Skip to content

Update all dependencies - #1619

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies
Open

Update all dependencies#1619
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies

Conversation

@renovate

@renovate renovate Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@kobalte/core (source) 0.13.12 → 0.13.13 age confidence
@solidjs/start (source) 2.0.0 → 2.0.4 age confidence
@typescript-eslint/eslint-plugin (source) 8.65.0 → 8.68.0 age confidence
@typescript-eslint/parser (source) 8.65.0 → 8.68.0 age confidence
eslint (source) 10.7.0 → 10.9.1 age confidence
eslint-plugin-solid ^0.14.5 → ^0.17.0 age confidence
globals 17.7.0 → 17.11.0 age confidence
pnpm (source) 11.20.0 → 11.24.0 age confidence
solid-js (source) 1.9.14 → 1.9.15 age confidence
typescript-eslint (source) 8.65.0 → 8.68.0 age confidence
vite (source) 8.2.1 → 8.2.2 age confidence
zod (source) 4.4.3 → 4.5.4 age confidence

Release Notes

kobaltedev/kobalte (@​kobalte/core)

v0.13.13

Patch Changes

  • cb89022: ## v0.13.13 (August 10, 2026)

    新建 features

    Bug fixes

    • Defer aria-hidden in ariaHideOutside to avoid focus warning (#​700)
    • Tabs: Skip indicator animation on initial render (#​704)
    • Prevent default in selection escape handler only when empy disallowEmptySelection (#​708)
    • Tooltip: button type (#​708)
    • Combobox: clear input on blur (#​708)
    • Select: call onChange only when changed (#​708)
    • Set form control label for attribute during ssr (#​708)
solidjs/solid-start (@​solidjs/start)

v2.0.4

比较 Source

Patch Changes

  • ac3f321: Parse stack traces in the dev toolbar's error overlay with error-stack-parser-es/lite instead of error-stack-parser. The lite entry point is a much smaller, ESM-only parser that returns plain frame objects rather than class instances, and it no longer pulls in the stackframe package. Errors that carry no stack are now handled as an empty frame list instead of throwing.

  • ac3f321: Redesign the dev toolbar. The toolbar and its panels share a common set of design tokens, giving them a consistent dark palette, translucent surfaces, and elevation. The server function inspector is now a master-detail split with a persistent call list beside the request/response pane, and the error overlay places the stack frame list beside a code preview that fills the panel. Headers, form data, and URL search params render as aligned key-value tables, the hex viewer gains an offset gutter with the ASCII column aligned per row, and blobs are shown as file cards with their type and size. The seroval body inspector is now an expandable tree with collapsed previews, syntax-colored values, cycle detection, and live promise and stream state, replacing the previous column-based drill-down.

    Along with the redesign, the toolbar only starts a drag from the toolbar itself rather than from its panels, unhandled promise rejections are captured by the error overlay, the code preview shows more surrounding lines, and a stack frame whose source cannot be loaded now stays listed and reports that its source is unavailable instead of silently rendering nothing.

  • ac3f321: Use @jridgewell/trace-mapping instead of source-map-js to resolve original sources in the dev toolbar's error overlay. It decodes mappings lazily, so only the positions actually inspected are resolved, it is significantly smaller in the browser bundle, and it understands indexed source maps.

  • f619c7f: Pre-bundle the dev toolbar's CommonJS dependencies so it no longer throws on every dev page load

  • d43ad1b: Update Solid to 1.9.15 to include the latest lazy loading and hydration fixes

v2.0.3

比较 Source

Patch Changes
  • 91fc972: Prefix production entry scripts, stylesheets, modulepreloads, and serialized manifest paths with Vite's configured base URL.

v2.0.2

比较 Source

Patch Changes
  • e21fadf: fix potentially incomplete first chunk for chunk readers
  • d78288f: Declare an explicit Content-Type: text/plain; charset=utf-8 on seroval-stream server function responses (success and error paths) so intermediaries cannot content-sniff a type onto them

v2.0.1

比较 Source

Patch Changes
  • fd5e2ae: Delegate vite preview to Nitro when its preview plugin is active, including for static builds that intentionally have no server entry.
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.68.0

比较 Source

🚀 Features
  • eslint-plugin: [strict-void-return] add fix suggestions (#​12086)
🩹 Fixes
  • eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#​12739)
  • eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#​12646)
  • eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#​12711)
  • eslint-plugin: [unified-signatures] report identical signatures (#​12678)
  • eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#​12707)
  • eslint-plugin: [unified-signatures] deduplicate types in report (#​12656)
❤️ Thank You

See GitHub 发布 for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

比较 Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub 发布 for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

比较 Source

🩹 Fixes
  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#​12617)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#​12588)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#​12607)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#​12591)
  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#​12590)
❤️ Thank You

See GitHub 发布 for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.68.0

比较 Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub 发布 for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

比较 Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub 发布 for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

比较 Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub 发布 for more information.

You can read about our versioning strategy and releases on our website.

eslint/eslint (eslint)

v10.9.1

比较 Source

v10.9.0

比较 Source

v10.8.1

比较 Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub 操作 Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub 操作 Bot)
  • 8a10424 docs: Update README (GitHub 操作 Bot)
  • 69bb948 docs: Update README (GitHub 操作 Bot)

Chores

v10.8.0

比较 Source

Features

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
  • b2c608c fix: 新建Expression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub 操作 Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)
solidjs-community/eslint-plugin-solid (eslint-plugin-solid)

v0.17.0

比较 Source

Server functions are core in Solid 2.0, so the plugin now lints them. Four new rules cover the "use server" directive's silent failure modes — all enabled as errors in the v2 and v2-strict configs, and verified against the official Solid 2.0 templates (zero findings) and under Oxlint.

新建 Rules
  • solid/valid-use-server. The compiler only honors "use server" in specific positions and silently ignores it everywhere else — often shipping database access or secrets to the client without any error. Flags directives that aren't in the directive prologue (after other statements, inside plain blocks), template-literal "directives", and directives in positions the compiler never extracts (object methods, getters/setters, class methods). For module-level directive files, also flags non-function exports (which fail at server boot) and calls to client declaration wrappers (GET, live, withMeta from @solidjs/web; query, action, liveQuery from @solidjs/router), whose client-side behavior is silently compiled out in such files. A clientWrappers option adds project-specific wrapper names, with * wildcard and /regex/ support.
  • solid/require-async-server-function. On the client every server function call resolves a Promise, but during SSR the function is called in-process and returns synchronously — so a non-async server function observes two different return types, and TypeScript only sees one of them. Covers function-level directives and all exports of module-level directive files (including export { name } specifiers). Autofixes by inserting async.
  • solid/no-invalid-server-capture. An editor-time mirror of the compiler's closure-capture validation: server functions cannot capture variables from intermediate scopes (component state, enclosing function parameters), because the extracted function is hoisted to module level on the server and becomes a network proxy on the client. The compiler already rejects this at build time; the rule reports the same captures as you type. Module top-level bindings, imports, globals, own params/locals, named-function-expression self-references, and TS type-only references are all allowed.
  • solid/no-browser-globals-in-server-function. Flags unambiguous browser-only globals (window, document, localStorage, etc.) inside server functions, which only run on the server. The list is deliberately conservative — server runtimes provide fetch, crypto, URL, and even navigator, so those never warn — and shadowing bindings and typeof window guards are ignored. In module-level directive files, the whole module is checked.
Internal
  • customReactiveFunctions-style pattern matching (exact names, * wildcards, /regex/ strings) was extracted into a shared createNameMatcher utility, now used by both solid/reactivity and solid/valid-use-server.

Full Changelog: solidjs-community/eslint-plugin-solid@v0.16.1...v0.17.0

v0.16.1

比较 Source

A precision pass over solid/reactivity, driven by the longest-standing false-positive reports in the tracker. Every fix landed with a regression test reproducing the original issue, and the Solid 2.0 templates still lint clean.

Fixes
  • Context provider value gets a real explanation (#​209). Passing a reactive expression to a provider's value prop previously produced the generic "should be used within JSX" message — nonsense for something that is in JSX. It now reports a dedicated message explaining that providers read value once, untracked, when created (true in both Solid 1.x and 2.0), and to pass the signal, memo, or store itself. Detection also now covers the Solid 2.0 form, where the context object is used directly as the provider (<MyContext value={...}>), by resolving JSX names to createContext() calls.
  • createResource argument shapes (#​199, #​195). createResource(fetcher, options) no longer treats the fetcher as a tracked scope (so async fetchers with an options object stop reporting noAsyncTrackedScope), and in createResource(source, fetcher) the fetcher is now correctly treated as an untracked called function that may be async and read current values. The source remains a synchronous tracked scope.
  • Destructuring props inside a tracked scope (#​191). const { item } = props inside createMemo/createEffect re-runs on updates and no longer warns. Destructuring at component setup level still does.
  • window.setTimeout and friends (#​194). Timer and scheduling callbacks prefixed with window., globalThis., or self. now get the same called-function treatment as the bare globals.
  • mergeProps/merge function arguments are tracked scopes (#​179). Both wrap function sources in createMemo, so reactive reads inside them no longer warn.
  • Memos passed to functions are as safe as signals (#​182). Passing a createMemo accessor to a create*/use*/custom reactive function no longer warns, matching the existing allowance for signals.
  • Directly-returned create* calls (#​52). return createMemo(...) (or as an arrow body) no longer reports shouldAssign — the result is handed to the caller, like a custom primitive.
  • Functions passed to calls inside tracked scopes (#​197). An inline function passed to an unknown call inside an effect (doSomething(() => props.toggle)) no longer warns, matching the existing behavior for named functions: synchronous calls still run tracked, and later calls poll current values.
Features
  • Patterns in customReactiveFunctions (#​176). Entries now support * wildcards ("watch*") and regexes written as "/pattern/" strings, in addition to exact names.

v0.16.0

比较 Source

The complete Solid 2.0 lint surface: version-aware rules, new v2 / v2-strict configs, and a
full set of 2.0-specific rules, all vetted against the official Solid 2.0 templates (which lint
clean with zero errors and zero warnings under the v2 config).

Features
  • settings.solid.version. Rules can now read the targeted Solid major version from ESLint
    settings (settings: { solid: { version: 2 } }). Unset means the permissive dual-version
    behavior from 0.15. The new configs preset it; any custom config can opt in with one line.
  • 新建 v2 config (eslint-plugin-solid/configs/v2, also solid.configs.v2): what the
    official Solid 2.0 templates ship. Sets the version setting, switches existing rules to strict
    2.0 semantics, and enables the new 2.0 rules — errors are reserved for near-certain bugs,
    heuristics stay warnings.
  • 新建 v2-strict config (eslint-plugin-solid/configs/v2-strict): everything in v2 plus
    the plugin's strongest opinions (see below).
  • 新建 rule solid/removed-api (error in v2): flags removed/renamed 1.x APIs with
    autofixes where mechanical (onMount→onSettled, batch→flush, mergeProps→merge,
    unwrap→snapshot, equalFn→isEqual, getListener→getObserver,
    classList={{...}}→class={{...}}, "solid-js/web"→"@solidjs/web",
    "solid-js/store"→"solid-js") and prescriptive migration messages otherwise
    (createResource, on, Suspense→Loading, Index→<For keyed={false}>, produce, etc.).
    Lists verified against the Solid 2.0 RC source.
  • 新建 rule solid/no-single-arg-create-effect (error in v2): Solid 2.0 requires the split
    createEffect(compute, effect) form. The single-argument 1.x form produces no TS compile error
    on a bare statement call and only throws at runtime in dev mode; this rule is the build-time
    hard stop for the most commonly reproduced AI mistake.
  • 新建 rule solid/no-accessor-as-prop (error in v2): <div title={count} /> silently
    renders a stringified function. Fires on any expression that statically resolves to a function
    in a value-typed DOM attribute, with a message that states the fix (count → count()).
    Event handlers, ref, children, namespaced attributes, components, and custom elements are
    exempt.
  • 新建 rule solid/prefer-structured-class (warning in v2, error in v2-strict): nudges
    manually-built class strings (concatenation with conditionals, conditional template literals,
    .join(" ")) toward the structured array/object ClassValue forms that Solid 2.0 accepts
    natively. Static strings and plain interpolation are untouched.
  • 新建 rule solid/no-module-scope-reactive-primitive (error in v2-strict only): reactive
    state at module scope is shared across SSR requests. createRoot-wrapped module state is the
    deliberate escape hatch and is not flagged.
  • 新建 rule solid/prefer-onSettled-for-side-effects (warning in v2-strict only): flags
    side-effectful setup (timers, global listeners, observers) in component bodies, where it also
    runs during SSR; suggests onSettled. Never flags onCleanup itself.
  • 新建 rule solid/no-restated-default-options (error in v2-strict only, autofixable):
    removes restated defaults like <For keyed={true}> and <Show keyed={false}>.
  • Version-2 behavior in existing rules (active when settings.solid.version is 2):
    • solid/no-unknown-namespaces inverts its premise: namespaces are no longer reserved in 2.0,
      so any colon-name is a legal literal attribute — but the formerly-special prefixes use:,
      attr:, bool:, on:, and oncapture: are flagged as near-certain 1.x migration bugs with
      per-prefix guidance. prop: remains the only special namespace.
    • solid/event-handlers graduates from style to correctness: only camelCase onClick is an
      event handler in 2.0; a lowercase onclick with a function value is a listener that will
      never fire (autofixed to camelCase for known DOM events). Lowercase names with static string
      values are legitimate literal attributes and are no longer flagged. onDoubleClick (which
      lowercases to a nonexistent DOM event) is autofixed to onDblClick.
    • solid/imports requires the 2.0 export locations: store exports from core "solid-js", web
      exports from "@solidjs/web". The legacy solid-js/store / solid-js/web subpaths are
      solid/removed-api's territory, avoiding double reports.
    • solid/jsx-no-undef auto-imports the 2.0 control-flow components (For, Repeat, Show,
      Switch, Match, Errored, Loading, Reveal); Index is no longer suggested.
    • solid/reactivity delegates its uncalled-signal-in-DOM-attribute case to
      solid/no-accessor-as-prop so a node never gets two reports.
    • solid/no-react-deps self-gates off (a dependency array in the second argument is already a
      type and runtime error in 2.0).
  • Template vetting. A fixture test runs the v2 config over sources copied from the official
    Solid 2.0 templates in CI, and test/lint-templates.mjs sweeps a local solidjs/templates
    checkout. All eleven solid-v2/* templates lint clean.

v0.15.0

比较 Source

The revival release: Solid 2.0 support and a modernized toolchain.

Breaking Changes

  • ESLint v9 and v10 only. The eslint peer dependency range is now ^9.0.0 || ^10.0.0. Support for ESLint v6–v8 has been dropped.
  • Flat config only. The legacy eslintrc-style plugin:solid/recommended and plugin:solid/typescript configs have been removed, matching ESLint v10's removal of the eslintrc system. Use eslint-plugin-solid/configs/recommended / eslint-plugin-solid/configs/typescript, or the configs on the root export (solid.configs.recommended / solid.configs.typescript). The configs["flat/recommended"] and configs["flat/typescript"] names from 0.14.x still work as aliases.
  • Node.js 22+ required. The engines.node field is now >=22.0.0 (Node 20 reached end-of-life in April 2026).

Features

  • Solid 2.0 API support in solid/reactivity. The rule now recognizes, alongside the 1.x APIs: createProjection, createOptimistic, createOptimisticStore, merge, omit, isPending, latest, resolve, deep, repeat, flush, action, onSettled, createTrackedEffect, createErrorBoundary, createLoadingBoundary, createRevealOrder, function-form createSignal(fn) / createStore(fn), split effects (createEffect(compute, effect)), async computations (e.g. createMemo(async () => ...)), and <For>'s keyed prop callback shapes. Imports from @solidjs/signals are recognized as Solid imports. Callsites whose meaning differs between 1.x and 2.0 are resolved permissively so that neither interpretation warns.
  • 新建 readAfterAwait warning in solid/reactivity. In async computations (async createMemo, function-form derived primitives), reactive reads placed after the first await or yield are not tracked—in 1.x they behave like reads in an event handler, and in 2.0 they can observe unpredictable mid-transition state. The rule now reports these reads specifically and suggests reading the value before the computation suspends.
  • solid/imports understands Solid 2.0 export locations. createStore, reconcile, and store types imported from core solid-js (their 2.0 home) are no longer flagged.
  • Oxlint support. The plugin runs under Oxlint's jsPlugins without modification; see the README for setup.

Internal

  • Removed the ESLint v6–v8 test matrix; tests run against typescript-eslint, Babel, and espree parsers on ESLint 10.
  • Toolchain updated: pnpm 11, typescript-eslint 8.67, vitest 4, TypeScript 5.9; CI tests Node 22/24/26.
  • CI publishing switched from a stored npm token to npm Trusted Publishing (OIDC).
  • Fixed silently-broken docs generation (auto-generated CASES sections regenerate again).

Full Changelog: solidjs-community/eslint-plugin-solid@v0.14.5...v0.15.0

sindresorhus/globals (globals)

v17.11.0

比较 Source

v17.10.0

比较 Source

v17.9.0

比较 Source

v17.8.0

比较 Source

pnpm/pnpm (pnpm)

v11.24.0: pnpm 11.24

比较 Source

Minor Changes
Patch Changes

  • Fixed pnpm v11 incorrectly reporting confirmModulesPurge as unrecognized when set in pnpm-workspace.yaml. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting.

  • pnpm install --frozen-lockfile no longer fails with ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE when the pinned pnpm version recorded in pnpm-lock.yaml has to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged #​14124.

  • Under nodeLinker: hoisted, peer-resolution variants of an injected directory dependency (a file: snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this.

  • Fixed pnpm install --merge-git-branch-lockfiles --frozen-lockfile failing with ERR_PNPM_OUTDATED_LOCKFILE when a branch lockfile predates the removal of a dependency, or its move to another dependency group #​13966. A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it.

  • Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the publish and postpublish scripts after each completed registry group pnpm/pnpm#14101.

  • The Rust CLI now honors five settings it recognized but ignored: updateNotifier, legacyDirFiltering, initAuthorName / initAuthorEmail / initAuthorUrl, initLicense, and initVersion. pnpm install and pnpm add check once a day for a newer pnpm and print how to get it (turn it off with updateNotifier: false); a {<dir>} filter selector can go back to matching the subtree below the directory with legacyDirFiltering: true; and pnpm init writes the configured author, license, and version into the package.json it scaffolds. PNPM_CONFIG_INIT_VERSION is now read as well.

    maxsockets, npm's spelling of maxSockets, is no longer ignored: both spellings are read from pnpm-workspace.yaml, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently.

    A lastUpdateCheck timestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around.

    legacyDirFiltering no longer reaches the workspace-root selectors pnpm generates for itself: the !{<workspace-root>} exclusion a recursive run / exec / add / test appends, and the {<workspace-root>} inclusion --workspace-root appends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and --workspace-root pulled in every project below the root instead of the root alone #​14101.

  • pnpm install --frozen-lockfile no longer fails when pnpm-lock.yaml records the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block #​14124.

v11.23.0: pnpm 11.23

比较 Source

Minor Changes

  • pnpm config get and pnpm config list now show the settings pnpm acts on under their documented names:

    • registries shows the registries pnpm resolves from, merged across every source (.npmrc, pnpm-workspace.yaml, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare @ scope. Built-in routes are included — the @jsr scope and the npmjs and gh prefixes — unless pointed elsewhere. Previously pnpm config get registries printed undefined.
    • update and audit show the effective sections, whichever spelling set them. The deprecated internal spellings (updateConfig, auditConfig, auditLevel) are no longer listed.
    • catalogs shows the complete resolved catalog set — the singular catalog block is its default entry — whichever spelling declared it.
    • The registry and @scope:registry entries show the merged routes rather than raw .npmrc values, so they always agree with the registries view.

  • 设置 that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level pnpm-workspace.yaml (where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example, globalShims is a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 2 workspace projects
? Verifying lockfile against supply-chain policies (689 entries)...
✓ Lockfile passes supply-chain policies (689 entries in 8.5s)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 28, reused 0, downloaded 0, added 0
Progress: resolved 35, reused 0, downloaded 0, added 0
Progress: resolved 37, reused 0, downloaded 0, added 0
Progress: resolved 174, reused 0, downloaded 0, added 0
Progress: resolved 213, reused 0, downloaded 0, added 0
Progress: resolved 217, reused 0, downloaded 0, added 0
Progress: resolved 219, reused 0, downloaded 0, added 0
Progress: resolved 223, reused 0, downloaded 0, added 0
Progress: resolved 441, reused 0, downloaded 0, added 0
Progress: resolved 465, reused 0, downloaded 0, added 0
Progress: resolved 550, reused 0, downloaded 0, added 0
Progress: resolved 649, reused 0, downloaded 0, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 1 version does not meet the minimumReleaseAge constraint:
  eslint-plugin-solid@0.17.0 was published at 2026-08-29T06:29:45.547Z, within the minimumReleaseAge cutoff (2026-08-22T18:30:44.492Z)

@bolt-new-by-stackblitz

bolt-new-by-stackblitz Bot commented Aug 9, 2026

Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@netlify

netlify Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown

❌ Deploy Preview for solid-docs failed. Why did it fail? →

Name Link
🔨 Latest commit c077894
🔍 Latest deploy log https://app.netlify.com/projects/solid-docs/deploys/6a92a5f6566b6e000855b7d8

@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 7 times, most recently from 3ff6aca to 0762c60 比较 August 18, 2026 14:57
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 8 times, most recently from ed0751a to ac284e5 比较 August 25, 2026 14:07
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch from e175123 to 0bedba3 比较 August 28, 2026 22:53
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch from 0bedba3 to c077894 比较 August 29, 2026 09:27
注册 for free to join this conversation on GitHub. Already have an account? 登录 to comment

Reviewers

No reviews

Assignees

No one assigned

标签

None yet

项目

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants