chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #241 · unjs/db0

renovate · 2026-07-15T03:36:08Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	`^5` → `^5.20260728.1`
eslint (source)	`^10.7.0` → `^10.8.0`
kysely (source)	`^0.29.3` → `^0.29.4`
mysql2 (source)	`^3.22.6` → `^3.23.2`
pnpm (source)	`11.12.0` → `11.17.0`
pnpm (source)	`10.19.0` → `10.34.5`
prettier (source)	`^3.9.5` → `^3.9.6`
undocs	`^0.4.10` → `^0.4.17`
wrangler (source)	`^4.110.0` → `^4.115.0`

Release Notes

cloudflare/workerd (@cloudflare/workers-types)

eslint/eslint (eslint)

`v10.8.0`

Compare Source

Features

2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
c5963f7 docs: Update README (GitHub Actions Bot)

Chores

4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

kysely-org/kysely (kysely)

`v0.29.4`: 0.29.4

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

PostgreSQL 🐘

fix: fix postgres password not being passed to control client by @CakeWithDivinity & @igalklebanov in #1944

SQLite 📘

fix(sqlite): returning clauses wrongfuly output after order by and limit in delete queries. by @igalklebanov in #1946

📖 Documentation

📦 CICD & Tooling

chore: bump dependencies. by @igalklebanov in #1945

⚠️ Breaking Changes

🐤 New Contributors

@CakeWithDivinity made their first contribution in #1944

What's Changed

Full Changelog: kysely-org/kysely@v0.29.3...v0.29.4

sidorares/node-mysql2 (mysql2)

`v3.23.2`

Compare Source

Bug Fixes

correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
don't leave a failed execute as the active command (#4425) (fbd64b6)

`v3.23.1`

Compare Source

Bug Fixes

security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

`v3.23.0`

Compare Source

Features

return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

pnpm/pnpm (pnpm)

`v11.17.0`: pnpm 11.17

Compare Source

Minor Changes

Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #13220.

pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes

The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.
Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #13232.
Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #13164.
Revert script ordering change for pnpm run --sequential /regex/
Support the from-git argument in the pnpm version command.
When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors

Gold Sponsors

`v11.16.0`: pnpm 11.16

Compare Source

Minor Changes

The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.
Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.
Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.
Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:
```
update:
  ignoreDeps: # was updateConfig.ignoreDependencies
    - webpack
    - "@&#8203;babel/*"

audit:
  level: high # was auditLevel
  ignore: # was auditConfig.ignoreGhsas
    - GHSA-xxxx-yyyy-zzzz
```
update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

Fixed pnpm add --save-exact/--save-prefix and pnpm update writing a package's version with the peerDependencies range's prefix (e.g. ^19.2.7 instead of the requested 19.2.7) whenever the same package also appeared in peerDependencies. A real dependencies/devDependencies/optionalDependencies entry now takes precedence over a same-named peerDependencies entry when computing the current specifiers #13108.

Platinum Sponsors

Gold Sponsors

`v11.15.1`

Compare Source

`v11.15.0`: pnpm 11.15

Compare Source

Minor Changes

Optional peer dependencies declared only via peerDependenciesMeta (for example debug's supports-color peer) are now resolved from a satisfying version already present in the dependency graph, the same way explicitly declared optional peer dependencies are. Previously such peers were only resolved this way when the package's metadata was read back from the lockfile, so an unrelated dependency change could rewrite peer resolutions across the whole lockfile.

Patch Changes

Updated adm-zip to prevent crafted ZIP archives from causing excessive memory allocation.
pnpm version -r no longer writes a versioning-ledger entry with no consumed intents as a bare intents: key, which the next run failed to read with ERR_PNPM_INVALID_VERSIONING_LEDGER. Empty intent lists are now written as intents: [], and the ledger reader accepts the bare form left by earlier releases.
Fixed pnpr workspace resolution to preserve project names and versions for workspace: dependencies.

Platinum Sponsors

Gold Sponsors

`v11.14.0`: pnpm 11.14

Compare Source

Minor Changes

peerDependencies now accept dependency specifiers that carry a scheme — a named-registry spec (<registry>:<version>), an npm: alias, or a file:/git/URL spec — instead of rejecting them with ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION #13095. Such a peer is matched against the semver range carried by the specifier (work:5.x.x is checked as 5.x.x, npm:bar@^5 as ^5), or against * when it carries no version, while the original specifier still selects the package to auto-install. Bare name@version values, which are almost always a mistake, are still rejected.
Added pnpm doctor, which diagnoses the pnpm installation and the environment it runs in: the versions and install method, whether the global bin directory is on PATH, whether the store and cache are writable, which link strategies (reflink, hardlink, symlink) the store's filesystem supports, registry connectivity, and an offline file: install that exercises the resolve/store/link path end to end. Each check reports how to fix what it finds, and the command exits non-zero when any check fails.

Use --offline to skip the checks that need network access, --json for machine-readable output, and --benchmark to time the filesystem and install checks.
Added support for executing multiple scripts matching a RegExp passed to pnpm run (e.g., pnpm run "/^build:.*/"), running matched scripts in deterministic lexicographical order. Restored the --sequential (-s) CLI option for pnpm run, which forces workspaceConcurrency to 1 so that matched scripts run sequentially one by one across and within packages.

Patch Changes

Fixed pnpm install failing with ERR_PNPM_LOCKFILE_IS_SYMLINK when pnpm-lock.yaml is a symlink, as build sandboxes such as Bazel and Nix stage it #13073. Reading a lockfile through a symlink is allowed again, and an install that leaves the lockfile unchanged no longer rewrites it, so --frozen-lockfile no longer needs to write at all. Writing a changed lockfile through a symlink is still refused, as that would redirect the write onto the symlink's target.
Fixed frozen installs incorrectly treating equivalent Git dependency specifiers as a stale lockfile. See #13039.
pnpm owner ls now reports authentication and authorization failures (401/403) as dedicated errors that include the registry's response body, matching pnpm owner add/rm, instead of a generic Failed to fetch owners message.
Recover from a metadata cache entry that disappears (concurrent cache cleanup, antivirus) after the registry has already answered the conditional request with 304 Not Modified. The metadata is re-requested once without cache validators instead of failing the install with ERR_PNPM_CACHE_MISSING_AFTER_304.
A project pinned to a broken pnpm release via packageManager or devEngines.packageManager now reports which release is broken and what to do about it, instead of failing inside the installer. pnpm self-update already refused these releases; the version switch does too.
Prevent broken-lockfile errors from including snippets of the lockfile's contents.
pnpm self-update now checks that the version it installed can run before making it the active pnpm. A release that installs but cannot execute is discarded with an error instead of replacing a working installation.
Fixed an out-of-memory regression when workspace projects concurrently resolve a package with large registry metadata pnpm/pnpm#13077.
Fixed pnpm update rewriting exact version pins that use the = operator (for example =3.5.1) to a caret range (^3.5.1). Exact pins are now preserved and written back as the bare version. See #12745.

Platinum Sponsors

Gold Sponsors

`v11.13.1`: pnpm 11.13.1

Compare Source

Patch Changes

Fixed pnpm pack applying workspace-root ignore rules when a workspace package has its own .npmignore file.
Keep the interactive minimumReleaseAge approval prompt visible during pnpm install. The progress reporter now pauses its redraws while a prompt is waiting for input instead of overwriting it, so the install no longer hangs on a question the user cannot see #13019.
Fixed pnpm self-update failing to link native platform binaries stored in sibling global virtual store slots.

`v11.13.0`: pnpm 11.13

Compare Source

Minor Changes

Added versioning.epics to pnpm-workspace.yaml. An epic ties a group of member packages to a lead package, constraining every member's major version to a band derived from the lead's major: while the lead is on major M, members live in M*100 … M*100+99. Members move independently inside the band (patch, minor, and a major intent that stays in-band); a bump that would carry a member past the band ceiling is rejected until the lead advances its own major. When a release plan takes the lead to a new stable major, every member re-bases to the band floor in the same plan. Membership is matched with pnpm's package selectors — name globs, ./-prefixed directory globs, and !-prefixed negations.
Added the team command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.
Added native workspace release management #12952: the new pnpm change command records change intents as changesets-compatible .changeset/*.md files (pnpm change status shows the pending release plan), and the bare pnpm version -r consumes them — bumping versions across the workspace with dependent propagation through workspace: ranges, fixed groups, a maxBump cap, --filter narrowing, and --dry-run — writing changelogs, and recording consumed intents in a committed ledger that keeps cherry-picks and merge-backs between release branches safe. Packages can be moved onto per-package release lanes with the new pnpm lane <name> --filter <pkg> command and back with pnpm lane main --filter <pkg> (pnpm lane shows the membership), releasing X.Y.Z-lane.N prereleases from the same runs that release stable versions of the packages on the main lane. Configuration lives under the new versioning key of pnpm-workspace.yaml (fixed, ignore, maxBump, lanes, changelog). When two workspace projects publish the same name, intent files, versioning.lanes, and versioning.fixed/ignore may reference a project by its workspace-relative directory path (e.g. "./pnpm/npm/pnpm") — the one additive extension to the changesets format, applied automatically by pnpm change.

Release changelogs default to registry storage (versioning.changelog.storage): no CHANGELOG.md is committed. Each release's section is composed at publish time and packed i

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "after 1am and before 5am"
Automerge
- "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/all-minor-patch branch 14 times, most recently from 463b8f4 to 6498410 Compare July 22, 2026 23:58

renovate Bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from 4a9233f to 12f2c04 Compare July 30, 2026 21:48

renovate Bot force-pushed the renovate/all-minor-patch branch from 12f2c04 to 348cea5 Compare July 31, 2026 04:27

chore(deps): update all non-major dependencies

206c6e5

renovate Bot force-pushed the renovate/all-minor-patch branch from 348cea5 to 206c6e5 Compare July 31, 2026 20:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies - #241

chore(deps): update all non-major dependencies#241
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Bug Fixes

Documentation

Chores

v0.29.4: 0.29.4

🚀 Features

🐞 Bugfixes

PostgreSQL 🐘

SQLite 📘

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Bug Fixes

Bug Fixes

Features

v11.17.0: pnpm 11.17

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.16.0: pnpm 11.16

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.15.0: pnpm 11.15

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.14.0: pnpm 11.14

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.13.1: pnpm 11.13.1

Patch Changes

v11.13.0: pnpm 11.13

Minor Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 15, 2026 •

edited

Loading

`v0.29.4`: 0.29.4

`v11.17.0`: pnpm 11.17

`v11.16.0`: pnpm 11.16

`v11.15.0`: pnpm 11.15

`v11.14.0`: pnpm 11.14

`v11.13.1`: pnpm 11.13.1

`v11.13.0`: pnpm 11.13