chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #1357 · nuxt/cli

renovate · 2026-06-29T05:39:04Z

This PR contains the following updates:

Package	Change	Type	Update
@antfu/eslint-config	`^9.0.0` → `^9.1.0`	devDependencies	minor
@codspeed/vitest-plugin (source)	`^5.6.0` → `^5.7.1`	devDependencies	minor
CodSpeedHQ/action	`v4.17.6` → `v4.18.1`	action	minor
eslint (source)	`^10.5.0` → `^10.6.0`	devDependencies	minor
eslint-plugin-jsdoc	`63.0.7` → `63.0.10`	pnpm-workspace.overrides	patch
exsolve	`^1.0.8` → `^1.1.0`	dependencies	minor
exsolve	`^1.0.8` → `^1.1.0`	devDependencies	minor
knip (source)	`^6.17.1` → `^6.23.0`	devDependencies	minor
nypm	`^0.6.7` → `^0.6.8`	dependencies	patch
nypm	`^0.6.7` → `^0.6.8`	devDependencies	patch
pnpm (source)	`11.8.0` → `11.9.0`	packageManager	minor
tinyclip	`^0.1.14` → `^0.1.15`	dependencies	patch
tinyclip	`^0.1.14` → `^0.1.15`	devDependencies	patch
vue (source)	`^3.5.38` → `^3.5.39`	devDependencies	patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

antfu/eslint-config (@antfu/eslint-config)

`v9.1.0`

Compare Source

🚀 Features

Update deps - by @antfu (ff246)

🐞 Bug Fixes

Update deps and scope unicorn rules - by @antfu (82078)

View changes on GitHub

CodSpeedHQ/codspeed-node (@codspeed/vitest-plugin)

`v5.7.1`

Compare Source

What's Changed

fix: emit perf maps when not parsing the full inlining logs from V8 by @GuillaumeLagrange in #85

Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1

`v5.7.0`

Compare Source

Highlights

Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set CODSPEED_WALLTIME_PROFILER=samply env variable in the codspeed action.
Added support for tinybench v5 and v6 in @codspeed/tinybench-plugin

What's Changed

Add necessary flags to dump optimized inlining info and fix walltime marker placement by @GuillaumeLagrange in #83

Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0

CodSpeedHQ/action (CodSpeedHQ/action)

`v4.18.1`

Compare Source

Release Notes

🚀 Features

Bump go-runner to 1.2.1 by @adriencaccia in #421

Install codspeed-runner 4.18.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.1

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

`v4.18.0`

Compare Source

Release Notes

🚀 Features

Bump valgrind-codspeed to 3.26.0-0codspeed4
Bump samply by @GuillaumeLagrange in #415
Set env var to have node dump inlining information by @GuillaumeLagrange
Change isolation logic to include samply and non root fallback by @GuillaumeLagrange
Add experimental --cycle-estimation flag by @not-matthias in #412
Make samply-codspeed a submodule rather than git rev with cargo by @GuillaumeLagrange in #416

🐛 Bug Fixes

Honor locally-installed valgrind on non-apt systems by @not-matthias in #414

Install codspeed-runner 4.18.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.0

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

eslint/eslint (eslint)

`v10.6.0`

Compare Source

Features

b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

a83683d docs: Update README (GitHub Actions Bot)
f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
bea49f7 docs: Update README (GitHub Actions Bot)
e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
3eb3d9b docs: Update README (GitHub Actions Bot)
c5bb59c docs: Update README (GitHub Actions Bot)
eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

gajus/eslint-plugin-jsdoc (eslint-plugin-jsdoc)

`v63.0.10`

Compare Source

Bug Fixes

escape-inline-tags: allow scoped packages in declaration references (#1705) (70e0a11)

`v63.0.9`

Compare Source

Bug Fixes

check-template-names, require-template, valid-types: keep commas inside @template default values (0980b71)

`v63.0.8`

Compare Source

Bug Fixes

check-template-names: detect template usage in @augments/@extends/@implements types (208079f)

unjs/exsolve (exsolve)

`v1.1.0`

Compare Source

compare changes

🚀 Enhancements

Sync internal with latest Node.js upstream (#49)

🔥 Performance

Optimize resolver cache lookups (#48)

🏡 Chore

Update deps (43c20e3)
Apply automated updates (15806be)
Fix ts issues (3177a7e)

