Skip to content

chore(deps): update all non-major dependencies - #60

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#60
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@ai-sdk/gateway (source) ^4.0.116 → ^4.0.121 age confidence dependencies patch
@ai-sdk/vue (source) ^4.0.143 → ^4.0.148 age confidence dependencies patch
@comark/nuxt (source) ^0.7.0 → ^0.8.1 age confidence dependencies minor
@iconify-json/logos ^1.2.16 → ^1.2.17 age confidence dependencies patch
@iconify-json/lucide ^1.2.145 → ^1.2.147 age confidence dependencies patch
@iconify-json/vscode-icons ^1.2.90 → ^1.2.92 age confidence dependencies patch
@iconify/vue (source) ^5.0.3 → ^5.0.4 age confidence dependencies patch
@nuxt/devtools-kit (source) 4.0.0-beta.5 → 4.0.0-beta.7 age confidence devDependencies patch
@opentelemetry/api (source) ^1.9.1 → ^1.10.0 age confidence dependencies minor
@opentelemetry/exporter-trace-otlp-proto (source) ^0.223.0 → ^0.300.0 age confidence devDependencies minor
@vercel/functions (source) ^3.10.1 → ^3.10.2 age confidence dependencies patch 3.10.3
ai (source) ^7.0.143 → ^7.0.148 age confidence dependencies patch
comark (source) ^0.7.0 → ^0.8.1 age confidence dependencies minor
es-module-lexer ^3.0.2 → ^3.0.4 age confidence devDependencies patch
node 24 → 24.22.1 age confidence uses-with minor
nuxt-agent-discovery ^0.7.1 → ^0.8.0 age confidence dependencies minor
pnpm (source) 12.14.0 → 12.15.0 age confidence packageManager minor
satori ^0.62.0 → ^0.63.2 age confidence dependencies minor

Release Notes

vercel/ai (@​ai-sdk/gateway)

v4.0.121

Compare Source

Patch Changes

v4.0.120

Compare Source

Patch Changes
  • 9bec2c3: chore(provider/gateway): update gateway model settings files

v4.0.119

Compare Source

Patch Changes
  • 9d13c4d: Add the MiniMax M3.1 Flash model ID to the MiniMax and AI Gateway providers.
  • 0c2a9de: Add maxOutputTokens and reasoning to experimental decision calls and forward them to language-model-backed decisions. Language-model adapters keep reasoning disabled when omitted. Native decision providers warn when either setting is unsupported.
  • Updated dependencies [0c2a9de]
  • Updated dependencies [200c47f]

v4.0.118

Compare Source

Patch Changes
  • 1c47fee: chore(provider/gateway): update gateway model settings files

v4.0.117

Compare Source

Patch Changes
vercel/ai (@​ai-sdk/vue)

v4.0.148

Compare Source

Patch Changes

v4.0.147

Compare Source

Patch Changes
  • Updated dependencies [66e74dc]
    • ai@​7.0.147

v4.0.146

Compare Source

Patch Changes

v4.0.145

Compare Source

Patch Changes
  • ai@​7.0.145

v4.0.144

Compare Source

Patch Changes
comarkdown/comark (@​comark/nuxt)

v0.8.1: comark v0.8.1

Compare Source

Bug Fixes
  • security: sanitize frontmatter, tag selectors and data URLs (#​486) (becc5aa)

v0.8.0: comark v0.8.0

Compare Source

🚨 Breaking Changes
🚀 Features
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
nuxt/devtools (@​nuxt/devtools-kit)

v4.0.0-beta.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.0.0-beta.6

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
open-telemetry/opentelemetry-js (@​opentelemetry/api)

v1.10.0

Compare Source

🚀 (Enhancement)
🐛 (Bug Fix)
  • fix(core): added falsy check to make otel core work with browser where webpack config had process as false or null #​3613 @​ravindra-dyte
  • fix(instrumentation-http): include query params in http.target #​3646 @​kobi-co
📚 (Refine Doc)
🏠 (Internal)
vercel/ai (ai)

v7.0.148

Compare Source

Patch Changes

v7.0.147

Compare Source

Patch Changes

v7.0.146

Compare Source

Patch Changes
  • 0c2a9de: Add maxOutputTokens and reasoning to experimental decision calls and forward them to language-model-backed decisions. Language-model adapters keep reasoning disabled when omitted. Native decision providers warn when either setting is unsupported.
  • 3785b2e: fix(ai): remove orphaned reasoning, including consecutive summary and reasoning-file parts, when pruning tool calls
  • ab8eb61: Fix optional tools adding an incorrect undefined member to tool call, result, error, denied output, and execution event types.
  • Updated dependencies [9d13c4d]
  • Updated dependencies [0c2a9de]
  • Updated dependencies [200c47f]

v7.0.145

Compare Source

Patch Changes

v7.0.144

Compare Source

Patch Changes
  • 60cc252: feat(perplexity): add decisions api support
  • 0ed59e2: Fix streamText return types for reusable options and ReturnType by moving low-memory streaming to experimental_streamTextLowMemory. Replace experimental streamText({ experimental_lowMemory: true, ...options }) calls with experimental_streamTextLowMemory(options).
  • Updated dependencies [60cc252]
  • Updated dependencies [6b7fb8f]
guybedford/es-module-lexer (es-module-lexer)

v3.0.4

Compare Source

What's Changed

Full Changelog: guybedford/es-module-lexer@3.0.3...3.0.4

v3.0.3

Compare Source

What's Changed

Full Changelog: guybedford/es-module-lexer@3.0.2...3.0.3

actions/node-versions (node)

v24.22.1: 24.22.1

Compare Source

Node.js 24.22.1

v24.22.0: 24.22.0

Compare Source

Node.js 24.22.0

v24.21.0: 24.21.0

Compare Source

Node.js 24.21.0

v24.20.0: 24.20.0

Compare Source

Node.js 24.20.0

v24.19.0: 24.19.0

Compare Source

Node.js 24.19.0

v24.18.1: 24.18.1

Compare Source

Node.js 24.18.1

v24.18.0: 24.18.0

Compare Source

Node.js 24.18.0

v24.17.0: 24.17.0

Compare Source

Node.js 24.17.0

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

v24.15.0: 24.15.0

Compare Source

Node.js 24.15.0

v24.14.1: 24.14.1

Compare Source

Node.js 24.14.1

v24.14.0: 24.14.0

Compare Source

Node.js 24.14.0

v24.13.1: 24.13.1

Compare Source

Node.js 24.13.1

v24.13.0: 24.13.0

Compare Source

Node.js 24.13.0

v24.12.0: 24.12.0

Compare Source

Node.js 24.12.0

v24.11.1: 24.11.1

Compare Source

Node.js 24.11.1

v24.11.0: 24.11.0

Compare Source

Node.js 24.11.0

v24.10.0: 24.10.0

Compare Source

Node.js 24.10.0

v24.9.0: 24.9.0

Compare Source

Node.js 24.9.0

v24.8.0: 24.8.0

Compare Source

Node.js 24.8.0

v24.7.0: 24.7.0

Compare Source

Node.js 24.7.0

v24.6.0: 24.6.0

Compare Source

Node.js 24.6.0

v24.5.0: 24.5.0

Compare Source

Node.js 24.5.0

v24.4.1: 24.4.1

Compare Source

Node.js 24.4.1

v24.4.0: 24.4.0

Compare Source

Node.js 24.4.0

v24.3.0: 24.3.0

Compare Source

Node.js 24.3.0

v24.2.0: 24.2.0

Compare Source

Node.js 24.2.0

v24.1.0: 24.1.0

Compare Source

Node.js 24.1.0

v24.0.2: 24.0.2

Compare Source

Node.js 24.0.2

v24.0.1: 24.0.1

Compare Source

Node.js 24.0.1

benjamincanac/nuxt-agent-discovery (nuxt-agent-discovery)

v0.8.0

Compare Source

Features
Bug Fixes
  • import useRuntimeConfig from nitropack/runtime on the server (#​55) (c1a5310)
  • module: support sites served under app.baseURL (#​58) (0371b57)
  • sitemap: list a route once in sitemap.md and llms.txt (#​57) (fc025c9)
pnpm/pnpm (pnpm)

v12.15.0: pnpm 12.15

Compare Source

This release lets pnpm-workspace.yaml delegate settings to other files and config dependencies with include, adds lockfile.integrityTarget: tar and tar-registry support, accepts zstd-compressed registry responses, and honors SOURCE_DATE_EPOCH in pnpm deploy and pnpm install. It also rejects registry metadata that names a different package than the one requested and speeds up workspace installs and macOS file linking.

Minor Changes

  • pnpm-workspace.yaml can now delegate settings to other YAML files and to config dependencies through a new include field. Each source may define only the settings the root manifest delegates to it. Every setting has one owner. Commands that change settings write each one to the file that owns it. A relative path in an included file is relative to that file. See Splitting Settings Across Files.

    A config dependency supplies its settings through the YAML file named in the pnpm.config field of its package.json. The new bootConfig setting sets the release-age and trust policy pnpm uses to install config dependencies and the pnpm version from packageManager.

  • Added the lockfile.integrityTarget setting. With integrityTarget: tar, pnpm-lock.yaml pins the hash of every package's uncompressed tar, so the lockfile no longer changes when a registry recompresses its tarballs or serves them as tars. pnpm learns a version's tar hash from the store or by downloading it once. pnpm audit signatures ties the tar hash to the signed .tgz integrity.

    lockfile:
  integrityTarget: tar

  • pnpm can now install from a registry that serves uncompressed tars with zstd or gzip content coding. pnpm-lock.yaml records the hash of each tar. Declare such a registry with serverType: pnpr in registries to keep tarball URLs out of the lockfile. See Tar registries.

    pnpm now decodes the content coding of tarball downloads itself. It rejects a zstd response whose window is larger than 8 MiB.

    Added the maxTarballUnpackedSize setting. It caps the bytes the files of one package may unpack to, 4 GiB by default.

  • Registry revisions now always pin the hash of the uncompressed tar, the original included. pnpm records an original selected through the revision protocol, for example with a +r0 specifier, as revision: 0 in the lockfile and fetches it from the registry's digest route. pnpm checks a revision's tar whether the registry sends it as a tar, gzip, or zstd. Revision metadata must list revision 0 and mark the selected revision. pnpm rejects incomplete revision metadata with ERR_PNPM_MALFORMED_METADATA.

  • pnpm now accepts zstd-compressed responses. Registries that serve zstd send package metadata in fewer bytes than with gzip, most of all the full metadata that settings such as minimumReleaseAge and trustPolicy read.

  • pnpm deploy and pnpm install now use the SOURCE_DATE_EPOCH environment variable as an upper bound for timestamps in node_modules/.modules.yaml and node_modules/.pnpm-workspace-state-v1.json. With an equivalently prepared deploy target and an epoch no later than the timestamps that would otherwise be recorded, deploying the same project twice produces identical files #​17171.

  • pnpm update --interactive now highlights the row under the cursor in cyan while keeping the colors of its version changes.

Patch Changes
Security

  • pnpm now fails with ERR_PNPM_REGISTRY_NAME_MISMATCH if a registry returns metadata for a package other than the one requested. Before, pnpm installed the package under the name in the metadata, so allowBuilds rules for the requested package did not apply to it.

  • minimumReleaseAgeExcludePrune and trustPolicyExcludePrune now keep exclusions for resolved configuration dependencies and their transitive dependencies #​17142.

Resolving dependencies

  • When pnpm install resolves a dependency again, it now reuses a version that the install already resolved for the same package, as a fresh install does. Before, it kept the version the lockfile pinned and added a second copy of the package. A locked version still stays when nothing else in the install prefers another version. To pin a transitive dependency on purpose, use overrides #​17084.

  • When another workspace project adds a different version of a package, a project's auto-installed peer on that package now moves to the version a fresh install picks. It used to stay on its locked version while any other project still accepted that version #​17058.

  • A package that lists the same dependency in dependencies and as an optional peer now gets the peer bound when a project adds a provider for it later. The lockfile now records every peer a package declares, including one its own dependency supplies #​17056.

  • pnpm install --prod and pnpm deploy --prod no longer drop a dependency that a package declares both as an optional peer and as its own dependency, when the package resolved it as its own dependency and a dev dependency provides the same package under another alias.

  • pnpm install with an existing lockfile and a second pnpm dedupe now keep optional peer bindings that point into a dependency cycle or back into the dependent package. Before, the second run dropped the optional peer binding from the lockfile snapshot key.

  • pnpm install and pnpm dedupe now preserve own-dependency and peer-dependency bindings when reusing a lockfile whose peer suffixes were hashed by peersSuffixMaxLength.

    Upgrading a direct dependency in one workspace project now refreshes matching transitive pins in sibling projects during the same pnpm install pass.

  • With resolvePeersFromWorkspaceRoot: false, a workspace project no longer binds a peer to a version that only another project's dependencies provide. pnpm now auto-installs a version that satisfies the peer range for that project. Before, the project got a version outside the range, with no peer warning.

  • pnpm install, pnpm add, and pnpm update now reuse the lockfile's resolution for dependencies that take part in a dependency cycle, such as mlly and pkg-types. They re-resolved those packages and everything that depends on them from the registry before pnpm/tasks#130.

  • pnpm now measures a pnpm.overrides entry written as a workspace: path, such as workspace:./packages/foo, from the directory holding pnpm-workspace.yaml. It used to be measured from each package the override rewrote. The install then linked a directory that does not exist, or failed if workspace packages were injected #​17010.

  • pnpm install now removes config dependencies that are no longer declared, including when the entire configDependencies setting is removed. Frozen installs reject a lockfile that still records removed config dependencies.

  • pnpm install --update-checksums now re-resolves every locked package and records the integrity the registry reports now.

  • pnpm add and pnpm install now accept gist:<id> dependencies and GitHub Gist URLs, and install them from the gist's archive. pnpm pkg fix normalizes a gist: repository the way npm pkg fix does, pnpm licenses links a gist package to its gist page, and pnpm sbom reports the repository of a package whose repository field is a gist: shorthand.

  • pnpm add now reads the package name correctly from a tarball URL under a registry URL that has a path, such as https://example.com/npm/, and installs a registry tarball URL with a malformed percent escape as a plain tarball URL. Before, the registry path became part of the name, so a scoped package failed with ERR_PNPM_INVALID_PACKAGE_NAME.

  • With minimumReleaseAge set, pnpm now revalidates a package's cached full metadata with a single ETag request so an unchanged registry answers with 304, even when the registry does not list a publish time for every version. Previously, pnpm downloaded that metadata again whenever the cached copy was older than minimumReleaseAge. With resolutionMode set to lowest-direct or time-based, pnpm also reuses that metadata across every workspace project that depends on the package.

  • When pnpm revalidates cached registry metadata, it now sends If-Modified-Since when the registry's modification time is a date without a time, and no longer crashes when the modification time is before 1970.

  • Added protocol versioning between the pnpm client and pnpr server, verified applied resolution policies in resolution responses, and preserved structured error codes across the wire.

Performance

  • Sped up pnpm install on macOS. On a 12-core Mac, installing 1352 packages from a warm store took 1.3 seconds, down from 2.2. pnpm now writes package files into node_modules with 4 threads on macOS, whatever the number of CPU cores. Set the PNPM_MACOS_LINK_THREADS environment variable to use a different number of threads, or to 0 to write files with the threads pnpm uses for the rest of the install.

  • pnpm install is faster and uses less memory in large workspaces with sharedWorkspaceLockfile: false. Each project's install no longer reads the manifests of every other workspace project again. Installs that wait for their workspace dependencies now count toward workspaceConcurrency #​16966.

  • Sped up workspace project discovery, dependency resolution, lockfile up-to-date checks, and peer dependency checks in large workspaces #​16839 pnpm/tasks#9. On a workspace with 6,833 projects, the lockfile up-to-date check uses about 1 second less CPU time. The peer dependency check at the end of an install now checks linked workspace projects against the manifests already in memory, without reading each package.json again.

  • Sped up bin linking and build planning during pnpm install. Package binary targets and shebang runtimes are now precalculated during tarball extraction and served in pnpr registry metadata alongside verified requiresBuild, tarball size, and file-count metadata.

  • Lowered peak memory when pnpm downloads many packuments, such as during lockfile verification with trustPolicy on Linux. In one 1,800-entry workspace, a lockfile update now peaks at 1.8 to 2.0 GB. It peaked at 2.6 to 3.7 GB before #​17020.

  • pnpm install in a Cargo workspace skips crates that an earlier install already unpacked into the store. Before, a repeat install processed every crate in Cargo.lock again. pnpm install --force unpacks every crate again pnpm/tasks#69.

Linking node_modules and workspaces

  • Concurrent installs that import the same package into one project now all complete. One of them used to fail with ENOTEMPTY when its copy of the package collided with the copy another install had already placed pnpm/tasks#48.

  • pnpm install now succeeds when node_modules is a symlink to an existing directory. Dependency hoisting previously rejected a symlinked node_modules as an invalid destination #​17157.

  • A filtered first install under the isolated linker now links every workspace project by name into node_modules/.pnpm/node_modules, not only the selected ones pnpm/tasks#155.

  • With nodeLinker: hoisted, a filtered install such as pnpm --filter app add <pkg> keeps the root node_modules links and bins of the workspace projects it did not select. A project with no dependencies of its own lost them until the next full install.

  • pnpm install --filter with nodeLinker: hoisted and --prod or --dev now preserves previously installed dependency groups for unselected workspace projects pnpm/tasks#164. Repeat filtered installs also re-resolve when a transitive injected workspace dependency or a linked dependency's version changes.

  • With sharedWorkspaceLockfile: false, pnpm install now runs the workspace root's pnpmfile for every project, after the project's own pnpmfile. Before, it ran only the pnpmfile in the project's directory.

  • pnpm install and pnpm peers check now detect peer dependency issues and report linked package versions in linked projects that use package.json5 or package.yaml pnpm/tasks#172.

  • pnpm install and pnpm peers check no longer report an unmet peer when a workspace package's peer is provided by a remote tarball URL. pnpm now compares the peer range with the version in the tarball's manifest #​17037.

  • pnpm prune now removes extraneous direct packages from node_modules when package.json and pnpm-lock.yaml are already in sync. pnpm prune also honors --filter, --recursive, sharedWorkspaceLockfile: false, and the trustLockfile setting and --trust-lockfile flag. With the lockfile trusted, pnpm prune --prod works offline when every package is in the store #​16999.

Injected workspace packages

  • pnpm install --frozen-lockfile now fails with ERR_PNPM_OUTDATED_LOCKFILE when a local directory dependency or injected workspace package changes a dependency to a different tarball URL or git commit #​17129. It also fails when an injected workspace package changes a dependency's named-registry range, such as work:^2.0.0, to one the locked version no longer satisfies.

  • pnpm install --frozen-lockfile now accepts the lockfile it wrote for a file: dependency on a directory without a package.json. It also accepts the lockfile for an injected workspace package that bundles a dependency in bundledDependencies, lists a dependency in both dependencies and optionalDependencies, or publishes from a publishConfig.directory whose package.json lists other dependencies than the project's own. Before, these failed with ERR_PNPM_OUTDATED_LOCKFILE.

  • The lockfile now records a catalog: peer dependency of an injected workspace package as written in its package.json. It recorded the catalog's range before, so editing the catalog changed the consumer's lockfile entry [v11/v12 parity: catalog peer of an injected package recorded differently in the lockfile pnpm/tasks#153](https://redirec

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coldtea-pr-lens

coldtea-pr-lens Bot commented Oct 19, 2026

Copy link
Copy Markdown

Note

renovate[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

github.comment.notice: false in .github/pr-lens.yml turns this note off

@vercel

vercel Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
comark-docs-layer Ready Ready Preview Oct 22, 2026 5:34pm UTC

@coderabbitai

coderabbitai Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: ad63f893-625a-453d-9ae2-02cd2d8724f4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown 
npm i https://pkg.pr.new/comarkdown/comark-docs@60

commit: 907a0c0

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9adcca8 to cec67cf Compare October 20, 2026 10:13
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from cec67cf to 993b8d5 Compare October 20, 2026 12:34
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 993b8d5 to e18f007 Compare October 20, 2026 13:40
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from e18f007 to aa4e535 Compare October 20, 2026 14:18
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from aa4e535 to 5b7afcf Compare October 20, 2026 15:30
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 5b7afcf to 48d5ece Compare October 21, 2026 08:45
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 48d5ece to 6a7698e Compare October 21, 2026 09:28
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 6a7698e to f00e357 Compare October 21, 2026 16:50
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from f00e357 to b025126 Compare October 21, 2026 18:18
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from b025126 to 907a0c0 Compare October 22, 2026 10:20
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 907a0c0 to 2408c60 Compare October 22, 2026 17:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 2408c60 to 600730e Compare October 22, 2026 17:16
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 600730e to 91acf3b Compare October 22, 2026 17:31

This branch was successfully deployed

1 active deployment
Preview — 91acf3bd Deployed Oct 22, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants