fix(deps): update all non-major dependencies with stable versions (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/types (source)	^7.29.0 → ^7.29.7
@commitlint/cli (source)	^21.0.1 → ^21.0.2
@commitlint/config-conventional (source)	^21.0.1 → ^21.0.2
@evilmartians/lefthook	^2.1.6 → ^2.1.9
@vitejs/plugin-vue (source)	^6.0.6 → ^6.0.7
@vitest/ui (source)	^4.1.6 → ^4.1.9
@vue/test-utils	^2.4.10 → ^2.4.11
commitizen	^4.3.1 → ^4.3.2
markdown-it-attrs	^4.3.1 → ^4.3.2
markdown-it-deflist	^3.0.0 → ^3.0.1
postcss (source)	^8.5.14 → ^8.5.15
semantic-release	^25.0.3 → ^25.0.5
vite-plugin-vue-devtools (source)	^8.1.1 → ^8.1.3
vitest (source)	^4.1.6 → ^4.1.9
vue (source)	^3.5.34 → ^3.5.38

---

Release Notes

babel/babel (@​babel/types)

v7.29.7

Compare Source

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

conventional-changelog/commitlint (@​commitlint/cli)

v21.0.2

Compare Source

Bug Fixes

• disallow same commit hash for --from and --to (#​4773) (121005e)

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.0.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

evilmartians/lefthook (@​evilmartians/lefthook)

v2.1.9

Compare Source

• fix: update hooks path after resetting (#​1431) by @​mrexox
• deps: May 2026 (#​1415) by @​mrexox

v2.1.8

Compare Source

• fix: do not warn if local hooks path is equal to default hooks path (#​1421) by @​mrexox

v2.1.7

Compare Source

• fix: use contrast colors (#​1420) by @​mrexox
• fix: apply stage_fixed only if it is safe (#​1418) by @​mrexox
• fix: try to always restore unstaged changes (#​1417) by @​mrexox
• fix: always restore unstaged changes (#​1416) by @​mrexox
• refactor: add new logger without a global state (#​1385) by @​mrexox
• fix: linter, sacrifice optimization for readability by @​mrexox
• fix: separate fallback push branch from pathspecs (#​1396) by @​lawrence3699

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.7

Features

• use carets for @rolldown/pluginutils version (#​776) (941b651)

Bug Fixes

• deps: update all non-major dependencies (#​762) (9e825b8)
• deps: update all non-major dependencies (#​774) (77dc8bc)

vitest-dev/vitest (@​vitest/ui)

v4.1.9

Compare Source

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

vuejs/test-utils (@​vue/test-utils)

v2.4.11

Compare Source

compare changes

🩹 Fixes

• Drop legacy Mutation Event listener entries (#​2844)
• Handle setData() correctly for components using both setup() and data() (#​2846)
• Export GlobalMountOptions type (#​2851)
• Set spec-compliant event.code on keydown/keyup (#​2850)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Renato de Leão (@​renatodeleao)
• Matt Van Horn (@​mvanhorn)
• Carsten Brachem (@​cbrachem)
• Ahmad Hanan (@​AhmadHannan037)
• Paul Cochrane (@​paultcochrane)
• Arpit Jain (@​arpitjain099)

commitizen/cz-cli (commitizen)

v4.3.2

Compare Source

4.3.2 (2026-06-12)

• chore(deps): bump semantic-release to 25 for npm trusted publishing (#​1029) (6eb168c), closes #​1029
• ci(release): bump actions/checkout and actions/setup-node to v4 (#​1024) (f5702c4), closes #​1024
• ci(release): use npm trusted publishing via OIDC (#​1028) (096ed52), closes #​1028
• chore(deps) Update all non-major dependencies (#​1026) (4e98218), closes #​1026
• chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#​1010) (11be6a1), closes #​1010
• fix(ci): fix pipelines and update matrices to node 18/20/22 (#​1023) (48e4b8b), closes #​1023
• docs: update README.md to add contributors (#​985) (3c08866), closes #​985

arve0/markdown-it-attrs (markdown-it-attrs)

v4.3.2

Compare Source

What's Changed

• fix: handle null meta on tbody_open for headerless tables (issue #​161) by @​Copilot in #​167

New Contributors

• @​Copilot made their first contribution in #​167

Full Changelog: arve0/markdown-it-attrs@v4.3.1...v4.3.2

markdown-it/markdown-it-deflist (markdown-it-deflist)

v3.0.1

Compare Source

• Correct lazy paragraph continuations, #​11.

postcss/postcss (postcss)

v8.5.15

Compare Source

• Fixed declaration parsing performance (by @​homanp).

semantic-release/semantic-release (semantic-release)

v25.0.5

Compare Source

Bug Fixes

• revert: next (#​4200) (db8ffaa)

v25.0.4

Compare Source

Bug Fixes

• code-quality: add missing comma in context object for consistency (493d6cd)

vuejs/devtools (vite-plugin-vue-devtools)

v8.1.3

Compare Source

   🐞 Bug Fixes

• vite: Align module field with emitted ESM output  -  by @​itosa-kazu in #​1106 (4720c)

    View changes on GitHub

vitest-dev/vitest (vitest)

v4.1.9

Compare Source

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)

View changes on GitHub

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

vuejs/core (vue)

v3.5.38

Compare Source

v3.5.37

Compare Source

v3.5.36

Compare Source

Bug Fixes

• compiler-core: avoid crash on CDATA at the document root (#​14916) (0ea17e2)
• compiler-core: prefix dynamic keys on v-memo elements (#​14922) (68e978e), closes #​14920
• compiler-sfc: handle vue-ignore on leading intersection/union type (#​14950) (0dcd225), closes #​12254
• compiler-sfc: respect var hoisting in props destructure (48ad452)
• reactivity: preserve watch callback return value when wrapped for once: true (#​14902) (450a8a8)
• runtime-core: add dev warning for silent catch in compat mode and fix test description typo (#​14891) (db3e117)
• runtime-core: force model update when reverted before sync (#​14897) (7f76378), closes #​13524
• runtime-core: skip async component callbacks after unmount (#​14911) (5300ead)
• transition: avoid move transition for hidden v-show group children (#​14895) (c11f6ee), closes #​14894
• watch: trigger immediate callback for empty sources (#​14914) (1f2ca7e), closes #​14898

v3.5.35

Compare Source

Bug Fixes

• compiler-core: avoid double processing v-for keys with v-memo (#​14861) (34a0ded), closes #​14859
• compiler-sfc: resolve top-level exports from files registered as global types (#​14805) (3d077f2), closes nuxt/nuxt#33694
• runtime-core: avoid repeated hydration mismatch checks (#​14857) (170fc95), closes #​14855
• runtime-core: skip idle persisted transition hooks in keep-alive moves (#​14865) (80fc139), closes #​14031
• server-renderer: propagate sync errors from ssrRenderSuspense (#​14804) (4760997), closes nuxt/nuxt#28162
• teleport: skip child unmount when pending mount discarded (#​14876) (#​14877) (584beb1)

Performance Improvements

• reactivity: skip type checks for cached proxies (#​14860) (5734fe9)
• runtime-dom: optimize array event handler dispatch (#​14828) (bb18dc8)
• server-renderer: avoid materializing iterables in ssrRenderList (#​14821) (1b7a2cc)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 65, reused 0, downloaded 0, added 0
Progress: resolved 71, reused 0, downloaded 0, added 0
Progress: resolved 79, reused 0, downloaded 0, added 0
Progress: resolved 183, reused 0, downloaded 0, added 0
 ERR_PNPM_TRUST_DOWNGRADE  High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)

This error happened while installing the dependencies of sass@1.99.0

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had provenance attestation, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.