deps: all non-major dependencies#684
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThe PR bumps Node.js versions in the CI, crawl, and deploy-sanity workflows from 11.8.0 to 11.9.0. It also updates packageManager and several package versions in package.json, including AWS SDK, Sanity, Sentry, TanStack Query, styled-components, and Playwright. ChangesWorkflow and package version bumps
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
6cc2858 to
3920aad
Compare
dejanvasic85
force-pushed
the
renovate/all-minor-patch
branch
from
3920aad to
5eaa600
Compare
This was referenced Jun 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.1074.0→3.1075.06.1.0→6.2.010.59.0→10.61.010.62.05.101.0→5.101.15.101.0→5.101.11.61.0→1.61.111.8.0→11.9.011.8.0→11.9.06.1.0→6.2.06.4.2→6.4.3Release Notes
aws/aws-sdk-js-v3 (@aws-sdk/client-ses)
v3.1075.0Compare Source
Note: Version bump only for package @aws-sdk/client-ses
sanity-io/sanity (@sanity/vision)
v6.2.0Compare Source
Bug Fixes
getsentry/sentry-javascript (@sentry/nextjs)
v10.61.0Compare Source
Important Changes
feat(core): Enable
streamGenAiSpansby default (#21732)The SDK now extracts all
gen_aispans out of a transaction and sends them as v2 envelope items by default. This prevents gen_ai spans from being dropped when the transaction payload exceeds size limits. Because they are no longer constrained by transaction size limits, AI message data is also no longer truncated by default. SetenableTruncation: trueon the respective AI integration to re-enable truncation. To keep the previous behavior, setstreamGenAiSpans: false.Self-hosted Sentry users should opt out with
streamGenAiSpans: false, since streamed gen_ai spans may not be ingested by their Sentry instance.Other Changes
db.query.summaryfunctionality (#21670)Sentry.setAttribute(s)APIs (#21705)trace_idswith span streaming (#21714)Internal Changes
bindTracingChannelToSpanacross runtimes (#21642)fsIntegration(#21654)sentry-sdk-initmeasure and marks (#21687)v10.60.0Compare Source
Other Changes
bindScopeToEmitterto bind a scope to an event emitter (#21594)url.fullandhttp.urlattributes have the same values onhttp.clientspans (#21660)tracingChannelfor Node v18 compatibility (#21662)vitepeer dependency (#21677)Internal Changes
@opentelemetry/core(#21679)captureSpantoSentrySpanProcessor(#21648)@opentelemetry/coredep (#21688)@opentelemetry/semantic-conventionsdependency (#21691)@opentelemetry/resourcesdependency (#21690)TanStack/query (@tanstack/react-query)
v5.101.1Compare Source
Patch Changes
9eff92e]:TanStack/query (@tanstack/react-query-devtools)
v5.101.1Compare Source
Patch Changes
microsoft/playwright (playwright-core)
v1.61.1Compare Source
Bug Fixes
pnpm/pnpm (pnpm)
v11.9.0: pnpm 11.9Compare Source
Minor Changes
bae694f: Some registries generate tarballs on-demand and cannot provide an integrity checksum in their package metadata. In that case pnpm now computes the integrity from the downloaded tarball and stores it in the lockfile, so the entry is verifiable on subsequent installs instead of being written without an integrity (which would fail the next install). This also applies to--lockfile-only: the tarball is downloaded so its integrity can be computed. A lockfile entry that is still missing its integrity is rejected as aERR_PNPM_MISSING_TARBALL_INTEGRITYlockfile verification violation (the install fails closed) rather than being silently re-fetched.6c35a43: Added--exclude-peerstopnpm sbom. Withauto-install-peers(the default), peer dependencies resolve into the lockfile and are otherwise indistinguishable from the package's own dependencies. The flag drops peer dependencies (and any transitive subtree reachable only through them) from the SBOM. CycloneDX 1.7 has no scope or relationship that expresses "consumer-provided peer", so omission is the only spec-clean handling. The flag name matchespnpm list --exclude-peers; note the SBOM flag prunes a peer's exclusive subtree, which is stricter thanpnpm list(which only hides leaf peers).Patch Changes
25a829e:pnpm audit --fixnow writes a single combinedminimumReleaseAgeExcludeentry per package (e.g.axios@0.18.1 || 0.21.1) instead of one entry per version, matching the format documented for the setting. Existing per-version entries inpnpm-workspace.yamlare merged into the combined form rather than left as duplicates. Installs that auto-collect immature versions intominimumReleaseAgeExcludenow report the same combined entries, so the "Added N entries" message matches what is written to the manifest #12534.1cbb5f2: Fixed non-deterministic peer resolution that could add or remove an optional transitive peer — for example@babel/core, reached throughstyled-jsx— from a package's peer-dependency suffix across otherwise identical installs, churning the lockfile and causing intermittentpnpm dedupe --checkfailures in CI. When a package's children are resolved by one occurrence (the "owner") and reused by a deeper consumer, whether that consumer inherited the owner's missing peers depended on whether the owner's resolution had finished yet — a race under concurrent resolution. The decision is now a function of the dependency graph's structure rather than resolution-completion order.d577eea: Fixed a Windows flakiness inpnpm dlxwhere a failed install could surface a spuriousEBUSY: resource busy or lockederror. The cleanup of a partially-populated dlx cache is now best-effort with retries and no longer masks the original error.ec7cf70: Shortened thepnpm dlxcache path so deep dependency trees no longer overflow Windows'MAX_PATH, which could make a dependency's lifecycle script fail withspawn cmd.exe ENOENT.05b95ab: Fixedpnpmhanging (and crashing with an unhandled promise rejection) when a non-retryable network error such asSELF_SIGNED_CERT_IN_CHAINoccurs while fetching from a registry. The error is now rejected through the returned promise instead of being thrown inside the detached retry callback.d3f68e2: Fix apnpm auditperformance regression on lockfiles that contain dependency cycles. The reachable-vulnerability pruning added in pnpm 11.5.1 only memoized acyclic subtrees, so any node whose subtree touched a cycle — together with all of its ancestors — was recomputed on every query, making the path walk quadratic. Reachability is now computed once per node using Tarjan's strongly-connected-components algorithm, so cyclic graphs are handled in linear time #12212.The audit path walk also no longer recurses, so a deeply nested dependency graph can no longer overflow the call stack, and the install path to each finding is tracked without per-node copying, keeping memory linear in the graph depth.
322f88f: Fix failed optional dependency updates so they don't rewrite unrelated dependency specs #11267.1488db1: WhenenableGlobalVirtualStoreis toggled on for a project that was previously installed without it, stale hoisted symlinks undernode_modules/.pnpm/node_modulesare now replaced instead of being left pointing at the old per-project virtual store location #9739.6545793: Fixedpnpm install --ignore-workspaceoverwriting theallowBuildsmap inpnpm-workspace.yaml. The ignored builds of a package with a build script were auto-populated intoallowBuildseven though--ignore-workspacewas passed, clobbering committedtrue/falsevalues with theset this to true or falseplaceholder #12469.fbdc0eb: FixedminimumReleaseAgeExcludeandtrustPolicyExcludeso multiple exact-version entries for the same package behave the same as a single||disjunction entry. Previously only the first matching rule's versions were honored, so a config like[form-data@4.0.6, form-data@2.5.6]could still flagform-data@2.5.6as violatingminimumReleaseAge, while[form-data@4.0.6 || 2.5.6]worked as expected #12463.fa7004b: The in-memory package metadata cache is now populated on the exact-version disk fast path, so repeated resolutions of the same package within one install no longer re-read and re-parse the on-disk metadata. In large monorepos this brings the time for adding a new package down from minutes to seconds. The in-memory cache key now also includes the registry, so a package of the same name served by two different registries in a single install can no longer share a cache slot and resolve the wrong tarball.0a154b1: Fixedpnpm patchdropping the package name (and leaking internal option fields) when the patched dependency resolves to a single git-hosted version.4d3fe4b: The pnpr resolver endpoints moved under the reserved/-/pnprnamespace:POST /v1/resolveis nowPOST /-/pnpr/v0/resolveandPOST /v1/verify-lockfileis nowPOST /-/pnpr/v0/verify-lockfile. The capability handshake atGET /-/pnpradvertises protocol version0to match. This keeps every pnpr-proprietary route in npm's reserved namespace, so it can never collide with a package path.0ec878d: Removing a runtime dependency now removes the matchingdevEngines.runtimeorengines.runtimeentry that was materialized from it. Blank runtime selectors are normalized tolatest.17e7f2c:pnpm sbomnow emits a CycloneDXissue-trackerexternal reference for components (and the root) whosepackage.jsondeclares abugsURL. Email-onlybugsentries are skipped, since the reference requires a URL.a84d2a1: Add@pnpm/resolving.tarball-url, which builds and recognizes the canonical npm tarball URL of a package. It vendorsgetNpmTarballUrl(previously the externalget-npm-tarball-urlpackage) and addsisCanonicalRegistryTarballUrl, the predicate the lockfile writer uses to decide whether a tarball URL is derivable from name+version+registry (and can therefore be omitted frompnpm-lock.yaml).Exposing
isCanonicalRegistryTarballUrllets a custom resolver (pnpmfileresolvers) fronting a proxy that serves tarballs on a non-canonical path (e.g. an ephemerallocalhost:<port>) rewrite the resolved tarball to the canonical form, so nothing host-specific is persisted to the lockfile. Previously this logic was private to@pnpm/lockfile.utils.Two correctness fixes are included while consolidating the logic: the scoped-package unescape now handles uppercase
%2Fas well as%2f(percent-encoding is case-insensitive), and protocol-insensitive comparison strips only a leadinghttp(s)://scheme instead of splitting on the first://(which could truncate URLs containing a later://).852d537: Lockfile verification no longer reports a registry metadata fetch failure (for example a403/401on a private registry, or a network error) asERR_PNPM_TARBALL_URL_MISMATCH. When the registry can't be reached to verify an entry, the install now aborts with the registry's own fetch error (such asERR_PNPM_FETCH_403, which already explains the authentication situation) instead of mislabeling a transport failure as lockfile tampering. Registry fetch errors no longer leak basic-auth credentials embedded in the registry URL (https://user:pass@host/) into their message.Platinum Sponsors
Gold Sponsors
sanity-io/sanity (sanity)
v6.2.0Compare Source
Features
_systemto useDocumentVersions (#13094) (d4acef0)Bug Fixes
enabledon the markdown plugin alongside deprecatedconfig(51ce0ce)Performance Improvements
styled-components/styled-components (styled-components)
v6.4.3Compare Source
Patch Changes
f692ec2: Fix a TypeScript error when wrapping a component whose props can't be statically read, such as Mantine v7's polymorphic-factory components (Button,Card,Menu.Item, and similar). These styled components no longer reject every prop, includingchildren; arbitrary props are accepted again at the JSX call site and via.attrs(), while components with readable prop types stay fully type-checked.f692ec2: Keep TypeScript attribute autocomplete working while you type props on a polymorphic styled component. When a component renders a different element throughas(for exampleas="video"), beginning to type a new prop name could make the whole suggestion list vanish; the rendered element's props now keep autocompleting as you go.Configuration
📅 Schedule: (in timezone Australia/Melbourne)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.