chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@curev/eslint-config	^0.6.1 → ^0.6.2
@types/node (source)	^20.19.35 → ^20.19.43
@unocss/eslint-plugin (source)	^66.6.2 → ^66.10.0
@unocss/preset-icons (source)	^66.6.2 → ^66.10.0
axios (source)	^1.13.6 → ^1.20.0
eslint (source)	^9.39.3 → ^9.39.5
less (source)	^4.5.1 → ^4.9.1
lint-staged	^16.2.7 → ^16.4.0
pnpm (source)	10.30.3 → 10.34.5
prettier (source)	^3.8.1 → ^3.9.6
query-string	^9.3.1 → ^9.5.1
sass	^1.97.3 → ^1.104.0
simple-git-hooks	^2.13.1 → ^2.14.0
taze	^19.9.2 → ^19.17.2
unocss (source)	^66.6.2 → ^66.10.0
unocss-preset-palette	^0.4.0 → ^0.6.0
vite (source)	^6.4.1 → ^6.4.3
vite-plugin-pwa	^1.2.0 → ^1.3.0
vue (source)	^3.5.29 → ^3.5.42
vue-virtual-scroller	2.0.0-beta.8 → 2.0.1
workbox-core (source)	^7.4.0 → ^7.4.1
workbox-expiration (source)	^7.4.0 → ^7.4.1
workbox-precaching (source)	^7.4.0 → ^7.4.1
workbox-routing (source)	^7.4.0 → ^7.4.1
workbox-strategies (source)	^7.4.0 → ^7.4.1
workbox-window (source)	^7.4.0 → ^7.4.1

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

curev/eslint-config (@​curev/eslint-config)

v0.6.2

Bug Fixes

• bring back eslint-plugin-html (3150569)
• only disable no-unused-vars on vue file (6759593)

unocss/unocss (@​unocss/eslint-plugin)

v66.10.0

Compare Source

   🚀 Features

• Add Rollup and Rolldown integration  -  by @​hannoeru in #​5296 (37554)
• inspector: Rebuild on devframe  -  by @​antfubot and @​antfu in #​5276 (25973)

   🐞 Bug Fixes

• presets: Emit real blend mode properties for global keywords  -  by @​giaBaoJS in #​5301 (6cc1d)

    View changes on GitHub

v66.9.2

Compare Source

   🐞 Bug Fixes

• vite: Encode virtual IDs in global HMR updates  -  by @​zyyv in #​5298 (199c1)

    View changes on GitHub

v66.9.1

Compare Source

No significant changes

    View changes on GitHub

v66.8.1

Compare Source

   🐞 Bug Fixes

• eslint-plugin: Avoid undeclared types dependency  -  by @​zyyv (1979e)
• vscode: Fix extension publish by renaming after build  -  by @​Jungzl in #​5272 (65f2a)

    View changes on GitHub

v66.8.0

Compare Source

   🚀 Features

• reset, preset-wind4: Port new tailwind changes  -  by @​kidonng in #​5265 (f2b25)
• rule-utils: Enhance open preudo class generation  -  by @​zyyv in #​5245 (fef64)

   🐞 Bug Fixes

• examples: Disable hmrTopLevelAwait in the sveltekit example  -  by @​Nic-Polumeyv and Henrik Berglund in #​5257 (54530)
• playground: Await prettier when formatting panels  -  by @​ilyaliao and Claude Sonnet 4.6 in #​5256 (bab37)
• svelte-scoped: Handle @​property at-rules in writeUtilStyles  -  by @​simondoesstuff and Claude Sonnet 4.6 in #​5260 (a4f4d)

   🏎 Performance

• core:
  • Index selector merge candidates  -  by @​hannoeru in #​5270 (311c0)
  • Avoid blocklist allocation  -  by @​hannoeru in #​5269 (7cff6)
  • Optimize token parse batching  -  by @​hannoeru in #​5268 (c3ea2)
• language-server:
  • Exclude preflights from pre-class color matching  -  by @​Jungzl in #​5249 (bb50c)

    View changes on GitHub

v66.7.5

Compare Source

   🚀 Features

• preset-wind4: New rule for gap decorations  -  by @​zyyv in #​5241 (30fce)

   🐞 Bug Fixes

• transformer-compile-class: Update explicit shortcuts > Co-authored-by: LevDomasnih resolve #​4926, close #​5239  -  by @​zyyv in #​4926 and #​5239 (b5338)
• transformer-directive: Prehandle properties layer to skip apply css transform  -  by @​zyyv in #​5240 (67220)
• virtual-shared: Remove unnecessary envMode assignment in createContext close #​5243  -  by @​zyyv in #​5243 (d78d3)

    View changes on GitHub

v66.7.4

Compare Source

   🚀 Features

• Introduce @unocss/twoslash  -  by @​9romise and @​zyyv in #​5215 (e4a35)

   🐞 Bug Fixes

• astro: Skip wind3 reset injection when wind4 is detected  -  by @​zyyv in #​5236 (b48cc)

    View changes on GitHub

v66.7.3

Compare Source

   🚀 Features

• preset-wind4: Add scrollbar gutter utilities  -  by @​cyphercodes and cyphercodes in #​5224 (e41b2)

   🐞 Bug Fixes

• integration: Batch filesystem content extraction to avoid ENOMEM  -  by @​zyyv in #​5234 (23eea)

   🏎 Performance

• Batch token parsing  -  by @​TheAlexLichter, Anthony Fu and @​zyyv in #​5231 (edc53)
• core:
  • Skip redundant shortcut variant matching  -  by @​TheAlexLichter in #​5233 (1fd92)
  • Prefilter dynamic rules  -  by @​TheAlexLichter in #​5232 (6dc74)
• integration:
  • Reduce transformer dispatch overhead  -  by @​TheAlexLichter and @​zyyv in #​5230 (df33e)

    View changes on GitHub

v66.7.2

Compare Source

No significant changes

    View changes on GitHub

v66.7.0

Compare Source

   🚀 Features

• preset-web-fonts:
  • Add ZeoSeven Chinese fonts provider  -  by @​Jack-sh1 and @​zyyv in #​5175 (a8bb9)
  • Add onDownload callback to createLocalFontProcessor  -  by @​Jack-sh1 and @​zyyv in #​5199 (36509)
• preset-wind4:
  • Support theme parse in all bracket syntax rule  -  by @​zyyv in #​5181 (ff1b3)
  • Enhance border utilities with new color and size options  -  by @​zyyv in #​5206 (b6dc5)

   🐞 Bug Fixes

• example/astro: Add @​unocss/astro dependency  -  by @​cworld1 in #​5179 (fd88f)
• language-server: Support colorPreview for presetWind4  -  by @​Jungzl in #​5186 (89e4d)
• nuxt: Apply cssnano workaround for Nuxt 4 as well  -  by @​Whyjsee and @​zyyv in #​5200 (c907d)
• preset-wind4: Keep media outside child selectors  -  by @​lawrence3699 and lawrence3699 in #​5189 (5e964)
• runtime/preset-icons: Import createPresetIcons from browser module  -  by @​Jungzl in #​5191 (78eae)
• webpack: Update RESOLVED_ID_RE handling in buildStart and transform methods  -  by @​zyyv in #​5204 (72b63)

    View changes on GitHub

v66.6.8

Compare Source

   🚀 Features

• preset-wind4: Improve css variable usage in bracket syntax  -  by @​zyyv in #​5174 (89308)
• svelte-scoped: Add hashSafelistClasses boolean, by default do not hash safelisted classes  -  by @​henrikvilhelmberglund in #​5157 (e5f89)

   🐞 Bug Fixes

• inspector: Add background colors  -  by @​liangmiQwQ in #​5160 (5a138)
• svelte-scoped: Replace build hook with buildEnd to remove setAss…  -  by @​henrikvilhelmberglund in #​5159 (17513)
• transformer-attributify-jsx: Improve error message  -  by @​9romise in #​5156 (07800)
• webpack: Persistent cache  -  by @​Jack-sh1, Jack-sh1 and @​zyyv in #​5017 (ff7e7)

    View changes on GitHub

v66.6.7

Compare Source

   🚀 Features

• rule-utils: Add details-content pseudo to pseudo.ts  -  by @​henrikvilhelmberglund in #​5138 (2a2c9)

   🐞 Bug Fixes

• eslint-plugin: Update types for Linter compatibility  -  by @​Jungzl in #​5147 (f18d7)
• inspector: No longer hijack printUrls  -  by @​antfu (d00a6)
• language-server,vscode: Honor workspace roots for unocss config discovery  -  by @​Jungzl and GPT-5.4 in #​5145 (062bf)
• preset-wind4: Fix option variable-prefix not working  -  by @​micaiguai in #​5142 (f1094)

    View changes on GitHub

v66.6.6

Compare Source

   🐞 Bug Fixes

• svelte-scoped: Generate in buildEnd() to make presetWind4 on-dem…  -  by @​henrikvilhelmberglund in #​5133 (06d7c)

    View changes on GitHub

v66.6.5

Compare Source

   🐞 Bug Fixes

• config: Enhance loadConfig to track user custom config presence  -  by @​zyyv in #​5132 (76f65)

    View changes on GitHub

v66.6.4

Compare Source

   🚀 Features

• core: Add noScope key determines whether to wrap the selector  -  by @​zyyv and Copilot in #​5130 (5b67c)

    View changes on GitHub

v66.6.3

Compare Source

   🚀 Features

• core: Support * parse in variant group  -  by @​zyyv and Copilot in #​5124 (037ba)
• language-server: Add @unocss/language-server  -  by @​Jungzl in #​5102 (90f75)
• transformer-attributify-jsx: Migrate from babel to oxc for JSX parsing  -  by @​9romise in #​5068 (6fbf7)
• vscode: Use LogOutputChannel to log info  -  by @​Jungzl in #​5125 (4fe3a)

   🐞 Bug Fixes

• language-server: Improve context reloading and error handling  -  by @​Jungzl in #​5126 (3f4de)
• preset-wind4: Update negative variant for spacing value  -  by @​zyyv in #​5123 (fa851)

    View changes on GitHub

axios/axios (axios)

v1.20.0

Compare Source

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

• HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#​11082)

🔒 Security Fixes

• Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#​11141)

🐛 Bug Fixes

• Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#​11087, #​11118)
• Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#​11109)
• XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#​11094, #​11121)
• Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#​11091)
• Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#​11096)

🔧 Maintenance & Chores

• Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#​11092, #​11098, #​11099, #​11106, #​11107, #​11122, #​11123, #​11126, #​11127, #​11133, #​11140, #​11143, #​11144)
• Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#​11101, #​11113, #​11097, #​11119)
• Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#​11124, #​11136, #​11137)
• CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#​11128, #​11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​yens1 (#​11109)
• @​Sasireddy001 (#​11113)
• @​ari-token-security (#​11094)
• @​timothyokooboh (#​11097)
• @​gi9439041-png (#​11119)
• @​Hashim1999164 (#​11082)
• @​v-dev-cl (#​11091)
• @​r0h1tb (#​11118)
• @​ostapondo (#​11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0

Compare Source

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

v1.18.1

Compare Source

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#​10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#​10917, #​10930, #​10942, #​10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#​10959, #​11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#​11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#​11007, #​11010, #​11023, #​11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#​11011, #​11012, #​11013, #​11014, #​11015, #​11016, #​11017, #​11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#​10913)
• @​sijie-Z (#​10993)
• @​bartlomieju (#​11023)
• @​JSap0914 (#​11019)

Full Changelog

v1.18.0

Compare Source

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

v1.17.0

Compare Source

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

v1.16.1

Compare Source

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

v1.16.0

Compare Source

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

v1.15.2

Compare Source

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

v1.15.1

Compare Source

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

v1.15.0

Compare Source

Bug Fixes

• headers: fixed & optimized clear method; (#​5507) (9915635)
• http: add zlib headers if missing (#​5497) (65e8d1e)

Features

• fomdata: added support for spec-compliant FormData & Blob types; (#​5316) (6ac574e)

Contributors to this release

• Dmitriy Mozgovoy
• ItsNotGoodName

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.6 (2023-01-28)

Bug Fixes

• headers: added missed Authorization accessor; (#​5502) (342c0ba)
• types: fixed CommonRequestHeadersList & CommonResponseHeadersList types to be private in commonJS; (#​5503) (5a3d0a3)

Contributors to this release

• Dmitriy Mozgovoy

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.5 (2023-01-26)

Bug Fixes

• types: fixed AxiosHeaders to handle spread syntax by making all methods non-enumerable; (#​5499) (580f1e8)

Contributors to this release

• Dmitriy Mozgovoy
• Elliot Ford

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.4 (2023-01-22)

Bug Fixes

• types: renamed RawAxiosRequestConfig back to AxiosRequestConfig; (#​5486) (2a71f49)
• types: fix AxiosRequestConfig generic; (#​5478) (9bce81b)

Contributors to this release

• Dmitriy Mozgovoy
• Daniel Hillmann

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.3 (2023-01-10)

Bug Fixes

• types: fixed AxiosRequestConfig header interface by refactoring it to RawAxiosRequestConfig; (#​5420) (0811963)

Contributors to this release

• Dmitriy Mozgovoy

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.2.2] - 2022-12-29

Fixed

• fix(ci): fix release script inputs #​5392
• fix(ci): prerelease scipts #​5377
• fix(ci): release scripts #​5376
• fix(ci): typescript tests #​5375
• fix: Brotli decompression #​5353
• fix: add missing HttpStatusCode #​5345

Chores

• chore(ci): set conventional-changelog header config #​5406
• chore(ci): fix automatic contributors resolving #​5403
• chore(ci): improved logging for the contributors list generator #​5398
• chore(ci): fix release action #​5397
• chore(ci): fix version bump script by adding bump argument for target version #​5393
• chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2 #​5342
• chore(ci): GitHub Actions Release script #​5384
• chore(ci): release scripts #​5364

Contributors to this release

• Dmitriy Mozgovoy
• Winnie

[1.2.1] - 2022-12-05

Changed

• feat(exports): export mergeConfig #​5151

Fixed

• fix(CancelledError): include config #​4922
• fix(general): removing multiple/trailing/leading whitespace #​5022
• fix(headers): decompression for responses without Content-Length header #​5306
• fix(webWorker): exception to sending form data in web worker #​5139

Refactors

• refactor(types): AxiosProgressEvent.event type to any #​5308
• refactor(types): add missing types for static AxiosError.from method #​4956

Chores

• chore(docs): remove README link to non-existent upgrade guide #​5307
• chore(docs): typo in issue template name #​5159

Contributors to this release

• Dmitriy Mozgovoy
• Zachary Lysobey
• Kevin Ennis
• Philipp Loose
• secondl1ght
• wenzheng
• Ivan Barsukov
• Arthur Fiorette

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.2.0] - 2022-11-10

Changed

• changed: refactored module exports #​5162
• change: re-added support for loading Axios with require('axios').default #​5225

Fixed

• fix: improve AxiosHeaders class #​5224
• fix: TypeScript type definitions for commonjs #​5196
• fix: type definition of use method on AxiosInterceptorManager to match the README #​5071
• fix: __dirname is not defined in the sandbox #​5269
• fix: AxiosError.toJSON method to avoid circular references #​5247
• fix: Z_BUF_ERROR when content-encoding is set but the response body is empty #​5250

Refactors

• refactor: allowing adapters to be loaded by name #​5277

Chores

• chore: force CI restart #​5243
• chore: update ECOSYSTEM.md #​5077
• chore: update get/index.html #​5116
• chore: update Sandbox UI/UX #​5205
• chore:(actions): remove git credentials after checkout #​5235
• chore(actions): bump actions/dependency-review-action from 2 to 3 #​5266
• chore(packages): bump loader-utils from 1.4.1 to 1.4.

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.