Skip to content

Update all non-major dependencies - #4538

Merged
Hugos68 merged 2 commits into
mainfrom
renovate/all-non-major-dependencies
Jul 21, 2026
Merged

Update all non-major dependencies#4538
Hugos68 merged 2 commits into
mainfrom
renovate/all-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/mdx (source) 7.0.2 → 7.0.3 age confidence
@astrojs/vercel (source) 11.0.2 → 11.0.3 age confidence
@changesets/cli (source) 2.31.0 → 2.31.1 age confidence
@comark/svelte (source) 0.5.0 → 0.5.1 age confidence
@floating-ui/dom (source) 1.7.6 → 1.8.0 age confidence
@iconify-json/simple-icons 1.2.89 → 1.2.90 age confidence
@lucide/astro (source) 1.24.0 → 1.25.0 age confidence
@lucide/svelte (source) 1.24.0 → 1.25.0 age confidence
@prettier/plugin-oxc (source) 0.2.0 → 0.2.1 age confidence
@sveltejs/kit (source) 2.69.2 → 2.70.0 age confidence
@tailwindcss/vite (source) 4.3.2 → 4.3.3 age confidence
@tanstack/react-router (source) 1.170.17 → 1.170.18 age confidence
@tanstack/react-start (source) 1.168.27 → 1.168.30 age confidence
@tanstack/router-cli (source) 1.167.18 → 1.167.21 age confidence
astro (source) 7.0.7 → 7.1.1 age confidence
comark (source) 0.5.0 → 0.5.1 age confidence
drizzle-orm (source) 1.0.0-rc.4-5d5b77c → 1.0.0-rc.4-de6c356 age confidence
fuse.js (source) 7.4.2 → 7.5.0 age confidence
lucide-react (source) 1.24.0 → 1.25.0 age confidence
oxc-resolver (source) 11.23.0 → 11.24.2 age confidence
oxlint (source) 1.73.0 → 1.74.0 age confidence
oxlint-tsgolint 0.24.0 → 0.25.0 age confidence
pnpm (source) 11.11.0 → 11.14.0 age confidence
postcss (source) 8.5.16 → 8.5.19 age confidence
satori 0.26.0 → 0.28.0 age confidence
svelte (source) 5.56.4 → 5.56.6 age confidence
svelte-check 4.7.2 → 4.7.3 age confidence
tailwindcss (source) 4.3.2 → 4.3.3 age confidence
tsdown (source) 0.22.4 → 0.22.9 age confidence
vite (source) 8.1.4 → 8.1.5 age confidence

Release Notes

withastro/astro (@​astrojs/mdx)

v7.0.3

Compare Source

Patch Changes
  • #​17341 64b0d66 Thanks @​Princesseuh! - Fixes custom pre components not applying to syntax-highlighted code blocks when using the Sätteri Markdown processor with MDX.
withastro/astro (@​astrojs/vercel)

v11.0.3

Compare Source

Patch Changes
changesets/changesets (@​changesets/cli)

v2.31.1

Compare Source

Patch Changes
  • #​2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.
comarkdown/comark (@​comark/svelte)

v0.5.1: @​comark/svelte v0.5.1

Compare Source

0.5.1 (2026-07-14)

floating-ui/floating-ui (@​floating-ui/dom)

v1.8.0

Compare Source

Minor Changes
  • feat: add 'layoutViewport' string option to rootBoundary. Unlike the visual 'viewport' boundary, it remains stable while pinch-zooming or when a mobile software keyboard is open, and unlike a manually passed Rect of the documentElement's client size, it accounts for space reserved by scrollbar-gutter: stable.
Patch Changes
  • fix: remove redundant passive options from scroll listeners
  • fix: support explicit undefined for optional properties with exactOptionalPropertyTypes
  • fix(autoUpdate): update immediately instead of waiting for the 1s layoutShift refresh throttle when the reference moved during an observer refresh
  • fix(getClippingRect): correct clipping-ancestor filtering for fixed-position elements
  • perf(dom): reduce bundle size and skip redundant per-call work in positioning utilities
  • fix(getViewportRect): account for scrollbar-gutter: stable both-edges reserved space
  • fix(getViewportRect): don't overflow past a left-side document scrollbar
  • fix(platform): don't throw in getClientRects when a virtual element without a getClientRects method is used with the inline() middleware
  • fix(autoUpdate): refresh layout shift observer on root resize
  • Update dependencies: @floating-ui/core@1.8.0, @floating-ui/utils@0.2.12
lucide-icons/lucide (@​lucide/astro)

v1.25.0: Version 1.25.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.24.0...1.25.0

prettier/prettier (@​prettier/plugin-oxc)

v0.2.1

Compare Source

sveltejs/kit (@​sveltejs/kit)

v2.70.0

Compare Source

Minor Changes
  • feat: move defineEnvVars to @sveltejs/kit/env (#​16378)
Patch Changes
  • fix: enable CSRF protection in builds with a non-production NODE_ENV value (#​16313)

v2.69.3

Compare Source

Patch Changes

  • fix: detect destructured load and actions exports during type generation (#​16329)

  • fix: ensure CSS URL references are absolute when paths.relative is false (#​16315)

  • fix: align MAX_COOKIE_SIZE with RFC 6265bis (#​16322)

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.3

Compare Source

Fixed
  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)
TanStack/router (@​tanstack/react-router)

v1.170.18

Compare Source

Patch Changes
TanStack/router (@​tanstack/react-start)

v1.168.30

Compare Source

Patch Changes

v1.168.29

Compare Source

Patch Changes

v1.168.28

Compare Source

Patch Changes
TanStack/router (@​tanstack/router-cli)

v1.167.21

Compare Source

Patch Changes

v1.167.20

Compare Source

Patch Changes

v1.167.19

Compare Source

Patch Changes
withastro/astro (astro)

v7.1.1

Compare Source

Patch Changes

v7.1.0

Compare Source

Minor Changes

  • #​17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';

const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #​17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    collectionStorage: 'chunked',
  },
});

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #​17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  security: {
    csp: {
      scriptDirective: {
        resources: [{ resource: 'https://cdn.example.com', kind: 'element' }],
      },
      styleDirective: {
        resources: [{ resource: "'unsafe-inline'", kind: 'attribute' }],
      },
    },
  },
});
Scoping at runtime

The same kind option is available on the runtime CSP API, where the existing methods now also accept an object:

ctx.csp.insertScriptResource({ resource: 'https://cdn.example.com', kind: 'element' });
ctx.csp.insertStyleResource({ resource: "'unsafe-inline'", kind: 'attribute' });

  • #​17258 84814d4 Thanks @​astrobot-houston! - Adds a new format() option to the paginate utility. The format() option is a function that accepts the current URL of the page, and returns a new URL.

    For example, when your host only supports URLs using the .html extension, you can use format() to add it to the generated URLs:

    ---
export async function getStaticPaths({ paginate }) {
  // Load your data with fetch(), getCollection(), etc.
  const response = await fetch(`https://pokeapi.co/api/v2/pokemon?limit=150`);
  const result = await response.json();
  const allPokemon = result.results;

  // Return a paginated collection of paths for all items
  return paginate(allPokemon, {
    pageSize: 10,
    format: (url) => `${url}.html`,
  });
}

const { page } = Astro.props;
---

  • #​17331 7db6420 Thanks @​matthewp! - Adds a --ignore-lock flag to astro dev for starting a dev server without checking or writing the lock file, so it can run alongside an already-running dev server for the same project.

    The new instance is not tracked by astro dev stop, astro dev status, or astro dev logs. --ignore-lock cannot be combined with --background (or an auto-detected AI agent environment, which runs dev servers in the background automatically) or --force, since those rely on the lock file.

    astro dev --ignore-lock

  • #​17389 16de021 Thanks @​florian-lefebvre! - Allows passing URL entrypoints when configuring the logger

    Matching other APIs like session drivers or font providers, the logger entrypoint can now be a URL:

    import { defineConfig } from 'astro/config';

export default defineConfig({
  logger: {
    entrypoint: new URL('./logger.js', import.meta.url),
  },
});
Patch Changes

  • #​17332 4407483 Thanks @​astrobot-houston! - Fixes the JSON logger crashing with process is not defined in non-Node runtimes like Cloudflare's workerd. The JSON logger now uses console.log/console.error instead of process.stdout/process.stderr, matching the pattern already used by the console logger.

  • #​17391 186a1e7 Thanks @​florian-lefebvre! - Fixes a case where an integration could not update the logger with updateConfig()

  • #​17394 d9f99e1 Thanks @​matthewp! - Fixes element-specific CSP directives to preserve the existing behavior of configured script and style resources

  • #​17374 b2d1b3e Thanks @​astrobot-houston! - Fixes dev server returning 404 for ?url imported assets when accessed via browser navigation

  • #​17390 ed71eaf Thanks @​florian-lefebvre! - Removes an unused and undocumented generic from the AstroLoggerDestination type

  • #​17393 092da56 Thanks @​matthewp! - Hardens generated transition styles, development metadata, and server island URLs when embedding dynamic values

v7.0.9

Compare Source

Patch Changes

  • #​17286 a249317 Thanks @​astrobot-houston! - Fixes the first browser visit after astro dev starts triggering an immediate full page reload

  • #​17369 a94d4a5 Thanks @​adamchal! - Fixes an issue where a client island could permanently fail to hydrate if the first attempt to load its component failed. Islands now reliably recover from transient import failures, which previously did not work for React components during astro dev.

v7.0.8

Compare Source

Patch Changes
krisk/Fuse (fuse.js)

v7.5.0

Compare Source

⚠️ Behavior changes

Every change in this release is a bug fix, but each one corrects a scoring or ranking bug. Scores and result ordering will shift for some queries. That is why this ships as a minor rather than a patch: the public API is unchanged and upgrading is a drop-in, but the results you get back can differ, and that should not arrive silently in a patch bump.

If you assert on exact score values or on a specific result order, expect those assertions to need updating. Re-baseline them against 7.5.0 rather than pinning to 7.4.x, since the 7.4.x behavior was wrong in the cases below.

  • Field-length normalisation now counts words correctly. Tabs and newlines were not treated as word separators, so a multi-line or tab-delimited field was scored as though it were one long word, making it look far shorter than it is. Fields containing \t, \n, or \r now score differently (#​830).
  • Key weights are now normalised in object and keyless-logical search. Weights that did not sum to 1 were applied unnormalised, skewing the relative influence of each key. If your keys weights do not already sum to 1, your relative ranking changes (#​833).
  • limit now returns the correct top-N when scores tie. A tie at the cutoff boundary could evict a result that should have been kept, so limit could return the wrong items, not merely the right items in a different order (#​835).
  • Bitap respects minMatchCharLength in the exact-match shortcut. Matches shorter than minMatchCharLength were still reported via the exact-match fast path, so the matches array could contain entries it was configured to exclude (#​831).
Bug Fixes
  • bitap: respect minMatchCharLength in exact-match shortcut (dbb98b6), closes #​831
  • fieldNorm: count tabs and newlines as word separators (6fe85b0), closes #​830
  • fieldNorm: count word-starts instead of space transitions (2946f97)
  • scoring: normalise key weights in object and keyless-logical search (e164b61), closes #​833
  • search: keep the correct top-N under limit when scores tie (437f8f3), closes #​835, thanks @​spokodev for the report and the fix
7.4.2 (2026-06-05)
Bug Fixes
  • types: emit CommonJS declarations (.d.cts) for node16/nodenext (#​780) (33f5d29)
7.4.1 (2026-06-02)
Bug Fixes
  • types: add TypeScript declarations for fuse.js/worker-script (6ef6c33), closes #​828
  • types: ship TypeScript declarations for fuse.js/worker (572ad1e), closes #​828
lucide-icons/lucide (lucide-react)

v1.25.0

Compare Source

oxc-project/oxc-resolver (oxc-resolver)

v11.24.2

Compare Source

🎨 Styling
Contributors

v11.24.1

Compare Source

🚀 Features
🚜 Refactor
📚 Documentation
⚡ Performance
  • (cache) reuse the child path when its parent canonicalizes to itself (#​1288) (by @​Boshen)
  • (napi) shrink release binaries (path remap + build-std without backtrace) (#​1283) (by @​Boshen)
Contributors
oxc-project/oxc (oxlint)

v1.74.0

Compare Source

🚀 Features
  • 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#​24044) (Boshen)
🐛 Bug Fixes
  • 8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#​24341) (leaysgur)
  • 2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#​24339) (leaysgur)
⚡ Performance
  • 7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#​24413) (connorshea)
  • 6272051 linter/typescript/no-require-imports: Compile allow patterns once (#​24417) (connorshea)
  • 33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#​24420) (connorshea)
oxc-project/tsgolint (oxlint-tsgolint)

v0.25.0

Compare Source

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated (UTC)
plus.skeleton.dev Ignored Ignored Preview Jul 21, 2026 4:53pm
themes.skeleton.dev Ignored Ignored Jul 21, 2026 4:53pm
www.skeleton.dev Ignored Ignored Preview Jul 21, 2026 4:53pm

Request Review

@renovate renovate Bot added the dependencies Anything related to dependency issues or updates. label Jul 20, 2026
@changeset-bot

changeset-bot Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 2cf41fb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from d844280 to a4037c1 Compare July 20, 2026 09:10
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from a4037c1 to 2dbacf1 Compare July 21, 2026 02:44
@Hugos68
Hugos68 merged commit d7ce920 into main Jul 21, 2026
7 checks passed
@Hugos68
Hugos68 deleted the renovate/all-non-major-dependencies branch July 21, 2026 16:55
@renovate

renovate Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Anything related to dependency issues or updates.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Hugos68