Skip to content

chore(deps): update devdependencies (major) - #485

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-devdependencies
Open

chore(deps): update devdependencies (major)#485
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-devdependencies

Conversation

@renovate

@renovate renovate Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@actions/cache (source) ^4.0.2 → ^6.0.0 age confidence
@actions/core (source) ^1.11.1 → ^3.0.0 age confidence
@actions/exec (source) ^1.1.1 → ^3.0.0 age confidence
@actions/http-client (source) 2.2.3 → 4.0.1 age confidence
@actions/io (source) ^1.1.3 → ^3.0.0 age confidence
@actions/tool-cache (source) ^2.0.2 → ^4.0.0 age confidence
@babel/core (source) ^7.26.9 → ^8.0.0 age confidence
@babel/preset-typescript (source) ^7.27.1 → ^8.0.0 age confidence
@biomejs/biome (source) ^1.9.4 → ^2.0.0 age confidence
@octokit/openapi-types (source) ^25.0.0 → ^29.0.0 age confidence
@octokit/plugin-paginate-rest ^13.0.0 → ^16.0.0 age confidence
@octokit/plugin-rest-endpoint-methods ^16.0.0 → ^18.0.0 age confidence
@octokit/types ^14.0.0 → ^18.0.0 age confidence
@pnpm/patching.apply-patch (source) ^1000.0.7 → ^1100.0.0 age confidence
@types/jest (source) ^29.5.14 → ^30.0.0 age confidence
@types/node (source) ^22.13.8 → ^26.0.0 age confidence
admina ^1.0.1 → ^2.0.0 age confidence
cross-env 7.0.3 → 10.1.0 age confidence
cspell (source) ^9.0.0 → ^10.0.0 age confidence
eslint-config-atomic ^1.22.1 → ^2.0.0 age confidence
jest (source) ^29.7.0 → ^30.0.0 age confidence
npm-check-updates ^19.3.1 → ^23.0.0 age confidence
npm-run-all2 ^8.0.4 → ^9.0.0 age confidence
p-timeout ^6.1.4 → ^8.0.0 age confidence
safe-stable-stringify ^2.5.0 → ^3.0.0 age confidence
typescript (source) ^5.8.2 → ^7.0.0 age confidence
vite (source) ^7.3.1 → ^8.0.0 age confidence

Release Notes

actions/toolkit (@​actions/cache)

v6.3.0

  • Isolate Windows BSD tar read scratch files per operation and make cleanup best-effort, preventing concurrent cache restores from racing over shared temporary archives (#​2497).
  • Update compatible runtime and development dependencies, refresh transitive dependencies, and resolve npm audit findings.

v6.2.0

  • Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
  • Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v6.1.0

  • Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v6.0.1

  • Bump dependency versions (#​2393):
    • @actions/core to ^3.0.1
    • @actions/http-client to ^4.0.1
    • @actions/io to ^3.0.2
    • @azure/core-rest-pipeline to ^1.23.0
    • @azure/storage-blob to ^12.31.0
    • semver to ^7.7.4

v6.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v5.3.0

  • Isolate Windows BSD tar scratch files for concurrent cache list and extract operations, preventing calls from sharing cache.tar #​2497.
  • Update compatible runtime and development dependencies and resolve npm audit findings.

v5.2.0

  • Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
  • Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v5.1.0

  • Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v5.0.5

  • Bump @actions/glob to 0.5.1

v5.0.4

  • Bump @actions/http-client to 3.0.2

v5.0.3

Prevent retries for rate limited cache operations 2243.

v5.0.1

  • Fix Node.js 24 punycode deprecation warning by updating @azure/storage-blob from ^12.13.0 to ^12.29.1 #​2213
  • Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http, which eliminates the transitive dependency on node-fetch@2 → whatwg-url@5 → tr46@0.0.3 that used the deprecated punycode module

v5.0.0

  • Remove @azure/ms-rest-js dependency #​2197
    • The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead of @azure/ms-rest-js
  • Bump @actions/core from ^1.11.1 to ^2.0.0 #​2198
  • Bump @actions/exec from ^1.0.1 to ^2.0.0 #​2198
  • Bump @actions/glob from ^0.1.0 to ^0.5.0 #​2198
  • Bump @actions/http-client from ^2.1.1 to ^3.0.0 #​2198
  • Bump @actions/io from ^1.0.1 to ^2.0.0 #​2198
  • Add support for Node.js 24 #​2110
  • Add node-fetch override to resolve audit vulnerabilities #​2110
actions/toolkit (@​actions/core)

v3.0.1

  • Bump undici from 6.23.0 to 6.24.1 #​2348

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

  • Bump @actions/http-client to 3.0.2

v2.0.1

v2.0.0

actions/toolkit (@​actions/exec)

