chore(deps): update all non-major dependencies - #446
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
9c4e39b to
5bfebea
Compare
5bfebea to
7804f68
Compare
renovate
Bot
changed the title
7804f68 to
2d975ff
Compare
2d975ff to
0104ff1
Compare
0104ff1 to
8120e32
Compare
8120e32 to
5ec9f5e
Compare
5ec9f5e to
efcb3b7
Compare
efcb3b7 to
1a61aec
Compare
1a61aec to
cf8e7f8
Compare
cf8e7f8 to
2b13cf8
Compare
6132302 to
360e116
Compare
360e116 to
aa97a8b
Compare
aa97a8b to
714cf9d
Compare
714cf9d to
bdbb60c
Compare
bdbb60c to
9343bf3
Compare
9343bf3 to
fb7fea7
Compare
fb7fea7 to
556aaae
Compare
commit: |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
📦 Package Size📚 22 runtime dependencies (no change)
All tracked output (25)
Runtime dependencies (22)
Baseline: main_@_f291aa1f___2026-09-09 · gzip is the comparison metric · changes below 16 B gzip are ignored |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This PR contains the following updates:
^9.15.0→^9.16.0^26.5.0→^26.5.1v0.0.9-mp→v0.0.9^6.8.0→^6.9.0^6.8.0→^6.9.024→24.21.0^1.428.7→^1.428.111.429.5(+5)^1.428.7→^1.428.111.429.5(+5)^1.4.2→^1.5.0Release Notes
stripe/stripe-js (@stripe/stripe-js)
v9.16.0Compare Source
New features
Fixes
Changed
Hebilicious/reproduire (Hebilicious/reproduire)
v0.0.9Compare Source
compare changes
maplibre/maplibre-gl-js (maplibre-gl)
v6.9.0Compare Source
✨ Features and improvements
setRTLTextPluginandgetRTLTextPluginStatus(#8343) (by @HarelM)OffscreenCanvaswhere available, removing a main-thread stall of tens of milliseconds on GPU-accelerated browsers when a sprite loads (#8339) (by @cherenkov)🐞 Bug fixes
setStyle()throwing while terrain is still loading because an intermediate render tried to compile a terrain shader before the replacement style initialized its projection (#6824) (by @miakh)updateDataproperty removals throwing after geometry-only updates or retaining previously updated values (#8372) (by @jokrasno)undefinedas not given injumpTo,easeToandflyTo; they were coerced to NaN (#8373) (by @vlumi)Not implemented.error that broke panning and zooming when the projection was changed while the camera was moving, on maps with terrain enabled or atransformCameraUpdatecallback (#8351) (by @lazerg)400x300fallback size when the container is shown before the resize observer's first notification is delivered (#8277) (by @spliffone)MercatorTransformthrowing when it is resized to a zero width, and skip the matrix calculation of every projection while the transform has a zero width or height (#8374) (by @avosa)idlefrom firing for the transition duration after the map was otherwise done, and could ease the sky and the light on a different curve from the layers (#8348) (by @cherenkov)actions/node-versions (node)
v24.21.0: 24.21.0Compare Source
Node.js 24.21.0
v24.20.0: 24.20.0Compare Source
Node.js 24.20.0
v24.19.0: 24.19.0Compare Source
Node.js 24.19.0
v24.18.1: 24.18.1Compare Source
Node.js 24.18.1
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
v24.17.0: 24.17.0Compare Source
Node.js 24.17.0
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
PostHog/posthog-js (posthog-js)
v1.428.11Compare Source
1.428.11
Patch Changes
d5abeceThanks @bs1180! - fix(surveys): don't show the default "Start typing..." placeholder when the survey's placeholder text is empty(2026-09-09)
v1.428.10Compare Source
1.428.10
Patch Changes
891eefaThanks @robbie-c! - Apply replay URL privacy settings to URL values in captured JSON-LD payloads.(2026-09-09)
891eefa,891eefa]:v1.428.9Compare Source
1.428.9
Patch Changes
e8b2be1Thanks @robbie-c! - Include the masked page URL with JSON-LD replay events.(2026-09-09)
e8b2be1]:v1.428.8Compare Source
open-circle/valibot (valibot)
v1.5.0Compare Source
Many thanks to @tats-u, @idleberg, @yslpn, @francisjohnjohnston-web, @MaxFreedomPollard, @mahirhir, @ItzXynx, @LeSingh1, @maxtaran2010, @ysknsid25, @cyyynthia, @spokodev and @sanjibani for contributing to this release.
codePoints,maxCodePoints,minCodePointsandnotCodePointsvalidation actions to validate the number of Unicode code points (pull request #888)ksuidvalidation action to validate KSUIDs (pull request #1370)_getStandardPropsutility with_standardSchema(pull request #1534)urlaction to useURL.canParsewhen available to avoid constructing URL objects (pull request #1608)stringifyJsonaction to preserve the dataset value whenJSON.stringifyreturnsundefined(pull request #1476)literalschema andvalue,values,notValueandnotValuesactions to treatNaNas equal to itself (pull request #1573)intersectschema to merge matchingNaNvalues and invalid dates (pull request #1573)cacheandcacheAsyncmethods to clone the issues of a cached dataset, preventing parent schemas from adding their path item to the same issue on every cache hit (pull request #1620)strictObject,looseObject,objectWithRestand their async variants to correctly handle unknown input keys that collide withObject.prototypemembers (pull request #1523)intersectandintersectAsyncschemas to ignore inherited properties when merging objects and preserve own properties without invoking inherited setters or changing the output prototype (pull request #1621)ulidaction to reject ULIDs that exceed the maximum 128-bit value (pull request #1498)emailaction to reject non-ASCII characters accepted by Unicode case folding (pull request #1075)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.