[elonehoo]

Applies the dependency upgrades from the nine open Renovate PRs in one branch, with a lockfile regenerated by pnpm 12.14.0 and the follow-on fixes required for CI to install, build, and test. The existing Renovate PRs are left open.

Upgrades

Where a minor PR and a major PR touched the same package, the major range is what landed.

• chore(deps): update all non-major dependencies - autoclosed #191 non-major: @antfu/eslint-config ^8.3.0 (superseded by chore(deps): update dependency @antfu/eslint-config to v9 - autoclosed #192), @types/node ^24.19.2, bumpp ^11.1.0 (superseded by chore(deps): update dependency bumpp to v12 - autoclosed #196), eslint ^10.13.0, vue ^3.5.44, @vitejs/plugin-vue ^6.0.10, vite ^8.3.4, @iconify-json/carbon ^1.2.28, @unocss/reset ^66.11.0, @vueuse/core ^14.4.0 (superseded by chore(deps): update dependency @vueuse/core to v15 - autoclosed #198), https-localhost ^4.7.2, jiti ^2.7.0, unocss ^66.11.0, unplugin-vue-components ^32.1.0, workbox-window ^7.4.1
• chore(deps): update dependency @antfu/eslint-config to v9 - autoclosed #192 @antfu/eslint-config ^9.5.1
• chore(deps): update actions/checkout action to v7 - autoclosed #193 actions/checkout v7 (CI and release)
• chore(deps): update dependency typescript to v7 - autoclosed #194 TypeScript 7.0.2, installed as @typescript/native (npm:typescript@^7.0.2). tsc is 7.0.2
• chore(deps): update actions/setup-node action to v7 - autoclosed #195 actions/setup-node v7 (CI and release)
• chore(deps): update dependency bumpp to v12 - autoclosed #196 bumpp ^12.3.0
• chore(deps): update dependency chalk to v6 - autoclosed #197 chalk ^6.0.1
• chore(deps): update dependency @vueuse/core to v15 - autoclosed #198 @vueuse/core ^15.0.0
• chore(deps): update dependency tsup to v9 - autoclosed #199 tsup ^9.0.0

Why CI was red

pnpm/action-setup with version: latest installs pnpm 12. That release fails pnpm install in two ways the Renovate lockfiles do not satisfy:

• minimumReleaseAge defaults to 24 hours, so a lockfile generated the same day as a publish dies with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (eslint 10.13.0 on chore(deps): update all non-major dependencies - autoclosed #191).
• strictDepBuilds defaults to true, so unapproved install scripts fail with ERR_PNPM_IGNORED_BUILDS (esbuild on chore(deps): update dependency @antfu/eslint-config to v9 - autoclosed #192, chore(deps): update dependency typescript to v7 - autoclosed #194, chore(deps): update dependency bumpp to v12 - autoclosed #196, chore(deps): update dependency chalk to v6 - autoclosed #197, chore(deps): update dependency @vueuse/core to v15 - autoclosed #198, chore(deps): update dependency tsup to v9 - autoclosed #199).

pnpm/action-setup v6 also errors when a version input is set and package.json packageManager is set. pnpm is pinned as packageManager: pnpm@12.14.0, Node is installed before pnpm, and the workflow no longer passes version: latest.

Other fixes

• allowBuilds.esbuild: true so the esbuild postinstall is allowed. minimumReleaseAge: 0 so --no-frozen-lockfile does not reject a same-day publish. ignore-workspace-root-check, strict-peer-dependencies, and auto-install-peers moved from .npmrc into pnpm-workspace.yaml, because pnpm 12 only reads auth and registry settings from .npmrc.
• @antfu/eslint-config v9 requires shellEmulator: true, trustPolicy: no-downgrade, and minimumReleaseAgeExcludePrune: true in the workspace file, and a sorted key order.
• TypeScript 7 has no compiler API. tsup 9's rollup-plugin-dts fails on typescript@7.0.2, and typescript-eslint (pulled in by the antfu config) throws on TS 7. The typescript dependency is npm:@typescript/typescript6@^6.0.2 so tsup and eslint keep importing the TS 6 API. @typescript/native is TypeScript 7.0.2, and the tsc bin is 7.0.2.
• ESLint 10 / antfu 9: image alt text on the READMEs, and Object.hasOwn() in isEmptyObject.

pnpm run lint, pnpm run build, and pnpm run test pass locally on Node 22 and Node 26.12.0. pnpm install --frozen-lockfile passes with pnpm 12.14.0.

Not changed

• The nine Renovate PRs are left open.
• test/ still uses Vitest 3, Vite 6, and @vitest/coverage-v8 3. None of the open PRs bump them, and the test job passes on Node 26 without a Vitest major.
• Docs are not built in CI.

  

---

Note

Medium Risk
Broad dev-dependency and pnpm/CI toolchain changes affect install, build, and lint everywhere, though runtime library behavior is unchanged aside from a minor isEmptyObject implementation tweak.

^{Reviewed by Cursor Bugbot for commit 5faf32a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.