

v24.0.1: 24.0.1

Compare Source

Node.js 24.0.1

pnpm/pnpm (pnpm)

v12.4.1: pnpm 12.4.1

Compare Source

pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under nodeLinker: hoisted. Repeat installs are faster.

Patch Changes

Installing packages

• pnpm install no longer fails with Operation not permitted when the filesystem refuses a hard link or a copy-on-write clone #​14722. Under packageImportMethod: auto and clone-or-copy, pnpm copies the file instead. EdenFS checkouts, which have no hard links, and rootless containers, which refuse the clone syscall, both hit this. An explicit packageImportMethod: hardlink or clone still reports the error.

  pnpm also copies a package file whose store entry has reached the filesystem's limit on names for one file, 1024 on NTFS and 65000 on ext4. Such a file failed the install under packageImportMethod: hardlink, and under auto it stopped pnpm hard linking for the rest of the install.

• pnpm install no longer writes a package file through a symlink left at the path it is importing to. Copying such a file overwrote whatever the link pointed at, and created that file when the link pointed nowhere. An executable package file also made the link's target executable.

• Fixed pnpm install and pnpm dlx on Android. Registry requests crashed because pnpm found no system CA certificates, so pnpm uses bundled ones there #​14777. Imports also failed with "Permission denied" on filesystems that deny hard links and reflinks, and now fall back to copying #​14780.

• pnpm install no longer fails with "Invalid cross-device link" while preserving a package's nested node_modules directory during a Docker build #​14758.

• pnpm install no longer fails on a package tarball that carries a file at the archive root, such as the ._* entries macOS tar adds #​14701. The file is installed at the root of the package.

  A file: tarball packed without the usual package/ directory is now recorded under the name and version from its own package.json. It was recorded under the alias the dependency was given, at version 0.0.0.

• Under nodeLinker: hoisted, pnpm install no longer re-imports packages that are already in place. A repeat install replaced the whole node_modules tree and reported Packages: +N. A package is still imported when its directory is missing, when its package.json no longer carries the installed version, when it is a file: dependency, and when it is patched. Lifecycle scripts no longer run again for a package left in place, and pnpm rebuild and a change to allowBuilds still reach it.

• pnpm install now runs a dependency's build scripts again when its side-effects cache entry has no files to restore #​14717. Such builds were skipped and nothing was put in their place, so a script whose whole effect lands outside its own package directory, such as a git hook installer, never took effect. pnpm no longer publishes empty artifacts to the shared side-effects cache either.

Resolving and linking dependencies

• pnpm install, pnpm add, and pnpm dedupe now apply ignoredOptionalDependencies #​14729. Matching optional dependencies are left out of the lockfile and are not installed. pnpm 12 installed them whenever it resolved dependencies from scratch.

• pnpm install no longer links a transitive dependency to a workspace package when linkWorkspacePackages is true and the dependency is declared with a plain version range #​14781. Enabling preferWorkspacePackages does not change this. Set linkWorkspacePackages: deep to link them.

• pnpm install no longer leaves dangling dependency links in workspace packages located above the workspace root #​14726.

• pnpm install and pnpm add no longer leave a dangling symlink in node_modules when a project starts depending directly on a package that the lockfile holds only as a transitive dependency with resolved peer dependencies #​14714.

• pnpm dedupe now keeps a compatible auto-installed peer when another workspace project depends on a newer major #​14697. Repeated runs alternated between compatible and incompatible peer versions.

• pnpm peers check no longer reports a peer dependency declared as workspace:^, workspace:~, or a bare workspace: as unmet #​14770. pnpm reported these as unmet whatever version the linked workspace project supplied.

Performance

• Sped up repeat installs #​14540. pnpm checks the store's files only for the packages it links into node_modules, instead of every package in the lockfile. Creating the command shims in node_modules/.bin makes about 1,500 fewer filesystem calls in a 76 project workspace. Installs that use the global virtual store read their slot paths from the cache directory instead of deriving them every time. Verifying a large lockfile also allocates less memory.

• Sped up pnpm install in Cargo workspaces with many member crates. Repeated installs reuse verified Cargo checksum metadata.

• Installing several packages from the same Git repository and commit now downloads the source once per install #​14725. Each package still runs its prepare scripts in its own copy of the checkout.

Running scripts and tasks

• pnpm now passes Ctrl+C on to the script or command it started and waits for it to shut down #​14723. pnpm exited first, so a script that was still writing landed on the shell prompt.

• pnpm run "/pattern/" --no-bail now lets every matched script finish after one of them fails #​14718. The command exits with ERR_PNPM_RUN_FAILED, and its message lists the scripts that failed in the order they were selected.

• pnpm pipeline no longer fails on a project that tracks a symlink, such as a CLAUDE.md pointing at AGENTS.md #​14692. Changing a symlinked input's target invalidates that task's cache, and pnpm pipeline --no-cache no longer hashes task inputs.

Commands

• pnpm add -g, pnpm update -g, and pnpm remove -g no longer change global bins or install directories after reading only part of an installed package group #​13796. If any declared package manifest is missing, malformed, or unreadable, pnpm now fails before it activates or removes anything and leaves the existing global installation intact.

• pnpm dedupe now processes every workspace project by default, including workspaces that keep a separate lockfile per project #​14732. Workspace filters select which projects it processes, and --fail-if-no-match exits with an error when no project matches.

• pnpm update <name>@<version> now keeps the range operator the manifest declares #​14745. Running pnpm update react@19.3.0 on "react": "^19.2.8" writes "react": "^19.3.0". A jsr: entry keeps its jsr: prefix, and a plain pnpm update now moves a jsr: range the way it moves an npm range.

• pnpm --filter directory selectors now support ? wildcards and character classes such as [ab]. A * or ? wildcard no longer selects a directory whose name starts with a dot, as on pnpm 11.

• pnpm deploy --legacy now prefers the dependency versions pinned in the source workspace lockfile when they still satisfy the deployed project's range #​13857.

• pnpm sbom now leaves out a package's author field when the manifest author name is empty or contains only whitespace #​14685. In a filtered or split workspace run, only a project with no author field inherits the workspace root's author.

  pnpm sbom --sbom-format spdx now writes creationInfo.created with whole seconds, such as 2026-09-08T10:38:21Z #​14684. The fractional seconds it carried were rejected by strict SPDX consumers.

Configuration

• The updateConfig pnpmfile hook now receives the resolved configuration, including settings that came from .npmrc, the command line, or a default #​14676. Scoped registries are reported under registriesByScope, and a hook may rewrite that map to change where packages are fetched from. Registry credentials are reported under configByUri, as pnpm 11 reports them. An unset setting is left out rather than reported as null.

• pnpm audit --fix and the minimumReleaseAgeStrict approval prompt now keep the comments in minimumReleaseAgeExclude when they append an entry to it in pnpm-workspace.yaml. The rest of the list is left as written, and the trustPolicyExcludePrune and minimumReleaseAgeExcludePrune cleanups keep the comments of the entries they retain.

  pnpm install and pnpm dedupe now run those cleanups too #​14759. Only pnpm add, pnpm update, and pnpm remove pruned the entries that the freshly written lockfile no longer resolves.

• pnpm config set --global node-download-mirrors no longer rejects the key #​13611. The global config file already accepted nodeDownloadMirrors, but the command refused to write it.

• NO_PROXY entries that start with a dot, such as .npmjs.org, now bypass the proxy for the domain and its subdomains #​14686.

• pnpm no longer creates a project pnpm-lock.yaml when devEngines.packageManager.onFail is download and lockfile writing is off through lockfile: false or --no-lockfile #​14728. pnpm still switches to the pinned version.

• pnpm now writes node_modules/.package-map.json only when nodeExperimentalPackageMap is enabled. Nothing reads the file without that setting, and an install that stops writing the map removes the one a previous install left.

Windows

• pnpm pipeline no longer fails with intermittent access denied errors when concurrent tasks save their cache entries on Windows.

• Windows filesystem operations now retry permission errors for up to one second #​14682. A permanent permission error delayed the failure by a minute. Sharing and lock violations keep their one minute retry budget.

Messages and output

• pnpm now warns when the root package.json declares a non-empty workspaces array and the project has no pnpm-workspace.yaml #​2255. Such an install linked no project and said nothing about why.

• ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR now names the file or directory in node_modules that pnpm could not clean up. It reported only the underlying OS error, such as "Access is denied (os error 5)".

• pnpm --help no longer describes pnpm as experimental.

Platinum Sponsors

Gold Sponsors

v12.4.0: pnpm 12.4

Compare Source

Minor Changes

• pnpm can now manage npm, Python, and Cargo dependencies in the same workspace. Enable python.enabled or cargo.enabled in pnpm-workspace.yaml, then use pnpm install to install them together.

  • Add Python packages with pnpm add pypi:<package>. pnpm uses pyproject.toml, pylock.toml, and a managed .venv. Frozen and offline installs are supported, and pnpm run and pnpm exec make the environment's executables available #​14566.
  • Add Rust crates with pnpm add crate:<package>. pnpm supports crates.io and custom sparse registries configured with cargo.indexUrl. Registry authentication supports pnpm credentials and, for crates.io, CARGO_REGISTRY_TOKEN or $CARGO_HOME/credentials.toml.

  Both ecosystems support faster dependency resolution through pnprServer, with local resolution as a fallback when the server does not support it.

• Added pnpm pipeline [name] to install frozen dependencies and run workspace tasks declared in pipelines. It selects affected projects, runs their task graph, and continues running tasks after a task fails.

  Tasks support inputs, outputs, env, and cache settings. Cached results restore task outputs and replay logs. Cargo tasks can reuse local build state between worktrees with tasks.<name>.cargoTargetDir. Set includeWorkspaceRoot: true to include root tasks.

  Use pnpm pipeline --dry-run to preview the task graph without installing configuration dependencies or running workspace hooks.

• Added support for Android on arm64 and x64, FreeBSD on x64, and Linux on ppc64le, s390x, and RISC-V (riscv64 with glibc) #​14431, #​14597, #​7582.

• Added trustPolicyExcludePrune to automatically remove unused versions and packages from trustPolicyExclude when running pnpm add, pnpm update, or pnpm remove. It is disabled by default. Package name patterns such as @scope/* are kept, and cleanup is skipped when `sharedWorkspac

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scripts-docs	Error		Sep 16, 2026 6:04am UTC
scripts-playground	Ready	Preview	Sep 16, 2026 6:04am UTC

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts@446

commit: b40362b

[vercel]

Suggested change

	"@nuxt/ui": "4.2.1",
	"@nuxt/ui": "^4.2.1",

The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.

View Details

Analysis

Inconsistent version pinning for @nuxt/ui dependency

What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.

How to reproduce:

cat docs/package.json | grep -A 15 '"dependencies"'

Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:

• "@nuxt/content": "^3.8.2"
• "@nuxt/fonts": "^0.12.1"
• "@nuxthq/studio": "^2.2.1"
• All other 10 dependencies also use ^ prefix

Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.

Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.

[vercel]

Suggested change

	"posthog-js": "^1.321.2"
	"posthog-js": "^1.0.0"

The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).

View Details

Analysis

Overly restrictive posthog-js peer dependency breaks backward compatibility

What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.

How to reproduce:

# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2

Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"

Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:

• Code only uses posthog.init() and basic config options (api_host, capture_pageview, disable_session_recording) available since 1.0.0
• The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
• Peer dependencies should be permissive to maximize compatibility
• Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible

This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[github-actions]

📦 Package Size

⚠️ 4 size metrics grew

📚 22 runtime dependencies (no change)

Package output	Gzipped	Δ
@nuxt/scripts-cli · runtime dependencies	72 kB → 72 kB	🔴 +70 B (+0.1%)
@nuxt/scripts-cli · dependency magicast	72 kB → 72 kB	🔴 +70 B (+0.1%)
@nuxt/scripts · runtime dependencies	434 kB → 436 kB	🔴 +2.0 kB (+0.5%)
@nuxt/scripts · dependency valibot	80 kB → 82 kB	🔴 +2.0 kB (+2.5%)

All tracked output (25)

Package output	Gzipped	Raw
@nuxt/scripts-cli · runtime dependencies	72 kB	355 kB	🔴
@nuxt/scripts-cli · dependency magicast	72 kB	355 kB	🔴
@nuxt/scripts-cli · export .	3.4 kB	12 kB	✅
@nuxt/scripts-cli · published payload	3.4 kB	12 kB	✅
@nuxt/scripts · runtime dependencies	436 kB	1.92 MB	🔴
@nuxt/scripts · dependency @nuxt/devtools-kit	2.9 kB	7.7 kB	✅
@nuxt/scripts · dependency @oxc-project/types	0 B	0 B	✅
@nuxt/scripts · dependency @vueuse/core	174 kB	707 kB	✅
@nuxt/scripts · dependency @vueuse/shared	39 kB	154 kB	✅
@nuxt/scripts · dependency h3	34 kB	146 kB	✅
@nuxt/scripts · dependency semver	25 kB	72 kB	✅
@nuxt/scripts · dependency sirv	8.8 kB	21 kB	✅
@nuxt/scripts · dependency unstorage	70 kB	225 kB	✅
@nuxt/scripts · dependency valibot	82 kB	590 kB	🔴
@nuxt/scripts · dist/runtime	101 kB	297 kB	✅
@nuxt/scripts · export .	25 kB	106 kB	✅
@nuxt/scripts · export ./registry	29 kB	90 kB	✅
@nuxt/scripts · export ./stats	13 kB	91 kB	✅
@nuxt/scripts · export ./types-source	46 kB	231 kB	✅
@nuxt/scripts · published payload	215 kB	815 kB	✅
@nuxt/scripts · components runtime	2.4 kB	6.2 kB	✅
@nuxt/scripts · composables runtime	7.5 kB	24 kB	✅
@nuxt/scripts · registry runtime	45 kB	133 kB	✅
@nuxt/scripts · server runtime	29 kB	87 kB	✅
@nuxt/scripts · utils runtime	2.5 kB	7.4 kB	✅

Runtime dependencies (22)

Package	Dependency	Requested	Resolved	Cost
@nuxt/scripts-cli	magicast	^0.5.5	0.5.5	📦 72 kB gzip
@nuxt/scripts-cli	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxt/scripts	@nuxt/devtools-kit	^3.4.2	3.4.2	📦 2.9 kB gzip
@nuxt/scripts	@oxc-project/types	^0.150.0	0.150.0	📦 0 B gzip
@nuxt/scripts	@vueuse/core	^14.4.0	14.4.0	📦 174 kB gzip
@nuxt/scripts	@vueuse/shared	^14.4.0	14.4.0	📦 39 kB gzip
@nuxt/scripts	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxt/scripts	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxt/scripts	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxt/scripts	magic-string	^1.4.1	1.4.1	♻️ free via Nuxt 4.5.2
@nuxt/scripts	ofetch	^1.5.1	1.5.1	♻️ free via Nuxt 4.5.2
@nuxt/scripts	ohash	^2.0.12	2.0.12	♻️ free via Nuxt 4.5.2
@nuxt/scripts	oxc-walker	^1.1.1	1.1.1	♻️ free via Nuxt 4.5.2
@nuxt/scripts	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxt/scripts	semver	^7.8.5	7.8.5	📦 25 kB gzip
@nuxt/scripts	sirv	^3.0.2	3.0.2	📦 8.8 kB gzip
@nuxt/scripts	std-env	^4.2.0	4.2.0	♻️ free via Nuxt 4.5.2
@nuxt/scripts	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2
@nuxt/scripts	ultrahtml	^1.7.0	1.7.0	♻️ free via Nuxt 4.5.2
@nuxt/scripts	unplugin	^3.3.0	3.3.0	♻️ free via Nuxt 4.5.2
@nuxt/scripts	unstorage	^1.17.5	1.17.5	📦 70 kB gzip
@nuxt/scripts	valibot	^1.5.0	1.5.0	📦 82 kB gzip

_{Baseline: main_@_f7dbadef___2026-09-16 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@​20.14.0 ⏵ 20.14.5			+1	+1
	maplibre-gl@​6.8.0 ⏵ 6.9.1			+1	+1
	@​oxc-project/​types@​0.150.0
	@​types/​node@​26.5.0 ⏵ 26.5.1			+1	+1
	vite@​8.2.2 ⏵ 8.3.0	+1		+1
	posthog-js@​1.428.7 ⏵ 1.433.3			+2
	magicast@​0.5.5
	rollup@​4.63.3
	unimport@​7.0.1 ⏵ 7.0.2				+1
	@​paypal/​paypal-js@​11.0.0 ⏵ 11.0.1	+1		+1
	@​stripe/​stripe-js@​9.15.0 ⏵ 9.16.0	+1			+1

View full report