❤️ Contributors

Pi0x x@pi0.io
Alexander Lichter (@TheAlexLichter)
Pooya Parsa (@pi0)

webpro-nl/knip (knip)

`v6.23.0`: Release 6.23.0

Compare Source

feat: add customCss to Starlight plugin (#1828) (f85d96f) - thanks @trueberryless!
fix: enable vite and vitest plugins when vite-plus is found (#1830) (62e9753) - thanks @ghostdevv!
feat: add support for @astrojs/markdoc (#1829) (94e2863) - thanks @trueberryless!
Support nub (resolve #1831) (8a6050e)
Don't report optimizeDeps and dedupe deps as unlisted (resolve #1832) (849b5ac)

`v6.22.0`: Release 6.22.0

Compare Source

Support XO v1+ (#1819) (1dffe36) - thanks @patrik-csak!
feat: detect execaNode scripts in execa visitor (#1824) (5095ae1) - thanks @gwagjiug!
Skip optional peerDeps referenced only via a host (resolve #1823) (7759a98)
docs: update npmjs.com links to npmx.dev (#1826) (11fe8bd) - thanks @serhalp!
docs: fix semi-broken link to DEVELOPMENT.md in CONTRIBUTING.md (#1827) (a5302b2) - thanks @serhalp!
feat: add support for Lunaria (#1825) (3e1b821) - thanks @trueberryless!
Fix lint issues (76c92e2)

`v6.21.0`: Release 6.21.0

Compare Source

Detect Vite config dependencies (resolve #1721) (8754c43)
fix: Update timerifyMethods to include resolveFromAST (#1814) (3c8deac) - thanks @gwagjiug!
Fix crash on null root export in package.json (resolve #1815) (9b8af2b)
Fix unresolved subpath imports with a colon prefix (resolve #1816) (f89db41)
Detect Next.js entry files in subdirectory (resolve #1817) (f32c6ea)

`v6.20.0`: Release 6.20.0

Compare Source

Add raw transfer opt-out (resolve #1813) (6f08c68)
Fix cached plugin config cycles (resolve #1811) (2bc2f24)

`v6.19.0`: Release 6.19.0

Compare Source

feat: support new optional sveltekit config pattern via vite config (#1810) (3fee8bf) - thanks @fubits1!
Optimize hot path string scanning (e30cfe7)
Update astro snapshot (71e71a7)

`v6.18.0`: Release 6.18.0

Compare Source

Update dependencies (pin oxc-resolver) (7dda4ec)
Resolve tsconfig paths for non-TS importers independent of oxc ownership (3b71565)
Format (64865f8)
Fix false positive for Vitest mocks (#1802) (ec93e20) - thanks @remcohaszing!
Mark npx-run binaries optional unless --no-install (resolve #1803) (203c31e)
Ignore pnpm [WARN] lines in ecosystem snapshots (392835a)
Update slonik snapshot (62d802b)
Update Jest entry patterns for Jest 30 (#1808) (d2caedd) - thanks @gwagjiug!
Report stale workspaces configuration keys as configuration hints (#1807) (9083c16) - thanks @WooWan!

`v6.17.2`: Release 6.17.2

Compare Source

Fix up jest plugin (63dbd65)
Detect coverage provider from bare vitest --coverage flag (#1800) (dc11d9f) - thanks @WooWan!
Don't disable configuration hints in workspace-scoped runs (#1791) (8ce1ec8) - thanks @WooWan!
Detect react-email v6 packages from non-numeric version ranges (resolve #1798) (27a1cae)
Discover workspaces included after a negated pattern (resolve #1797) (630e152)

pnpm/pnpm (pnpm)

`v11.9.0`

Compare Source

tinylibs/tinyclip (tinyclip)

`v0.1.15`

Compare Source

What's Changed

fix: writing empty string on windows by @florian-lefebvre in #40
feat: surface unknown errors by @florian-lefebvre in #41

Full Changelog: tinylibs/tinyclip@0.1.14...0.1.15

vuejs/core (vue)

`v3.5.39`

Compare Source

Bug Fixes

compiler-core: correct filter rewrite recursion (#14959) (be7ce31)
hydration: force patch dynamic props when hydrating (#9083) (024cf06), closes #9033
hydration: respect data-allow-mismatch on conditional branches (#12801) (164af63), closes #12782
reactivity: avoid triggering effects when set fails (#14964) (e450973)
runtime-core: handle non-isomorphic block element update (#15002) (932ddd0), closes #6385
runtime-core: normalize function children for elements and Teleport (#9108) (2f374cd), closes #9107
runtime-core: pause tracking when invoking function refs (#14985) (3ac052b)
runtime-core: preserve once event listener name (#8341) (87b73b6), closes #8342
runtime-dom: preserve option modifier event names (#8338) (4b659e6), closes #8334
ssr: dedupe inherited scope ids during vnode rendering (#15005) (027da6b), closes #12159 #12175
ssr: resolve nested async teleport content (#9431) (31d0f23), closes #6207
teleport: handle teleport unmount edge case (#12705) (671997a), closes #12702
types: support named tuple emits (#12676) (232f402), closes #12673
types: validate defineModel defaults (#14968) (747f57e), closes #14966

Configuration

📅 Schedule: (UTC)

Branch creation
- "on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-06-29T05:39:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tinyclip@0.1.15
	exsolve@1.1.0
	@antfu/eslint-config@9.1.0
	nypm@0.6.8
	vue@3.5.39
	knip@6.23.0
	@codspeed/vitest-plugin@5.7.1
	eslint@10.6.0

View full report

pkg-pr-new · 2026-06-29T05:39:55Z

nuxt-cli-playground

npm i https://pkg.pr.new/create-nuxt@1357

npm i https://pkg.pr.new/nuxi@1357

npm i https://pkg.pr.new/@nuxt/cli@1357

commit: 4ff25fe

socket-security · 2026-06-29T05:39:56Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/nitro@3.0.1-alpha.2` → `npm/nitropack@2.13.4` → `npm/@nuxt/eslint-config@1.16.0` → `npm/knip@6.23.0` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@typescript-eslint/eslint-plugin` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@nuxt/eslint-config@1.16.0` → `npm/@antfu/eslint-config@9.1.0` → `npm/@typescript-eslint/eslint-plugin@8.62.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.62.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `eslint-plugin-jsdoc` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@nuxt/eslint-config@1.16.0` → `npm/@antfu/eslint-config@9.1.0` → `npm/eslint-plugin-jsdoc@63.0.10` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-jsdoc@63.0.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

codspeed-hq · 2026-06-29T05:41:58Z

Merging this PR will not alter performance

✅ 2 untouched benchmarks

_{Comparing renovate/all-minor-patch (4ff25fe) with main (49dd7f7)}

renovate Bot requested a review from danielroe as a code owner June 29, 2026 05:39

chore(deps): update all non-major dependencies

4ff25fe

renovate Bot force-pushed the renovate/all-minor-patch branch from 537142e to 4ff25fe Compare June 29, 2026 15:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies#1357

chore(deps): update all non-major dependencies#1357
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🚀 Features

🐞 Bug Fixes

What's Changed

Highlights

What's Changed

Release Notes

🚀 Features

Install codspeed-runner 4.18.1

Install prebuilt binaries via shell script

Download codspeed-runner 4.18.1

Release Notes

🚀 Features

🐛 Bug Fixes

Install codspeed-runner 4.18.0

Install prebuilt binaries via shell script

Download codspeed-runner 4.18.0

Features

Bug Fixes

Documentation

Chores

Bug Fixes

Bug Fixes

Bug Fixes

🚀 Enhancements

🔥 Performance

🏡 Chore

❤️ Contributors

v6.23.0: Release 6.23.0

v6.22.0: Release 6.22.0

v6.21.0: Release 6.21.0

v6.20.0: Release 6.20.0

v6.19.0: Release 6.19.0

v6.18.0: Release 6.18.0

v6.17.2: Release 6.17.2

What's Changed

Bug Fixes

Configuration

Uh oh!

socket-security Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed-hq Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jun 29, 2026 •

edited

Loading

`v6.23.0`: Release 6.23.0

`v6.22.0`: Release 6.22.0

`v6.21.0`: Release 6.21.0

`v6.20.0`: Release 6.20.0

`v6.19.0`: Release 6.19.0

`v6.18.0`: Release 6.18.0

`v6.17.2`: Release 6.17.2

socket-security Bot commented Jun 29, 2026 •

edited

Loading

pkg-pr-new Bot commented Jun 29, 2026 •

edited

Loading

socket-security Bot commented Jun 29, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 29, 2026 •

edited

Loading