Skip to content

Update all non-major dependencies - #100

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch
Open

Update all non-major dependencies#100
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@opennextjs/cloudflare (source) ^1.20.1 → ^1.20.4 age confidence
@tailwindcss/postcss (source) ^4.3.2 → ^4.3.3 age confidence
@types/node (source) ^25.9.4 → ^25.9.5 age confidence
@types/react (source) ^19.2.17 → ^19.2.18 age confidence
@types/react-dom (source) ^19.2.3 → ^19.2.5 age confidence
eslint (source) ^9.39.4 → ^9.39.5 age confidence
eslint-config-next (source) 16.2.10 → 16.3.3 age confidence
lucide-react (source) ^1.23.0 → ^1.35.0 age confidence
pnpm (source) 11.9.0 → 11.24.0 age confidence
prettier (source) ^3.9.4 → ^3.9.6 age confidence
prettier-plugin-tailwindcss ^0.8.0 → ^0.8.1 age confidence
radix-ui (source) ^1.6.1 → ^1.6.7 age confidence
react (source) ^19.2.7 → ^19.2.8 age confidence
react-dom (source) ^19.2.7 → ^19.2.8 age confidence
shadcn (source) ^4.13.0 → ^4.19.0 age confidence
sharp (source, changelog) ^0.35.3 → ^0.35.4 age confidence
tailwindcss (source) ^4.3.2 → ^4.3.3 age confidence
wrangler (source) ^4.107.0 → ^4.127.1 age confidence

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

opennextjs/opennextjs-cloudflare (@​opennextjs/cloudflare)

v1.20.4

Compare Source

Patch Changes

v1.20.3

Compare Source

Patch Changes

  • #​1361 8c31fbc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.1

    See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1

  • #​1359 65e4487 Thanks @​vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3

  • #​1359 65e4487 Thanks @​vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks

    Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and
    loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to
    resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks
    instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and
    WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.

    Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at
    runtime, most visibly breaking Prisma with the workerd client runtime.

    The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js
    middleware bundles.

  • #​1309 56dfacc Thanks @​ScienHAC! - feature: support Node.js middleware (proxy.ts)

    Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.

    The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs:
    the OpenNext config manifests are inlined at build time (as for the edge middleware) and the
    middleware compiled by Next.js is statically bundled instead of being loaded from the
    filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).

    The support is experimental and requires the nodejs_compat compatibility flag.

  • #​1359 65e4487 Thanks @​vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle

    Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware
    does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js.
    workerd does not support dynamic requires so every request handled by the Node.js middleware
    (proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.

    The guard Next.js uses (process.env.NEXT_RUNTIME !== "edge") is inlined by Next.js when it
    compiles the middleware, so it can not be eliminated when the middleware is re-bundled. The loader
    is stubbed out instead, which matches the edge runtime behaviour: the server function - which
    shares the isolate - keeps registering the hook.

v1.20.2

Compare Source

Patch Changes

  • #​1312 38ea40b Thanks @​james-elicx! - fix: handle encoded middleware and cache paths safely

    Upgrade @opennextjs/aws to prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.

  • #​1313 766eee9 Thanks @​james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11

  • #​1306 97ef330 Thanks @​james-elicx! - fix: normalize Windows paths when patching the Turbopack runtime

    Ensure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.3

Compare Source

Fixed
  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)
eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

Documentation

Chores

  • 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
  • 202117b chore: package.json update for @​eslint/js release (Jenkins)
  • d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
  • 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
  • daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
  • daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
  • 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)
vercel/next.js (eslint-config-next)

v16.3.3

Compare Source

v16.3.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • [backport] Scope app-entry export validation to files inside the app directory (#​97357)
  • [backport] Fix catch-all index page being served for every other slug (#​97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#​97353) (#​97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#​97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#​97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#​97603)
Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

Compare Source

v16.3.0

Compare Source

v16.2.12

Compare Source

v16.2.11

Compare Source

lucide-icons/lucide (lucide-react)

v1.35.0: Version 1.35.0

Compare Source

What's Changed
New Contributors

Full Changelog: lucide-icons/lucide@1.34.0...1.35.0

v1.34.0: Version 1.34.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.33.0...1.34.0

v1.33.0: Version 1.33.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

v1.32.0: Version 1.32.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.31.0...1.32.0

v1.31.0

Compare Source

v1.30.0

Compare Source

v1.29.0: Version 1.29.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.28.0...1.29.0

v1.28.0

Compare Source

v1.27.0: Version 1.27.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

v1.26.0

Compare Source

v1.25.0

Compare Source

v1.24.0: Version 1.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.23.0...1.24.0

pnpm/pnpm (pnpm)

v11.24.0: pnpm 11.24

Compare Source

Minor Changes
Patch Changes

  • Fixed pnpm v11 incorrectly reporting confirmModulesPurge as unrecognized when set in pnpm-workspace.yaml. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting.

  • pnpm install --frozen-lockfile no longer fails with ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE when the pinned pnpm version recorded in pnpm-lock.yaml has to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged #​14124.

  • Under nodeLinker: hoisted, peer-resolution variants of an injected directory dependency (a file: snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this.

  • Fixed pnpm install --merge-git-branch-lockfiles --frozen-lockfile failing with ERR_PNPM_OUTDATED_LOCKFILE when a branch lockfile predates the removal of a dependency, or its move to another dependency group #​13966. A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it.

  • Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the publish and postpublish scripts after each completed registry group pnpm/pnpm#14101.

  • The Rust CLI now honors five settings it recognized but ignored: updateNotifier, legacyDirFiltering, initAuthorName / initAuthorEmail / initAuthorUrl, initLicense, and initVersion. pnpm install and pnpm add check once a day for a newer pnpm and print how to get it (turn it off with updateNotifier: false); a {<dir>} filter selector can go back to matching the subtree below the directory with legacyDirFiltering: true; and pnpm init writes the configured author, license, and version into the package.json it scaffolds. PNPM_CONFIG_INIT_VERSION is now read as well.

    maxsockets, npm's spelling of maxSockets, is no longer ignored: both spellings are read from pnpm-workspace.yaml, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently.

    A lastUpdateCheck timestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around.

    legacyDirFiltering no longer reaches the workspace-root selectors pnpm generates for itself: the !{<workspace-root>} exclusion a recursive run / exec / add / test appends, and the {<workspace-root>} inclusion --workspace-root appends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and --workspace-root pulled in every project below the root instead of the root alone #​14101.

  • pnpm install --frozen-lockfile no longer fails when pnpm-lock.yaml records the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block #​14124.

v11.23.0: pnpm 11.23

Compare Source

Minor Changes

  • pnpm config get and pnpm config list now show the settings pnpm acts on under their documented names:

    • registries shows the registries pnpm resolves from, merged across every source (.npmrc, pnpm-workspace.yaml, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare @ scope. Built-in routes are included — the @jsr scope and the npmjs and gh prefixes — unless pointed elsewhere. Previously pnpm config get registries printed undefined.
    • update and audit show the effective sections, whichever spelling set them. The deprecated internal spellings (updateConfig, auditConfig, auditLevel) are no longer listed.
    • catalogs shows the complete resolved catalog set — the singular catalog block is its default entry — whichever spelling declared it.
    • The registry and @scope:registry entries show the merged routes rather than raw .npmrc values, so they always agree with the registries view.

  • Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level pnpm-workspace.yaml (where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example, globalShims is a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project's pnpm-workspace.yaml, previously ignored silently, are now reported the same way. pnpm config get <key> and pnpm get <key> no longer print config-load warnings, so a script capturing the value gets the value alone.

  • The importPackage pnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on #​14101.

  • node_modules/.modules.yaml no longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it.

    It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use: pnpm list, pnpm why, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one.

    They now use the configured registries, like every other command already did.

  • When enableGlobalVirtualStore is on, every process pnpm spawns for the project (pnpm run, pnpm exec, lifecycle scripts) now receives a NODE_PATH pointing at the project's hoisted node_modules, plus a NODE_OPTIONS --import flag that registers a resolve hook restoring NODE_PATH lookups for ESM imports. Dependencies that import undeclared ("phantom") packages keep resolving under the global virtual store — for both CommonJS and ESM — without installing the @pnpm/plugin-esm-node-path config dependency pnpm/pnpm#9618. Tools run by pnpm dlx resolve such dependencies too: the JS CLI passes them the same environment, while the Rust CLI's dlx cache is self-contained, so its layout already exposes them.

  • A registry can now declare that its abbreviated metadata carries the time field, so resolutionMode: time-based reads the full metadata document only from the registries that need it:

    resolutionMode: time-based
registries:
  https://npm.internal.example/:
    supportsTimeField: true

    registry.npmjs.org omits time from abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing: registrySupportsTimeField answered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed a time field npmjs does not serve. The answer is now per registry, and registrySupportsTimeField remains the answer for every registry that does not declare one.

    The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf.

  • A pnpr resolve request now carries the client's registries the way the registries setting declares them — keyed by URL, with the scopes routed to each, the bare-specifier prefix each answers to, and each one's serverType — in place of the prefix map it used to send.

    The server routes them through the same inversion the config reader runs, so a pnpr-served install resolves a scoped dependency from the registry that scope is routed to, which it previously could not: only the default registry and the prefix-addressed ones reached the server. A declared serverType reaches it too, so the tarball URLs pnpr omits from the lockfile match the ones the client reconstructs.

    Built-in scope routes the project has not pointed elsewhere are not declared, so a pnpr server's allowlist is not asked about npm.jsr.io on requests that resolve no JSR package.

    A registry a request only declares is no longer refused up front for being off the server's allowlist — a client describes its whole configuration, including scopes a given resolve never reaches, so a stray @scope:registry in a developer's ~/.npmrc no longer fails every install against a pnpr server that does not serve it. The boundary moves to the fetch itself: an origin the resolve does reach is refused before the request leaves the server, with the same message.

    This changes the resolve and verify-lockfile request bodies. A pnpr server and its clients have to be on matching versions; the protocol is still experimental and unversioned.

  • The registries setting now declares a registry once, keyed by its URL, with everything about that registry in the entry: how it lays out tarball URLs, the scopes routed to it, and the bare-specifier prefix it answers to.

    registries:
  https://artifactory.example.com/artifactory/api/npm/npm-virtual/:
    serverType: artifactory
    scopes: ['@acme', '@acme-internal']
    prefix: work
    • serverType tells pnpm how the registry lays out its tarball URLs, which decides whether a URL can be omitted from pnpm-lock.yaml:
      • undeclared (the default) — strict. Only the exact canonical URL is treated as reconstructible.
      • npm — the registry behaves like registry.npmjs.org, which also serves a scoped package from its percent-encoded path. Declare this for a faithful mirror or caching proxy of the public registry so its tarball URLs can be omitted too.
      • artifactory — JFrog Artifactory repeats the scope in a scoped package's tarball filename (@acme/widget/-/@acme/widget-1.0.0.tgz) where the npm registry strips it (@acme/widget/-/widget-1.0.0.tgz). Declaring it lets pnpm rebuild that URL, so it is omitted from pnpm-lock.yaml instead of being written out for every scoped package pnpm/get-npm-tarball-url#16.
    • scopes lists the @-prefixed scopes that resolve from this registry. A bare '@' is the scope-less default registry, the one the registry setting names.
    • prefix is the alias a dependency addresses this registry by, as in "foo": "work:^1.0.0".

    The layout is never inferred from the registry URL, so nothing cha

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Only on Monday (* * * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 19e7350 to df98e40 Compare July 20, 2026 22:13
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from fe87f48 to 2a5669b Compare August 3, 2026 01:07
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 8095390 to c919cca Compare August 10, 2026 01:50
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 2b6e31f to 4cc5d78 Compare August 17, 2026 01:44
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 4099950 to 4ab9133 Compare August 31, 2026 01:44
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 4ab9133 to abc1c13 Compare August 31, 2026 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants