chore(deps): update all non-major dependencies #221

renovate · 2026-02-01T01:18:29Z

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/js (source)	`^9.39.1` → `^9.39.2`
@types/node (source)	`^22.19.1` → `^22.19.7`
@vitest/eslint-plugin	`^1.5.1` → `^1.6.6`
eslint (source)	`^9.39.1` → `^9.39.2`
pnpm (source)	`10.24.0` → `10.28.2`
prettier (source)	`^3.7.3` → `^3.8.1`
tsdown (source)	`^0.16.8` → `^0.20.1`
typescript-eslint (source)	`^8.48.0` → `^8.54.0`
vite (source)	`^7.2.4` → `^7.3.1`

Release Notes

eslint/eslint (@eslint/js)

`v9.39.2`

Compare Source

vitest-dev/eslint-plugin-vitest (@vitest/eslint-plugin)

`v1.6.6`

Compare Source

🚀 Features

Add require-test-timeout rule - by @hamirmahal in #863 (0829c)

View changes on GitHub

`v1.6.5`

Compare Source

🚀 Features

No-conditional-expect takes expect.assertions into account - by @vidarc in #840 (01f6d)

🐞 Bug Fixes

Treat vitest and vi the same - by @G-Rath in #851 (48aa6)
prefer-mock-return-shorthand:
- Ignore use of update expressions - by @G-Rath in #858 (da4b6)
- Ignore async implementations - by @G-Rath in #857 (1881e)
- Don't report mutable implementations - by @G-Rath in #1908 and #855 (9636a)

View changes on GitHub

What's Changed

refactor: apply prettier to whole codebase by @G-Rath in #853
fix: treat vitest and vi the same by @G-Rath in #851
test(unbound-method): port most of the test suite by @G-Rath in #850
chore: update eslint-remote-tester by @G-Rath in #859
fix(prefer-mock-return-shorthand): ignore use of update expressions by @G-Rath in #858
fix(prefer-mock-return-shorthand): ignore async implementations by @G-Rath in #857
fix(prefer-mock-return-shorthand): don't report mutable implementations by @G-Rath in #855
refactor: Require rule name in createTestingLibraryRule return type and use rule.name in tests by @y-hsgw in #860
feat: no-conditional-expect takes expect.assertions into account by @vidarc in #840
docs: put rule descriptions after title by @G-Rath in #861

New Contributors

@vidarc made their first contribution in #840

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.4...v1.6.5

`v1.6.4`

Compare Source

🚀 Features

Create new prefer-mock-return-shorthand rule - by @G-Rath in #848 (c0b72)

🐞 Bug Fixes

unbound-method: Ignore functions passed to vi.mocked - by @G-Rath in #849 (aa8af)

View changes on GitHub

What's Changed

docs(no-conditional-expect): add asymmetric matchers to example usage by @wjhsf in #847
fix(unbound-method): ignore functions passed to vi.mocked by @G-Rath in #849
feat: create new prefer-mock-return-shorthand rule by @G-Rath in #848

New Contributors

@wjhsf made their first contribution in #847

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.3...v1.6.4

`v1.6.3`

Compare Source

🚀 Features

Option to disable autofix of prefer-import-in-mock - by @nunomarks in #846 (3046a)

View changes on GitHub

What's Changed

feat: Option to disable autofix of prefer-import-in-mock by @nunomarks in #846

New Contributors

@nunomarks made their first contribution in #846

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.1...v1.6.2

`v1.6.1`

Compare Source

🐞 Bug Fixes

Treat test.extend results as test calls - by @y-hsgw in #843 (7a401)

View changes on GitHub

What's Changed

fix: Treat test.extend results as test calls by @y-hsgw in #843
New rule: prefer-to-have-been-called-times by @y-hsgw in #842
remove duplicate rules by @veritem in #844
remove patched package by @veritem in #845

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.5.4...v1.6.0

`v1.5.4`

Compare Source

No significant changes

View changes on GitHub

`v1.5.2`

Compare Source

🐞 Bug Fixes

Regression for valid-title and prefer-hooks-on-top when using test.scoped - by @y-hsgw in #836 (bdf8e)

View changes on GitHub

eslint/eslint (eslint)

`v9.39.2`

Compare Source

pnpm/pnpm (pnpm)

`v10.28.2`: pnpm 10.28.2

Compare Source

Patch Changes

Security fix: prevent path traversal in directories.bin field.
When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.
Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

Patch Changes

Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #10307.
Fix installation of Git dependencies using annotated tags #10335.

Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out commit hash didn't match the stored tag object hash.
Binaries of runtime engines (Node.js, Deno, Bun) are written to node_modules/.bin before lifecycle scripts (install, postinstall, prepare) are executed #10244.
Try to avoid making network calls with preferOffline #10334.

Platinum Sponsors

Gold Sponsors

`v10.26.1`: pnpm 10.26.1

Compare Source

Patch Changes

Don't fail on pnpm add, when blockExoticSubdeps is set to true #10324.
Always resolve git references to full commits and ensure HEAD points to the commit after checkout #10310.

Platinum Sponsors

Gold Sponsors

`v10.26.0`

Compare Source

`v10.25.0`

Compare Source

prettier/prettier (prettier)

`v3.8.1`

Compare Source

`v3.8.0`

Compare Source

diff

🔗 Release note

`v3.7.4`

Compare Source

diff

LWC: Avoid quote around interpolations (#18383 by @kovsu)

<!-- Input -->
<div foo={bar}>   </div>

<!-- Prettier 3.7.3 (--embedded-language-formatting off) -->
<div foo="{bar}"></div>

<!-- Prettier 3.7.4 (--embedded-language-formatting off) -->
<div foo={bar}></div>

TypeScript: Fix comment inside union type gets duplicated (#18393 by @fisker)

// Input
type Foo = (/** comment */ a | b) | c;

// Prettier 3.7.3
type Foo = /** comment */ (/** comment */ a | b) | c;

// Prettier 3.7.4
type Foo = /** comment */ (a | b) | c;

TypeScript: Fix unstable comment print in union type comments (#18395 by @fisker)

// Input
type X = (A | B) & (
  // comment
  A | B
);

// Prettier 3.7.3 (first format)
type X = (A | B) &
  (// comment
  A | B);

// Prettier 3.7.3 (second format)
type X = (
  | A
  | B // comment
) &
  (A | B);

// Prettier 3.7.4
type X = (A | B) &
  // comment
  (A | B);

rolldown/tsdown (tsdown)

`v0.20.1`

Compare Source

🚀 Features

inline-only: Show warnings if bundled deps - by @sxzz (1e0e7)

View changes on GitHub

`v0.20.0`

Compare Source

🚨 Breaking Changes

Upgrade dts plugin, remove dts.resolve option - by @sxzz (16655)

🚀 Features

Add option to disable legacy CJS warning - by @sxzz (9fada)
Apply inlineOnly option for dts files - by @sxzz (7d89d)
Upgrade rolldown to 1.0.0-beta.60 - by @sxzz (bb3ee)
Upgrade rolldown to rc 1 - by @sxzz (1959f)
entry: Support mixed array and object entries - by @sxzz (a8083)

🐞 Bug Fixes

Optional parseEnv - by @sxzz (be1b6)
Reload config on restart - by @sxzz (1756b)
Config extensions typo - by @aryaemami59 in #722 (d2bb7)
windows: Normalize path separators in build output - by @ryuapp in #719 (c4525)

🏎 Performance

Native filter for external plugin - by @sxzz (8764e)

View changes on GitHub

`v0.19.0`

Compare Source

🚨 Breaking Changes

Rename debugLogs to debug - by @sxzz (bb4e7)
Remove deprecated silent option - by @sxzz (59015)
devtools:
- Rename debug to devtools, rename debug.devtools to devtools.ui - by @sxzz (63e6f)
exports:
- Add legacy option, remove main & module fields if pure ESM - by @sxzz (16841)
- Exclude extension name for exports.exclude - by @sxzz (53d38)
- Only auto-fill types when exports.legacy - by @lishaduck and @sxzz in #685 (7be6b)

🚀 Features

Add typeAssert util back - by @sxzz (1d385)
Generate CSS exports when css.splitting is disabled - by @jinghaihan and @sxzz in #680 (b737c)
Upgrade rolldown to 1.0.0-beta.58 - by @sxzz (48036)
Expose enableDebug - by @sxzz (2d922)
Expose resolveUserConfig - by @sxzz (c9acb)
Upgrade rolldown to 1.0.0-beta.59 - by @sxzz (d564f)
Clear console on rebuild start - by @sxzz (78efd)
migrate: Add monorepo support - by @lauigi and @sxzz in #659 (efba2)

🐞 Bug Fixes

Print blank line only when the log level is info - by @tomgao365 in #689 (96d82)
attw: Add --ignore-scripts to avoid lifecycle output - by @Doctor-wu in #661 (1c8b1)
cjs: Update version check for require ESM support - by @sxzz (beeff)

🏎 Performance

Optimize hot paths - by @sxzz (7925d)

View changes on GitHub

`v0.18.4`

Compare Source

🚀 Features

Export mergeConfig - by @sxzz (ccd17)
Warn deprecated removeNodeProtocol - by @sxzz (90cd6)
css: Add CSS code splitting support - by @jinghaihan and @sxzz in #654 (0525f)
entry: Support multiple patterns with same base - by @sxzz (cee1b)
exports: Add packageJson option - by @sxzz (6d220)

View changes on GitHub

`v0.18.3`

Compare Source

🚀 Features

Upgrade rolldown to 1.0.0-beta.57 - by @sxzz (525c0)
Add envFile & envPrefix option - by @toto6038 and @sxzz in #664 (d5493)
attw: Add ignoreRules option to filter specified rule - by @zyyv and Copilot in #665 (450b0)

🐞 Bug Fixes

Inline PackageJson type - by @sxzz (dfc43)

View changes on GitHub

`v0.18.2`

Compare Source

🚀 Features

Support globs for noExternal / inlineOnly / exports.exclude - by @sxzz and @TheAlexLichter (84b68)
entry: Support glob negation patterns in object entry - by @Doctor-wu and @sxzz in #662 (8ed1b)

🐞 Bug Fixes

Preserve import cache for node_modules - by @sxzz (426ab)
skipNodeModulesBundle for monorepo - by @sxzz (9a34f)
attw: Show full entrypoint - by @sxzz (c89c4)
clean: Remove dot files - by @sxzz (0430b)

View changes on GitHub

`v0.18.1`

Compare Source

🚀 Features

Support glob patterns in object entry - by @sxzz (bcb7a)

export default defineConfig({
  entry: {
    '*': './src/*.ts',
    'data-loaders': './src/data-loaders/entries/index.ts',
    'data-loaders/*': './src/data-loaders/entries/!(index).ts',
    'volar/*': './src/volar/entries/*.ts',
  },
}

Upgrade rolldown to 1.0.0-beta.55 - by @sxzz (5be3e)
Mark exports option as a stable feature - by @sxzz (ce9e0)

🐞 Bug Fixes

Keep banner / footer as-is - by @sxzz (f67e0)

View changes on GitHub

`v0.18.0`

Compare Source

🚨 Breaking Changes

copy: Rework, sync behavior of rollup-plugin-copy - by @sxzz (e864b)

`v0.17.4`

Compare Source

🚨 Breaking Changes

copy: Sync behavior of rollup-plugin-copy - by @sxzz (e864b)

🚀 Features

exports: Add exclude option - by @TheAlexLichter and @sxzz in #340 (9e634)
shortcuts: Case insensitive - by @btea in #649 (019af)

🐞 Bug Fixes

Resolve cwd from user config - by @sxzz (bc066)

View changes on GitHub

`v0.17.3`

Compare Source

🚀 Features

copy: Support glob in copy - by @kricsleo and @sxzz in #637 (c1fd4)
- This may be a breaking change, as the behavior has changed again in v0.17.4. Please upgrade to v0.17.4 and verify the issue.

🐞 Bug Fixes

Print error stack - by @sxzz (1c5b6)
Add config name to rebuilt message - by @sxzz (bfdc6)
Call hooks for each format - by @sxzz (19bdd)
Merge input & output options - by @sxzz (14181)

View changes on GitHub

`v0.17.2`

Compare Source

🐞 Bug Fixes

Empty clean array - by @sxzz (eae7f)

View changes on GitHub

`v0.17.1`

Compare Source

🐞 Bug Fixes

Respect clean on watch mode - by @sxzz (bfbfb)

View changes on GitHub

`v0.17.0`

Compare Source

🚨 Breaking Changes

Notable features: https://bsky.app/profile/sxzz.dev/post/3m6xi7e7d5k2b

Rolldown native watcher - by @sxzz in #329 (1c4f8)
Enable failOnWarn by default in CI - by @sxzz in #617 (245e7)
Remove unconfig from configLoader - by @sxzz (9d6a7)
Support exports, publint, attw for multi-configs - by @sxzz (f889a)
refactor!(attw): rename profile value from esmOnly to esm-only - by @sxzz (85c10f3)

🚀 Features

Export WatchPlugin - by @sxzz (4ccb2)
Add write option - by @sxzz (64fea)
Add chunks on build:done hook - by @sxzz (eb45c)
Override options by format - by @sxzz (482f6)
Upgrade rolldown to 1.0.0-beta.53 - by @sxzz (a04f2)
migrate:
- Migrate optionalDependencies - by @sxzz (22fd9)
- Use ast-grep for config file - by @Doctor-wu and @sxzz in #620 (b0b34)

🐞 Bug Fixes

Move require before import - by @sxzz (85c0e)
copy: Call function - by @sxzz (e4197)
exports: Merge multi-config outputs - by @pyyupsk and @sxzz in #625 (73984)
migrate: Build before publish - by @sxzz (bf0f5)
workspace: Cwd defaults to config dirname, support filter for all configs - by @sxzz (24f27)

🏎 Performance

Reload config via import-without-cache - by @sxzz (0b7e4)
Use native loader for bun - by @sxzz (36dbf)