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

actions/toolkit (@​actions/http-client)

v4.0.1

  • Bump undici from 6.23.0 to 6.24.0 #​2347

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v3.0.2

  • Bump undici from 5.28.5 to 6.23.0

v3.0.1

  • Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent #​2229

v3.0.0

actions/toolkit (@​actions/io)

v3.0.2

  • Fix: update lock file version

v3.0.1

  • Fix: export @actions/io/lib/io-util

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

  • Add support for Node 24 #​2110
  • Ensures consistent behavior for paths on Node 24 with Windows
actions/toolkit (@​actions/tool-cache)

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()
3.0.1
  • Bump @actions/http-client to 3.0.2
3.0.0
  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
2.0.2
2.0.1
  • Update to v2.0.1 of @actions/http-client #​1087
2.0.0
  • Update to v2.0.0 of @actions/http-client
  • The type of the headers parameter in the exported function downloadTool has been narrowed from { [header: string]: any } to { [header: string]: number | string | string[] | undefined; } (that is, http.OutgoingHttpHeaders).
    This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
  • Update lockfileVersion to v2 in package-lock.json #​1025
1.7.1
1.7.0
1.6.1
1.6.0
1.3.5
1.3.4

Here is the security issue that was fixed in the http-client 1.0.8 release

1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
1.1.2
1.0.0
  • Initial release

v3.0.1

  • Bump @actions/http-client to 3.0.2

v3.0.0

  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
babel/babel (@​babel/core)

v8.0.9

Compare Source

v8.0.9 (2026-10-23)

This release contains no changes. It is needed only to update the repo (which is based on @babel/core's last release) in Node.js's CITGM.

v8.0.7

Compare Source

🐛 Bug Fix
  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • babel-traverse
  • Other
  • babel-core
🏠 Internal
  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3

v8.0.6

Compare Source

👓 Spec Compliance
  • babel-helper-validator-identifier, babel-parser
🐛 Bug Fix
  • babel-parser
  • babel-helper-string-parser, babel-parser
🏠 Internal
  • babel-code-frame, babel-core, babel-generator, babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-parser, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-regenerator, babel-plugin-transform-typescript, babel-preset-env, babel-traverse, babel-types
  • babel-parser
  • babel-core
  • babel-build-external-helpers, babel-cli, babel-code-frame, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-globals, babel-helper-string-parser, babel-helper-transform-fixture-test-runner, babel-helper-validator-identifier, babel-node, babel-parser, babel-plugin-transform-async-generator-functions, babel-plugin-transform-runtime, babel-register, babel-runtime-corejs3, babel-traverse
🏃‍♀️ Performance
  • babel-helper-compilation-targets, babel-helper-transform-fixture-test-runner

v8.0.5

Compare Source

👓 Spec Compliance
🐛 Bug Fix
📝 Documentation
🏠 Internal
  • babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • babel-node
  • babel-types
🏃‍♀️ Performance

v8.0.1

Compare Source

💥 Breaking Change
  • babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

v8.0.0

Compare Source

👓 Spec Compliance
💥 Breaking Change
  • babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • babel-parser
🐛 Bug Fix
  • babel-generator
  • babel-plugin-transform-modules-systemjs
📝 Documentation
🏠 Internal
🏃‍♀️ Performance
babel/babel (@​babel/preset-typescript)

v8.0.7

Compare Source

🐛 Bug Fix
  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • babel-traverse
  • Other
  • babel-core
🏠 Internal
  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3

v8.0.1

Compare Source

💥 Breaking Change
  • babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

v8.0.0

Compare Source

👓 Spec Compliance
💥 Breaking Change
  • babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • babel-parser
🐛 Bug Fix
  • babel-generator
  • babel-plugin-transform-modules-systemjs
📝 Documentation
🏠 Internal
🏃‍♀️ Performance
biomejs/biome (@​biomejs/biome)

v2.6.3

Compare Source

Patch Changes

  • #​12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

    const minimum = array.toSorted((a, b) => a - b)[0];

  • #​12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

  • #​12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

    for (const name of users.map((user) => user.name)) {
  console.log(name);
}

  • #​12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

  • #​12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

    <table bgcolor="#ffffff" cellpadding="5"></table>

  • #​12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

    const fullPath = __dirname + "/foo.js"; // reported

  • #​12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

    await page.locator("button").first().click();

  • #​12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

    @layer components {
  @layer components {
    .button {
      color: red;
    }
  }
}

  • #​12289 bbbd95d Thanks @​dyc3! - Added the nursery rule noShortTimeValues, which reports CSS animation and transition times that are shorter than the configured minimum number of milliseconds. The rule does nothing until minimum is set.

    For example, the following code is invalid when minimum is 100:

    a {
  transition-duration: 80ms;
}

  • #​12431 f748ec0 Thanks @​dyc3! - Added the nursery rule noSvelteInternal, which disallows importing from svelte/internal and its submodules. These modules are private to Svelte and can change or disappear in any release.

    import { get_current_component } from "svelte/internal";

  • #​12270 8ae35c4 Thanks @​dyc3! - Added the nursery rule noTanstackQueryRestDestructuring, which disallows rest destructuring and object spread on TanStack Query results. Both read every property of the result, so the component updates on every change to the query.

    import { useQuery } from "@tanstack/react-query";

const { data, ...rest } = useQuery({ queryKey: ["todos"], queryFn: fetchTodos });

    The rule belongs to the new tanstackQuery domain.

  • #​12308 372af2a Thanks @​dyc3! - Added the new nursery rule noUnreadableForOfExpression, which reports for...of and for await...of loops that go through the result of a complex expression instead of a variable, a property, or a short call.

    for (const item of getItems(createArgument(seed))) {} // reported

  • #​12422 0be8d10 Thanks @​dyc3! - Added the new nursery rule noUnsafeReturn, which disallows returning a value typed as any from a function.

    function parse(text: string) {
  return JSON.parse(text); // reported
}

  • #​12311 8434c92 Thanks @​dyc3! - Added the nursery rule noUselessSplice, which reports splice() calls that have a simpler alternative. For example, array.splice(0, 1) can be written as array.shift().

  • #​12293 eaa4a2b Thanks @​dyc3! - Added the nursery rule noVueUnusedEmitDeclarations, which reports events that a Vue component declares but never emits.

    For example, the following component never emits close:

    <script setup>
const emit = defineEmits(["change", "close"]);
emit("change");
</script>

  • #​12386 f01ebb0 Thanks @​dyc3! - Added the nursery rule noVueVTextVHtmlOnComponent, which disallows v-text and v-html on Vue components. These directives replace everything inside the component's root element instead of filling its slot.

    <template>
  <MyComponent v-html="html"></MyComponent>
</template>

  • #​12385 7bd38b7 Thanks @​dyc3! - Added the new nursery rule noVueWatchAfterAwait, which disallows creating watchers after an await in a Vue component's setup() function. Vue doesn't stop these watchers when the component is removed. A watcher is allowed when the function it returns is stored, so that function can be called later to stop the watcher.

    <script>
import { watch } from "vue";

export default {
  async setup() {
    await fetchUser();
    watch(source, () => {});
  },
};
</script>

  • #​12286 50d2a4e Thanks [@​dyc3](https://redirect.github.

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Sep 5, 2026
@renovate
renovate Bot enabled auto-merge (squash) September 5, 2026 06:14
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 15 times, most recently from 9c90a2e to ea96bf1 Compare September 12, 2026 03:09
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 10 times, most recently from d78fc22 to 25648e2 Compare September 19, 2026 01:48
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 3 times, most recently from bda9bde to c6387c4 Compare September 23, 2026 03:58
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 8 times, most recently from a25782e to 8452256 Compare October 1, 2026 15:47
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 8 times, most recently from bccb872 to 67176e1 Compare October 8, 2026 16:08
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 6 times, most recently from 994dcdd to 05faa98 Compare October 16, 2026 18:33
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 6 times, most recently from c85457e to e000a1a Compare October 23, 2026 17:31
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch from e000a1a to 4498fa8 Compare October 24, 2026 16:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants