Skip to content

build: update all non-major dependencies (main) - #34336

Merged
dgp1130 merged 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-all-non-major-dependencies
Oct 13, 2026
Merged

build: update all non-major dependencies (main)#34336
dgp1130 merged 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-all-non-major-dependencies

Conversation

@angular-robot

@angular-robot angular-robot commented Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@listr2/prompt-adapter-inquirer 4.2.7 → 4.3.1 age adoption passing confidence
@rollup/wasm-node (source) 4.64.1 → 4.64.5 age adoption passing confidence
@typescript-eslint/eslint-plugin (source) 8.71.1 → 8.71.2 age adoption passing confidence
@typescript-eslint/parser (source) 8.71.1 → 8.71.2 age adoption passing confidence
@vitest/coverage-v8 (source) 5.0.3 → 5.0.4 age adoption passing confidence
beasties (source) 0.5.4 → 0.5.5 age adoption passing confidence
express (source) 5.2.1 → 5.3.0 age adoption passing confidence
listr2 11.1.1 → 11.2.0 age adoption passing confidence
pnpm (source) 12.10.1 → 12.11.2 age adoption passing confidence
puppeteer (source) 25.12.0 → 25.13.0 age adoption passing confidence
rolldown (source) 1.2.12 → 1.2.13 age adoption passing confidence
rolldown-plugin-dts 0.28.6 → 0.28.8 age adoption passing confidence
rollup (source) 4.64.1 → 4.64.5 age adoption passing confidence
vite (source) 8.3.3 → 8.3.4 age adoption passing confidence
vitest (source) 5.0.3 → 5.0.4 age adoption passing confidence
zod (source) 4.6.5 → 4.6.7 age adoption passing confidence
  • If you want to rebase/retry this PR, check this box

Release Notes

listr2/listr2 (@​listr2/prompt-adapter-inquirer)

v4.3.1

Compare Source

@​listr2/prompt-adapter-inquirer 4.3.1 (2026-10-12)

Bug Fixes
  • deps: link listr2 to the workspace through pnpm (6cb5e49)

v4.3.0

Compare Source

@​listr2/prompt-adapter-inquirer 4.3.0 (2026-10-12)

Features
  • test: write junit and cobertura reports natively (bacdfc2)
Dependencies
  • listr2: upgraded to 11.2.0
rollup/rollup (@​rollup/wasm-node)

v4.64.5

Compare Source

2026-10-10

Bug Fixes
  • Prevent cycles when using indirect top-level await for dynamic imports (#​6516)
Pull Requests

v4.64.4

Compare Source

2026-10-10

Bug Fixes
  • Support the Rollup WASM build on big-endian hosts (#​6559)
Pull Requests

v4.64.3

Compare Source

2026-10-08

Bug Fixes
  • Fix a performance regression when bundling code with deeply nested property calls (#​6565)
Pull Requests

v4.64.2

Compare Source

2026-10-07

Bug Fixes
  • Fix a regression where certain CoreJS helpers were wrongly tree-shaken (#​6562)
  • Do not show errors from closeBundle if there were also build errors (#​6554)
Pull Requests
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.71.2

Compare Source

🩹 Fixes
  • eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#​12805)
  • eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#​12995)
  • eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#​12977)
  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#​12974)
  • eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#​12989)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.71.2

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
danielroe/beasties (beasties)

v0.5.5

Compare Source

v0.5.5 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes
  • beasties: don't terminate block at-rules with a semicolon (#​454)
  • beasties: ignore prototype names in text entities (#​453)
  • beasties: keep keyframes named through custom properties (#​452)
  • beasties: match selectors against decoded attribute values (#​451)
  • beasties: handle escaped quotes in quoted urls (#​450)
  • beasties: await pruned stylesheet writes before resolving process (7871a77)
  • beasties: avoid quadratic state growth in the streaming scanner (#​435)
🏡 Chore
🤖 CI
  • replace agentscan action with the github app (12bf216)
  • use pnpm/setup and devEngines (#​428)
🎉 New Contributors
❤️ Contributors
expressjs/express (express)

v5.3.0

Compare Source

=====

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #​4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #​7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #​7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #​5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #​6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #​7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #​6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #​7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

  • Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @​Mayvis in #​7390

⚡ Performance

  • Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @​bjohansebas in #​6991
pnpm/pnpm (pnpm)

v12.11.2: pnpm 12.11.2

Compare Source

This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

Patch Changes

  • --workspace-concurrency=Infinity now runs workspace projects with no concurrency limit. It used to fail with invalid digit found in string #​16793.

  • pnpm install and other recursive commands now apply the filter and filterProd that an updateConfig hook sets. They used to run on every workspace project #​16792.

  • enable-modules-dir=false now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.

Platinum Sponsors
Bit OpenAI Notion
CodeRabbit
Gold Sponsors
Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.11.1: pnpm 12.11.1

Compare Source

This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

Patch Changes

  • pnpm install no longer fails when packageManager pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.

  • pnpm install no longer fails with ERR_PNPM_CMD_SHIM_CHMOD when node_modules/.bin holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.

  • enable-modules-dir=false (enableModulesDir: false through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under node_modules. The setting exists for a node_modules that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain --lockfile-only run still fetches nothing.

  • pnpm pack and pnpm publish no longer put .npmignore and .gitignore files in the tarball. A files entry that names one still ships it.

  • pnpm now treats https://registry.npmjs.com/ as an alias of https://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.

  • pnx --package=rust@<channel> <tool> runs a tool of that Rust release, for example pnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets from rust-toolchain.toml and the target of each --target argument.

  • pnpm install now links agent skills for more coding agents. It detects the agent from ANTIGRAVITY_AGENT, COPILOT_AGENT, COPILOT_CLI, CODEX_THREAD_ID, CODEX_SANDBOX, AI_AGENT, and CLAUDE_CODE pnpm/tasks#116.

  • When the registry rejects pnpm stage publish, the error message now starts with "Failed to stage package".

Platinum Sponsors
Bit OpenAI Notion
CodeRabbit
Gold Sponsors
Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.11.0: pnpm 12.11.0

Compare Source

This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output.

Minor Changes

  • pnpm install now links the agent skills that direct dependencies ship under skills/<name>/SKILL.md into the project's agent skill directories, such as .claude/skills. A package's skills are linked only after you approve them with pnpm approve. The skills.dirs setting chooses the directories pnpm/rfcs#35.

    Added the permissions setting, which records what each dependency may do. Its build capability works like allowBuilds and takes precedence over it. pnpm approve-builds writes to permissions when pnpm-workspace.yaml already has it, and to allowBuilds otherwise.

    Added pnpm permissions, which lists the granted and denied permissions and the packag

❗ Important

✂ PR body was truncated to here.

@angular-robot angular-robot added action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only] labels Oct 13, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Oct 13, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates various dependencies and the package manager version across multiple package.json files in the workspace. Notable changes include upgrading pnpm to version 12.11.2, and bumping versions for dependencies such as vitest, rollup, express, puppeteer, listr2, rolldown, and zod. There are no review comments, and I have no feedback to provide.

@angular-robot
angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch from 037985d to d57d186 Compare October 13, 2026 17:56
@angular-robot
build: update all non-major dependencies
55906e3 
See associated pull request for more information.
@angular-robot
angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch from d57d186 to 55906e3 Compare October 13, 2026 19:53
@dgp1130
dgp1130 merged commit 48f8c0c into angular:main Oct 13, 2026
39 checks passed
@dgp1130

dgp1130 commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator

This PR was merged into the repository. The changes were merged into the following branches:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alan-agius4 alan-agius4 alan-agius4 approved these changes
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@angular-robot @dgp1130 @alan-agius4