chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #1865 · nuxt/bridge

renovate · 2026-07-13T13:34:12Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@types/semver (source)	`7.7.1` → `7.8.0`	devDependencies	minor
@vitejs/plugin-legacy (source)	`^8.0.2` → `^8.2.2`	dependencies	minor	`8.2.3`
@vue/reactivity (source)	`^3.5.38` → `^3.5.41`	devDependencies	patch
MatteoGabriele/agentscan-action	`v2.0.1` → `v2.2.0`	action	minor
acorn	`^8.17.0` → `^8.18.0`	dependencies	minor
actions/checkout	`v7.0.0` → `v7.0.1`	action	patch
danielroe/provenance-action	`v0.1.1` → `v0.2.0`	action	minor
devalue	`5.8.1` → `5.9.0`	devDependencies	minor
enhanced-resolve	`^5.24.0` → `^5.24.5`	dependencies	patch
eslint (source)	`9.39.4` → `9.39.5`	devDependencies	patch
eslint-plugin-import-x	`^4.16.2` → `^4.17.1`	devDependencies	minor
eslint-plugin-jsdoc	`63.0.7` → `63.3.3`	devDependencies	minor
eslint-plugin-vue (source)	`^10.9.2` → `^10.10.0`	devDependencies	minor
exsolve	`^1.0.8` → `^1.1.1`	dependencies	patch
globals	`^17.6.0` → `^17.9.0`	devDependencies	patch
globby	`16.2.0` → `16.2.2`	devDependencies	patch
happy-dom	`^20.10.6` → `^20.11.1`	devDependencies	minor
knip (source)	`6.17.1` → `6.31.0`	devDependencies	minor	`6.32.0`
nypm	`^0.6.7` → `^0.6.9`	dependencies	patch
playwright-core (source)	`1.61.0` → `1.62.1`	devDependencies	minor
rollup (source)	`^4.62.2` → `^4.62.4`	devDependencies	patch
std-env	`^4.1.0` → `^4.2.0`	dependencies	minor
std-env	`4.1.0` → `4.2.0`	devDependencies	minor
terser (source)	`^5.48.0` → `^5.49.2`	dependencies	minor
typescript-eslint (source)	`^8.61.1` → `^8.66.0`	devDependencies	minor
unimport	`^6.3.0` → `^6.4.0`	dependencies	minor
vite (source)	`~7.3.5` → `~7.3.6`	dependencies	patch
vite (source)	`~7.3.5` → `~7.3.6`	devDependencies	patch
vitest (source)	`4.1.9` → `4.1.10`	devDependencies	patch
vue-bundle-renderer	`^2.2.0` → `^2.3.1`	dependencies	minor

Release Notes

vitejs/vite (@vitejs/plugin-legacy)

`v8.2.2`

Features

update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)

Bug Fixes

deps: update dependency magic-string to v1 (#22998) (c60b4d7)
legacy: don't use newer syntax when minifying legacy chunks (#23013) (989a42e)

`v8.2.1`

Compare Source

Bug Fixes

deps: update all non-major dependencies (#22921) (fef682d)
deps: update rolldown-related dependencies (#22922) (3c345e4)
legacy: don't use newer syntax when minifying polyfill chunks (#22939) (c4df6ef)

`v8.2.0`

Compare Source

Features

legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

deps: update all non-major dependencies (#22734) (e635f49)
deps: update rolldown-related dependencies (#22591) (2ce6677)

Code Refactoring

legacy: use babel-plugin-polyfill-* consistently (#22874) (9dddae6)

`v8.1.0`

Compare Source

vuejs/core (@vue/reactivity)

`v3.5.41`

Compare Source

Bug Fixes

compiler-core: preserve vnode lifecycle in stable v-for (#11682) (02421cd), closes #9239 #12569
compiler-sfc: handle transformed template AST after cache invalidation (#15136) (a4440c0), closes #15126 #15128
custom-element: preserve nested async mount order (#15154) (71f9ff5), closes #15153
custom-element: warn when props override native properties (#12125) (22b53ea), closes #12124
runtime-core: avoid re-fetching resource props with unchanged values (#15105) (a7513a1)
runtime-core: restore SSR setup state when handling async setup result (#15114) (b6191cb), closes #15113
scheduler: avoid stack overflow when flushing very large post cb arrays (#15143) (c04a45d), closes #15142
slots: handle nullish v-bind slot props (#15177) (2506700)
ssr: normalize hidden states during hydration (#13125) (4e467d7)
transition: support transition to teleport component child (#11959) (77061fe), closes #11910
types: preserve defineModel inference with factory defaults (#15097) (0516c43), closes #15096
v-model: preserve text input before hydration (#14411) (2468464), closes #14403

`v3.5.40`

Compare Source

Bug Fixes

compiler-core: avoid leaking slot branch keys (#15051) (20c9d26), closes #15048
hydration: pass namespace when patching dynamic props (#15082) (e0d2723), closes #15081 #15050
reactivity: handle effect removal during scope stop (#15084) (378f978), closes #15083
runtime-core: skip lazy hydration for detached roots (#15092) (97f3525), closes #15091
runtime-core: unwind dangling blocks when slot content throws (#15071) (ddc132d), closes #15070
runtime-dom: respect current select model type (#15010) (eb89e93), closes #15009
server-renderer: handle errors in optimized component renders (#12601) (474907c), closes #12575
server-renderer: remove package dependency cycle (#15063) (4d35eca)
shared: prevent SSR comment escaping from creating closing delimiters (#15045) (bd962bb)
types: don't constrain component $el type to Element (#15040) (164460a)

`v3.5.39`

Compare Source

Bug Fixes

compiler-core: correct filter rewrite recursion (#14959) (be7ce31)
hydration: force patch dynamic props when hydrating (#9083) (024cf06), closes #9033
hydration: respect data-allow-mismatch on conditional branches (#12801) (164af63), closes #12782
reactivity: avoid triggering effects when set fails (#14964) (e450973)
runtime-core: handle non-isomorphic block element update (#15002) (932ddd0), closes #6385
runtime-core: normalize function children for elements and Teleport (#9108) (2f374cd), closes #9107
runtime-core: pause tracking when invoking function refs (#14985) (3ac052b)
runtime-core: preserve once event listener name (#8341) (87b73b6), closes #8342
runtime-dom: preserve option modifier event names (#8338) (4b659e6), closes #8334
ssr: dedupe inherited scope ids during vnode rendering (#15005) (027da6b), closes #12159 #12175
ssr: resolve nested async teleport content (#9431) (31d0f23), closes #6207
teleport: handle teleport unmount edge case (#12705) (671997a), closes #12702
types: support named tuple emits (#12676) (232f402), closes #12673
types: validate defineModel defaults (#14968) (747f57e), closes #14966

MatteoGabriele/agentscan-action (MatteoGabriele/agentscan-action)

`v2.2.0`

Compare Source

What's Changed

refactor(evidence): remove redundant copy by @MatteoGabriele in #33

Full Changelog: MatteoGabriele/agentscan-action@v2.1.0...v2.2.0

`v2.1.0`

Compare Source

What's Changed

feat: add evidence on comments by @MatteoGabriele in #32

Full Changelog: MatteoGabriele/agentscan-action@v2.0.1...v2.1.0

acornjs/acorn (acorn)

`v8.18.0`

Compare Source

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

danielroe/provenance-action (danielroe/provenance-action)

`v0.2.0`

Compare Source

compare changes

🚀 Enhancements

Respect pnpm's trustPolicyExclude (2f0f52d)
Detect loss of npm staged publishing approval (fc86c9a)

📖 Documentation

Update action description (e78b179)
Add link to pnpm v10.21 trustPolicy 🎉 (fd8dd3c)

🏡 Chore

Add licence (cafd196)
Revert pnpm trust policy and restore provenance action (4320fb9)
Release v0.0.2 (194cad5)
Migrate to pnpm v11 (#99)

✅ Tests

Improve coverage of lockfile parsing utils (a9d6553)
Migrate to vitest (07fa732)
Add api responses as fixtures + test provenance utils (fd6ed30)

🤖 CI

Pin github actions to full-length commit shas (9426311)
Add agent-scan workflow to flag bot-authored PRs (81568f7)

❤️ Contributors

Daniel Roe (@danielroe)

sveltejs/devalue (devalue)

`v5.9.0`

Compare Source

Minor Changes

07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

`v5.8.2`

Compare Source

Patch Changes

48cc81f: fix: serialize DataView subviews with the correct byte offset and length
cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
8c0db06: fix: serialize Temporal values referenced more than once in uneval
3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
756265a: fix: preserve shared-reference identity for Map keys in uneval
faa8a05: fix: emit uneval reconstructions before the statements that reference them
06129ad: fix: do not grow sparse arrays by one slot in uneval

webpack/enhanced-resolve (enhanced-resolve)

`v5.24.5`

Compare Source

Patch Changes

Soft-fail when auto tsconfig discovery loads a broken config, and keep relative extends paths relative. (by @xiaoxiaojx in #645)

`v5.24.4`

Compare Source

Patch Changes

Keep the original request resolvable when extensionAlias lists its own extension. (by @alexander-akait in #641)
Fix string restrictions boundary checks: a restriction ending with a separator no longer rejects everything inside it, restrictions are normalized before they are compared, and a Windows path now matches the way path.win32 does, treating / and \ as interchangeable and comparing case-insensitively, while \ stays a filename character in a posix path. The same comparison backs tsconfig path matching. (by @alexander-akait in #643)
Treat a UNC path (\\server\share\…) as a Windows path, so it normalizes, joins and walks up with path.win32 semantics instead of being taken for a bare module request. (by @alexander-akait in #644)

`v5.24.3`

Compare Source

Patch Changes

Resolve tsconfig extends package specifiers from ancestor node_modules directories (workspace hoisting). (by @alexander-akait in #631)

`v5.24.2`

Compare Source

Patch Changes

Batch cached filesystem callbacks from one synchronous burst into a single tick. (by @alexander-akait in #623)

`v5.24.1`

Compare Source

Patch Changes

Reduce hot-path allocations in the resolve pipeline. (by @xiaoxiaojx in #615)

eslint/eslint (eslint)

`v9.39.5`

Compare Source

Bug Fixes

253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)

Documentation

74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
202117b chore: package.json update for @eslint/js release (Jenkins)
d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)

un-ts/eslint-plugin-import-x (eslint-plugin-import-x)

`v4.17.1`

Compare Source

Patch Changes

#498 cf25a01 Thanks @marcalexiei! - fix(extensions): don't require an extension for package subpaths that resolve to a .d.ts (e.g. vitest/config)

`v4.17.0`

Compare Source

Minor Changes

#474 4b2c0c5 Thanks @regseb! - Support RegExp in the import-x/ignore setting and the ignore option of the no-unresolved rule.

Patch Changes

#494 1c84235 Thanks @morgan-coded! - Fixed no-unresolved crashing when case-sensitive path checks encounter EACCES or EPERM on an ancestor directory.
#481 3e13121 Thanks @B4nan! - fix: memoize legacyNodeResolve resolver to avoid native memory leak
#484 9a07009 Thanks @sairus2k! - Make the extensions rule check Node.js subpath imports (specifiers starting with #, e.g. #utils/helper). Previously parsePath treated a leading # as a URL hash fragment, so the rule skipped extension validation for these imports.

Note: single-segment subpath imports without a slash (e.g. #dep) are still skipped by the existing external-root-module classification; fixing that is deferred to avoid expanding scope.
#468 240ed58 Thanks @silverwind! - Make extensions handle .d.ts correctly
#479 e3cc7e4 Thanks @mrginglymus! - fix: strip querystrings and hash fragments when checking for file existence
#476 fce29b1 Thanks @nbouvrette! - fix(deps): replace @package-json/types with an inline minimal type

gajus/eslint-plugin-jsdoc (eslint-plugin-jsdoc)

`v63.3.3`

Compare Source

Bug Fixes

types: add missing tsdoc configs; closes #1739 (4ff1e96)

`v63.3.2`

Compare Source

Bug Fixes

require-example: support fixer with 1-line JSDoc blocks; fixes #1736 (36f8e9e)

`v63.3.1`

Compare Source

Bug Fixes

normalize-see-links: minimally escape link targets instead of encodeURI (#1735) (ae27cd2)

`v63.3.0`

Compare Source

Features

normalize-see-links: autofix delimiter-colliding labels via escape round-trip (#1734) (cfe9cdb)

`v63.2.2`

Compare Source

Bug Fixes

update jsdoccomment and devDeps. (#1730) (3663803)

`v63.2.1`

Compare Source

Bug Fixes

update jsdoccomment, spdx-expression-parse, devDeps.; fixes #1727 (#1728) (9fd2f28)

`v63.2.0`

Compare Source

Features

normalize-see-links: add wrapBareUrls option (#1726) (77a7b1a)

`v63.1.0`

Compare Source

Features

add normalize-see-links rule (#1725) (c03dd66)

`v63.0.14`

Compare Source

Bug Fixes

escape-inline-tags: ignore Markdown code spans (786d12d)

`v63.0.13`

Compare Source

Bug Fixes

failing pages build and deployment (3728347)

`v63.0.12`

Compare Source

`v63.0.11`

Compare Source

Bug Fixes

require-jsdoc: skip overloads to find method comment blocks; fixes #1688 (7676b50)

`v63.0.10`

Compare Source

Bug Fixes

escape-inline-tags: allow scoped packages in declaration references (#1705) (70e0a11)

`v63.0.9`

Compare Source

Bug Fixes

check-template-names, require-template, valid-types: keep commas inside @template default values (0980b71)

`v63.0.8`

Compare Source

Bug Fixes

check-template-names: detect template usage in @augments/@extends/@implements types (208079f)

vuejs/eslint-plugin-vue (eslint-plugin-vue)

`v10.10.0`

Compare Source

sindresorhus/globby (globby)

`v16.2.2`

Compare Source

Fix: Do not enumerate ignored directories with gitignore option 8bf8f54

`v16.2.1`

Compare Source

Fix gitignore ignoring an entire checkout under an anchored ancestor path (#277) e7bd988

capricorn86/happy-dom (happy-dom)

webpro-nl/knip (knip)

`v6.31.0`: Release 6.31.0

Compare Source

feat: Add basic support for Marko 6 and 5 (#1914) (c6b1516) - thanks @caseycarroll!
Use Array.from in Marko compiler (5aadf47)
Update release-it and fix release script flags (6fa9c26)
Downgrade @types/vscode to match extension engines range (6d8e9bf)

`v6.30.0`: Release 6.30.0

Compare Source

`v6.29.0`: Release 6.29.0

Compare Source

fix(glob): do not follow symbolic links in async glob (#1900) (b7d5ce2) - thanks @mogelbrod!
Add built-in compiler for tsrx (db05e01)
Fix -u shortcut for --duration (932b926)

`v6.28.0`: Release 6.28.0

Compare Source

Update oxc-resolver (resolve #1889) (1444f6a)
Keep entry-exported members public (resolve #1890) (94967c1)
Don't un-ignore sibling paths on unrelated gitignore negations (resolve #1891) (5c026ba)
Memoize the gitignore shadowed-pattern check (a5fa3b0)
Ignore nested files under a gitignore dir/* pattern ([404a53e](https://redirect.github.com/webpro-nl/knip/commit/4

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-07-13T13:35:04Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@20.11.1
	typescript-eslint@8.66.0
	@types/semver@7.8.0
	vitest@4.1.10
	playwright-core@1.62.1
	@vue/reactivity@3.5.41
	vite@7.3.6
	eslint-plugin-import-x@4.17.1
	vue-bundle-renderer@2.3.1
	globby@16.2.2
	acorn@8.18.0
	eslint-plugin-vue@10.10.0
	nypm@0.6.9
	terser@5.49.2
	devalue@5.9.0
	unimport@6.4.0
	knip@6.31.0
	@vitejs/plugin-legacy@8.2.2
	eslint@9.39.5
	rollup@4.62.4
	eslint-plugin-jsdoc@63.3.3
	enhanced-resolve@5.24.5

View full report

socket-security · 2026-07-13T13:35:06Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

pkg-pr-new · 2026-07-13T13:38:56Z

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/bridge@1865

npm i https://pkg.pr.new/@nuxt/bridge-schema@1865

commit: eff58a0

renovate Bot requested a review from wattanx as a code owner July 13, 2026 13:34

renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 232aecb to 49015bf Compare July 19, 2026 20:13

renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 4da8fab to 01cba3e Compare July 27, 2026 23:52

renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 1fc29b1 to b48d04c Compare July 30, 2026 07:13

renovate Bot force-pushed the renovate/all-minor-patch branch 17 times, most recently from ca23382 to eff58a0 Compare August 6, 2026 13:01

chore(deps): update all non-major dependencies

b11e2f9

renovate Bot force-pushed the renovate/all-minor-patch branch from eff58a0 to b11e2f9 Compare August 6, 2026 19:02

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update all non-major dependencies - #1865

chore(deps): update all non-major dependencies#1865
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Code Refactoring

Bug Fixes

Bug Fixes

Bug Fixes

What's Changed

What's Changed

🚀 Enhancements

📖 Documentation

🏡 Chore

✅ Tests

🤖 CI

❤️ Contributors

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Bug Fixes

Documentation

Chores

Patch Changes

Minor Changes

Patch Changes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

🎨 Features

v6.31.0: Release 6.31.0

v6.30.0: Release 6.30.0

v6.29.0: Release 6.29.0

v6.28.0: Release 6.28.0

Configuration

Uh oh!

socket-security Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 13, 2026 •

edited

Loading

`v6.31.0`: Release 6.31.0

`v6.30.0`: Release 6.30.0

`v6.29.0`: Release 6.29.0

`v6.28.0`: Release 6.28.0

socket-security Bot commented Jul 13, 2026 •

edited

Loading

socket-security Bot commented Jul 13, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 13, 2026 •

edited

Loading