Skip to content

chore(deps): update all non-major dependencies#6592

Merged
benjamincanac merged 2 commits into
v4from
renovate/all-minor-patch
Jun 15, 2026
Merged

chore(deps): update all non-major dependencies#6592
benjamincanac merged 2 commits into
v4from
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@ai-sdk/anthropic (source) ^3.0.81^3.0.84 age confidence
@ai-sdk/gateway (source) ^3.0.125^3.0.131 age confidence
@ai-sdk/mcp (source) ^1.0.46^1.0.50 age confidence
@ai-sdk/vue (source) ^3.0.197^3.0.205 age confidence
@iconify-json/lucide ^1.2.111^1.2.112 age confidence
@iconify-json/simple-icons ^1.2.85^1.2.86 age confidence
@iconify-json/vscode-icons ^1.2.55^1.2.57 age confidence
@nuxt/eslint-config (source) ^1.15.2^1.16.0 age confidence
@nuxtjs/color-mode ^4.0.0^4.0.1 age confidence
@regle/core (source) ^1.26.1^1.27.2 age confidence
@regle/rules (source) ^1.26.1^1.27.2 age confidence
@tailwindcss/postcss (source) ^4.3.0^4.3.1 age confidence
@tailwindcss/vite (source) ^4.3.0^4.3.1 age confidence
@takumi-rs/core (source) ^1.7.0^1.8.5 age confidence
ai (source) ^6.0.197^6.0.205 age confidence
better-sqlite3 ^12.10.0^12.10.1 age confidence
eslint (source) ^10.4.1^10.5.0 age confidence
happy-dom ^20.10.2^20.10.3 age confidence
motion-v ^2.2.1^2.3.0 age confidence
nuxt-og-image (source) ^6.5.2^6.6.0 age confidence
nuxt-schema-org (source) ^6.1.0^6.2.1 age confidence
pnpm (source) 11.5.211.6.0 age confidence
prettier (source) ^3.8.3^3.8.4 age confidence
tailwindcss (source) ^4.3.0^4.3.1 age confidence
vue (source) ^3.5.35^3.5.38 age confidence
vue-component-meta (source) ^3.3.3^3.3.5 age confidence
vue-component-type-helpers (source) ^3.3.4^3.3.5 age confidence
vue-tsc (source) ^3.3.4^3.3.5 age confidence

Release Notes

vercel/ai (@​ai-sdk/anthropic)

v3.0.84

Patch Changes

v3.0.82

Compare Source

Patch Changes
  • 2a91a17: feat(provider/anthropic): add support for claude-fable-5 and the fallbacks API parameter
vercel/ai (@​ai-sdk/mcp)

v1.0.49

Patch Changes
  • 3e8d9ba: fix(mcp): lock first sse endpoint received via event

  • 4fa7354: fix(mcp): prevent prototype-named tools from bypassing the schemas allowlist

    When using client.tools({ schemas }) to expose only an explicitly allowed
    subset of an MCP server's tools, the allowlist check used the in operator,
    which also matches inherited Object.prototype properties. A server-advertised
    tool named constructor, toString, __proto__, etc. would pass the check
    even though the developer never defined it in schemas, and was then exposed to
    the model and executable. The check now uses Object.hasOwn, so only
    explicitly defined tools are returned.

  • Updated dependencies [bfa5864]

  • Updated dependencies [f42aa79]

v1.0.47

Compare Source

Patch Changes
  • bf1d6bd: fix(mcp): prevent mcp oauth credential exfiltration during rediscovery
nuxt/eslint (@​nuxt/eslint-config)

v1.16.0

Compare Source

   🚀 Features
    View changes on GitHub
nuxt-modules/color-mode (@​nuxtjs/color-mode)

v4.0.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
victorgarciaesgi/regle (@​regle/core)

v1.27.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.27.1

Compare Source

v1.27.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.1

Compare Source

Added
  • Add --silent option to suppress output in @tailwindcss/cli (#​20100)
Fixed
  • Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#​20028)
  • Canonicalization: don't crash when plugin utilities throw for unsupported values (#​20052)
  • Allow @apply to be used with CSS mixins (#​19427)
  • Ensure not-* correctly negates @container queries, including style(…) queries (#​20059)
  • Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#​20080)
  • Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#​20103)
  • Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#​20027)
  • Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)]px-[calc(1rem+0)]) (#​20127)
  • Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px]left-[99999px], not left-24999.75) (#​20130)
  • Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#​20137)
  • Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#​20139)
  • Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#​20198)
  • Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#​19588)
  • Allow @variant to be used inside addBase (#​19480)
  • Ensure @source globs with symlinks are preserved (#​20203)
  • Ensure later @source rules can re-include files excluded by earlier @source not rules (#​20203)
  • Upgrade: don't migrate empty class rules to invalid @utility rules (#​20205)
  • Ensure transitions between inset-shadow-none and other inset shadows work correctly (#​20208)
  • Ensure explicitly referenced @source directories are scanned even when ignored by git (#​20214)
  • Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#​20217)
  • Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)]w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#​20221)
  • Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#​20228)
Changed
  • Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#​20196)
  • Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#​20196)
kane50613/takumi (@​takumi-rs/core)

v1.8.5

Compare Source

Patch Changes

v1.8.4

Compare Source

Patch Changes

v1.8.3

Compare Source

Patch Changes

v1.8.2

Compare Source

Patch Changes

v1.8.1

Compare Source

Patch Changes

v1.8.0

Compare Source

Minor Changes
  • ae2c9aa: Built with nightly Rust toolchain with panic=immediate-abort to reduce binary size
Patch Changes
WiseLibs/better-sqlite3 (better-sqlite3)

v12.10.1

Compare Source

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

eslint/eslint (eslint)

v10.5.0

Compare Source

capricorn86/happy-dom (happy-dom)

v20.10.3

Compare Source

motiondivision/motion-vue (motion-v)

v2.3.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
nuxt-modules/og-image (nuxt-og-image)

v6.6.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.5.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
harlan-zw/nuxt-schema-org (nuxt-schema-org)

v6.2.1

Compare Source

No significant changes

    View changes on GitHub

v6.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.1.3

Compare Source

compare changes

🚀 Enhancements
  • devtools: Ship devtools as a layer (#​123)
🩹 Fixes
  • Inline v2 schema-org copy to survive prod dependency trace (#​122)
  • Vendor @unhead/schema-org majors, drop npm-alias dep (#​126)
🏡 Chore
❤️ Contributors

v6.1.2

Compare Source

compare changes

🩹 Fixes
  • Prefer nitro unhead for schema-org vendor (#​121)
  • Serialize schema org identity config (#​120)
❤️ Contributors

v6.1.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
pnpm/pnpm (pnpm)

v11.6.0

Compare Source

Minor Changes
  • pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.

  • 615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:

    npm_config_//registry.npmjs.org/:_authToken=<token>
    pnpm_config_//registry.npmjs.org/:_authToken=<token>
    

    This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

  • Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
  • Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #​12324.
  • Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g. @nx/nx-win32-arm64-msvcos: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them #​11702.

v11.5.3

Compare Source

Patch Changes
  • Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from .npmrc, and in workspace registry URLs from pnpm-workspace.yaml. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config.

  • Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution.

  • Avoid writing packageManagerDependencies to pnpm-lock.yaml when package manager policy is set to onFail: ignore or pmOnFail: ignore #​12228.

  • Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest.

  • Using the $ version reference syntax in overrides (e.g. "react": "$react") now prints a deprecation warning. The syntax still works, but catalogs are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with the catalog: protocol instead.

  • Fixed pnpm config get globalconfig to return the global config.yaml path again pnpm/pnpm#11962.

  • Fixed bare --color so it does not consume the following CLI flag, allowing command shorthands like --parallel to expand correctly and forms like pnpm --color with current <command> to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.

  • Fix pnpm install ignoring enableGlobalVirtualStore toggle by including it in the workspace state settings check #​12142.

  • Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.

