fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@arborium/arborium (source)	^2.12.4 → ^2.13.0			dependencies	minor
@types/node (source)	^24.10.11 → ^24.10.13			devDependencies	patch
hono (source)	^4.11.8 → ^4.11.9			devDependencies	patch
node (source)	24.13.0 → 24.13.1				patch
pnpm (source)	10.28.2+sha512.41872f037ad22f7348e3b1debbaf7e867cfd448f2726d9cf74c08f19507c31d2c8e7a11525b983febc2df640b5438dee6023ebb1f84ed43cc2d654d2bc326264 → 10.29.3			packageManager	minor
typescript-eslint (source)	^8.54.0 → ^8.55.0			devDependencies	minor
vite-tsconfig-paths	^6.0.5 → ^6.1.1			devDependencies	minor

---

Release Notes

bearcove/arborium (@​arborium/arborium)

v2.13.0

Compare Source

honojs/hono (hono)

v4.11.9

Compare Source

nodejs/node (node)

v24.13.1

Compare Source

pnpm/pnpm (pnpm)

v10.29.3

Compare Source

v10.29.2

Compare Source

v10.29.1: pnpm 10.29.1

Compare Source

Minor Changes

• The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
• Support configuring auditLevel in the pnpm-workspace.yaml file #​10540.
• Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #​10436.

Patch Changes

• Fixed pnpm list --json returning incorrect paths when using global virtual store #​10187.

• Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #​10290.

• Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #​10497.

• Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #​10176.

• Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #​10281.

• Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #​10460.

• Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #​10540.

• update tar to version 7.5.7 to fix security issue

  Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842

• Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #​10325.

• Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #​10271.

• pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #​10561.

• Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #​10457.

Platinum Sponsors

Gold Sponsors

typescript-eslint/typescript-eslint (typescript-eslint)

v8.55.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

aleclarson/vite-tsconfig-paths (vite-tsconfig-paths)

v6.1.1

Compare Source

v6.1.0

Compare Source

Features

• New importerFilter option: Provides fine-grained control over which files should have their imports resolved by this plugin. (Closes #​175, #​193)
• Ignore .d.ts overrides: The plugin now ignores resolutions that point to .d.ts files, avoiding issues when tsconfig is used for opt-in type overrides. (Closes #​179, #​180)

Performance

• Hoisted regular expressions out of the hot path in the resolver for better performance.

Internal

• Added resolvedToDeclarationFile event to the debug log file.

---

Configuration

📅 Schedule: Branch creation - "before 9am on saturday" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ghloc	Ready	Preview	Feb 14, 2026 1:53am