Skip to content

fix(deps): update all major dependencies (major)#355

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-major
Open

fix(deps): update all major dependencies (major)#355
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-major

Conversation

@renovate

@renovate renovate Bot commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@zxcvbn-ts/core ^3.0.4 → ^4.0.0 age confidence
@zxcvbn-ts/language-common ^3.0.4 → ^4.0.0 age confidence
@zxcvbn-ts/language-en ^3.0.2 → ^4.0.0 age confidence
autumn-js (source) ^0.1.43 → ^1.0.0 age confidence
prettier-plugin-svelte 3.5.1 → 4.1.0 age confidence
vercel (source) 53.1.1 → 54.12.2 age confidence

Release Notes

zxcvbn-ts/zxcvbn (@​zxcvbn-ts/core)

v4.1.0

Compare Source

useautumn/autumn (autumn-js)

v1.2.28

Compare Source

v1.2.27

Compare Source

v1.2.26

Compare Source

v1.2.25

Compare Source

v1.2.24

Compare Source

v1.2.23

Compare Source

v1.2.22

Compare Source

v1.2.21

Compare Source

v1.2.20

Compare Source

v1.2.19

Compare Source

v1.2.18

Compare Source

v1.2.15

Compare Source

v1.2.14

Compare Source

v1.2.13

Compare Source

v1.2.12

Compare Source

v1.2.11

Compare Source

v1.2.10

Compare Source

v1.2.9

Compare Source

v1.2.8

Compare Source

v1.2.7

Compare Source

v1.2.6

Compare Source

v1.2.5

Compare Source

v1.2.4

Compare Source

v1.2.3

Compare Source

v1.2.2

Compare Source

v1.2.0

Compare Source

v1.1.10

Compare Source

v1.1.8

Compare Source

v1.0.2

Compare Source

v1.0.1

Compare Source

v1.0.0

Compare Source

sveltejs/prettier-plugin-svelte (prettier-plugin-svelte)

v4.1.0

Compare Source

Minor Changes
  • feat: support Svelte 5 declaration tags (#​533)

v4.0.1

Compare Source

Patch Changes
  • fix: print @const correctly (#​530)

v4.0.0

Compare Source

  • (breaking) Require Svelte 5
  • (breaking) Remove svelteBracketNewLine option
  • (breaking) Remove svelteStrictMode option
  • (fix) Keep trailing <!-- #endregion --> comments below svelte:options / scripts / styles

v3.5.2

Compare Source

  • (fix) Preserve non-breaking spaces
  • (fix) handle comments in bind: get/set tuple
  • (fix) handle computed properties in e.g. {#each} blocks
vercel/vercel (vercel)

v54.12.2

Compare Source

Patch Changes

v54.12.1

Compare Source

Patch Changes

v54.12.0

Compare Source

Minor Changes
  • 5757bca: [services] add support to vc dev for experimentalServicesV2.
Patch Changes

v54.11.1

Compare Source

Patch Changes

v54.11.0

Compare Source

Minor Changes
  • fc7b557: Ensure project manifest includes framework for non-service builds.
Patch Changes
  • bc8dc95: Fix the darwin-arm64 native CLI binary crashing with SIGSEGV on most commands. The custom Node
    runtime was stripped with bare strip, which removes the exported napi_* symbols that native
    addons (@napi-rs/keyring) bind against at dlopen time. The runtime is now stripped with
    strip -SXx, which keeps exported symbols. Also makes the @vercel/vc-native bin shim launch
    the platform binary directly when the postinstall script did not run (pnpm blocks dependency
    build scripts by default), instead of always failing.
  • bc8dc95: Fix vercel upgrade crashing with ENOENT: no such file or directory, realpath '…/.pkg-staging/pkg.js'
    in the native binary. The command tried to realpath process.argv[1], which points into the binary's
    virtual filesystem snapshot. Native installs now detect the package manager (npm, pnpm, or yarn) from
    the binary's real install location and suggest the matching global upgrade command.

v54.10.3

Compare Source

Patch Changes
  • 4f82914: Bump the embedded sandbox CLI to 3.1.2 (@vercel/sandbox 2.1.1) to fix vc sandbox commands crashing with a segmentation fault.

v54.10.2

Compare Source

Patch Changes
  • 0f7844c: Fix the native CLI binary crashing on auth commands (login, whoami, logout, and any
    command that reads config) with ERR_MODULE_NOT_FOUND: '@&#8203;vercel/cli-auth'. The package is now
    staged into the binary. The binary release is also hardened with a real command smoke test and a
    build-time check that every statically-imported dependency is bundled, so a binary missing a
    required package can no longer be released.
  • Updated dependencies [78e5d4f]

v54.10.1

Compare Source

Patch Changes

v54.10.0

Compare Source

Minor Changes
Patch Changes

  • f6a6e55: Only offer the Claude Code plugin in projects that have actually been used with Claude Code. Previously the prompt could appear in any directory as long as a ~/.claude directory existed on disk. The CLI now checks whether the current project (walking up from the working directory) appears in Claude Code's per-project history before offering the plugin.

  • a4f7dc9: CLI help and command-schema cleanups from the docs audit:

    • blob: remove orphan addStoreSubcommand, removeStoreSubcommand, and getStoreSubcommand exports that duplicated the wired create-store / delete-store / get-store specs. Handlers and telemetry now import the actual wired subcommand definitions.
    • dns list: the <domain> argument is now declared required: false to match the runtime, which already supports listing every domain's records when no argument is given.
    • routes delete: declare the <name-or-id> argument as multiple: true so the help synopsis and schema match the variadic behavior already supported by the handler and shown in the existing examples.
    • init: fix the "Initialize example project into specified directory" help example, which was missing the init literal (vercel <example> <dir> → vercel init <example> <dir>).
    • promote status and rollback status: declare --timeout on the status subcommand options so --help matches the examples (promote status --timeout 30s, rollback status --timeout 30s). The flag is also kept on the parent command, where parsing actually happens.

  • 33efa25: Added non-managed Connex connector creation with --data and optional --connector-type.

  • 3a2d61e: Add vercel domains search <query> for client-side Domain Discovery with fast bulk availability and registrar pricing, renewal pricing, --available and exact TLD filters, ordering, candidate windows of up to 200 domains, and JSON output.

  • c5eeb30: Gate the client-side 900-second maxDuration upper bound behind the VERCEL_CLI_SKIP_MAX_DURATION_LIMIT environment variable. The limit is now owned by a single helper in @vercel/build-utils instead of being hardcoded in multiple validators. When the variable is set to 1, the client-side maximum is skipped and validation defers to the server. Default behavior is unchanged — the maximum, the lower bound, and the integer check are all still enforced when the variable is unset.

  • 9f9eed3: Nest Build Output API files for experimentalServicesV2 under .vercel/output/services/<name>.

  • fb30b76: Strip ANSI escape sequences from connector UID and name cells in connect list table output.

  • Updated dependencies [c5eeb30]

  • Updated dependencies [09c39af]

v54.9.1

Compare Source

Patch Changes

  • f5ab607: [evals] Shrink eval result uploads and fix run discovery

    The eval ingest transform (transform-agent-eval-to-canonical.js) now excludes raw transcripts (transcript-raw.jsonl) from the --upload-artifacts all path, roughly halving each ingest payload. The parsed transcript.json is still uploaded and still read for resolvedModels metadata.

    It also normalizes provider-prefixed model paths before upload. Models that resolve to provider/model (e.g. openai/gpt-5.5-pro) write results one directory deeper, pushing the timestamp past the experiment/model/timestamp shape the ingest endpoint discovers runs from, which previously failed with Could not discover any experiment/model/timestamp runs. The model is now collapsed to a single segment (openai-gpt-5.5-pro) so discovery succeeds.

  • 2b31813: Fix vc build --standalone failing to zip Lambdas when run from a monorepo
    subdirectory. When dependencies are hoisted to the monorepo root (e.g. pnpm's
    node_modules/.pnpm/...), the recorded function file paths could escape the
    function root (../../node_modules/...), which later caused zipping to fail
    with invalid relative path: ../../node_modules/.... These paths are now
    re-anchored inside the function so the standalone output is self-contained.

  • 252c6eb: [cli] Show claim in vercel integration resource --help

    The claim subcommand was missing from resourceSubcommand.subcommands, so vercel integration resource --help only listed connect, disconnect, remove, and create-threshold. The legacy vercel integration-resource --help and the dispatcher's runtime resolution both already included claim — this was purely a help/discoverability gap on the canonical nested path. Adds claimSubcommand to the subcommand list and updates the parent description accordingly.

  • 0a170fd: [services] wire experimentalServicesV2 into fs-detectors.

  • Updated dependencies [aeb5bfa]

  • Updated dependencies [0a170fd]

v54.9.0

Compare Source

Minor Changes
  • fb4fb2d: Add support for claiming sandbox marketplace resources (Stripe, Shopify) from the CLI. integration list shows a new Claim column, integration-resource claim <name> opens the provider claim URL in the browser and polls until completion, and integration add offers to claim sandbox resources after provisioning with new --claim / --no-claim flags.
Patch Changes

v54.8.0

Compare Source

Minor Changes

  • fddeb55: Add configurable credentials storage handling across the CLI auth stack. Storage of credentials can be configured by the new credStorage key in global config.json or the new VERCEL_TOKEN_STORAGE environment variable. The environment variable takes precedence over the configuration key. Accepted values are file (store credentials in auth.json), keyring (store credentials in system keyring, e.g macOS Keychain or Secrets Service on Linux), and auto (try storing in keyring if available, fall back to file if keyring is not available).

    @vercel/oidc supports keyring-stored authentication credentials by delegating the OIDC minting to the CLI executable via @vercel/cli-exec.

Patch Changes

  • a869874: [connect] Rename user-facing "client" references to "connector"

    Updates the vercel connect CLI commands to use the official "connector" terminology in all user-facing surfaces: help text argument names (remove/attach/detach), usage strings in error messages, and the --format=json output key (clients → connectors) for vercel connect list.

  • 200aa3b: [connect] Forward --scopes and --installation-id into the authorize/install recovery URL

    When vercel connect token hits an action-required error (user_authorization_required or client_installation_required), the CLI builds an authorize/install URL for the user to complete consent in the browser. Previously this URL carried only teamId and request_code, dropping the --scopes and --installation-id the user supplied. As a result the consent flow fell back to provider defaults (e.g. Slack's users.profile:read), and the post-authorization token retry mismatched the requested scopes. The CLI now forwards scopes (comma-joined) and installationId as query params, which the authorize and install endpoints already accept.

  • 3019788: [services] Remove the services field from vercel.json and the VERCEL_USE_SERVICES gate.

  • fe893ec: [services] Add experimentalServicesV2 field to vercel.json implementing the new schema for services.

  • d22d812: [cli] Nest integration-resource under integration resource and add integration resource connect

    The marketplace resource subcommands (disconnect, remove, create-threshold) are now discoverable under vercel integration resource <sub>. The standalone vercel integration-resource and vc ir forms still work as hidden aliases — no scripts or tests break.

    Adds a new vercel integration resource connect <resource> [project] command (the inverse of disconnect). Accepts --environment (repeatable, defaults to all three), --prefix for env var namespacing, --yes, and --format=json. Defaults to the project linked in the current directory when <project> is omitted.

    Tightens disconnect to error (exit 1) when the specified project is not connected to the resource, instead of exiting 0 with a "not found" message.

    Both commands emit a structured outputAgentError payload with reason: confirmation_required and a next: [{command}] retry hint when run in non-interactive / agent mode without --yes. When connect fails because an env var with the same name already exists on the target project, the error names the conflicting variable and suggests --prefix or vercel env rm as remediation.

  • Updated dependencies [3019788]

  • Updated dependencies [fe893ec]

  • Updated dependencies [fddeb55]

v54.7.1

Compare Source

Patch Changes

v54.7.0

Compare Source

Minor Changes
  • 0b4e1ef: Add vercel connect revoke-tokens subcommand to revoke tokens issued from a connector.
Patch Changes
  • ba6e7c6: Internal: fix _deploy eval grader passing --token "" in the Docker sandbox where VERCEL_TOKEN isn't in process env. Only pass --token when set; CLI falls back to auth.json otherwise.
  • 92988c2: Handle sensitive Environment Variable pull challenges in the CLI.
  • 3986bb0: Stop retrying intentionally aborted requests so the CLI exits promptly after a deployment is ready.
  • 64f5484: Allow SAML re-authentication to use device-code flow in non-TTY sessions.
  • 97fdbbe: [flags] fix dep detection for build embedding
  • Updated dependencies [2d918b8]

v54.6.1

Compare Source

Patch Changes

v54.6.0

Compare Source

Minor Changes
  • af3e0bd: adding version node + cli version to top of every command
Patch Changes

v54.5.1

Compare Source

Patch Changes

v54.5.0

Compare Source

Minor Changes
  • 6860c32: Add project manifest to rust builder.
  • 2c17a12: Added --open and --view flags to vercel traces get. --open opens the trace in the Vercel Dashboard instead of printing the markdown summary. --view <timeline|tree|gantt> selects the dashboard view and is only valid with --open.
Patch Changes
  • 620bcfa: Add --type, --service, and --search filter flags to vercel connect list.
  • ff2a980: Add a vercel domains check subcommand for registrar availability and extend
    vercel domains price to support bulk price lookups for multiple domains.
  • Updated dependencies [1318682]
  • Updated dependencies [6860c32]
  • Updated dependencies [e917989]
  • Updated dependencies [baac149]
  • Updated dependencies [ecf5033]
  • Updated dependencies [73dbbe6]
  • Updated dependencies [[647c1e8](https://redirect.github.

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@stickerdaniel Graphite App

stickerdaniel commented May 4, 2026

Copy link
Copy Markdown
Owner

This stack of pull requests is managed by Graphite. Learn more about stacking.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs		 saas-starter 3fbd204 Jun 15 2026, 02:01 PM

@renovate renovate Bot force-pushed the renovate/major-all-major branch 5 times, most recently from 280eae5 to 6a64d02 Compare May 5, 2026 15:52
@socket-security

socket-security Bot commented May 5, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate renovate Bot force-pushed the renovate/major-all-major branch 3 times, most recently from 6b84b5f to 1118ba8 Compare May 10, 2026 09:25
@renovate renovate Bot force-pushed the renovate/major-all-major branch 5 times, most recently from c666453 to 8252a62 Compare May 16, 2026 16:38
@renovate renovate Bot changed the title fix(deps): update dependency autumn-js to v1 fix(deps): update all major dependencies (major) May 16, 2026
@renovate renovate Bot force-pushed the renovate/major-all-major branch 10 times, most recently from a7ec3d4 to 71aac5e Compare May 23, 2026 22:49
@renovate renovate Bot force-pushed the renovate/major-all-major branch 3 times, most recently from 66a5aa0 to c0c3bcc Compare May 25, 2026 17:08
@renovate renovate Bot force-pushed the renovate/major-all-major branch 10 times, most recently from ad83f7a to 0541cd7 Compare June 1, 2026 00:45
@stickerdaniel stickerdaniel force-pushed the main branch 2 times, most recently from 60d29e3 to 29070d5 Compare June 1, 2026 13:31
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 0541cd7 to 94b13d8 Compare June 1, 2026 13:53
@renovate renovate Bot force-pushed the renovate/major-all-major branch 6 times, most recently from d4411a5 to bb5871a Compare June 7, 2026 16:51
@renovate renovate Bot force-pushed the renovate/major-all-major branch 5 times, most recently from 1af8d14 to 3185c1b Compare June 12, 2026 16:16
@socket-security

socket-security Bot commented Jun 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedvercel@​53.1.1 ⏵ 54.12.280100100 +199 +1100
Updated@​zxcvbn-ts/​language-common@​3.0.4 ⏵ 4.1.1100 +4810080 -289 -1100
Updated@​zxcvbn-ts/​language-en@​3.0.2 ⏵ 4.1.0100 +6010082 -389 +190 -9
Updatedautumn-js@​0.1.48 ⏵ 1.2.2999 +110082 +298100
Updated@​zxcvbn-ts/​core@​3.0.4 ⏵ 4.1.1100 +1210085 +189 -1100
Updatedprettier-plugin-svelte@​3.5.1 ⏵ 4.1.010010010092100

View full report

@renovate renovate Bot force-pushed the renovate/major-all-major branch 3 times, most recently from 7a05ce8 to c9e2b4e Compare June 12, 2026 23:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stickerdaniel