Skip to content

chore(deps): update all non-major dependencies#446

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#446
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 5, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update
@types/google.maps (source) ^3.58.1 → ^3.64.1 age confidence peerDependencies minor
@types/youtube (source) ^0.1.0 → ^0.2.0 age confidence peerDependencies minor
@unhead/vue (source) ^2.0.3 → ^2.1.15 age confidence peerDependencies minor
Hebilicious/reproduire v0.0.9-mp → v0.0.9 age confidence action patch
actions/checkout v6.0.1 → v6.0.2 age confidence action patch
actions/stale v10.0.0 → v10.2.0 age confidence action minor
eslint (source) ^10.3.0 → ^10.4.0 age confidence pnpm.catalog.default minor
eslint-plugin-harlanzw ^0.14.3 → ^0.15.1 age confidence pnpm.catalog.default minor
oxc-parser (source) ^0.130.0 → ^0.132.0 age confidence pnpm.catalog.default minor
pnpm (source) 11.1.2 → 11.1.3 age confidence packageManager patch
posthog-js (source) ^1.373.4 → ^1.374.2 age confidence pnpm.catalog.default minor
posthog-js (source) ^1.0.0 → ^1.374.2 age confidence peerDependencies minor
rollup (source) ^4.60.3 → ^4.60.4 age confidence pnpm.catalog.default patch
unimport ^6.2.0 → ^6.3.0 age confidence pnpm.catalog.default minor
vue-tsc (source) ^3.2.9 → ^3.3.0 age confidence pnpm.catalog.default minor

Release Notes

unjs/unhead (@​unhead/vue)

v2.1.15

Compare Source

No significant changes

    View changes on GitHub

v2.1.13

Compare Source

   🐞 Bug Fixes
  • schema-org: Normalize target to array before merging potentialAction  -  by @​harlan-zw and Claude Opus 4.6 (1M context) in #​709 (22ac9)
    View changes on GitHub

v2.1.12

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.11

Compare Source

    ⚠️ Security
  • Fixed XSS bypass in useHeadSafe via attribute name injection (GHSA-g5xx-pwrp-g3fv). Users handling untrusted input with useHeadSafe should upgrade immediately.
   🐞 Bug Fixes
    View changes on GitHub

v2.1.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.9

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.3

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.1

Compare Source

No significant changes

    View changes on GitHub

v2.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.0.19

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.18

Compare Source

   🏎 Performance
    View changes on GitHub

v2.0.17

Compare Source

No significant changes

    View changes on GitHub

v2.0.14

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.13

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.12

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.11

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.9

Compare Source

   🏎 Performance
    View changes on GitHub

v2.0.8

Compare Source

No significant changes

    View changes on GitHub

v2.0.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.0.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
Hebilicious/reproduire (Hebilicious/reproduire)

v0.0.9

Compare Source

compare changes

actions/checkout (actions/checkout)

v6.0.2

Compare Source

actions/stale (actions/stale)

v10.2.0

Compare Source

v10.1.1

Compare Source

What's Changed

Bug Fix
Improvement
Dependency Upgrades

New Contributors

Full Changelog: actions/stale@v10...v10.1.1

v10.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/stale@v10...v10.1.0

eslint/eslint (eslint)

v10.4.0

Compare Source

harlan-zw/eslint-plugin-harlanzw (eslint-plugin-harlanzw)

v0.15.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v0.15.0

Compare Source

   🚀 Features
    View changes on GitHub
oxc-project/oxc (oxc-parser)

v0.132.0

v0.131.0

pnpm/pnpm (pnpm)

v11.1.3

Compare Source

Patch Changes

  • pnpm install now re-validates pnpm-lock.yaml entries against the active minimumReleaseAge and trustPolicy: 'no-downgrade' policies before any tarball is fetched. Lockfiles resolved elsewhere (committed to the repo, restored from a CI cache, produced by an older pnpm) under a weaker or absent policy can no longer install a freshly-published or trust-downgraded version silently. Violating entries abort the install with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION, ERR_PNPM_TRUST_DOWNGRADE, or the generic ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION when both policies trip in the same batch; minimumReleaseAgeExclude and trustPolicyExclude are honored. Verification results are cached so repeat installs against an unchanged lockfile take a fast path, and pnpm shows a transient progress line while the registry round-trip runs.

    When fresh resolution picks an immature version, the behavior depends on minimumReleaseAgeStrict:

    • Loose mode — the default, in effect whenever minimumReleaseAge keeps its built-in 24-hour value — auto-adds the immature picks to minimumReleaseAgeExclude in pnpm-workspace.yaml and lets the install proceed. A single info message lists what was persisted.
    • Strict mode in an interactive terminal collects every immature direct AND transitive pick in one pass and prompts once with the full list. Approving adds them to minimumReleaseAgeExclude and the install continues; declining aborts before the lockfile, package.json, or node_modules is touched.
    • Strict mode in CI (or any non-TTY context) aborts with ERR_PNPM_NO_MATURE_MATCHING_VERSION listing every offending entry, instead of failing on the first one the resolver hit.

    minimumReleaseAgeStrict auto-enables whenever the user explicitly sets minimumReleaseAge (CLI flag, env var, global config.yaml, or pnpm-workspace.yaml); set minimumReleaseAgeStrict: false to keep loose-mode auto-collect even with an explicit minimumReleaseAge value. Closes #​10438, #​10488, #​11687.

  • Allow redundant trailing base64 padding in .npmrc auth values and report invalid auth base64 with a pnpm error.

  • Make pnpm self-update respect minimumReleaseAge (and minimumReleaseAgeExclude) when resolving which pnpm version to install.

    When the latest dist-tag points to a version newer than the configured age threshold, self-update now selects the newest mature version instead unless excluded by minimumReleaseAgeExclude.

    Also makes dlx and outdated surface invalid minimumReleaseAgeExclude patterns under the same ERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDE error code already used by install, instead of leaking the internal ERR_PNPM_INVALID_VERSION_UNION / ERR_PNPM_NAME_PATTERN_IN_VERSION_UNION codes.

  • Global installs respect global config build policy (e.g., dangerouslyAllowAllBuilds from config.yaml) when GVS is enabled #​9249.

    The global virtual-store (GVS) default allowBuilds = {} was applied before workspace manifest settings were read and before global config values (stripped by extractAndRemoveDependencyBuildOptions) were re-applied via globalDepsBuildConfig. This caused hasDependencyBuildOptions to return true (because {} is not null), blocking restoration of global config values like dangerouslyAllowAllBuilds. As a result, global installs skipped all build scripts even when the config explicitly allowed them.

    This fix moves the GVS default to after workspace manifest reading and globalDepsBuildConfig re-application, so that:

    1. Workspace manifest allowBuilds takes precedence (if present)
    2. Global config dangerouslyAllowAllBuilds is properly restored (if set and no workspace policy exists)
    3. Empty {} is only applied as a last resort when no policy is configured anywhere

  • Honor --silent when verifyDepsBeforeRun: install auto-installs dependencies before pnpm run or pnpm exec, preventing install output from being written to stdout #​11636.

  • Fix lockfile parsing failures when pnpm-lock.yaml contains CRLF line endings and multiple YAML documents #​11612.

  • Anchor the side-effects-cache key and global-virtual-store hash to the project's script-runner Node — engines.runtime pin when present, shell node otherwise — instead of pnpm's own runtime.

    ENGINE_NAME (the <platform>;<arch>;node<major> prefix used as the side-effects-cache key and the engine portion of the GVS hash) was computed from process.version — the Node that runs pnpm itself. That was wrong in two situations:

    1. @pnpm/exe SEA bundle. The bundle has its own embedded Node, not the node on the user's PATH that actually spawns lifecycle scripts. Two pnpm installations on the same machine (one SEA, one npm-package) therefore disagreed on the cache key, partitioning the side-effects cache and the global virtual store across two Node majors even though both installs would run scripts on the same shell node.
    2. engines.runtime / devEngines.runtime pin. When a project pins a Node version via devEngines.runtime (pnpm v11+), pnpm downloads that Node into node_modules/node/ and uses it to run lifecycle scripts. But the hash still anchored to whichever Node ran pnpm itself, not to the pinned Node — so two installs of the same project with two different runner Nodes would still disagree on the GVS slot path even though scripts run on the same pinned Node.

    Three changes:

    • @pnpm/engine.runtime.system-node-version now exports engineName(nodeVersion?). Resolves the version in this order: explicit override → getSystemNodeVersion() (which already prefers node --version over process.version in SEA contexts) → process.version.
    • @pnpm/deps.graph-hasher now exports findRuntimeNodeVersion(snapshotKeys) — scans an iterable of lockfile snapshot keys for a node@runtime:<version> entry and returns its bare version string. calcDepState and calcGraphNodeHash/iterateHashedGraphNodes accept a nodeVersion? (in the options bag for the first, as a trailing parameter / ctx field for the others), forwarded to engineName(). The default (no override) preserves the pre-change behaviour. The legacy ENGINE_NAME constant in @pnpm/constants is unchanged so external consumers and existing tests keep working; in non-SEA, non-pinned contexts every value lines up.
    • Every install-side caller of the graph-hasher (@pnpm/installing.deps-resolver, @pnpm/installing.deps-restorer, @pnpm/installing.deps-installer, @pnpm/building.during-install, @pnpm/building.after-install, @pnpm/deps.graph-builder) now derives the project's pinned runtime via findRuntimeNodeVersion(Object.keys(graph)) once per invocation and threads it through.

    On upgrade, two one-time GVS slot churns are possible:

    • SEA-pnpm users without a runtime pin: slots that previously hashed under the embedded-Node major (e.g. node26) now hash under the shell-Node major (e.g. node24), matching what pacquet, the npm-published pnpm package, and any other pnpm-compatible tool already produce.
    • Projects with a devEngines.runtime pin: slots that previously hashed under the runner's Node major now hash under the pinned Node major, matching what the lifecycle scripts will actually run on.

    In both cases the old slots become prune-eligible.

  • Resolve the GVS hash's engine portion per-snapshot when a dependency declares its own engines.runtime, instead of using an install-wide value.

    Pnpm's resolver desugars a dep's engines.runtime into dependencies.node: 'runtime:<version>', and the bin linker spawns that dep's lifecycle scripts through the pinned Node downloaded into <pkgDir>/node_modules/node/. The GVS hash and the side-effects-cache key prefix were still anchored to the install-wide runtime — so a pinning snapshot's slot encoded the wrong Node major, and a reinstall on the same host could read the cached side-effects under a key whose <platform>;<arch>;node<major> triple disagreed with the Node the build actually ran on.

    Per-snapshot resolution now matches what bins/linker already does on a per-package basis:

    • @pnpm/deps.graph-hasher adds readSnapshotRuntimePin(children) — reads the node entry from one snapshot's graph children and extracts the version from a node@runtime: value. Pairs with the existing findRuntimeNodeVersion(snapshotKeys) install-wide fallback (also now exported from @pnpm/deps.graph-hasher rather than @pnpm/engine.runtime.system-node-version, where it was a poor fit — system-node-version is about probing the host Node, not parsing lockfile-derived strings).
    • calcDepState and calcGraphNodeHash consult readSnapshotRuntimePin(graph[depPath].children) first and only fall back to the install-wide nodeVersion parameter when the snapshot doesn't pin its own Node.

    Pacquet mirrors the same precedence at the calc_graph_node_hash call site in package-manager/src/virtual_store_layout.rs — a new find_own_runtime_node_major(snapshot) helper reads each snapshot's dependencies for a node entry with Prefix::Runtime and overrides the install-wide engine when present.

    On upgrade, snapshots of dependencies that declare their own engines.runtime re-hash under that dep's pinned Node instead of the install-wide value. The old slots become prune-eligible. Closes #​11690.

  • Fixed pnpm publish failing with a 404 when authentication relied on OIDC trusted publishing alongside an .npmrc written by actions/setup-node (_authToken=${NODE_AUTH_TOKEN}) without NODE_AUTH_TOKEN being set. Unresolved ${VAR} placeholders in auth values are now treated as empty rather than passed through verbatim, so the literal placeholder no longer surfaces as a bearer token when OIDC fallback is the intended auth source #​11513.

  • Fix devEngines.packageManager (singular form, without onFail) defaulting to onFail: "error" instead of the documented pmOnFail: "download". As a result, a project that pinned a different pnpm version via devEngines.packageManager and ran pnpm install from a mismatched pnpm version failed with a hard error, even though the migration table from managePackageManagerVersions: true to pmOnFail: download (default) promises the install would auto-download the wanted version #​11676.

    The array form of devEngines.packageManager keeps its existing per-element defaults (error for the last entry, ignore for the rest), since those reflect explicit prioritization by the user. Explicit onFail values continue to win.

  • Fix devEngines.packageManager not writing packageManagerDependencies to pnpm-lock.yaml when the lockfile lacks an env-doc entry. Previously the lockfile sync skipped resolution unless an existing packageManagerDependencies.pnpm entry needed refreshing, so a fresh install without onFail: "download" left the resolved pnpm version unrecorded — contradicting the documented behavior that the resolved version is stored in pnpm-lock.yaml #​11674.

  • Warn when package.json contains a legacy pnpm field with settings pnpm no longer reads from package.json (e.g. pnpm.overrides, pnpm.patchedDependencies). Previously these were silently ignored after the upgrade from v10, leaving users unaware that their overrides/patched dependencies had stopped taking effect #​11677.

PostHog/posthog-js (posthog-js)

v1.374.2

Compare Source

1.374.2

Patch Changes

  • #​3550 df91995 Thanks @​TueHaulund! - Preserve session-recording remote config across posthog.reset().

    posthog.reset() was clearing the entire persistence store, which wiped
    $session_recording_remote_config along with user state. On the next session
    rotation triggered by the reset, start('session_id_changed') would early-return
    because the remote config was missing — leaving rrweb torn down and the new
    session opening with no Meta + FullSnapshot until the next periodic 5-minute
    checkout.

    This affected any flow where an app calls posthog.reset() mid-session
    (e.g. on sign-out / sign-in) and was particularly visible on Flutter Web
    recordings that depend on a fresh FullSnapshot to anchor the CanvasKit DOM. (2026-05-18)

  • Updated dependencies []:

v1.374.1

Compare Source

v1.374.0

Compare Source

1.374.0

Minor Changes
  • #​3620 594ea11 Thanks @​pauldambra! - Dead clicks: add a .ph-no-deadclick CSS class (and capture_dead_clicks.css_selector_ignorelist config option) to exclude specific elements from dead-click detection without affecting autocapture, session replay, or heatmaps. Mirrors the existing .ph-no-rageclick pattern.
    (2026-05-18)
Patch Changes
  • #​3621 3c0a09f Thanks @​pauldambra! - Dead clicks: a click on an <a> (or any element inside an <a>, including across shadow DOM) is no longer flagged as a dead click — the browser navigates / downloads / opens a new window and we can't observe that. Reuses autocapture's existing DOM walker for the ancestor walk. Direct clicks on <button>, <input>, <select>, <textarea>, <label>, and <form> (previously all skipped) are now eligible for dead-click detection: if their JS handler ran, the existing mutation / scroll / selection observers see the effect; if it didn't, dead-click correctly surfaces the bug. A broken <button> with no handler, or an <svg> icon inside one, will now flag — which is exactly the dead-click case we want to catch.
    (2026-05-18)
  • Updated dependencies [594ea11]:

v1.373.5

Compare Source

1.373.5

Patch Changes
  • #​3613 221973e Thanks @​lucasheriques! - Surveys: submit open text questions with Cmd/Ctrl+Enter. The textarea still inserts a newline on plain Enter (native behaviour), matching the convention used by Slack, GitHub, Discord, and ChatGPT for multi-line inputs. Single-line "Other:" inputs continue to submit on plain Enter as before.
    (2026-05-15)
  • Updated dependencies []:
rollup/rollup (rollup)

v4.60.4

Compare Source

2026-05-14

Bug Fixes
  • Improve stability of chunk hashes (#​6362)
Pull Requests
unjs/unimport (unimport)

v6.3.0

Compare Source

   🚀 Features
   🏎 Performance
    View changes on GitHub
vuejs/language-tools (vue-tsc)

v3.3.0

Compare Source

language-core
  • feat: check required fallthrough attributes (#​6049) - Thanks to @​KazariEX!
  • fix: penetrate v-if branch fragments when collecting single root nodes - Thanks to @​KazariEX!
  • refactor: rename Sfc APIs to IR - Thanks to @​KazariEX!
language-service
  • fix: reuse ASTs for define assignment suggestions - Thanks to @​KazariEX!
  • fix: re-support html.customData (#​5910) - Thanks to @​Bomberus!
  • fix: strip ="" only for plain boolean props completion edits - Thanks to @​KazariEX!
  • fix: reset to default data provider after running with vue data provider - Thanks to @​KazariEX!
typescript-plugin
vscode
  • fix: include extraFileExtensions in tsserver configure request payload (#​6048) - Thanks to @​KazariEX!
  • fix: write typescript plugins at build time (#​6050) - Thanks to @​KazariEX!
  • fix: avoid infinite diagnostics on Vue files when project diagnostics is enabled (#​6051) - Thanks to @​KazariEX!

