Skip to content

Update Monthly Dev Dependencies - #3319

Open
gardener-ci-robot wants to merge 1 commit into
masterfrom
renovate/monthly-dev-dependencies
Open

Update Monthly Dev Dependencies#3319
gardener-ci-robot wants to merge 1 commit into
masterfrom
renovate/monthly-dev-dependencies

Conversation

@gardener-ci-robot

@gardener-ci-robot gardener-ci-robot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@typescript-eslint/utils (source) 8.68.0 → 8.70.1 age confidence
@vitejs/plugin-vue (source) 6.0.8 → 6.0.9 age confidence
@vitest/coverage-v8 (source) 5.0.0 → 5.0.2 age confidence
@vitest/ui (source) 5.0.0 → 5.0.2 age confidence
@vue/test-utils 2.5.0 → 2.5.1 age confidence
eslint (source) 10.10.0 → 10.11.0 age confidence
eslint-plugin-lodash 8.0.0 → 8.1.0 age confidence
eslint-plugin-security 4.0.1 → 4.1.0 age confidence
eslint-plugin-vue (source) 10.10.0 → 10.11.1 age confidence
jsdom 30.0.1 → 30.1.1 age confidence
p-event 7.1.0 → 7.1.1 age confidence
supertest 7.2.2 → 7.3.0 age confidence
vitest (source) 5.0.0 → 5.0.2 age confidence

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/utils)

v8.70.1

Compare Source

This was a version bump only for utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.0

Compare Source

This was a version bump only for utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

This was a version bump only for utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.9

Bug Fixes
Miscellaneous Chores
vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v5.0.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
vuejs/test-utils (@​vue/test-utils)

v2.5.1

Compare Source

What's Changed

New Contributors

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

eslint/eslint (eslint)

v10.11.0

Compare Source

Features
  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#​21271) (Pavel)
  • 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#​21316) (electrohyun)
  • d3dd47f feat: only exempt new-cap built-ins that reference the global (#​21290) (sethamus)
Bug Fixes
  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#​21311) (xbinaryx)
  • b684bb1 fix: make TimePass.parse optional in types and docs (#​21313) (ntnyq)
  • 26d11bc fix: don't report __proto__ properties in object-shorthand (#​21310) (xbinaryx)
Documentation
  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#​21312) (bytedoe)
  • 6c789ff docs: Update README (GitHub Actions Bot)
  • 5997825 docs: clarify preserve-caught-error known limitation (#​21294) (Akinyemi Toluwalase)
Chores
  • 520dd77 perf: Implement fast paths in critical areas (#​21210) (Nicholas C. Zakas)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#​21330) (Francesco Trotta)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#​21331) (renovate[bot])
  • 24310e3 chore: update ecosystem plugins (#​21324) (ESLint Bot)
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#​21318) (dependabot[bot])
  • ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#​21221) (Nicholas C. Zakas)
  • c832660 chore: Upgrade Stylelint to the latest version in docs (#​21245) (Jung Hyeon Jun)
  • f9f88fc chore: update ecosystem plugins (#​21308) (ESLint Bot)
  • fc81076 ci: add more types integration tests (#​20395) (Nitin Kumar)
idok/eslint-plugin-lodash (eslint-plugin-lodash)

v8.1.0

Compare Source

  • [prop-shorthand] fix ESLint v9 incompatibility #1
  • upgrade yarn d16fe8d
  • update node actions 8e2c2d2
  • fix package json 8b024d1
eslint-community/eslint-plugin-security (eslint-plugin-security)

v4.1.0

Compare Source

Features
Bug Fixes
vuejs/eslint-plugin-vue (eslint-plugin-vue)

v10.11.1

Compare Source

Patch Changes

v10.11.0

Compare Source

Minor Changes
Patch Changes
  • Fixed vue/use-v-on-exact to avoid reporting @keydown.stop when paired with an exact key-specific listener (#​3082)
  • Specified explicit items policies for array rule option schemas (#​3112)
  • Updated resources (HTML elements) (#​3132 and #​3133)
jsdom/jsdom (jsdom)

v30.1.1

Compare Source

  • Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
  • Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
  • Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
  • Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
  • Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
  • Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
  • Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
  • Fixed the storageQuota option being ignored by frames.
  • Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
  • Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
  • Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
  • Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
  • Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

Compare Source

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

  • Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
  • Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
  • Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
  • Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
  • Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
  • Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
  • Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
  • Changed window.close() to preserve access to the document and its DOM through retained references.
  • Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
  • Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
  • Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
  • Fixed :focus matching in shadow trees. (@​asamuzaK)
  • Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
  • Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
  • Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
  • Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
  • Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
  • Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
  • Fixed successful cached resource loads being treated as aborted.
  • Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
  • Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
  • Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
  • Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
  • Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
  • Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
  • Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
  • Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
  • Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
  • Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
  • Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
  • Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
  • Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
  • Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
  • Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
  • Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
  • Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
  • Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
  • Fixed storage events being sent to windows created after the storage change, and ensured surviving recipients still receive events when the source document is destroyed.
  • Fixed attribute lookups after namespace prefix changes, and namespaced attributes incorrectly affecting ID lookups and element behavior. (@​scttcper)
  • Fixed input.list in detached element trees. (@​scttcper)
  • Fixed attr.ownerDocument after setting an attribute node on an element in another document or adopting its element. (@​Kjubikstronk)
  • Fixed fresh element.getElementsByTagName() calls using the previous document's case-sensitivity rules after adoption between HTML and XML documents. (@​Kjubikstronk)
  • Fixed element.tagName returning stale casing after adoption between HTML and XML documents.
  • Fixed radio button grouping and checkedness updates for controls with different form owners, controls outside their form, unnamed controls, and canceled clicks.
  • Fixed <select> selection updates when moving options, and unintended selection resets when moving a whole <select> or changing unrelated descendants.
  • Fixed cloning <input> elements to preserve input.indeterminate.
  • Fixed focus state after removing a focused element or its ancestor, including inside shadow trees.
  • Fixed script execution when inserting children into a connected, empty <script>. (@​Kjubikstronk)
  • Fixed incorrect script execution after changes to src="", and handling of type="", for="", and event="".
  • Fixed document.currentScript during nested script execution and scripts in shadow trees.
  • Fixed event dispatch, window.event, and default passive listener handling for non-node event targets, and event dispatch when user code modifies window.constructor.
  • Fixed volumechange and ratechange events to fire asynchronously. (@​christianaurichzm)
  • Fixed DOM APIs accepting user-created proxies around DOM objects where genuine DOM objects are required.
  • Fixed XPath iterator invalidation after DOM mutations and errors for invalid result types.
  • Fixed NodeIterator traversal when its filter removes nodes.
  • Fixed fileReader.readAsText() to honor the blob's MIME type charset when no supported explicit encoding is supplied.
  • Fixed fractional seconds in time input parsing and serialization. (@​Jaybhade)
  • Fixed large input.valueAsNumber assignments for time and local date/time inputs.
  • Fixed hard wrapping of <textarea> values to use the numeric textarea.cols value.
  • Fixed document.readyState to be "complete" for documents created with document.implementation.createDocument() and document.implementation.createHTMLDocument().
  • Fixed element.translate for empty translate="" values and elements without a parent.
  • Fixed XML parsing of lone surrogates to replace them with the Unicode replacement character.
  • Fixed node.lookupNamespaceURI() for the xml and xmlns prefixes. (@​vojtisprime11)
  • Fixed <base> elements to ignore data: and javascript: URLs. (@​vojtisprime11)
  • Fixed svgElement.viewportElement inside <symbol> elements.
  • Fixed the default blobEvent.timecode to be NaN.
  • Fixed the object shape and property descriptors of CSS.
sindresorhus/p-event (p-event)

v7.1.1

Compare Source

  • Fix: Reject pending iterator reads when resolution filters fail (#​56) ec26d45
ladjs/supertest (supertest)

v7.3.0

Compare Source

  • fix: stabilize ephemeral server requests and assertions 71dc5fb
  • Merge pull request #​883 from forwardemail/dependabot/npm_and_yarn/multi-acd8535d99 3b5ba5c
  • Merge pull request #​886 from forwardemail/dependabot/npm_and_yarn/picomatch-2.3.2 c3419b2
  • Merge pull request #​887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1 7e409db
  • Merge pull request #​898 from forwardemail/dependabot/npm_and_yarn/brace-expansion-1.1.21 b55a7f9
  • Merge pull request #​899 from forwardemail/dependabot/npm_and_yarn/browserslist-4.29.0 7a5deaa
  • Merge pull request #​900 from forwardemail/dependabot/npm_and_yarn/fast-uri-3.1.8 a75f6ee
  • Merge pull request #​901 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.15.2 c2cb33e
  • Merge pull request #​896 from pnookala-godaddy/codex/ephemeral-loopback-bind 7fb34e7
  • chore(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 c357584
  • chore(deps-dev): bump browserslist from 4.25.1 to 4.29.0 2a01b57
  • chore(deps-dev): bump fast-uri from 3.0.6 to 3.1.8 343394d
  • chore(deps-dev): bump brace-expansion from 1.1.12 to 1.1.21 6b203e9
  • Merge pull request #​881 from forwardemail/dependabot/npm_and_yarn/qs-6.14.2 d40ca7e
  • fix: match ephemeral server address family b6f5995
  • chore(deps-dev): bump lodash from 4.17.21 to 4.18.1 81766ca
  • chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 985ac7c
  • chore(deps): bump minimatch 58baa5f
  • chore(deps): bump qs from 6.14.1 to 6.14.2 c406e82

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@gardener-ci-robot gardener-ci-robot added kind/enhancement Enhancement, improvement, extension renovate labels Oct 1, 2026
@gardener-prow

gardener-prow Bot commented Oct 1, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign grolu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: fab07694-6e5f-49f8-b19d-d7bd57a939b7

📥 Commits

Reviewing files that changed from the base of the PR and between 112b793 and c7cde95.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (1)
  • .pnp.cjs

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

Walkthrough

The Yarn package-resolution map updates Vitest, ESLint, typescript-eslint, and related dependency versions and references. It also removes the siginfo and stackback resolution records.

Changes

Dependency resolution refresh

Layer / File(s) Summary
Update package resolutions
.pnp.cjs		 The map updates Vitest, ESLint, typescript-eslint, and related package resolutions. It also updates jsdom and other dependency records, changes dependency references, and removes the siginfo and stackback records.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: petersutter

Merge Risk: ⚪ Minimal · up to c7cde

This development-dependency refresh is consistent across the lockfile and generated package map. No concrete merge-blocking issue remains; proceed with normal CI checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description provides detailed dependency changes and release notes, but it omits most required template sections, including /area, /kind, issue references, reviewer notes, and the release note blo… Add the required template sections. Set appropriate /area and /kind values, state what the PR does and why, provide issue information or explicitly state that no issue applies, add reviewer notes, and complete the release note block or ente…
✅ Passed checks (4 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly summarizes the main change: a monthly update to development dependencies.
Full details: Description check

Explanation

The description provides detailed dependency changes and release notes, but it omits most required template sections, including /area, /kind, issue references, reviewer notes, and the release note block.

Resolution

Add the required template sections. Set appropriate /area and /kind values, state what the PR does and why, provide issue information or explicitly state that no issue applies, add reviewer notes, and complete the release note block or enter NONE.

  • Fix all pre-merge checks with AI
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@gardener-prow gardener-prow Bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Oct 1, 2026
@gardener-ci-robot
Update Monthly Dev Dependencies
c7cde95 
Signed-off-by: gardener-ci-robot <gardener.ci.robot@gmail.com>
@gardener-ci-robot
gardener-ci-robot force-pushed the renovate/monthly-dev-dependencies branch from 112b793 to c7cde95 Compare October 1, 2026 11:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kind/enhancement Enhancement, improvement, extension renovate size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gardener-ci-robot