Repository navigation
chore(deps): update all non-major dependencies - #547
Merged
ghiscoding merged 1 commit intoOct 24, 2026
Merged
Conversation
renovate-bot
force-pushed
the
renovate/all-minor-patch
branch
10 times, most recently
from
October 23, 2026 23:10
8903e26 to
ecd680f
Compare
renovate-bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 24, 2026 00:17
ecd680f to
d816543
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^5.6.3→^5.6.4^5.6.3→^5.6.4^5.6.3→^5.6.4^1.64.0→^1.64.1^9.8.0→^9.9.0^9.0.3→^9.0.4^8.5.30→^8.5.31^1.105.1→^1.106.1^8.11.2→^8.12.3^8.3.4→^8.3.5Release Notes
lerna-lite/lerna-lite (@lerna-lite/cli)
v5.6.4Compare Source
Bug Fixes
lerna-lite/lerna-lite (@lerna-lite/publish)
v5.6.4Compare Source
Bug Fixes
lerna-lite/lerna-lite (@lerna-lite/watch)
v5.6.4Compare Source
Bug Fixes
microsoft/playwright (@playwright/test)
v1.64.1Compare Source
Bug Fixes
cssnano/cssnano (cssnano)
v9.9.0: v9.9.0Compare Source
What's Changed
cssnano now ships its presets and plugins in a single package, so installing it adds one cssnano package to your dependency tree instead of about thirty, and you have fewer packages to review in audits and lockfile updates.
preset: 'lite'andpreset: 'advanced'now work without installing another package. An installed preset package still takes precedence over the built-in one and prints a one-timeCSSNANO_INSTALLED_PRESETwarning; pass the imported preset function to keep it without the warning. Full names such ascssnano-preset-defaultfall back to the built-in preset when no package is installed. Projects that requirecssnano-preset-defaultdirectly must declare it as a dependency, or switch topreset: ['default', {...}].overridesandresolutionsthat pin an individual plugin no longer apply.bcomnes/npm-run-all2 (npm-run-all2)
v9.0.4Compare Source
Merged
#255#240#258#261#259#254#263#262#256#252#250#248#246#245Commits
9f54ec7b06eac4postcss/postcss (postcss)
v8.5.31Compare Source
</style>escaping (by @firefoxic).sass/dart-sass (sass)
v1.106.1Compare Source
Fix a bug where an attribute selector with an empty value (such as
[class=""]) would crash when serializing.Don't crash when serializing a number with an empty unit. This is only
possible through the JavaScript and Dart APIs or the embedded protocol.
Embedded Dart Sass
PARAMSerrors.v1.106.0Compare Source
Don't normalize CSS escapes in statement contexts that can contain
interpolation. For example,
@f\6Fois now emitted as written rather thannormalized to
@foo.Fix a bug where quotes would be removed from attribute selector values that
contained backslashes.
Fix invalid source spans that could cause crashes when encountering a syntax
error in selectors or media queries that also contain escape sequences.
Fix a bug where the indented syntax parser would crash when parsing a file
where the first statement was indented and appeared after the first line.
Fix a bug that could cause crashes when encountering errors or warnings in
interpolations that contain patterns like
// */.Potentially breaking compatibility fix: CSS escape codes whose values are
0, for Unicode surrogates, or greater than the maximum allowed code point are
now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression
contexts. Previously, in some cases these were instead normalized to the
normalized form of the original escape sequence, which violates the principle
that all escape sequences for identical values should be normalized the same
way. In other cases, these would simply throw errors.
As a special case,
\0on its own will continue to be normalized to\0tosupport historical CSS hacks.
Potentially breaking bug fix: Throw an error for mixins and functions that
have rest parameters which are the same as normal parameters. Previously, the
positional parameters wouldn't be accessible and calling such a mixin or
function with a named argument would crash the compiler.
Potentially breaking bug fix: Fix various cases where using a CSS escape
code at the beginning of an identifier would change parsing behavior versus
using the character directly.
Potentially breaking bug fix: When a number's unit is ambiguous with a
numeric exponent, the unit is now serialized as an escape code rather than a
literal
eto avoid being interpreted as an exponent by CSS.Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN
CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in
@keyframespercentage selectors.Potentially breaking bug fix: Properly normalize underscores written as
CSS escape codes in variable, mixin, and function names.
v1.105.2Compare Source
Node.js Embedded Host
nodejs/undici (undici)
v8.12.3Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.12.2...v8.12.3
v8.12.2Compare Source
Security fixes
High severity
Denial of service via TLS 1.2 certificate-changing renegotiation
CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.
TLS certificate validation bypass through dropped
AgentoptionsCVE-2026-109383 · GHSA-2m5v-pch6-74hx
Agentused a JSON-based clone for constructor options, which silently removed function-valued TLS options such ascheckServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.Cache poisoning and cross-user disclosure through cross-origin redirects
CVE-2026-109829 · GHSA-4w7w-5xrc-9h26
When an originless
Agentcombined redirect and shared-cache interceptors ascompose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.Denial of service through excessive
Content-EncodingvaluesCVE-2026-109869 · GHSA-xjj6-f33q-929c
A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although
fetch()rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.Medium severity
Denial of service through the
decompressinterceptorCVE-2026-87029 · GHSA-55wc-3pg8-jfw6
An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when
decompresswas composed with a handler such asdumpwith a size limit. This release converts downstream handler exceptions into per-request errors.Subresource Integrity bypass with non-lowercase algorithm tokens
CVE-2026-109841 · GHSA-f72v-6w45-q472
fetch()treated valid mixed-case or uppercase SRI algorithm tokens, such asSHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.Denial of service through unbounded EventSource parser state
CVE-2026-109924 · GHSA-4qv8-2p9j-2685
A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny
data:fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.Denial of service through unbounded automatic WebSocket PONG buffering
CVE-2026-109932 · GHSA-9fm3-97px-rjf6
A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.
Full Changelog: nodejs/undici@v8.12.1...v8.12.2
v8.12.1Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.12.0...v8.12.1
v8.12.0Compare Source
What's Changed
.md->.htmlby @avivkeller in #5602New Contributors
Full Changelog: nodejs/undici@v8.11.2...v8.12.0
vitejs/vite (vite)
v8.3.5Compare Source
Bug Fixes
server.originto asset URLs (#23683) (52ba877)import.meta.env.*defines in theimport.meta.envobject (#23713) (6019aa7)%inurl()(#23676) (50b382d)oxc.jsxInjectimports (#23758) (38f3cb4)#(#23631) (0d86b34)Performance Improvements
Miscellaneous Chores
Code Refactoring
@vercel/detect-agentwithstd-env(#23744) (ce4293f)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.