fix(deps): update all non-major dependencies - #1557
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
✅ Deploy Preview for aptos-explorer ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
March 28, 2026 21:30
0766d90 to
e53bcdd
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
16 times, most recently
from
April 6, 2026 17:17
a4fe61f to
1a40fef
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
11 times, most recently
from
April 8, 2026 20:12
2b7e502 to
2162558
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
19 times, most recently
from
April 19, 2026 12:54
f3fd12f to
323b63b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
April 21, 2026 19:39
7b67eb2 to
7e808db
Compare
Contributor
Author
|
This was referenced Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.2.0→7.3.07.2.0→7.3.02.5.7→2.5.81.170.23→1.170.281.168.40→1.168.451.167.25→1.167.291.168.27→1.168.310.28.1→0.28.25.2.3→5.3.024.14.1→24.19.011.20.0→11.21.011.20.0→11.21.07.0.1→7.1.1Release Notes
aptos-labs/aptos-ts-sdk (@aptos-labs/ts-sdk)
v7.3.0Fixed
baseline-browser-mappingandcaniuse-litetoSAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONSinsetup-node-pnpmaction. These packages are republished frequently by browserslist and were causing ~36% Confidential Asset test failure rate when Dependabot refreshed lockfiles.CODECOV_TOKENis unavailable (expected on Dependabot and fork PRs where repo secrets are not accessible). This eliminated spurious 33% Codecov failure rate while preserving uploads on main branch and authenticated PRs.catof local testnet logs graceful (2>/dev/null || echo) across all test actions so that missing logs don't fail the failure-handling step. This was hiding the actual safe-chain/Codecov errors behind spuriouscat: no such fileexit codes.Added
generateTransactionPayloadTypeScript overload forInputMultiSigScriptData(returnsTransactionPayloadMultiSig), plus unit coverage for multisig script payloads. Localnet e2e for create/execute is skipped for now: indexingMultisigTransactionPayload::Scriptpanics the current CLI indexer processor and takes down the shared localnet.scripts/prepareRelease.mjsbumps a package's version and stamps its changelog, a two-phase release skill/Cursor rule (.claude/skills/release-ts-sdk/,.cursor/rules/release-ts-sdk.mdc) drives the version-bump PR and the tag + GitHub Release, and.github/workflows/publish.yamlpublishes@aptos-labs/ts-sdkand@aptos-labs/confidential-assetto NPM with provenance via OIDC trusted publishing when a GitHub Release is published. SeeCONTRIBUTING.mdanddocs/superpowers/specs/2026-07-06-automated-ts-sdk-releases-design.md.410 Goneresponse, so historical Node API reads keep working as fullnodes move to a rolling history window. Enabled by default; opt out withnew AptosConfig({ ..., archivalFallback: false }). Credentials are only forwarded to the archival endpoint when it is on the same site as the configured node.Changed
Upgrade to TypeScript 7.0 (
tsc7.0.2). The root package keeps the TypeScript 6.0 programmatic API via@typescript/typescript6(aliased astypescript) for tools such as TypeDoc that still require it, and installs the native TypeScript 7 compiler as@typescript/nativesotsc/pnpm builduse 7.0. Examples and other packages that only invoke the CLI depend ontypescript@^7.0.2directly. Aligntsconfig.jsonrootDirwith the confidential-asset package (.for editor/typecheck ofsrc+tests;./srconly intsconfig.build.json) so full-projecttsc --noEmitsucceeds under TypeScript 6/7.Adapt localnet e2e coverage to recent Aptos framework changes: skip the permissioned-delegation e2e (feature removed in aptos-core#20198), assert fungible-asset creator metadata by asset type rather than indexer row order, retarget table e2e tests away from the empty AptosCoin CoinInfo supply aggregator toward the genesis TypeInfo→FA metadata table, and pin account-abstraction example Move deps to
mainnetsoSmartTablecompiles against current CLI.Raise unit test line coverage threshold from 90% to 95% (
vitest.config.ts) and add mocked-client unit tests across API wrappers, keyless/federated JWKS flows,MultiKeyAccount, transaction submission helpers, clientaptosRequesterror paths, type guards, and encrypted-payload claim handling. Tests assert forwarded arguments, parsed results, and error types/messages rather than smoke-only execution.Add offline/mocked-client unit tests raising coverage of previously-untested modules:
internal/faucet.ts(fundAccount),client/get.tspagination helpers (getAptosFullNode,getAptosPepperService,paginateWithCursor,paginateWithObfuscatedCursor,getPageWithObfuscatedCursor),core/crypto/abstraction.ts(AbstractPublicKey/AbstractSignature),account/AbstractedAccount.ts,account/keylessSigner.ts(isKeylessSigner),api/account/abstraction.ts(AccountAbstraction),api/transactionSubmission/sign.ts(Sign),api/utils.ts(waitForIndexerOnVersion), andSimpleTransactionBCS round trips intransactions/instances.biomejs/biome (@biomejs/biome)
v2.5.8Compare Source
Patch Changes
#10710
0a0fbc1Thanks @dyc3! - Added a new nursery ruleuseReactCompiler, which reports diagnostics from React Compiler lint mode.#11251
ea9dd8aThanks @dyc3! - Improved performance ofnoImportCycles.#11247
52b44d6Thanks @dyc3! - Added the nursery rulenoSvelteLegacyConst, which disallows legacy Svelte{@const}tags and recommends declaration tags with$derived().Invalid:
{#each boxes as box} {@const area = box.width * box.height} <p>{area}</p> {/each}Valid:
{#each boxes as box} {const area = $derived(box.width * box.height)} <p>{area}</p> {/each}#11252
d5f5704Thanks @Turtle-Hwan! - Fixed #11250:useAwaitno longer reports async functions that contain anawait usingdeclaration.#11143
6be7be1Thanks @vznh! - Fixed #11017:noUselessUndefinedno longer reportsreturn undefinedwhen the enclosing function has a return type annotation other thanundefinedorvoid.#11234
caefe39Thanks @subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.:root { --font-stack: -/* comment */ + /* comment */ system-ui; }#11285
bca1f73Thanks @denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.#11080
af16a0bThanks @dyc3! - HTMLstyleattribute values are now parsed as CSS. All Biome CSS lint rules are applied to thestyleattributes.#11195
6a85588Thanks @dyc3! - Fixed Svelte files failing to parse when an expression begins with an object literal.Now the following snippet is correctly parsed:
#11173
481d008Thanks @Austin1serb! - Fixed #10242: JavaScript GritQL patterns with multiple metavariables now match snippets consistently in WebAssembly.#11187
23c0369Thanks @ematipico! - Added the nursery rulenoInvalidPropertyInitValue, which reports an@propertywhoseinitial-valuedoes not match itssyntaxdescriptor. For example, the following declaration triggers the rule becauseredis not a<length>:#11272
73896e6Thanks @ematipico! - Improved the diagnostic emitted bynoRootType.#11240
bd0b68dThanks @ematipico! - Fixed #11223: Improved theperformance of
noMisusedPromiseswhen analyzing async class methods that call other methods through
this.#11172
4a0bc5cThanks @saberoueslati! - Fixed #10806:noUselessFragmentsno longer causes Biome to panic when its unsafe fix removes a fragment used as a JSX attribute value.#11227
4d603b0Thanks @saberoueslati! - Fixed #11178:noUndeclaredVariablesno longer reports Vue's built-in instance properties, such as$slotsand$attrs, in template expressions or$eventin inline event-handler expressions. The instance properties are still reported inside<script setup>, where they are not defined.#11187
23c0369Thanks @ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates thesyntaxdescriptor of@propertyrules.TanStack/router (@tanstack/react-router)
v1.170.28Compare Source
Patch Changes
#8055
0c25a7b- Avoid wrapping root components that may render the HTML document in a Suspense boundary during SSR and hydration.#8054
31882c7- Reuse resolved lazy route components when revisiting code-split routes, preventing unnecessary pending UI.Updated dependencies [
31882c7]:v1.170.27Compare Source
Patch Changes
b0817f5- useMatchRoute w/ React Compilerv1.170.26Compare Source
Patch Changes
#8045
f500760- Warn when an Outlet is rendered inside a pending, error, or not-found component.#8043
1aafca9- remove the undocumented LinkisTransitioningstate anddata-transitioningattribute#8044
aa10b65- ApplypreloadDelayto viewport link preloading and cancel pending preloads when links leave the viewport.Updated dependencies [
7e93431]:v1.170.25Compare Source
Patch Changes
51138a8]:v1.170.24Compare Source
Patch Changes
44a8c3e,5253e70]:TanStack/router (@tanstack/react-start)
v1.168.45Compare Source
Patch Changes
0c25a7b,31882c7]:v1.168.44Compare Source
Patch Changes
b0817f5]:v1.168.43Compare Source
Patch Changes
f500760,1aafca9,aa10b65]:v1.168.42Compare Source
Patch Changes
v1.168.41Compare Source
Patch Changes
c59788c]:TanStack/router (@tanstack/router-cli)
v1.167.29Compare Source
Patch Changes
v1.167.28Compare Source
Patch Changes
v1.167.27Compare Source
Patch Changes
v1.167.26Compare Source
Patch Changes
TanStack/router (@tanstack/router-plugin)
v1.168.31Compare Source
Patch Changes
0c25a7b,31882c7]:v1.168.30Compare Source
Patch Changes
7e93431,f500760,1aafca9,aa10b65]:v1.168.29Compare Source
Patch Changes
51138a8]:v1.168.28Compare Source
Patch Changes
44a8c3e,5253e70]:evanw/esbuild (esbuild)
v0.28.2Compare Source
Fix tree shaking bug due to TypeScript import alias (#4507)
This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific
importassignment and looks something like this:Fix CSS minification bug involving
&(#4497)This release fixes a bug where esbuild's CSS minifier incorrectly removed a
&when it was unsafe to do so. Here is an example:This should match
<span class="a"><span class="b"><span class="b">yes</span></span></span>but not<span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.Avoid overwriting input files without
--allow-overwrite(#4484)For example:
esbuild input.js --outfile=input.jstells esbuild to overwriteinput.jswith the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless
--allow-overwriteis explicitly present. This is done by not writing out any files when a build error is encountered.Fix incorrect code generated when using top-level await (#4498)
Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing
asyncon one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing anasyncmodule wrapper.Fix a minification bug with lowered logical assignment operators (#4508)
This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
Fix a potential deadlock when the JavaScript API is used incorrectly (#4503, #4506)
The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.
Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.
This fix was submitted by @ZuBB.
Handle target collisions (#4509)
It's possible to specify the same target engine multiple times, such as with
--target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (sochrome99in this case instead ofchrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.Force
.mp3files to use theaudio/mpegMIME type (#4485)MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence
ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start withID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some.mp3files incorrectly using theapplication/octet-streamMIME type instead ofaudio/mpeg. With this release, esbuild will now always use theaudio/mpegMIME type for files ending in.mp3.Add a new TypeScript syntax warning
TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts
1 + 2 as number * 3as valid syntax but confusingly converts it to(1 + 2) * 3instead of the more intuitive conversion to1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:See microsoft/TypeScript#63527 for more information.
Add support for formatting errors for Visual Studio (#4460)
Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.
With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with
--log-style=visualstudio. Here is an example log message in this style:This log style is also available via the JS and Go APIs, and can now be used with the existing
formatMessagesAPI.Fix a bug with CSS gamut mapping (#4488)
Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.
This fix was submitted by @chatman-media.
nodeca/js-yaml (js-yaml)
v5.3.0Compare Source
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
Added
DUMP_SCHEMA, the default schema used by the dumper.YAMLException.throwAt()for throwing an error at a source position.Changed
EVENT_ID,SCALAR_STYLE,COLLECTION_STYLE, andCHOMPING_MODE, along with their value types. The oldexports are still preserved, but deprecated.
identifymandatory for custom tag definitions. Useidentify: () => falsefor load-only tags.Deprecated
Removed
MERGE_KEYexport (not used anymore after last fixes).Fixed
<<sequence items at merge time, so aliased merge sources arechecked too.
<<outside of a mapping key as the plain string'<<', matchingv4, instead of leaking an internal symbol into the result.
nodejs/node (node)
v24.19.0: 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
d08872b530] - (SEMVER-MINOR) buffer: implementblob.textStream()(Matthew Aitken) #6403635222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217d6ab039f24] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #630501da05fb79d] - doc: markstream.composestable (Matteo Collina) #625623c1636dabf] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300e323e877be] - (SEMVER-MINOR) fs: support caller-suppliedreadFile()buffers (Matteo Collina) #63634c1248c9544] - (SEMVER-MINOR) http: addhttpValidationoption to configure header value validation (RajeshKumar11) #61597a534b65815] - (SEMVER-MINOR) net: supportTCP_KEEPINTVLandTCP_KEEPCNTinsetKeepAlive(Guy Bedford) #63825a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #629357428b57a37] - (SEMVER-MINOR) src: allow empty--experimental-config-file(Marco Ippolito) #61610e57597173c] - (SEMVER-MINOR) stream: exposeReadableStreamTee(Matteo Collina) #641955396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #641195e901b5cd9] - (SEMVER-MINOR) tls: addcertificateCompressionoption (Tim Perry) #62217Commits
676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #640366e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #6374787e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #6362632174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #5389969cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #6362937ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #641182424207191] - build: suppress compiler warnings for histogram (Richard Lau) #6398063502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #639337907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #639880f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #6362273aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #6326112c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #636449a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #634908bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #6389597b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #637049098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #6366359cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #634372922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #632866fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #636081ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #6360792a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #635248b37af8b11] - deps: V8: backportbef0d9c(Joyee Cheung) #621328832126422] - deps: V8: cherry-pick64b36b4(Dan Carney) #6171275990c2cd6] - deps: update googletest to8b53336(Node.js GitHub Bot) #641818500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180dc78091b45] - deps: c-ares: cherry-pick8ba37af(René) #64110873cc72125] - deps: update googletest to [0b1e895](hConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.