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Apr 5, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
scripts-docs Error Error May 18, 2026 10:43pm
scripts-playground Error Error May 18, 2026 10:43pm

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9c4e39b to 5bfebea Compare April 5, 2025 00:30
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 5bfebea to 7804f68 Compare April 6, 2025 09:08
@renovate renovate Bot changed the title chore(deps): update resolutions typescript to v5.8.3 chore(deps): update all non-major dependencies Apr 6, 2025
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7804f68 to 2d975ff Compare April 7, 2025 04:48
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 2d975ff to 0104ff1 Compare April 7, 2025 08:22
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 0104ff1 to 8120e32 Compare April 7, 2025 15:15
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 8120e32 to 5ec9f5e Compare April 7, 2025 18:22
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 5ec9f5e to efcb3b7 Compare April 8, 2025 08:39
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from efcb3b7 to 1a61aec Compare April 10, 2025 00:28
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 1a61aec to cf8e7f8 Compare April 10, 2025 09:47
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from cf8e7f8 to 2b13cf8 Compare April 11, 2025 01:12
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 6132302 to 360e116 Compare April 16, 2025 14:05
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 360e116 to aa97a8b Compare April 17, 2025 00:59
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from aa97a8b to 714cf9d Compare April 17, 2025 08:46
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 714cf9d to bdbb60c Compare April 17, 2025 18:14
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from bdbb60c to 9343bf3 Compare April 18, 2025 20:28
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9343bf3 to fb7fea7 Compare April 21, 2025 12:46
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from fb7fea7 to 556aaae Compare April 21, 2025 16:40
@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Jul 16, 2025 •
edited
Loading

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts@446

commit: ac0d93a

vercel[bot]
vercel Bot reviewed Sep 20, 2025
View reviewed changes
Comment thread pnpm-lock.yaml Outdated
vercel[bot]
vercel Bot reviewed Nov 25, 2025
View reviewed changes
Comment thread docs/package.json Outdated
"@nuxt/image": "^1.11.0",
"@nuxt/scripts": "workspace:*",
"@nuxt/ui": "4.0.0",
"@nuxt/ui": "4.2.1",
Copy link
Copy Markdown
Contributor

@vercel vercel Bot Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"@nuxt/ui": "4.2.1",
"@nuxt/ui": "^4.2.1",

The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.

View Details

Analysis

Inconsistent version pinning for @nuxt/ui dependency

What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.

How to reproduce:

cat docs/package.json | grep -A 15 '"dependencies"'

Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:

  • "@nuxt/content": "^3.8.2"
  • "@nuxt/fonts": "^0.12.1"
  • "@nuxthq/studio": "^2.2.1"
  • All other 10 dependencies also use ^ prefix

Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.

Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.

vercel[bot]
vercel Bot reviewed Jan 15, 2026
View reviewed changes
Comment thread package.json Outdated
"posthog-js": "^1.0.0"
"@types/youtube": "^0.1.2",
"@unhead/vue": "^2.1.2",
"posthog-js": "^1.321.2"
Copy link
Copy Markdown
Contributor

@vercel vercel Bot Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"posthog-js": "^1.321.2"
"posthog-js": "^1.0.0"

The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).

View Details

Analysis

Overly restrictive posthog-js peer dependency breaks backward compatibility

What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.

How to reproduce:

# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2

Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"

Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:

  • Code only uses posthog.init() and basic config options (api_host, capture_pageview, disable_session_recording) available since 1.0.0
  • The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
  • Peer dependencies should be permissive to maximize compatibility
  • Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible

This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 29, 2026 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented May 18, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->

[936:0x31506000]   115008 ms: Scavenge (interleaved) 1487.2 (1492.8) -> 1486.7 (1496.8) MB, pooled: 0 MB, 79.81 / 0.00 ms  (average mu = 0.322, current mu = 0.320) allocation failure; 
[936:0x31506000]   117909 ms: Mark-Compact (reduce) 1491.9 (1499.3) -> 1488.7 (1493.4) MB, pooled: 0 MB, 1358.60 / 0.06 ms  (+ 856.8 ms in 54 steps since start of marking, biggest step 19.8 ms, walltime since start of marking 2438 ms) (average mu = 0.313,
FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0x73f8c4 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/24.15.0/bin/node]
 2: 0xc06f90  [/opt/containerbase/tools/node/24.15.0/bin/node]
 3: 0xc0707f  [/opt/containerbase/tools/node/24.15.0/bin/node]
 4: 0xeaa885  [/opt/containerbase/tools/node/24.15.0/bin/node]
 5: 0xeaa8b2  [/opt/containerbase/tools/node/24.15.0/bin/node]
 6: 0xeaabaa  [/opt/containerbase/tools/node/24.15.0/bin/node]
 7: 0xebb8aa  [/opt/containerbase/tools/node/24.15.0/bin/node]
 8: 0xebfc50  [/opt/containerbase/tools/node/24.15.0/bin/node]
 9: 0x1953f71  [/opt/containerbase/tools/node/24.15.0/bin/node]
/usr/local/bin/node: line 18:   936 Aborted                 /opt/containerbase/tools/node/24.15.0/bin/node "$@"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vercel vercel[bot] vercel[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants