Skip to content

chore(deps): update all non-major dependencies#179

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#179
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@codspeed/vitest-plugin (source) ^5.5.0 → ^5.7.1 age confidence devDependencies minor
@tanstack/react-table (source) 9.0.0-beta.16 → 9.0.0-beta.19 age confidence dependencies patch
CodSpeedHQ/action v4.17.5 → v4.18.1 age confidence action minor
knip (source) ^6.16.1 → ^6.20.0 age confidence devDependencies minor
nx (source) ^22.7.5 → ^22.7.6 age confidence devDependencies patch
react (source) 19.2.0 → 19.2.7 age confidence dependencies patch
react-dom (source) 19.2.0 → 19.2.7 age confidence dependencies patch
semver ^7.8.4 → ^7.8.5 age confidence dependencies patch
sherif ^1.11.1 → ^1.12.0 age confidence devDependencies minor
tsdown (source) ^0.22.2 → ^0.22.3 age confidence devDependencies patch
undici-types (source) 8.4.1 → 8.5.0 age confidence pnpm-workspace.overrides minor
verdaccio (source) ^6.7.2 → ^6.7.4 age confidence devDependencies patch
vitest (source) 4.1.8 → 4.1.9 age confidence devDependencies patch
vitest-evals (source) ^0.13.1 → ^0.14.0 age confidence devDependencies minor
zizmorcore/zizmor-action v0.5.6 → v0.5.7 age confidence action patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

CodSpeedHQ/codspeed-node (@​codspeed/vitest-plugin)

v5.7.1

Compare Source

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1

v5.7.0

Compare Source

Highlights
  • Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set CODSPEED_WALLTIME_PROFILER=samply env variable in the codspeed action.
  • Added support for tinybench v5 and v6 in @​codspeed/tinybench-plugin
What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0

v5.6.0

Compare Source

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.5.0...v5.6.0

TanStack/table (@​tanstack/react-table)

v9.0.0-beta.19

Compare Source

Version 9.0.0-beta.19 - 6/25/26, 4:08 AM

Changes

Fix
  • improve row selection api performance (#​6344) (f077ae7) by Kevin Van Cott
Docs
  • fix link (51298bb) by Kevin Van Cott
  • helpers guide, fix some example tsc errors (a7aae8b) by Kevin Van Cott
  • improve composable table guides (a471632) by Kevin Van Cott
  • rearrange docs sidebar some (4e8a35d) by Kevin Van Cott
Examples
  • standardize stress tests and remove re-render buttons (d1c84eb) by Kevin Van Cott

Packages

v9.0.0-beta.18

Compare Source

Version 9.0.0-beta.18 - 6/24/26, 1:07 PM

Changes

Fix
  • expanding and paginated row model memo (#​6342) (de74706) by Kevin Van Cott
Chore
Docs
  • update feature setup sections (17b84c3) by Kevin Van Cott

Packages

v9.0.0-beta.17

Compare Source

Version 9.0.0-beta.17 - 6/20/26, 8:27 PM

Changes

Fix
  • add checks to dictionaries for ssr (#​6338) (f237e20) by Kevin Van Cott
Chore
  • modify some typescript script generation (dde8248) by Kevin Van Cott

Packages

CodSpeedHQ/action (CodSpeedHQ/action)

v4.18.1

Compare Source

Release Notes

🚀 Features

Install codspeed-runner 4.18.1

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.1

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

v4.18.0

Compare Source

Release Notes

🚀 Features
🐛 Bug Fixes

Install codspeed-runner 4.18.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.0

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

v4.17.6

Compare Source

Release Notes

🚀 Features
🐛 Bug Fixes
💼 Other
🏗️ Refactor
📚 Documentation
⚙️ Internals

Install codspeed-runner 4.17.6

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.17.6/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.17.6

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.17.5...v4.17.6

webpro-nl/knip (knip)

v6.20.0: Release 6.20.0

Compare Source

v6.19.0: Release 6.19.0

Compare Source

v6.18.0: Release 6.18.0

Compare Source

v6.17.2: Release 6.17.2

Compare Source

v6.17.1: Release 6.17.1

Compare Source

  • Remove ignoreBinaries w/ tar (b13d0ca)
  • Wrap up docs/refs (29f3e46)
  • Update dependencies (7b2f345)
  • Fix up vscode-languageclient imports (820c233)

v6.17.0: Release 6.17.0

Compare Source

nrwl/nx (nx)

v22.7.6

Compare Source

22.7.6 (2026-06-23)
🩹 Fixes
  • misc: bump happy-dom, tmp, and form-data to patched versions (#​36013)
❤️ Thank You
facebook/react (react)

v19.2.7: 19.2.7 (June 1st, 2026)

Compare Source

React Server Components

v19.2.6: 19.2.6 (May 6th, 2026)

Compare Source

React Server Components

v19.2.5: 19.2.5 (April 8th, 2026)

Compare Source

React Server Components

v19.2.4: 19.2.4 (January 26th, 2026)

Compare Source

React Server Components

v19.2.3: 19.2.3 (December 11th, 2025)

Compare Source

React Server Components

v19.2.2: 19.2.2 (December 11th, 2025)

Compare Source

React Server Components

v19.2.1: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components
npm/node-semver (semver)

v7.8.5

Compare Source

Bug Fixes
QuiiBz/sherif (sherif)

v1.12.0

Compare Source

What's Changed

New Contributors

Full Changelog: QuiiBz/sherif@v1...v1.12.0

rolldown/tsdown (tsdown)

v0.22.3

Compare Source

   🚨 Breaking Changes
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
nodejs/undici (undici-types)

v8.5.0

Compare Source

⚠️ Security Release

This release line addresses 8 security advisories. Most are fixed in
v8.5.0; the SOCKS5 pool-reuse issue was fixed earlier in v8.2.0.

Action required: Upgrade to undici 8.5.0 or later.

npm install undici@^8.5.0

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 8.5.0 32dbf0b3
GHSA-38rv-x7px-6hhq CVE-2026-9675 High (7.5) 8.5.0 b4c287b3
GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 8.5.0 42d49559
GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 8.2.0 a516f870
GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 8.5.0 cb105d7c
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 8.5.0 5655ea43
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 8.5.0 5655ea43
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 8.5.0 6ea54ef8

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: 32dbf0b3 websocket: limit the number of fragments in a message (also c5ed7875 handle empty fragments and stream limits)

A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.

  • Affected: applications using new WebSocket(...) or WebSocketStream
    against untrusted endpoints.
  • Workaround: none — upgrade is required.
WebSocket DoS via cumulative fragment bypass — CVE-2026-9675

GHSA-38rv-x7px-6hhq · CWE-400, CWE-770
Fix: b4c287b3 fix(websocket): enforce max payload size across fragments

Undici validated the size of individual frames but did not track cumulative size
across a fragmented message. An attacker could send many small fragments that
each pass per-frame validation but collectively exceed the configured limit,
causing memory exhaustion. This is a regression introduced in 8.1.0 (the
6.x and 7.x lines are not affected).

  • Workaround: none — upgrade is required.
TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295
Fix: 42d49559 fix: honor requestTls when proxy is SOCKS5

The ProxyAgent silently discarded the requestTls option when configured with
a SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as ca, cert, key, rejectUnauthorized, and servername,
falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.

  • Affected: ProxyAgent / Socks5ProxyAgent over SOCKS5 that rely on
    requestTls.
  • Workaround: route traffic through an HTTP-proxy ProxyAgent, where
    requestTls functions correctly.
Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734

GHSA-hm92-r4w5-c3mj · CWE-346 · Fixed in 8.2.0
Fix: a516f870 fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#​5041)

Socks5ProxyAgent reused a single connection pool across different origins
without verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.

  • Affected: applications using Socks5ProxyAgent across multiple origins
    (introduced via #​4385).
  • Workaround: use a separate agent instance per origin.

Moderate severity

Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678

GHSA-pr7r-676h-xcf6 · CWE-524
Fix: cb105d7c fix(cache): trim qualified field names

The cache interceptor mishandled responses with whitespace-padded
Cache-Control directives such as private=" authorization". In shared-cache
mode this could cause authenticated data to be cached and served to other users.

  • Affected: apps using the cache interceptor in shared mode that forward
    Authorization upstream and receive non-canonical qualified directives.
  • Workaround: disable shared-cache mode for authenticated traffic, avoid
    caching authenticated responses, or add Vary: Authorization upstream.
HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

GHSA-p88m-4jfj-68fv · CWE-93
Fix: 5655ea43 fix(cookies): preserve values and parse SameSite strictly

parseSetCookie applied percent-decoding to cookie values, turning encoded
sequences like %0D%0A and %00 into literal bytes, contrary to RFC 6265 §5.4
and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via
#​3789.

  • Workaround: sanitize values before forwarding — strip or reject CR, LF,
    NUL, ;, and =.

Low severity

Set-Cookie SameSite attribute downgrade — CVE-2026-11525

GHSA-g8m3-5g58-fq7m · CWE-183
Fix: 5655ea43 fix(cookies): preserve values and parse SameSite strictly

The cookie parser accepted SameSite values containing Strict, Lax, or
None as substrings rather than requiring exact matches per RFC 6265. Values
like SameSite=NoneOfYourBusiness parsed as None, and SameSite=StrictLax
parsed as Lax, silently weakening cookie security policies for apps that
forward parsed attributes.

HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733

GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix: 6ea54ef8 fix: guard idle socket validation to skip fresh sockets, hardened by c9fbe9d2 keep idle validation on native timers (#​5397) and ac5394b8 keep idle validation on global timers (#​5407)

An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.

  • Requirements: attacker-controlled/compromised upstream and active
    keep-alive reuse.
  • Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the
    Client or Pool.

Also in v8.5.0 (non-security)

v8.5.0 shipped the security fixes above alongside the following changes. These
are not security fixes — they are listed for completeness of the release. (The
two queue-poisoning hardening PRs, #​5397
and #​5407, are covered under
CVE-2026-6733 above and are not repeated here.)

  • HTTP/2: #5408 don't rewind kPendingIdx past in-flight requests · #5391 allow h2 POST request multiplexing · #5406 reap idle HTTP/2 sessions · #5410 preserve h2 queue on out-of-order completion
  • Features: #5416 add bodyMixin.textStream() · #5418 align EventSource with spec
  • Docs / CI / tests: #5413 document request header validation · #5383 absorb h2 stream timeout resets (test) · #5420 remove stale repro + lint · #5426 extend Windows CI timeout · #5427 detect available python in WPT runner

Full changelog: v8.4.1...v8.5.0.

Credits

Per-advisory credits (as recorded in each GHSA):

verdaccio/verdaccio (verdaccio)

v6.7.4

Compare Source

Patch Changes

  • 0205c78: fix: run jwt middleware before middleware plugins

    Register the JWT mid

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from a team as a code owner June 22, 2026 00:34
@coderabbitai

coderabbitai Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Routine dependency and tooling version bumps across the monorepo: GitHub Actions pins for CodSpeed and zizmor are updated, pnpm is upgraded to 11.8.0, vitest to 4.1.9, and several package dependencies (semver, tsdown, verdaccio, sherif, undici-types, react, react-dom, @tanstack/react-table) are bumped to newer versions.

Changes

Dependency and Tooling Version Bumps

Layer / File(s) Summary
GitHub Actions pinned version bumps
.github/workflows/benchmarks.yml, .github/workflows/zizmor.yml		 CodSpeedHQ/action bumped from v4.17.5 to v4.17.6; zizmorcore/zizmor-action bumped from v0.5.6 to v0.5.7.
Root package.json and workspace toolchain bumps
package.json, pnpm-workspace.yaml		 pnpm bumped from 11.7.0 to 11.8.0 in packageManager and engines; sherif bumped to ^1.12.0, vitest to 4.1.9; undici-types workspace override updated to 8.5.0.
Package and benchmark dependency bumps
packages/intent/package.json, benchmarks/intent/package.json		 semver bumped to ^7.8.5, tsdown to ^0.22.3, verdaccio to ^6.7.4; @codspeed/vitest-plugin bumped to ^5.6.0, vitest to 4.1.9.
Eval fixture dependency bumps
evals/intent-discovery/fixtures/router-basic/package.json, evals/intent-discovery/fixtures/start-basic/package.json, evals/intent-discovery/fixtures/table-v9-basic/package.json		 react and react-dom bumped from 19.2.0 to 19.2.7 in all three fixtures; @tanstack/react-table bumped from 9.0.0-beta.16 to 9.0.0-beta.17 in table-v9-basic.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

  • TanStack/intent#132: The main issue tracking dependency updates that are applied directly in this PR, covering all the same version bumps for toolchain and packages.

Possibly related PRs

  • TanStack/intent#164: Bumps the same CodSpeedHQ/action and zizmorcore/zizmor-action pinned revisions in the same workflow files.

Suggested reviewers

  • KevinVandy

Poem

🐇 A rabbit hops through the monorepo,
Sprinkling version bumps far and low,
pnpm, vitest, react so bright,
Semver, zizmor—all shiny and right!
Dependencies fresh, the lockfiles sing,
Hop hop hooray for each little thing! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR body is Renovate-generated and does not follow the required template sections for Changes, Checklist, or Release Impact. Rewrite the PR description using the repository template and fill in the changes, testing checklist, and release impact sections.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main purpose of the PR: updating non-major dependencies across the project.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedreact@​19.2.0 ⏵ 19.2.71001008497100
Updatedreact-dom@​19.2.0 ⏵ 19.2.71001009298100
Updated@​tanstack/​react-table@​9.0.0-beta.16 ⏵ 9.0.0-beta.19100 +110010097 -1100

View full report

@socket-security

socket-security Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 0bdbc1d to e1820a8 Compare June 24, 2026 00:20
@nx-cloud

nx-cloud Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit d0da768

Command Status Duration Result
nx affected --targets=test:eslint,test:sherif,t... ✅ Succeeded 8s View ↗
nx run-many --targets=build --exclude=examples/** ✅ Succeeded 2s View ↗

☁️ Nx Cloud last updated this comment at 2026-06-24 12:53:02 UTC

@pkg-pr-new

pkg-pr-new Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/TanStack/intent/@tanstack/intent@179

commit: d0da768

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d0da768 to 9377778 Compare June 24, 2026 16:17
@renovate

renovate Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 3 workspace projects
? Verifying lockfile against supply-chain policies (881 entries)...
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 13, reused 0, downloaded 0, added 0
Progress: resolved 18, reused 0, downloaded 0, added 0
Progress: resolved 19, reused 0, downloaded 0, added 0
Progress: resolved 21, reused 0, downloaded 0, added 0
Progress: resolved 22, reused 0, downloaded 0, added 0
[WARN] Request took 11753ms: https://registry.npmjs.org/@types%2Fnode
Progress: resolved 23, reused 0, downloaded 0, added 0
[WARN] Request took 12495ms: https://registry.npmjs.org/nx
Progress: resolved 24, reused 0, downloaded 0, added 0
[WARN] Request took 13313ms: https://registry.npmjs.org/typescript
Progress: resolved 30, reused 0, downloaded 0, added 0
Progress: resolved 132, reused 0, downloaded 0, added 0
Progress: resolved 243, reused 0, downloaded 0, added 0
Progress: resolved 280, reused 0, downloaded 0, added 0
Progress: resolved 291, reused 0, downloaded 0, added 0
Progress: resolved 407, reused 0, downloaded 4, added 0
Progress: resolved 495, reused 0, downloaded 4, added 0
[WARN] Request took 10120ms: https://registry.npmjs.org/@typescript-eslint%2Fscope-manager
Progress: resolved 523, reused 0, downloaded 4, added 0
Progress: resolved 524, reused 0, downloaded 4, added 0
[WARN] Request took 11107ms: https://registry.npmjs.org/@typescript-eslint%2Fparser
[WARN] Request took 11391ms: https://registry.npmjs.org/@typescript-eslint%2Ftypescript-estree
Progress: resolved 525, reused 0, downloaded 4, added 0
[WARN] Request took 11835ms: https://registry.npmjs.org/@typescript-eslint%2Feslint-plugin
Progress: resolved 527, reused 0, downloaded 4, added 0
Progress: resolved 536, reused 0, downloaded 4, added 0
Progress: resolved 690, reused 0, downloaded 4, added 0
[WARN] Request took 17755ms: https://registry.npmjs.org/vite
✓ Lockfile passes supply-chain policies (881 entries in 29.6s)
Progress: resolved 691, reused 0, downloaded 4, added 0
Progress: resolved 706, reused 0, downloaded 4, added 0
Progress: resolved 794, reused 0, downloaded 7, added 0
Progress: resolved 795, reused 0, downloaded 7, added 0
Progress: resolved 835, reused 0, downloaded 7, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 3 versions do not meet the minimumReleaseAge constraint:
  @codspeed/core@5.7.1 was published at 2026-06-24T09:51:32.420Z, within the minimumReleaseAge cutoff (2026-06-24T05:45:31.954Z)
  @codspeed/vitest-plugin@5.7.1 was published at 2026-06-24T09:51:44.549Z, within the minimumReleaseAge cutoff (2026-06-24T05:45:31.954Z)
  knip@6.20.0 was published at 2026-06-24T13:53:40.969Z, within the minimumReleaseAge cutoff (2026-06-24T05:45:31.954Z)

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9377778 to c069dc8 Compare June 25, 2026 05:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants