fix(deps): update non-major (npm) - #207
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
renovate
Bot
force-pushed
the
renovate/non-major-npm
branch
from
August 24, 2026 13:39
0c69891 to
3fdcb60
Compare
renovate
Bot
force-pushed
the
renovate/non-major-npm
branch
from
August 24, 2026 20:55
3fdcb60 to
df0cd14
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.3.233→0.3.2392.5.8→2.5.1043.4.0→43.4.115.2.3→15.3.116.3.1→16.3.21.417.1→1.418.102.10.10→2.10.11Release Notes
anthropics/claude-agent-sdk-typescript (@anthropic-ai/claude-agent-sdk)
v0.3.239Compare Source
total_cost_usd/modelUsage.costUSDnow include the 1.1× US-only-inference (data residency) multiplier when the response reportsinference_geo: "us"total_cost_usd,duration_api_msandmodelUsageas of its release, not the turn-end snapshotSYSTEM_PROMPT_DYNAMIC_BOUNDARYin an arraysystemPromptbeing sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providersinitializeon a running process is now followed by abackground_tasks_changedsnapshot of the live background tasks, so reconnecting hosts see work that is still runningv0.3.238Compare Source
is_backgroundedandspawn_depthtotask_startedevents for subagent tasks (is_backgroundedalso on background Bash tasks)suppressOriginalPrompttoUserPromptExpansionhook output, matchingUserPromptSubmitcommand_lifecyclestaterefused: a cross-session peer message the session's receive-side policy declines now reports this terminal state instead of producing no lifecycle framesinitializeto an already-running CLI; the response now reportshooks_appliedCLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=truenot keepingprompt_suggestionmessages on when the account is near, but not over, its usage limitvcs_state_changedpush events to emit one event per pushed branchv0.3.237Compare Source
v0.3.236Compare Source
PostToolUsehooks can returnhookSpecificOutput.classifierContext, a short host-asserted note about a tool call's result that the auto mode permission classifier reads alongside that resultv0.3.235Compare Source
v0.3.234Compare Source
bypass_permissions_disabledfromExitReasontype; the value was never emitted — TypeScript consumers with an explicitcasebranch get a compile error on upgrade (runtime unaffected)ApiKeySourcetype to include the valuessystem/initactually reports (ANTHROPIC_API_KEY,apiKeyHelper,/login managed key,none)vcs_state_changedevents report the directory the shell finished in (an innercdis reflected)origininjected by the host may declare the sending session's permission class (fromMode) so a same-class message is delivered to a recipient that runs without askingSDKSystemMessage(system/init) gains an optionaleffortfield: the session's applied effort level, ornullwhen none is sent. Set on Remote Control bridge init framesbiomejs/biome (@biomejs/biome)
v2.5.10Compare Source
Patch Changes
#11403
8f7786fThanks @Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.#11403
8f7786fThanks @Princesseuh! - Fixed a bare<in Astro text being treated as the start of a tag, such as<p>5 < 6 and 7 > 6</p>. As in HTML, a<that cannot open a tag is text and needs no escaping.#11438
3133ffaThanks @Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.#11403
8f7786fThanks @Princesseuh! - Fixed #9165: an empty Astro expression such as<div>{}</div>no longer fails to parse. Astro renders{}as nothing.#11403
8f7786fThanks @Princesseuh! - Fixed Astro expressions containing a comment failing to parse.#11403
8f7786fThanks @Princesseuh! - Added support for Astro's fragment shorthand.#11403
8f7786fThanks @Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.#11403
8f7786fThanks @Princesseuh! - Fixed---being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its---lines are content.<!-- c --> --- this is text, not frontmatter ---#11403
8f7786fThanks @Princesseuh! - Fixed an Astro frontmatter block ending early on a line that merely starts with a dash.#11403
8f7786fThanks @Princesseuh! - Fixed the children of an Astro element carryingis:rawbeing parsed as markup instead of raw text. This now also covers<script>and<style>, whose contents Astro emits verbatim rather than processing, so they are no longer linted as JavaScript or CSS.#11403
8f7786fThanks @Princesseuh! - Fixed Astro rejecting attribute names that start with a colon, such as:href.#11403
8f7786fThanks @Princesseuh! - Fixed the Astro parser failing to recover from a malformed closing tag such as<div></{<//, so that a later mistake is reported where it happens rather than cascading.#11403
8f7786fThanks @Princesseuh! - Fixed{inside an Astro<math>element opening an expression. MathML is foreign content where Astro parses no expressions, so LaTeX such asR^{2x}now survives as text.<svg>is unaffected.#11403
8f7786fThanks @Princesseuh! - Fixed{{at the start of an Astro expression being read as an interpolation. Astro has no{{ }}syntax, so{{ a: 1 }}and<Comp a={{ b: 1 }} />are object literals.#11403
8f7786fThanks @Princesseuh! - Fixed expressions inside an Astro<pre>or<textarea>being read as raw text. Astro parses both as ordinary elements, so their markup and interpolations are now parsed, and a variable used only inside one is no longer reported as unused.#11403
8f7786fThanks @Princesseuh! - Added support for template literal attribute values in Astro, such as<div class=`a ${b} c`>.#11403
8f7786fThanks @Princesseuh! - Fixed Astro rejecting HTML5 unquoted attribute values that contain`,=,'or", such as<a href=a=b>and<a href=a'b>.#11393
dec5a8fThanks @1678092075! - Fixed #11207:useStrictModeno longer reports Vue event handlers such as@click="count++".#11431
c065f99Thanks @levrik! - Fixed #11429: Variables and imports used by Vue same-name bindings such as:disabledorv-bind:disabledare no longer reported as unused.#11409
405dedbThanks @ematipico! - Fixed a memory leak in the LSP server where memory usage kept growing over long editor sessions.#11422
a51eff7Thanks @dyc3! - Fixed #11416: Biome no longer crashes when parsing incomplete{let}or{const}declarations in Svelte files.#11378
34b715cThanks @Netail! - Added extra rule sources from@eslint/css.biome migrate eslintdetects rules in your eslint configurations more reliably.#11403
8f7786fThanks @Princesseuh! - Fixed{#,{/,{:and{@being read as Svelte block openings in every HTML-like file. They are now Svelte-only, so in HTML, Vue and Angular files a sequence such as{#if x}is ordinary text instead of a parse error.#11443
8d45229Thanks @ematipico! - Fixed #11390:noFloatingPromisesno longer performs unnecessary type inference on call arguments when checking methods of non-generic class instances created withnew.#11425
9c2667bThanks @dyc3! - Fixed #6426: GritQL plugins now match and rewrite metavariables embedded in quoted strings.#11441
00317c3Thanks @dyc3! - Improved performance ofuseNamedCaptureGroup,noMisplacedAssertion,noSkippedTests,noExportsInTest,noDuplicateTestHooks,noIdenticalTestTitle,useTestHooksInOrder, anduseTestHooksOnTop.v2.5.9Compare Source
Patch Changes
#11321
41386f3Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.#11248
57b197eThanks @yanthomasdev! - Expanded the environment variable metadata used bybiome rageto includeBIOME_BINARY,BIOME_LOG_FILE, andRUST_BACKTRACEas well as reworded explanations for better readability.#11377
a8798eaThanks @Netail! - Added a new nursery ruleuseNamedLayerwhich disallows anonymous cascade layers.#11327
6771cf5Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.<div> <!-- first group --> + <!-- second group --> </div>#10312
ba8aa18Thanks @dyc3! - Added the nursery ruleuseTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacingw-4 h-4withsize-4.#11333
715e0cdThanks @kkkhs! - Fixed #11328:lint/nursery/useExpectnow recognizes Vitest Browser Modeexpect.element()calls as assertions.#11343
9b98211Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in@variant, such as@xland@max-xl. These previously produced a parse error and anoUnknownAtRulesdiagnostic.#11220
3e8c488Thanks @santichausis! - Fixed #9541:noUndeclaredVariables,noUnusedImports, andnoUnusedVariablesnow correctly recognise exported variables and functions declared in one embedded<script>block as usable from a sibling<script>block, in Svelte's<script module>/<script>pair and Vue's non-setup<script>blocks.For example, Biome no longer reports
greetas undeclared in the following Svelte component:#11300
36430ebThanks @dyc3! - Fixed the HTML formatter's whitespace handling formarquee,noscript,video,audio, andobjectelements.#11299
6559e6cThanks @jp-knj! - Added the nursery ruleuseAstroClientOnlyDirectiveValue, which reports Astroclient:onlydirectives without an initializer.For example,
<Component client:only />triggers the rule.#11365
7529811Thanks @MHJahanbakhsh! - Fixed #11229: TheuseGenericFontNamesrule now treatsmathas a valid generic font family.#11346
674f5f4Thanks @Jayllyz! - Fixed #11335:noComponentHookFactoriesnow reports ause-prefixed variable only when a function is assigned to it directly.#11334
c87c46aThanks @zkasuran! - Fixed #11317:noSvgWithoutTitleno longer reports ansvgthat uses the boolean shorthandaria-hidden(equivalent toaria-hidden={true}in React).#11364
13853b1Thanks @ematipico! - Fixed a bug whereuseJsxKeyInIterableincorrectly flagged Astro files.#11321
41386f3Thanks @dyc3! - Fixed #11315: Invalid CSS declarations in HTMLstyleattributes now produce parser diagnostics instead of causing a panic.#11325
67c3bf0Thanks @dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.#11367
fe5b5d4Thanks @ematipico! - Fixed TypeScriptcompilerOptions.pathsresolution when mapping targets omit./. Biome now resolves these targets relative to their configured path base.#11316
17e48d6Thanks @wanxiankai! - Fixed #11289: the safe fix fornoExtraBooleanCastnow preserves parentheses around nested conditional expressions.#11254
d25d113Thanks @dyc3! - Fixed #11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.#11221
85aac73Thanks @freeatnet! - Added the nursery rulenoUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.#11314
7ffb677Thanks @ematipico! - Fixed #11310: Restored the performance ofnoMisusedPromisesandnoFloatingPromiseswhen analyzed expressions share deep imported type paths.#11356
6cd3263Thanks @johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar,shadow/50).#11318
76059e9Thanks @johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:,@max-lg:,@min-[400px]:) and child and descendant variants (*:,**:).#11357
faa2074Thanks @johncarmack1984! - The Tailwind parser now accepts the legacy leading!important marker (!flex,hover:!p-4).#11344
f34e15cThanks @johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:,has-[+p]:), modifiers on variants (group-hover/menu:,@sm/main:), and arbitrary container-query sizes (@[400px]:).#11324
2f5d452Thanks @dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.#11312
e65f07eThanks @xosnos! - Added a new nursery ruleuseControlLabelfor both HTML and JSX, which reports interactive control elements (button,menuitem) without an accessible label.#11364
13853b1Thanks @ematipico! - Fixed SVG parsing for files with an XML declaration followed by aPUBLICdoctype, such as<?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.#11301
610ee28Thanks @dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such assource,track, orparam.electron/electron (electron)
v43.4.1: electron v43.4.1Compare Source
Release Notes for v43.4.1
Fixes
webContents.setDevToolsWebContents(). #52937 (Also in 44)registerFileProtocolandregisterHttpProtocolreturning readable responses to cross-originno-corsfetches; they now return opaque responses likeprotocol.handle. #52853 (Also in 41, 42, 44)WebContentsViewstaying blank after its window is shown whensetBackgroundThrottling(false)was called while the window was hidden. #52864 (Also in 42, 44)systemPreferences.promptTouchID(reason)when an invalid reason value is passed. #52782 (Also in 42, 44)app.setLoginItemSettingsif a non-UTF8 service name is used. #52944 (Also in 44)tls/httpsshortly before exiting, affectingapp.exit()beforereadyand short-livedELECTRON_RUN_AS_NODE/child_process.fork()scripts. #52870 (Also in 44)contentTracing.stopRecording()when the trace file could not be written to the requested path. #52795 (Also in 42, 44)npm installfailure with no recovery path when the OS blocked the native zip extractor from loading (for example, Windows Smart App Control). #52845 (Also in 44)app.quit()while ashell.openExternal()orshell.openPath()call was still waiting on a system "Open with" dialog. #52897 (Also in 41, 44)electron-mksnapshot, and theloadBrowserProcessSpecificV8Snapshotfuse) having no effect in the main process on macOS arm64, Linux x64 and Windows x64. #52877 (Also in 42, 44)persist:prefix). #52835 (Also in 44)<webview>andwindow.opennow inheritnodeIntegrationInWorkerfrom the embedder, consistent with the other Node and sandbox preferences. #52830 (Also in 41, 42, 44)Other Changes
5246282. #528685422242,5420251. #52842Trayicons not appearing (and their menus not opening) on Linux desktops that address the StatusNotifierItem by its unique D-Bus name or via theorg.freedesktop.StatusNotifierIteminterface, such as GNOME with the AppIndicator extension, Cinnamon and XFCE. #52952speechSynthesiscould block the main process for several hundred milliseconds. #52814vercel/next.js (next)
v16.3.2Compare Source
Core Changes
Credits
Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!
PostHog/posthog-js (posthog-js)
v1.418.10Compare Source
1.418.10
Patch Changes
#4451
e1d993cThanks @posthog! - Guard the replayer's hover handling against non-element and detached hover targets, which previously threw an unhandledTypeError(querySelectorAllon a node without that method) and stopped session recording playback mid-stream.(2026-08-21)
#4557
4451274Thanks @posthog! - Keep replay playback running when a recording adopts constructed stylesheets across a document swap. A constructed stylesheet can only be adopted by the document that created it, so a sheet held over a swap is rejected and the error previously stopped the player. Adoption now falls back to whatever is already applied.(2026-08-21)
v1.418.9Compare Source
1.418.9
Patch Changes
c8df61cThanks @clr182! - fix(replay): attribute the backdated sessionIdle marker to the session that went idle, so a rotation-born session's recording no longer starts hours before its first snapshot(2026-08-21)
v1.418.8Compare Source
1.418.8
Patch Changes
6322f09Thanks @turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji.Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as
[Truncated].Type
OtlpAnyValue.intValueasstring | number— code reading that field must handle both. (2026-08-21)6322f09]:v1.418.7Compare Source
v1.418.6Compare Source
1.418.6
Patch Changes
#4578
bae46bfThanks @marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event.(2026-08-20)
#4582
aef2f49Thanks @ablaszkiewicz! - Stop building a stack frame for awindow.onerrorreport that carries no code position, such as theResizeObserverloop warning. The frame named the document URL rather than a script, so no source map could resolve it. These exceptions now arrive with no stack trace.(2026-08-20)
Updated dependencies [
bae46bf,aef2f49]:v1.418.5Compare Source
1.418.5
Patch Changes
9701637Thanks @ablaszkiewicz! - Stop counting Chromium<anonymous>stack frames (extension-injected, devtools or string-evaluated code) as in-app code.(2026-08-19)
9701637]:v1.418.4Compare Source
1.418.4
Patch Changes
b564d61Thanks @posthog! - Fix session recording in the full browser bundles.array.full.jsandmodule.full.es.jsonly inlined rrweb, so they still fetched the recorder script at runtime - the request the full bundles exist to avoid. They now inline the whole recorder. Also flags the session with$sdk_debug_recording_script_not_loadedwhen the recorder script fails to load, so a blocked recorder is visible in analytics rather than only in the console.(2026-08-19)
v1.418.3Compare Source
1.418.3
Patch Changes
3f9ba71Thanks @posthog! - Fall back to the synthetic exception stack when a capturedErrorhas no stack, so frameless failures (such as a Firefox networkfetchTypeError) keep their call-site frames and group per call site instead of merging into one issue.(2026-08-19)
3f9ba71]:v1.418.2Compare Source
1.418.2
Patch Changes
#4555
3e0edffThanks @HaynesPostHog! - Fix a Chrome renderer crash (grey "Aw, Snap" tab, "Error code: 5") that could still occur when closing an in-app survey on a heavy page such as a large dashboard.Closing a survey animated the fade-out with
document.startViewTransition, which snapshots the entire page viewport. The survey applied noview-transition-namescoping, so on a heavy host page capturing that whole-page snapshot could exhaust renderer memory and crash the tab. A previous fix addressed a related crash (a snapshot pointing at a removed node) but left the document-level transition — and its whole-page snapshot cost — in place.The survey renders in an isolated shadow root, so it never needed a document-level transition. The close now fades the popup out with a plain CSS opacity transition scoped to the survey's own container, then unmounts it once the fade has run. No whole-page snapshot, no crash, same fade-out UX. (2026-08-19)
v1.418.1Compare Source
1.418.1
Patch Changes
0599fe0Thanks @ablaszkiewicz! - Recognise Firefox and Safari extension frames when filtering extension exceptions, and stop counting Safari's maskedwebkit-masked-url://frames as in-app code.(2026-08-18)
0599fe0]:v1.418.0Compare Source
1.418.0
Minor Changes
1ade666Thanks @marandaneto! - AddcookieWinsOnConflictto keep shared cross-subdomain identity and session state ahead of stale per-origin localStorage, deprecate__preview_cookie_wins_on_conflict, and enable the new behavior for the2026-08-29defaults.(2026-08-18)
Patch Changes
1ade666]:v1.417.4Compare Source
1.417.4
Patch Changes
8d74821Thanks @ksvat! - Take a full snapshot when session recording wakes from idle if DOM mutations were dropped while idle, so replay no longer shows duplicated or overlapping DOM after an idle period.(2026-08-17)
v1.417.3Compare Source
1.417.3
Patch Changes
ce8fc13Thanks @marandaneto! - Restore exception autocapture compatibility for posthog-js clients through version 1.141.0.(2026-08-17)
v1.417.2Compare Source
1.417.2
Patch Changes
7b61aa4Thanks @posthog! - Fix error tracking coercion reporting the wrong exception type for non-Errorobjects (e.g.TypeError,ReferenceError) that are thrown by browser extensions or other cross-realm code. Previously these always reported as typeError, burying the reaConfiguration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.