Skip to content

fix(deps): update all non-major dependencies#140

Merged
chenjiahan merged 1 commit into
mainfrom
renovate/all-minor-patch
May 22, 2026
Merged

fix(deps): update all non-major dependencies#140
chenjiahan merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 22, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@coreui/react (source) ^5.10.0 → ^5.11.0 age confidence
@rsbuild/core (source) 2.0.6 → 2.0.7 age confidence
@rspack/cli (source) 2.0.3 → 2.0.4 age confidence
@rspack/core (source) 2.0.3 → 2.0.4 age confidence
@tanstack/react-query (source) ^5.100.10 → ^5.100.11 age confidence
@types/react (source) ^19.2.14 → ^19.2.15 age confidence
antd (source) ^6.4.2 → ^6.4.3 age confidence
date-fns ^4.1.0 → ^4.2.1 age confidence
framer-motion ^12.38.0 → ^12.39.0 age confidence
pnpm (source) 11.1.2 → 11.2.1 age confidence
postcss (source) ^8.5.14 → ^8.5.15 age confidence
preact (source) ^10.29.1 → ^10.29.2 age confidence
rolldown (source) ^1.0.1 → ^1.0.2 age confidence
styled-components (source) ^6.4.1 → ^6.4.2 age confidence
vue-i18n (source) ^11.4.2 → ^11.4.4 age confidence
webpack ^5.106.2 → ^5.107.0 age confidence

Release Notes

coreui/coreui-react (@​coreui/react)

v5.11.0

Compare Source

Full Changelog: coreui/coreui-react@v5.10.0...v5.11.0

web-infra-dev/rsbuild (@​rsbuild/core)

v2.0.7

Compare Source

Highlights

Web Worker Query Imports

Rsbuild now supports importing worker scripts with ?worker, ?worker&inline, and ?inline&worker:

import MyWorker from './worker.ts?worker';
import InlineWorker from './worker.ts?worker&inline';

const worker = new MyWorker();
const inlineWorker = new InlineWorker({ name: 'inline-worker' });
Automatic Dependency Externalization

output.autoExternal reads dependencies from the root package.json and generates output.externals rules for matching packages and subpath imports. This is useful for Node.js and SSR bundles where runtime dependencies should stay external.

export default {
  output: {
    target: 'node',
    autoExternal: true,
  },
};

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rsbuild@v2.0.6...v2.0.7

web-infra-dev/rspack (@​rspack/cli)

v2.0.4

Compare Source

Highlights 💡

  • Inline const with module declarations (#​14032): Previously, Rspack only inlined constant exports from leaf modules in the module graph. Now constant exports from any module can be inlined, even when that module also imports or re-exports other modules. In rare circular-reference cases this can make a TDZ error disappear, but we do not expect real projects to rely on TDZ errors, so Rspack prioritizes the optimization.

    // constants.js
import './setup';

export const ENABLE_EXPERIMENT = false;

// entry.js
import { ENABLE_EXPERIMENT } from './constants';

if (ENABLE_EXPERIMENT) {
  runExperiment();
}

// Before: constants.js is not a leaf module, so the branch could keep
// reading the imported binding.
if (ENABLE_EXPERIMENT) {
  runExperiment();
}

// Now: the constant can still be inlined, so dead branches are easier
// to remove.
if (false) {
  runExperiment();
}

  • Tree shake namespace default reexport (#​13980): Previously, the import * as a from './a'; export default a; pattern did not tree-shake a through the default export. Now Rspack further analyzes the default-exported namespace object and can remove unused exports from the original namespace module.

    // a.js
export function used() {}
export function unused() {}

// bridge.js
import * as a from './a';
export default a;

// app.js
import a from './bridge';

a.used();

// Before: both used and unused could be kept in the bundle.
// Now: unused can be tree-shaken.

  • CSS global module type (#​13988): css/global is useful when most selectors in a stylesheet should stay global, but you still want CSS Modules features for selected local selectors. This makes it easier to migrate existing global CSS gradually without turning every class name into a local scoped name.

    export default {
  module: {
    rules: [{ test: /\.global\.css$/i, type: 'css/global' }],
  },
};
    /* style.global.css */
.button {
  color: red;
}

:local(.title) {
  font-weight: 600;
}

    .button stays global, while .title is renamed as a local class.

  • CSS Modules local ident options (#​14009): CSS Modules now support local ident hash options such as hash function, digest, digest length, and salt. These options make generated class names more configurable and better aligned with webpack-compatible CSS Modules setups.

    export default {
  module: {
    rules: [{ test: /\.module\.css$/i, type: 'css/module' }],
    generator: {
      'css/module': {
        localIdentName: '[name]__[local]__[hash]',
        localIdentHashFunction: 'xxhash64',
        localIdentHashDigest: 'hex',
        localIdentHashDigestLength: 8,
        localIdentHashSalt: 'my-salt',
      },
    },
  },
};

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rspack@v2.0.3...v2.0.4

TanStack/query (@​tanstack/react-query)

v5.100.11

Patch Changes
ant-design/ant-design (antd)

v6.4.3

Compare Source

  • 🐞 Fix DatePicker RangePicker empty placeholder when locale only defines singular *Placeholder fields. #​58020 @​yogeshwaran-c
  • 🐞 Fix Result rendering an empty title element when the title prop is not provided. #​58028 @​yogeshwaran-c
  • 🐞 Fix Select search input font size and line-height rendering issue in Safari. #​57990 @​QDyanbing
  • 🐞 Fix strict ESM build errors caused by deep @rc-component/util runtime imports in Form, Input, Button and other components. #​57993 @​li-jia-nan
  • 🐞 Fix Transfer filteredItems not updating when filterOption or direction changes. #​58004 @​afc163
  • ⚡️ Improve Table and Mentions performance by reducing redundant array iterations. #​58006 @​ug-hero
  • Table
    • 🛠 Rename Table filter types FilterRestProps to FilterResetProps, with a deprecated alias kept for compatibility. #​57985 @​ZQDesigned
    • ⚡️ Improve Table row selection performance by using Set-based lookup instead of O(n*m) .includes() checks. #​58004 @​afc163
  • 🐞 修复 DatePicker RangePicker 在语言包仅定义单数形式 *Placeholder 时占位符为空的问题。#​58020 @​yogeshwaran-c
  • 🐞 修复 Result 未传入 title 属性时仍会渲染空的标题元素的问题。#​58028 @​yogeshwaran-c
  • 🐞 修复 Select 搜索输入框在 Safari 下字号和行高渲染异常的问题。#​57990 @​QDyanbing
  • 🐞 修复 Form、Input、Button 等组件在严格 ESM 构建链路下因 @rc-component/util 运行时深层导入导致的构建报错。#​57993 @​li-jia-nan
  • 🐞 修复 Transfer 在 filterOption 或 direction 变化时 filteredItems 不更新的问题。#​58004 @​afc163
  • ⚡️ 优化 Table 和 Mentions 性能，减少冗余的数组迭代操作。#​58006 @​ug-hero
  • Table
    • 🛠 Table 过滤类型将 FilterRestProps 更正为 FilterResetProps，并保留 deprecated 别名以兼容存量引用。#​57985 @​ZQDesigned
    • ⚡️ 优化 Table 行选择性能，使用 Set 查找替代 O(n*m) 的 .includes() 判断。#​58004 @​afc163
date-fns/date-fns (date-fns)

v4.2.1

Compare Source

Fixed
  • Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

Compare Source

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed
  • Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.
motiondivision/motion (framer-motion)

v12.39.0

Compare Source

Added
  • Support for repeatType and repeatDelay in animation sequences.
Fixed
  • Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.
  • Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so dragSnapToOrigin no longer leaves the drag transform stranded after a layout swap.
  • LazyMotion: Share React contexts between the framer-motion and framer-motion/m (and therefore motion/react and motion/react-m) CJS bundles so that <m.div> from the /m subpath picks up features loaded by <LazyMotion> from the main entry point.
  • useScroll: Support hydrating target and container refs from anywhere in the tree.
  • Drag: Gesture no longer starts from incorrect start point when rendered inside <AnimatePresence initial={false} />.
  • Drag: dragConstraints, when set as viewport-relative ref, no longer break on scroll.§
  • Updated visualElement hydration order.
  • useAnimate: Now respects skipAnimations.
  • AnimatePresence: Fix object-form initial values not applied on re-entry after exit completes.
  • scroll: Fixed callback progress when tracking an element.
  • useScroll: Fix hardware acceleration when tracking an element.
pnpm/pnpm (pnpm)

v11.2.1

Compare Source

Patch Changes
  • Mark optional subdependency snapshots of config dependencies with optional: true in the env lockfile, matching how optional dependencies are recorded elsewhere in pnpm-lock.yaml. Previously, snapshots for the platform-specific subdeps pulled in via a config dep's optionalDependencies were written as empty objects, which was inconsistent with the rest of the lockfile and made it look like those non-host platform variants were required.
  • Fix pickRegistryForPackage returning the wrong registry for an unscoped npm: alias under a scoped local name. A manifest entry like "@&#8203;private/foo": "npm:lodash@^1" was routing the lodash fetch through registries["@&#8203;private"], even though lodash is unscoped and doesn't live on that registry. The npm-alias branch now returns the alias target's own scope (or null for an unscoped target, falling through to registries.default) instead of leaking into the local key's scope.
  • Don't print "Installing config dependencies..." when config dependencies are already installed and nothing needs to be fetched, re-linked, or removed.

v11.2.0

Compare Source

Minor Changes

  • Experimental: Adding @pnpm/pacquet (the Rust port of pnpm) to configDependencies in pnpm-workspace.yaml now delegates the materialization phase of pnpm install to the pacquet binary. pnpm still owns dependency resolution; pacquet only fetches and imports from the freshly-written lockfile. This is an opt-in preview of the Rust install engine #​11723.

    To configure pacquet in a project, run:

    pnpm add @&#8203;pnpm/pacquet --config

    You'll see changes in pnpm-workspace.yaml and pnpm-lock.yaml that should be committed. If you experience any issues with pacquet, please let us know by mentioning this in the GitHub issue you create.

  • configDependencies now resolve and install one level of optionalDependencies declared by the config dependency, with os/cpu/libc platform filtering applied at install time. This unlocks the esbuild/swc-style pattern where a package ships platform-specific binaries via optionalDependencies — a config dependency can now do the same and have the matching binary symlinked next to it in the global virtual store, so require('pkg-platform-arch') from inside the config dependency resolves correctly.

    The env lockfile records all platform variants regardless of host platform, so it remains portable across machines. Each entry in a config dependency's optionalDependencies must declare an exact version — ranges and tags are rejected to keep installs reproducible.

  • Implement the documented pnpm login --scope <scope> flag. The scope is normalized (a leading @ is added if missing; blank values are ignored) and an @<scope>:registry=<registry> mapping is written to the pnpm auth file alongside the auth token. Subsequent installs of @<scope>/* packages then route to the chosen registry. Previously pnpm login --scope foo errored with Unknown option: 'scope' despite the flag being listed in the online documentation #​11716.

  • pnpm outdated and pnpm update --interactive now report Node.js, Deno, and Bun runtimes installed as project dependencies (runtime: specifiers). Previously these were silently skipped.

Patch Changes

  • Fix cafile=<relative-path> in .npmrc being read from the wrong directory when pnpm is invoked from a different cwd (e.g. pnpm --dir <project> install from a CI wrapper or monorepo script). The path is now resolved against the directory of the .npmrc that declared it, not process.cwd(). Before this fix the CA file silently failed to load — the install proceeded without the configured CA and the user only saw TLS errors against a private registry, with no log line tying back to the wrongly resolved path #​11624.

  • Fix config.registry getting a trailing slash appended when registry is set in .npmrc and no registries.default is provided by pnpm-workspace.yaml. The sync from registries.default to config.registry introduced in #​11744 now only fires when the workspace manifest actually contributes a different default.

  • Fix global add/update to handle minimumReleaseAge policy violations instead of surfacing an internal resolver guardrail error.

  • Fix two crashes with injectWorkspacePackages: true when the lockfile has been pruned (e.g. by turbo prune --docker):

    • Cannot use 'in' operator to search for 'directory' in undefined: a peer-dependency-variant injected snapshot inherits its resolution from the base packages: entry; when a pruner drops that base entry the readers crash. convertToLockfileObject now reconstructs the directory resolution from the file: depPath at load time — a single normalization point, so every reader sees a fully-formed snapshot.
    • ERR_PNPM_ENOENT on node_modules/.bin/<tool>: after prepare/postinstall, runLifecycleHooksConcurrently re-imported each injected workspace package; the scanDir-into-filesMap workaround fed target-internal paths to the importer, which the makeEmptyDir fast path (#​11088) then wiped. Drop the workaround and pass keepModulesDir: true so the importer preserves the target's existing node_modules (bin links + transitive deps) and source files keep their hardlinks.

  • Fixed pnpm login and pnpm logout ignoring registries.default from pnpm-workspace.yaml #​10099.

  • Fix the minimumReleaseAge (publishedBy) maturity shortcut to be inclusive at the cutoff. Previously, abbreviated metadata whose modified field equalled the cutoff fell off the fast path and triggered a full-metadata re-fetch (or a MISSING_TIME error when full metadata wasn't permitted). Since modified is an upper bound on every version's publish time, modified == publishedBy already implies every version passes the per-version <= filter in filterPkgMetadataByPublishDate, so the shortcut now accepts the boundary case directly. Strictly > (was >=) at the rejection branch.

  • Honor publishConfig.access when publishing packages.

v11.1.3

Compare Source

Patch Changes

  • pnpm install now re-validates pnpm-lock.yaml entries against the active minimumReleaseAge and trustPolicy: 'no-downgrade' policies before any tarball is fetched. Lockfiles resolved elsewhere (committed to the repo, restored from a CI cache, produced by an older pnpm) under a weaker or absent policy can no longer install a freshly-published or trust-downgraded version silently. Violating entries abort the install with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION, ERR_PNPM_TRUST_DOWNGRADE, or the generic ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION when both policies trip in the same batch; minimumReleaseAgeExclude and trustPolicyExclude are honored. Verification results are cached so repeat installs against an unchanged lockfile take a fast path, and pnpm shows a transient progress line while the registry round-trip runs.

    When fresh resolution picks an immature version, the behavior depends on minimumReleaseAgeStrict:

    • Loose mode — the default, in effect whenever minimumReleaseAge keeps its built-in 24-hour value — auto-adds the immature picks to minimumReleaseAgeExclude in pnpm-workspace.yaml and lets the install proceed. A single info message lists what was persisted.
    • Strict mode in an interactive terminal collects every immature direct AND transitive pick in one pass and prompts once with the full list. Approving adds them to minimumReleaseAgeExclude and the install continues; declining aborts before the lockfile, package.json, or node_modules is touched.
    • Strict mode in CI (or any non-TTY context) aborts with ERR_PNPM_NO_MATURE_MATCHING_VERSION listing every offending entry, instead of failing on the first one the resolver hit.

    minimumReleaseAgeStrict auto-enables whenever the user explicitly sets minimumReleaseAge (CLI flag, env var, global config.yaml, or pnpm-workspace.yaml); set minimumReleaseAgeStrict: false to keep loose-mode auto-collect even with an explicit minimumReleaseAge value. Closes #​10438, #​10488, #​11687.

  • Allow redundant trailing base64 padding in .npmrc auth values and report invalid auth base64 with a pnpm error.

  • Make pnpm self-update respect minimumReleaseAge (and minimumReleaseAgeExclude) when resolving which pnpm version to install.

    When the latest dist-tag points to a version newer than the configured age threshold, self-update now selects the newest mature version instead unless excluded by minimumReleaseAgeExclude.

    Also makes dlx and outdated surface invalid minimumReleaseAgeExclude patterns under the same ERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDE error code already used by install, instead of leaking the internal ERR_PNPM_INVALID_VERSION_UNION / ERR_PNPM_NAME_PATTERN_IN_VERSION_UNION codes.

  • Global installs respect global config build policy (e.g., dangerouslyAllowAllBuilds from config.yaml) when GVS is enabled #​9249.

    The global virtual-store (GVS) default allowBuilds = {} was applied before workspace manifest settings were read and before global config values (stripped by extractAndRemoveDependencyBuildOptions) were re-applied via globalDepsBuildConfig. This caused hasDependencyBuildOptions to return true (because {} is not null), blocking restoration of global config values like dangerouslyAllowAllBuilds. As a result, global installs skipped all build scripts even when the config explicitly allowed them.

    This fix moves the GVS default to after workspace manifest reading and globalDepsBuildConfig re-application, so that:

    1. Workspace manifest allowBuilds takes precedence (if present)
    2. Global config dangerouslyAllowAllBuilds is properly restored (if set and no workspace policy exists)
    3. Empty {} is only applied as a last resort when no policy is configured anywhere

  • Honor --silent when verifyDepsBeforeRun: install auto-installs dependencies before pnpm run or pnpm exec, preventing install output from being written to stdout #​11636.

  • Fix lockfile parsing failures when pnpm-lock.yaml contains CRLF line endings and multiple YAML documents #​11612.

  • Anchor the side-effects-cache key and global-virtual-store hash to the project's script-runner Node — engines.runtime pin when present, shell node otherwise — instead of pnpm's own runtime.

    ENGINE_NAME (the <platform>;<arch>;node<major> prefix used as the side-effects-cache key and the engine portion of the GVS hash) was computed from process.version — the Node that runs pnpm itself. That was wrong in two situations:

    1. @pnpm/exe SEA bundle. The bundle has its own embedded Node, not the node on the user's PATH that actually spawns lifecycle scripts. Two pnpm installations on the same machine (one SEA, one npm-package) therefore disagreed on the cache key, partitioning the side-effects cache and the global virtual store across two Node majors even though both installs would run scripts on the same shell node.
    2. engines.runtime / devEngines.runtime pin. When a project pins a Node version via devEngines.runtime (pnpm v11+), pnpm downloads that Node into node_modules/node/ and uses it to run lifecycle scripts. But the hash still anchored to whichever Node ran pnpm itself, not to the pinned Node — so two installs of the same project with two different runner Nodes would still disagree on the GVS slot path even though scripts run on the same pinned Node.

    Three changes:

    • @pnpm/engine.runtime.system-node-version now exports engineName(nodeVersion?). Resolves the version in this order: explicit override → getSystemNodeVersion() (which already prefers node --version over process.version in SEA contexts) → process.version.
    • @pnpm/deps.graph-hasher now exports findRuntimeNodeVersion(snapshotKeys) — scans an iterable of lockfile snapshot keys for a node@runtime:<version> entry and returns its bare version string. calcDepState and calcGraphNodeHash/iterateHashedGraphNodes accept a nodeVersion? (in the options bag for the first, as a trailing parameter / ctx field for the others), forwarded to engineName(). The default (no override) preserves the pre-change behaviour. The legacy ENGINE_NAME constant in @pnpm/constants is unchanged so external consumers and existing tests keep working; in non-SEA, non-pinned contexts every value lines up.
    • Every install-side caller of the graph-hasher (@pnpm/installing.deps-resolver, @pnpm/installing.deps-restorer, @pnpm/installing.deps-installer, @pnpm/building.during-install, @pnpm/building.after-install, @pnpm/deps.graph-builder) now derives the project's pinned runtime via findRuntimeNodeVersion(Object.keys(graph)) once per invocation and threads it through.

    On upgrade, two one-time GVS slot churns are possible:

    • SEA-pnpm users without a runtime pin: slots that previously hashed under the embedded-Node major (e.g. node26) now hash under the shell-Node major (e.g. node24), matching what pacquet, the npm-published pnpm package, and any other pnpm-compatible tool already produce.
    • Projects with a devEngines.runtime pin: slots that previously hashed under the runner's Node major now hash under the pinned Node major, matching what the lifecycle scripts will actually run on.

    In both cases the old slots become prune-eligible.

  • Resolve the GVS hash's engine portion per-snapshot when a dependency declares its own engines.runtime, instead of using an install-wide value.

    Pnpm's resolver desugars a dep's engines.runtime into dependencies.node: 'runtime:<version>', and the bin linker spawns that dep's lifecycle scripts through the pinned Node downloaded into <pkgDir>/node_modules/node/. The GVS hash and the side-effects-cache key prefix were still anchored to the install-wide runtime — so a pinning snapshot's slot encoded the wrong Node major, and a reinstall on the same host could read the cached side-effects under a key whose <platform>;<arch>;node<major> triple disagreed with the Node the build actually ran on.

    Per-snapshot resolution now matches what bins/linker already does on a per-package basis:

    • @pnpm/deps.graph-hasher adds readSnapshotRuntimePin(children) — reads the node entry from one snapshot's graph children and extracts the version from a node@runtime: value. Pairs with the existing findRuntimeNodeVersion(snapshotKeys) install-wide fallback (also now exported from @pnpm/deps.graph-hasher rather than @pnpm/engine.runtime.system-node-version, where it was a poor fit — system-node-version is about probing the host Node, not parsing lockfile-derived strings).
    • calcDepState and calcGraphNodeHash consult readSnapshotRuntimePin(graph[depPath].children) first and only fall back to the install-wide nodeVersion parameter when the snapshot doesn't pin its own Node.

    Pacquet mirrors the same precedence at the calc_graph_node_hash call site in package-manager/src/virtual_store_layout.rs — a new find_own_runtime_node_major(snapshot) helper reads each snapshot's dependencies for a node entry with Prefix::Runtime and overrides the install-wide engine when present.

    On upgrade, snapshots of dependencies that declare their own engines.runtime re-hash under that dep's pinned Node instead of the install-wide value. The old slots become prune-eligible. Closes #​11690.

  • Fixed pnpm publish failing with a 404 when authentication relied on OIDC trusted publishing alongside an .npmrc written by actions/setup-node (_authToken=${NODE_AUTH_TOKEN}) without NODE_AUTH_TOKEN being set. Unresolved ${VAR} placeholders in auth values are now treated as empty rather than passed through verbatim, so the literal placeholder no longer surfaces as a bearer token when OIDC fallback is the intended auth source #​11513.

  • Fix devEngines.packageManager (singular form, without onFail) defaulting to onFail: "error" instead of the documented pmOnFail: "download". As a result, a project that pinned a different pnpm version via devEngines.packageManager and ran pnpm install from a mismatched pnpm version failed with a hard error, even though the migration table from managePackageManagerVersions: true to pmOnFail: download (default) promises the install would auto-download the wanted version [#​11676](https://red

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@chenjiahan chenjiahan merged commit 9575952 into main May 22, 2026
7 of 10 checks passed
@chenjiahan chenjiahan deleted the renovate/all-minor-patch branch May 22, 2026 06:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chenjiahan chenjiahan chenjiahan approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chenjiahan