    This covers two paths that select an executable from repository-controlled input:

    • pacquet install engine — declaring pacquet (or @pnpm/pacquet) in configDependencies opts in to pnpm's Rust install engine. pnpm now verifies that the installed pacquet shim and the host's @pacquet/<platform>-<arch> binary carry a valid npm registry signature for their exact name@version, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.
    • automatic version switch / self-update — the packageManager / devEngines.packageManager field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of pnpm, @pnpm/exe, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command.

    In both cases the signature is verified over the installed integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint.

  • Made peer-dependent deduplication deterministic. When a peer-suffixed package variant was a subset of two or more mutually incompatible larger variants, the variant it collapsed into depended on the order importers were resolved in, which varies between machines. This could resolve the same workspace to different lockfiles on different platforms and make pnpm dedupe --check alternate between passing and failing.

  • Reject invalid package names and versions from staged tarball manifests before deriving filenames for pnpm stage download.

  • Clarified in CLI help that the pnpm store is trusted shared state and store integrity checks are corruption detection, not a tamper boundary for untrusted store writers.

  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.

  • Require trusted package identity before package-name allowBuilds entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the allowBuilds key. Lockfile verification now rejects lockfiles where a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.

  • Security: pnpm now verifies the OpenPGP signature of a downloaded Node.js runtime's SHASUMS256.txt before trusting its integrity hashes.

    When a repository requests a Node.js runtime (e.g. via devEngines.runtime / useNodeVersion), the download mirror is repository-configurable through node-mirror:<channel>. The integrity of the downloaded binary was only checked against SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy by serving a tampered binary together with a matching SHASUMS256.txt. pnpm then executes the binary (for example to run lifecycle scripts).

    pnpm now fetches SHASUMS256.txt.sig and verifies the detached OpenPGP signature against the Node.js release team's public keys, which ship embedded in the pnpm CLI. A mirror that serves a tampered binary cannot also produce a valid signature, so the download fails to verify. The embedded keys are kept current by a release-time check against the canonical nodejs/release-keys list.

    The musl variants from the hardcoded unofficial-builds.nodejs.org mirror are not repository-configurable and are signed by a different key, so they continue to be trusted over TLS.

prettier/prettier (prettier)

v3.8.4

Compare Source

vuejs/core (vue)

v3.5.38

Compare Source

v3.5.37

Compare Source

v3.5.36

Compare Source

Bug Fixes
vuejs/language-tools (vue-component-meta)

v3.3.5

Compare Source

language-core

v3.3.4

Compare Source

language-core
  • fix: only exclude already-set props from inherited attrs when checkRequiredFallthroughAttributes is enabled (#​6088) - Thanks to @​KazariEX!
  • fix: camelize slot props regardless of htmlAttributes option (#​6089) - Thanks to @​KazariEX!
  • fix: detect duplicate event listeners across name formats (#​6094) - Thanks to @​whysopaul!
language-service
typescript-plugin

Configuration

📅 Schedule: (in timezone Europe/Paris)

  • Branch creation
    • Between 06:00 AM and 09:59 AM, only on Monday (* 6-9 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from benjamincanac as a code owner June 15, 2026 07:29
@github-actions github-actions Bot added the v4 #4488 label Jun 15, 2026
@socket-security

socket-security Bot commented Jun 15, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@nuxt/eslint-config@1.16.0npm/@typescript-eslint/eslint-plugin@8.61.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm better-sqlite3 is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: docs/package.jsonnpm/better-sqlite3@12.10.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/better-sqlite3@12.10.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm eslint-plugin-jsdoc is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@nuxt/eslint-config@1.16.0npm/eslint-plugin-jsdoc@63.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-jsdoc@63.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm happy-dom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.jsonnpm/happy-dom@20.10.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@pkg-pr-new

pkg-pr-new Bot commented Jun 15, 2026

Copy link
Copy Markdown
npm i https://pkg.pr.new/@nuxt/ui@6592

commit: bb3a751

@benjamincanac benjamincanac merged commit 7e35950 into v4 Jun 15, 2026
23 checks passed
@benjamincanac benjamincanac deleted the renovate/all-minor-patch branch June 15, 2026 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v4 #4488

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant