Skip to content

fix(deps): update all non-major dependencies - #1535

Merged
dawsontoth merged 2 commits into
stagefrom
renovate/all-minor-patch
Jul 20, 2026
Merged

fix(deps): update all non-major dependencies#1535
dawsontoth merged 2 commits into
stagefrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@ai-sdk/react (source) 4.0.20 → 4.0.34 age confidence dependencies patch
@datadog/datadog-ci (source) 5.21.0 → 5.21.2 age confidence devDependencies patch
@harperfast/skills (source) 1.10.8 → 1.11.0 age confidence dependencies minor
@stripe/react-stripe-js 6.7.0 → 6.8.0 age confidence dependencies minor
@stripe/stripe-js (source) 9.9.0 → 9.10.0 age confidence dependencies minor
@tailwindcss/vite (source) 4.3.2 → 4.3.3 age confidence dependencies patch
@tanstack/react-router (source) 1.170.17 → 1.170.18 age confidence dependencies patch
ai (source) 7.0.19 → 7.0.31 age confidence dependencies patch
create-harper (source) 1.10.6 → 1.10.9 age confidence dependencies patch
davelosert/vitest-coverage-report-action v2.12.1 → v2.12.2 age confidence action patch
harper (source) 5.1.18 → 5.1.21 age confidence devDependencies patch 5.1.22
lucide-react (source) 1.24.0 → 1.25.0 age confidence dependencies minor
oxlint (source) 1.73.0 → 1.74.0 age confidence devDependencies minor
pnpm (source) 11.11.0 → 11.13.1 age confidence packageManager minor 11.15.1 (+2)
semantic-release 25.0.5 → 25.0.7 age confidence devDependencies patch 25.0.8
swagger-ui-react 5.32.8 → 5.32.9 age confidence dependencies patch
tailwindcss (source) 4.3.2 → 4.3.3 age confidence dependencies patch
vite (source) 8.1.4 → 8.1.5 age confidence devDependencies patch

Release Notes

vercel/ai (@​ai-sdk/react)

v4.0.34

Compare Source

Patch Changes

v4.0.33

Compare Source

Patch Changes
  • ai@​7.0.30

v4.0.32

Compare Source

Patch Changes
  • ai@​7.0.29

v4.0.31

Compare Source

Patch Changes

  • 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:

    • Runtime-validate _meta.ui and drop malformed or non-string fields.
    • Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist.
    • Derive a concrete postMessage target origin and validate inbound message origins.
    • Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link.
    • Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources.

  • Updated dependencies [48e7e78]

v4.0.30

Compare Source

Patch Changes
  • Updated dependencies [0bc8d4f]
    • ai@​7.0.28

v4.0.29

Compare Source

Patch Changes
  • 519c72b: fix (react/mcp-apps): sanitize server-supplied CSP domains in getMCPAppCSP so values cannot inject extra directives, sources, or policies into the generated Content-Security-Policy

v4.0.28

Compare Source

Patch Changes

v4.0.27

Compare Source

Patch Changes
  • Updated dependencies [27d294d]
    • ai@​7.0.26

v4.0.26

Compare Source

Patch Changes

v4.0.24

Compare Source

Patch Changes
  • Updated dependencies [930f949]
    • ai@​7.0.23

v4.0.23

Compare Source

Patch Changes
  • Updated dependencies [8f89c25]
    • ai@​7.0.22

v4.0.22

Compare Source

Patch Changes
  • Updated dependencies [308a519]
    • ai@​7.0.21

v4.0.21

Compare Source

Patch Changes
  • d26bf99: Align React development dependencies with React 18 so workspace-linked examples do not bundle duplicate React copies.
  • Updated dependencies [b9ac19f]
  • Updated dependencies [a4186d6]
    • ai@​7.0.20
DataDog/datadog-ci (@​datadog/datadog-ci)

v5.21.2

Compare Source

What's Changed

Serverless

Full Changelog: DataDog/datadog-ci@v5.21.1...v5.21.2

v5.21.1

Compare Source

What's Changed

Dependencies
Software Delivery

Full Changelog: DataDog/datadog-ci@v5.21.0...v5.21.1

HarperFast/skills (@​harperfast/skills)

v1.11.0

Compare Source

Features
  • rules: add v5-upgrade rule from v5 migration guide (#​71) (6c99002)
stripe/react-stripe-js (@​stripe/react-stripe-js)

v6.8.0

Compare Source

Changed
stripe/stripe-js (@​stripe/stripe-js)

v9.10.0

Compare Source

Changed
  • Terms element types (#​948)
  • Update Checkout Form change event types (#​946)
  • Add fields.name types to AE (#​947)
  • Add validateElements type to StripeCheckoutLoadActionsSuccess (#​945)
tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.3

Compare Source

Fixed
  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)
TanStack/router (@​tanstack/react-router)

v1.170.18

Compare Source

Patch Changes
vercel/ai (ai)

v7.0.31

Compare Source

Patch Changes

v7.0.30

Compare Source

Patch Changes

v7.0.29

Compare Source

Patch Changes

v7.0.28

Compare Source

Patch Changes
  • 0bc8d4f: Fix chat onFinish handling when overlapping requests clear the active response before a resume stream finishes.

v7.0.27

Compare Source

Patch Changes
  • ac01b79: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.
  • 2696562: experimental_streamTranscribe result promises now resolve without consuming fullStream: accessing any result promise consumes the stream internally. Previously await result.text alone deadlocked on transform backpressure. Because live transcription streams can be unbounded, fullStream is explicitly single-consumer (no replay buffering): access it once, before any result promise, when both stream parts and final results are needed.
  • Updated dependencies [31c7be8]
  • Updated dependencies [4d096f6]

v7.0.26

Compare Source

Patch Changes
  • 27d294d: feat(ai): group orphaned tool calls after tool approvals under parent span

v7.0.25

Compare Source

Patch Changes
  • 7805e4a: Cancelling the experimental_streamTranscribe fullStream now also aborts a still-pending doStream setup, so a model whose doStream has not yet resolved is cancelled instead of leaking.
  • f8e82fd: Update the experimental_streamTranscribe unsupported-model error message now that gateway string model IDs can support streaming transcription.
  • Updated dependencies [4be62c1]
  • Updated dependencies [f8e82fd]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]

v7.0.23

Compare Source

Patch Changes

v7.0.22

Compare Source

Patch Changes
  • 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

v7.0.21

Compare Source

Patch Changes

v7.0.20

Compare Source

Patch Changes
  • b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
  • a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.
HarperFast/create-harper (create-harper)

v1.10.9

Compare Source

v1.10.8

Compare Source

Bug Fixes
  • templates: drop removed baseUrl option from TS tsconfigs (a600cb4)

v1.10.7

Compare Source

davelosert/vitest-coverage-report-action (davelosert/vitest-coverage-report-action)

v2.12.2

Compare Source

Bug Fixes
harperfast/harper (harper)

v5.1.21

Compare Source

Reliability

  • Over-time write transactions now abort instead of force-committing (#​1407, #​1411). A write transaction that exceeds its open-time limit is now cleanly aborted and surfaced as an error rather than force-committed — which could otherwise persist a partially-applied transaction. Applies to both storage engines.

Full Changelog: HarperFast/harper@v5.1.20...v5.1.21

v5.1.20

Compare Source

Performance & correctness

  • get_analytics no longer risks a multi-million-row scan on large hdb_analytics tables. The query planner estimated a primary-key between range as a flat 10% of the table rather than from its actual width, so a narrow time window on a selective metric could be judged costlier than a plain metric match — driving iteration off the metric index and decoding its entire history instead of the requested window. On a large analytics table this could turn a routine status query into a scan that never completes and restarts the instance. get_analytics now leads with the bounded time window and pins execution order when one is given. (#​1798)

Security

  • Fixed a ReDoS in configValidator's directory-path validation that could hang the CLI at 100% CPU on a crafted input. Replaced the vulnerable regex with a control-character denylist and hardened it further to reject C1 control codes and Unicode line separators. (#​1784)

Build & packaging

  • The published npm-shrinkwrap.json no longer vendors dev-only packages. npm prune --omit=dev only touches node_modules, not the generated lockfile, so dev-only platform-specific packages (like @esbuild/*, pulled in via tsx) were shipping in the published shrinkwrap — and could cause npm ci to fail on a consumer's machine with EBADPLATFORM if their own lockfile folded that subtree in. The build now prunes dev entries from the shrinkwrap after it's generated. (#​1781, #​1783)

v5.1.19

Compare Source

Static component & deploy

  • Fixed root-mounted static serving 404ing every asset. A static component mounted at urlPath: '/' was being treated as a sub-route: the boundary check joined '/' + '/', which never matches any sub-path, so only the exact path / was served and every other asset 404'd. normalizeUrlPath now treats '/', '', and undefined as "no path constraint," restoring 5.0.x root-mount semantics. Also hardened trailing-slash handling ('/api//', '///', etc. now normalize consistently instead of surviving as a residual slash that failed both exact- and boundary-match). (#​1766)

Configuration

  • Config vars set via a component's .env file now warn instead of silently doing nothing. HARPER_DEFAULT_CONFIG / HARPER_CONFIG / HARPER_SET_CONFIG delivered through a component's loadEnv were being composed away before components ever loaded — no error, no effect. Harper now warns at boot and again at component-load time (for components deployed after boot), naming the variable, the file, and where it's actually supported (process environment or harper-config.yaml). (#​1513)

Full Changelog: HarperFast/harper@v5.1.18...v5.1.19

lucide-icons/lucide (lucide-react)

v1.25.0

Compare Source

oxc-project/oxc (oxlint)

v1.74.0

Compare Source

🚀 Features
  • 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#​24044) (Boshen)
🐛 Bug Fixes
  • 8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#​24341) (leaysgur)
  • 2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#​24339) (leaysgur)
⚡ Performance
  • 7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#​24413) (connorshea)
  • 6272051 linter/typescript/no-require-imports: Compile allow patterns once (#​24417) (connorshea)
  • 33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#​24420) (connorshea)
pnpm/pnpm (pnpm)

v11.13.1: pnpm 11.13.1

Compare Source

Patch Changes

  • Fixed pnpm pack applying workspace-root ignore rules when a workspace package has its own .npmignore file.
  • Keep the interactive minimumReleaseAge approval prompt visible during pnpm install. The progress reporter now pauses its redraws while a prompt is waiting for input instead of overwriting it, so the install no longer hangs on a question the user cannot see #​13019.
  • Fixed pnpm self-update failing to link native platform binaries stored in sibling global virtual store slots.

v11.13.0: pnpm 11.13

Compare Source

Minor Changes

  • Added versioning.epics to pnpm-workspace.yaml. An epic ties a group of member packages to a lead package, constraining every member's major version to a band derived from the lead's major: while the lead is on major M, members live in M*100 … M*100+99. Members move independently inside the band (patch, minor, and a major intent that stays in-band); a bump that would carry a member past the band ceiling is rejected until the lead advances its own major. When a release plan takes the lead to a new stable major, every member re-bases to the band floor in the same plan. Membership is matched with pnpm's package selectors — name globs, ./-prefixed directory globs, and !-prefixed negations.

  • Added the team command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.

  • Added native workspace release management #​12952: the new pnpm change command records change intents as changesets-compatible .changeset/*.md files (pnpm change status shows the pending release plan), and the bare pnpm version -r consumes them — bumping versions across the workspace with dependent propagation through workspace: ranges, fixed groups, a maxBump cap, --filter narrowing, and --dry-run — writing changelogs, and recording consumed intents in a committed ledger that keeps cherry-picks and merge-backs between release branches safe. Packages can be moved onto per-package release lanes with the new pnpm lane <name> --filter <pkg> command and back with pnpm lane main --filter <pkg> (pnpm lane shows the membership), releasing X.Y.Z-lane.N prereleases from the same runs that release stable versions of the packages on the main lane. Configuration lives under the new versioning key of pnpm-workspace.yaml (fixed, ignore, maxBump, lanes, changelog). When two workspace projects publish the same name, intent files, versioning.lanes, and versioning.fixed/ignore may reference a project by its workspace-relative directory path (e.g. "./pnpm/npm/pnpm") — the one additive extension to the changesets format, applied automatically by pnpm change.

    Release changelogs default to registry storage (versioning.changelog.storage): no CHANGELOG.md is committed. Each release's section is composed at publish time and packed into the published tarball on top of the previously published version's changelog, and the consumed change intents are garbage-collected by a later pnpm version -r only once the registry confirms the version is published with its section. Set versioning.changelog.storage: repository to keep committed CHANGELOG.md files instead.

  • Added a new override selector form with an empty range — "pkg@": "<version>" — called a convergence override. It rewrites a dependency edge only when its exact version satisfies the edge's declared range, so compatible consumers converge on one version while incompatible consumers keep their own resolution — now and for any dependent added in the future #​12794.

    overrides:
  "form-data@": 4.0.6

    The value must be an exact version. When a full resolution detects that every declared range also admits a newer version, pnpm warns that the override is stale and names the version to converge on. Previously an empty range in an override selector was undocumented and behaved like a bare (unscoped) override.

Patch Changes

  • A tokenHelper set in the global pnpm auth.ini is no longer rejected as project-level configuration. The guard that blocks tokenHelper from a project .npmrc only treated ~/.npmrc as a trusted source, so a helper written to auth.ini (for example by pnpm config set) failed on every command and could not even be removed with pnpm config delete. A tokenHelper in a workspace or project .npmrc is still rejected.

  • pnpm cache delete now removes a package's metadata from every metadata cache directory (metadata, metadata-full, and metadata-full-filtered), instead of only the one the current resolution mode reads. Previously a package cached under a different mode (e.g. metadata-full-filtered) was left behind. Closes #​12753.

  • Fixed an injected workspace dependency (injectWorkspacePackages: true) incorrectly staying as file: instead of deduping back to link: when an unrelated, ordinary shared dependency resolved to a peer-suffixed variant for the target project's own copy but not for the injected occurrence. See #​10433.

  • pnpm deploy now supports workspaces that use catalogs.

  • Fixed pnpm deploy with a shared lockfile so local file: tarball dependencies keep their package name in the generated deploy lockfile. This prevents warm-store deploys from failing with ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE when the tarball filename includes the version.

  • Options that follow create, exec, or test appearing as a subcommand of another command are now parsed instead of being silently treated as positional parameters. For example, pnpm team create @&#8203;org:team --registry <url> previously ignored the --registry option and sent the request to the default registry.

  • pnpm add -g, pnpm update -g, pnpm setup, and the self-updater no longer fail with ERR_PNPM_MISSING_TIME when trustPolicy: no-downgrade or resolutionMode: time-based is set in the global config #​12883. The decision to fetch full registry metadata now lives in one place, and the no-downgrade trust policy always requests full metadata (matching the self-updater), since the trust evidence it checks is missing from abbreviated metadata even on registries that include the time field.

  • pnpm list and pnpm why no longer crash with EMFILE: too many open files when a project has a large number of unsaved dependencies (packages present in node_modules but not in the lockfile). The reads of those packages are now concurrency-limited.

  • The published pnpm package no longer declares dependencies or devDependencies. Because the CLI bundles its runtime dependencies into dist/node_modules, those fields are dropped when packing, so npm install of the tarball no longer tries to resolve internal-only packages such as @pnpm/test-ipc-server. Closes #​12955.

  • Fixed pnpm publish --otp and pnpm publish --batch --otp to send the configured OTP to the registry.

  • pnpm publish again sends the package's README to the registry as metadata, so registries can render it on the package page. The readme is always included in the published metadata (matching the npm CLI), while the embed-readme setting continues to control only whether the readme is written into the package.json inside the tarball. This restores the behavior that was lost when publishing became fully native. Closes #​12966.

  • Fixed the dependency status check wrongly reporting "up to date" when a package.json, .pnpmfile.cjs, or patch file was edited in the same second as the previous install, on filesystems that record mtimes at whole-second resolution (for example ext4 with 128-byte inodes). The optimistic repeat-install fast path and verify-deps-before-run compared mtimes strictly, so a same-second edit whose mtime rounded down looked unchanged and re-resolution was skipped. Such a file's whole second is now treated as possibly-modified, falling through to the content check; behavior on sub-second filesystems is unchanged.

  • Retry package metadata requests when a registry or proxy returns 304 Not Modified to an unconditional request, preventing false ERR_PNPM_CACHE_MISSING_AFTER_304 failures pnpm/pnpm#12882.

    If the retry also returns 304, report ERR_PNPM_META_NOT_MODIFIED_WITHOUT_CACHE instead.

  • Fixed pnpm update removing transitive lockfile entries when dedupePeerDependents is disabled and the selected package is absent pnpm/pnpm#12456.

  • Limit modern deploy lockfiles and localized virtual stores to dependencies reachable from the selected dependency groups.

  • A tokenHelper command is now given a 60-second time limit. A helper that hangs (deadlock, stuck I/O) is killed and reported as an error instead of leaving the command waiting forever.

  • Fixed orphaned child processes on Windows when pnpm exits on an error while commands spawned by pnpm exec or pnpm dlx are still running (for example, when one project's command fails during pnpm --recursive exec). The PIDs of these commands are now recorded when they are spawned and their whole process trees are terminated with taskkill on an error exit. Previously the cleanup relied on enumerating the system process list, which is so slow on Windows that the enumeration hit its timeout and the cleanup was silently skipped #​12406.

  • pnpm pack now respects workspace-root .npmignore and .gitignore files when packing workspace packages.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.12.0: pnpm 11.12

Compare Source

Minor Changes

  • a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a { delegate: <resolution> } envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where cafs and fetchers cannot be passed to the hook. Related to pnpm/pnpm#11685.

Patch Changes

  • 2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like <since> value (such as --output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest .git entry, so the filter works in a git worktree checked out inside another repository's tree.

  • 43711ce: pnpm outdated no longer checks the registry for dependencies that are resolved from local link:, file:, or workspace: references in the lockfile #​12827.

  • 3c6718b: Fixed a deadlock in peer dependency resolution: pnpm install hung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installing electron-builder@26.15.3 #​12921.

  • 252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example ^1.0.0) could get the highest version found anywhere in the workspace (for example a 2.0.0 resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.

    Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.

  • a38adda: pnpm self-update <version> now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.

  • 6a85968: pnpm stage list now stops paginating after a fail-safe cap of 1

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "before 9am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner July 20, 2026 10:52
@renovate
renovate Bot requested a review from dawsontoth July 20, 2026 10:52
@renovate

renovate Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
? Verifying lockfile against supply-chain policies (1632 entries)...
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 20, reused 0, downloaded 0, added 0
Progress: resolved 40, reused 0, downloaded 0, added 0
Progress: resolved 46, reused 0, downloaded 0, added 0
Progress: resolved 53, reused 0, downloaded 0, added 0
Progress: resolved 60, reused 0, downloaded 0, added 0
Progress: resolved 68, reused 0, downloaded 0, added 0
Progress: resolved 74, reused 0, downloaded 0, added 0

   ╭──────────────────────────────────────────╮
   │                                          │
   │   Update available! 11.13.1 → 11.15.1.   │
   │   Changelog: https://pnpm.io/v/11.15.1   │
   │     To update, run: pnpm add -g pnpm     │
   │                                          │
   ╰──────────────────────────────────────────╯

Progress: resolved 77, reused 0, downloaded 0, added 0
Progress: resolved 79, reused 0, downloaded 0, added 0
[WARN] Request took 10094ms: https://registry.npmjs.org/react-dom
Progress: resolved 81, reused 0, downloaded 0, added 0
[WARN] Request took 12580ms: https://registry.npmjs.org/tailwindcss
Progress: resolved 82, reused 0, downloaded 0, added 0
Progress: resolved 83, reused 0, downloaded 0, added 0
[WARN] Request took 15703ms: https://registry.npmjs.org/typescript
Progress: resolved 84, reused 0, downloaded 0, added 0
Progress: resolved 266, reused 0, downloaded 0, added 0
Progress: resolved 356, reused 0, downloaded 0, added 0
Progress: resolved 477, reused 0, downloaded 0, added 0
Progress: resolved 593, reused 0, downloaded 0, added 0
Progress: resolved 924, reused 0, downloaded 0, added 0
Progress: resolved 999, reused 0, downloaded 0, added 0
Progress: resolved 1014, reused 0, downloaded 0, added 0
Progress: resolved 1152, reused 0, downloaded 0, added 0
Progress: resolved 1420, reused 0, downloaded 0, added 0
[WARN] Request took 10636ms: https://registry.npmjs.org/typescript
✓ Lockfile passes supply-chain policies (1632 entries in 27.8s)
Progress: resolved 1489, reused 0, downloaded 0, added 0
Progress: resolved 1495, reused 0, downloaded 0, added 0
Progress: resolved 1516, reused 0, downloaded 0, added 0
Progress: resolved 1631, reused 0, downloaded 0, added 0
[ERR_PNPM_UNUSED_PATCH] The following patches were not used: @tanstack/router-core@1.171.14

Either remove them from "patchedDependencies" or update them to match packages in your dependencies.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from addecaa to 2da5e58 Compare July 20, 2026 14:38
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 2da5e58 to cd91a82 Compare July 20, 2026 14:51
@dawsontoth @claude
fix(deps): retarget router-core patch to 1.171.15
7a13ff9 
The all-non-major bump moves @tanstack/react-router 1.170.17 -> 1.170.18,
which depends on @tanstack/router-core@1.171.15 (was 1.171.14). Our pnpm
patch was pinned to 1.171.14, so the fresh resolve orphaned it
(ERR_PNPM_UNUSED_PATCH) and left the lockfile out of date.

The patch (guards evicted in-flight preload matches against a TypeError via
isMatchLoadCancelledError) is still absent from upstream 1.171.15 -
load-matches.* is byte-identical between 1.171.14 and 1.171.15 and router.*
changed only in an unrelated scroll/history region - so the fix is still
needed. Regenerated the patch against 1.171.15 (exact line numbers) and
refreshed the lockfile. Verified frozen-lockfile install, build, lint, and
the full test suite pass and the patch applies to the installed package.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 50.99% 5434 / 10655
🔵 Statements 51.56% 5818 / 11282
🔵 Functions 43.21% 1331 / 3080
🔵 Branches 44.46% 3666 / 8245
File CoverageNo changed files found.
Generated in workflow #1554 for commit 7a13ff9 by the Vitest Coverage Report Action

@renovate

renovate Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@dawsontoth
dawsontoth added this pull request to the merge queue Jul 20, 2026
Merged via the queue into stage with commit 8500080 Jul 20, 2026
2 checks passed
@dawsontoth
dawsontoth deleted the renovate/all-minor-patch branch July 20, 2026 15:26
@dawsontoth dawsontoth mentioned this pull request Jul 27, 2026
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dawsontoth dawsontoth dawsontoth approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dawsontoth