Skip to content

fix(deps): update all non-major dependencies - #1209

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#1209
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@inlang/paraglide-js (source) ^2.27.0 → ^2.29.0 age confidence
@lucide/svelte (source) ^1.55.0 → ^1.59.0 age confidence
lefthook ^2.2.1 → ^2.2.2 age confidence
maplibre-gl (source) ^6.13.0 → ^6.15.0 age confidence
p-queue ^9.3.3 → ^9.3.5 age confidence
vite-plugin-lucide-preprocess ^1.8.0 → ^1.9.0 age confidence
vitest (source) ^5.0.3 → ^5.0.5 age confidence

Release Notes

opral/paraglide-js (@​inlang/paraglide-js)

v2.29.0

Minor Changes

  • 20c2ffe: Add the opt-in devErrorResponse Vite plugin option to return HTTP 500 while translation compilation or configuration is invalid, and resume serving after recovery.

    Wait for pending watch compilations when Vite closes, preventing writes after shutdown and interference with the next server in the same process.

Patch Changes
  • da2ebab: Accept readonly URL inputs, including SvelteKit 3's page.url, in localizeUrl and deLocalizeUrl. URL-like inputs are normalized to native URLs so unmatched routes still return a mutable URL.

v2.28.0

Minor Changes

  • 17d1aed: Add cookieSameSite and cookieSecure compiler options for the locale cookie that setLocale() writes. Both attributes are omitted by default, so the cookie only changes when you opt in. cookieSecure: "auto" adds Secure only on https: pages, and cookieSameSite: "none" without cookieSecure throws when Paraglide compiles the runtime, because browsers drop that cookie.

    The runtime exports cookieSameSite and cookieSecure, so server code that writes the same cookie with Set-Cookie can reuse the policy. With "auto", the server has to resolve the protocol itself.

  • b95a16b: Add redirect: "navigation" to paraglideMiddleware for GET and HEAD clients that omit Sec-Fetch-Dest but accept HTML. In this mode, form POST requests pass through to the resolve callback. The default "document" mode keeps its existing redirect behavior.

    The new mode adds Vary fields when needed to keep cached redirects and resolved responses separate. Mutable callback responses are updated in place to preserve their identity and runtime-specific state, including precompressed bodies on Cloudflare Workers. Immutable responses are rebuilt using the original response as the constructor options.

  • b375894: Add an optional ESLint/Oxlint plugin at @inlang/paraglide-js/eslint. Enable paraglide/no-dynamic-message-access to report runtime indexing, computed destructuring, and whole-catalog spread/rest copies that can defeat tree-shaking. The rule recognizes generated message imports, aliases and local scope, while allowing static message references and application-owned maps. Custom generated module paths can be added with messageModules. No runtime, compiler output, or application behavior changes; the rule has no automatic fix because applications must choose their supported messages.

    Add optional lint setup to paraglide-js init with --lint eslint|oxlint|none, preserving existing lint configs via a dedicated lint:i18n script. Add --yes/--non-interactive, explicit project/output paths, and optional setup flags for unattended use. Closed input without an unattended flag fails before writes; headless mode skips optional editor/machine-translation prompts, protects dirty git trees unless explicitly allowed, reuses existing projects, preserves TypeScript config comments, and returns nonzero on setup/compile failures. No dependencies are installed automatically.

  • 32b54a8: Show compilation and config errors in Vite's development overlay, including in newly opened tabs. Once compilation and config loading recover, the plugin requests a page reload to clear the overlay. The dev server keeps serving the last compiled output, as before.

Patch Changes

  • 08ef4de: Fix extractLocaleFromHeader picking languages the client rejected with q=0 and ranking ranges by malformed weights. fr; q=0.5 and fr;Q=0.5 were read as unknown tags, and weights like q=abc or q=2 were sorted as NaN or out-of-range numbers.

    Ranges with q=0 are now skipped, as RFC 9110 defines a weight of 0 as "not acceptable". Ranges whose weight is not a valid qvalue are skipped too. The q parameter is matched case-insensitively, whitespace around ; and = is tolerated, and other parameters are ignored, including quoted values that contain , or ;. shouldRedirect() and paraglideMiddleware() reach this function through the preferredLanguage strategy, so their redirects follow the same rules.

  • 4889802: Bound filesystem concurrency for generated output across message modules, locale modules, declarations, and additional files. Propagate write, directory creation, and required deletion errors instead of silently reporting successful compilation with incomplete output. Drain active operations before rejecting, close the loaded project on failure, and preserve unchanged generated files when cleaning during a partial update.

  • bfdaecf: Cache Intl formatters used by compiled messages instead of constructing them on every call. Bound each formatter cache to 256 locale/options configurations, preserve direct-call option semantics, and include caching in middleware-injected messages.

    Date/time formatters are cached only with an explicit time zone, so messages using the host default follow device or process time zone changes.

  • 4dedc3f: Keep canonical callback responses unchanged in navigation redirect mode when built-in URL routing determines the locale. Canonicalization redirects only vary by Accept and Sec-Fetch-Dest.

  • bdb8f54: Reduce generated localization payloads by returning static text directly from locale dispatchers. Preserve locale switching, fallbacks, markup, middleware, and locale-specialized builds.

  • b43abc2: Skip locale splitting for callback values without response headers or a body reader, and for consumed or locked bodies. Keep HTML injection working when the global Response constructor is replaced.

  • ceaba90: Allow opt-in outputStructure: "message-modules" with experimental per-locale Vite builds. Direct physical message imports let Vite retain page-specific messages in lazy chunks while specializing each graph to its selected locale.

  • ae63a90: Keep protocol-relative hrefs in localizeHref() and deLocalizeHref() instead of dropping their host. For example, with locale de, //cdn.example.com/docs now becomes //cdn.example.com/de/docs instead of /de/docs. This also handles /\ and separators containing tabs or newlines. Explicit ports are preserved, including default ports such as :80. Links keep their implicit protocol on the server outside the middleware, where getUrlOrigin() uses a fallback origin. Configured protocol or port changes still produce absolute URLs.

  • 2ca1028: Cancel queued rebuilds when CLI watch mode shuts down, and ignore late watcher events or compile completions after shutdown. This prevents stopped watch sessions from recompiling or reopening file watchers.

  • 2de79ed: getLocale(), setLocale() and extractLocaleFromCookie() no longer throw when document.cookie or localStorage throws, as both do with a SecurityError in sandboxed iframes without allow-same-origin and other documents with an opaque origin. A failed read falls through to the next strategy. A failed write is skipped, so setLocale() still navigates or reloads.

    The first getLocale() call writes the cookie, so a page whose locale came from the URL used to throw on its first message.

  • 4c66c0d: Upgrade the minimum inlang SDK version to 4.0.4, bringing lower memory use and batched processing for large translation projects.

  • e14ee56: Include Cookie in redirect Vary headers when the route uses the cookie strategy. Responses from resolve also vary by Cookie or Accept-Language when the corresponding strategies come before url, or when the URL does not supply a locale. Existing fields are kept without duplicates, and Vary: * is unchanged.

    With the default strategy, HTTP responses now include Vary: Cookie. Shared caches that honor Vary distinguish responses by the full Cookie header, which can reduce cache reuse. Mutable responses retain their identity; network error responses are passed through unchanged. Copied responses keep their url, redirected and type, including when cloned.

lucide-icons/lucide (@​lucide/svelte)

v1.59.0: Version 1.59.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

v1.58.0: Version 1.58.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.57.0...1.58.0

v1.57.0: Version 1.57.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

v1.56.0: Version 1.56.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

evilmartians/lefthook (lefthook)

v2.2.2

Compare Source

maplibre/maplibre-gl-js (maplibre-gl)

v6.15.0

Compare Source

✨ Features and improvements
  • Add dragRotate: {around: 'pointer'} to turn and tilt the map around the point under the pointer, and {around: 'center', movement: 'circular' | 'linear'}, which replaces the deprecated aroundCenter (#​8628) (by @​birkskyum)
  • Redraw fewer layers on terrain when a custom layer's terrainTileRevision or a feature state changes (#​8782) (by @​birkskyum)
  • Support the hash option in a projection registered with addProjection (#​8743) (by @​birkskyum)
  • Add experimental addProjection, removeProjection, a built-in identity projection and a {bbox} tile URL token for maps in a custom planar CRS with its own quad tile grid (#​168, #​5764)
  • Speed up tile loading by skipping point labels in the tile buffer, which the neighbouring tile draws (#​8535) (by @​cherenkov)
  • Project GeoJSON sources on a map in a registered CRS, in the workers, from a definition string and a projection handler (#​8736) (by @​johncarmack1984)
  • Support OpenType vert forms in vertical labels rendered with font-faces (#​8489) (by @​NEKOYASAN)
🐞 Bug fixes
  • Fix a map in a registered projection going blank when its center crosses 180° (#​8802) (by @​birkskyum)
  • Fix world projections like Equal Earth throwing and jumping when the mouse is in the space around the world (#​8803) (by @​birkskyum)
  • Work around a regression in Safari 26.6 and later where the map stops loading tiles after the page was in the background (#​8780) (by @​birkskyum)
  • Fix labels in Brahmic scripts such as Devanagari, Thai and Telugu mixing fonts or dropping letters when the style has a glyphs URL (#​8741) (by @​crackalamoo)
  • Fix setWorkerUrl treating a .cjs fragment or query marker as a module worker URL (#​8769) (by @​Anandb71)
  • Fix the terrain not finding a tile's own DEM data when the DEM source's maxzoom is below the terrain tile zoom (#​8765) (by @​johncarmack1984)
  • Fix the camera dropping to sea level while the terrain under the center of a jumpTo, easeTo or flyTo loads (#​8549) (by @​johncarmack1984)
  • Fix a grid of lines along tile borders in line layers of sliced overzoomed tiles when the source tile extent is larger than 4096, by scaling the clip buffer with the extent (#​8705) (by @​tordans)
  • Fix the globe drag rounding its rotation to single precision (#​8784) (by @​johncarmack1984)
  • Fix load and idle firing before the other tiles finish loading when one tile fails (#​8785) (by @​johncarmack1984)
  • Avoid using .innerHTML = … for the Popup close icon (#​8795) (by @​k-yle)
  • Fix a GeoJSON feature without coordinates staying out of the tiles after updateData gives it some, by updating geojson-vt to 6.3.0 (#​8797) (by @​johncarmack1984)
sindresorhus/p-queue (p-queue)

v9.3.5

Compare Source

  • Fix missed abort when the task aborts the signal while it starts 507e7ee

v9.3.4

Compare Source

  • Count the running task before emitting active 22edad4
WarningImHack3r/vite-plugin-lucide-preprocess (vite-plugin-lucide-preprocess)

v1.9.0: - Automated release

Compare Source

  • Add support for newly renamed components in Lucide v1.58.0

[!NOTE]
This is a fully automated release.
Despite its content being manually checked after its release, it might be incorrect or potentially break some compatibility with Lucide.
If you happen to notice any issue I might not be aware of or actively working on, please open an issue.

vitest-dev/vitest (vitest)

v5.0.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v5.0.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@netlify

netlify Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for pauseai canceled.

Name Link
🔨 Latest commit f41f617
🔍 Latest deploy log https://app.netlify.com/projects/pauseai/deploys/6ad6a2f4f9122838148218bc

@renovate renovate Bot changed the title chore(deps): update dependency p-queue to ^9.3.4 fix(deps): update all non-major dependencies Oct 12, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 22 times, most recently from 112d328 to a02018b Compare October 18, 2026 13:48
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 63ea3fc to f570cde Compare October 19, 2026 19:50
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from f570cde to f41f617 Compare October 19, 2026 23:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants