Skip to content

chore(deps): update all non-major dependencies#289

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#289
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Apr 4, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@effect/cli (source) 0.75.00.75.1 age confidence
@effect/language-service ^0.84.0^0.86.0 age confidence
@effect/platform (source) ^0.94.5^0.94.5 || ^0.96.0 age confidence
@effect/platform (source) 0.96.00.96.1 age confidence
@tanstack/react-query (source) 5.96.25.100.10 age confidence
@types/node (source) 22.19.1722.19.19 age confidence
ajv (source) 8.18.08.20.0 age confidence
autoprefixer 10.4.2710.5.0 age confidence
effect (source) 3.21.03.21.2 age confidence
fs-extra 11.3.411.3.5 age confidence
nanoid 5.1.75.1.11 age confidence
playwright (source) 1.59.11.60.0 age confidence
pnpm (source) 10.33.010.33.4 age confidence
postcss (source) 8.5.88.5.14 age confidence
react-hook-form (source) 7.72.17.75.0 age confidence
safe-regex2 5.1.05.1.1 age confidence
turbo (source) 2.9.32.9.12 age confidence
yaml (source) 2.8.32.9.0 age confidence

Release Notes

Effect-TS/effect (@​effect/cli)

v0.75.1

Compare Source

Patch Changes
  • #​6144 ec5c505 Thanks @​LikiosSedo! - Fix --log-level=value equals syntax incorrectly swallowing the next argument. Only skip the next arg when the previous arg is exactly --log-level (space-separated form).

  • Updated dependencies [f99048e]:

    • effect@​3.21.1
Effect-TS/language-service (@​effect/language-service)

v0.86.1

Compare Source

Patch Changes
  • #​732 0674371 Thanks @​mattiamanzati! - Update the Effect v4 test harness and language service development dependencies to Effect 4.0.0 beta 66, including fixture updates for the latest Context service API.

v0.86.0

Compare Source

Minor Changes
  • #​728 a5b0e47 Thanks @​mattiamanzati! - Add the unsafeEffectTypeAssertion diagnostic to catch as Effect<...>, as Stream<...>, and as Layer<...> assertions that unsafely narrow the error or requirements channels.

    The rule skips channels whose original type is any and offers a quick fix that removes the assertion while preserving the original expression.

v0.85.1

Compare Source

Patch Changes
  • #​726 fd4a8da Thanks @​mattiamanzati! - Update the Effect v4 beta examples and type parsing to match the renamed Context APIs in the latest 4.0.0-beta releases.

  • #​724 14d5798 Thanks @​mattiamanzati! - Refactor Effect context tracking to use cached node context flags and direct generator lookups.

    This aligns the TypeScript implementation more closely with the TSGo version and simplifies diagnostics that need to detect whether code is inside an Effect generator.

v0.85.0

Compare Source

Minor Changes
  • #​720 4229bb9 Thanks @​mattiamanzati! - Add the nestedEffectGenYield diagnostic to detect yield* Effect.gen(...) inside an existing Effect generator context.

    Example:

    Effect.gen(function* () {
      yield* Effect.gen(function* () {
        yield* Effect.succeed(1);
      });
    });
  • #​723 da9cc4b Thanks @​mattiamanzati! - Add the effectMapFlatten style diagnostic for Effect.map(...) immediately followed by Effect.flatten in pipe flows.

    Example:

    import { Effect } from "effect";
    
    const program = Effect.succeed(1).pipe(
      Effect.map((n) => Effect.succeed(n + 1)),
      Effect.flatten
    );
  • #​718 0af7c0f Thanks @​mattiamanzati! - Add the lazyPromiseInEffectSync diagnostic to catch Effect.sync(() => Promise...) patterns and suggest using Effect.promise or Effect.tryPromise for async work.

    Example:

    Effect.sync(() => Promise.resolve(1));
  • #​714 32985b2 Thanks @​mattiamanzati! - Add processEnv and processEnvInEffect diagnostics to guide process.env.* reads toward Effect Config APIs.

    Examples:

    • process.env.PORT
    • process.env["API_KEY"]
  • #​721 f05ae89 Thanks @​mattiamanzati! - Add the unnecessaryArrowBlock style diagnostic for arrow functions whose block body only returns an expression.

    Example:

    const trim = (value: string) => {
      return value.trim();
    };
  • #​717 b77848a Thanks @​mattiamanzati! - Add newPromise and asyncFunction effect-native diagnostics to report manual Promise construction and async function declarations, with guidance toward Effect-based async control flow.

  • #​722 6f19858 Thanks @​mattiamanzati! - Add the effectDoNotation style diagnostic for Effect.Do usage and suggest migrating to Effect.gen or Effect.fn.

    Example:

    import { pipe } from "effect/Function";
    import { Effect } from "effect";
    
    const program = pipe(
      Effect.Do,
      Effect.bind("a", () => Effect.succeed(1)),
      Effect.let("b", ({ a }) => a + 1)
    );
  • #​716 c3f67b0 Thanks @​mattiamanzati! - Add cryptoRandomUUID and cryptoRandomUUIDInEffect diagnostics for Effect v4 to discourage crypto.randomUUID() in favor of the Effect Random module, which uses Effect-injected randomness instead of the global crypto implementation.

Patch Changes
Effect-TS/effect (@​effect/platform)

v0.96.1

Compare Source

Patch Changes
  • #​6147 518d0e3 Thanks @​syhstanley! - Fix HttpLayerRouter.addHttpApi silently skipping API-level middleware.

  • #​6191 c016642 Thanks @​IGassmann! - Update msgpackr to 1.11.10 to fix silent decode failures in environments that block new Function() at runtime (e.g. Cloudflare Workers). The new version wraps the JIT new Function() call in a try/catch, falling back to the interpreted path when dynamic code evaluation is blocked.

  • Updated dependencies [74f3267]:

    • effect@​3.21.2

v0.96.0

Compare Source

Patch Changes

v0.95.0

Compare Source

Patch Changes
TanStack/query (@​tanstack/react-query)

v5.100.10

Patch Changes

v5.100.9

Compare Source

Patch Changes

v5.100.8

Compare Source

Patch Changes

v5.100.7

Compare Source

Patch Changes

v5.100.6

Compare Source

Patch Changes

v5.100.5

Compare Source

Patch Changes

v5.100.4

Compare Source

Patch Changes

v5.100.3

Compare Source

Patch Changes

v5.100.2

Patch Changes

v5.100.1

Patch Changes

v5.100.0

Compare Source

Patch Changes

v5.99.2

Compare Source

Patch Changes

v5.99.1

Compare Source

Patch Changes

v5.99.0

Compare Source

Patch Changes

v5.98.0

Compare Source

Patch Changes

v5.97.0

Compare Source

Patch Changes
ajv-validator/ajv (ajv)

v8.20.0

Compare Source

What's Changed

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

postcss/autoprefixer (autoprefixer)

v10.5.0

Compare Source

  • Added mask-position-x and mask-position-y support (by @​toporek).
Effect-TS/effect (effect)

v3.21.2

Compare Source

Patch Changes
  • #​6194 74f3267 Thanks @​mikearnaldi! - Fix TestClock.unsafeCurrentTimeNanos() to floor fractional millisecond instants before converting them to BigInt.

v3.21.1

Compare Source

Patch Changes
  • #​6139 f99048e Thanks @​marbemac! - Fix batched request resolver defects causing consumer fibers to hang forever.

    When a RequestResolver.makeBatched resolver died with a defect, the request Deferreds were never completed because the cleanup logic in invokeWithInterrupt used flatMap (which only runs on success). Changed to ensuring so uncompleted request entries are always resolved regardless of exit type.

jprichardson/node-fs-extra (fs-extra)

v11.3.5

Compare Source

  • Fix ensureLink*/ensureSymlink* identical file detection on Windows (#​1068)
  • Fix error handling in timestamp preservation code (#​1065, #​1069)
  • Fix potential file descriptor leak on error in synchronous timestamp preservation code (#​1066)
ai/nanoid (nanoid)

v5.1.11

Compare Source

  • Fixed breaking Nano ID by requesting big ID.

v5.1.10

Compare Source

v5.1.9

Compare Source

  • Fixed npm package size regression.

v5.1.8

Compare Source

microsoft/playwright (playwright)

v1.60.0

Compare Source

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:

await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:

await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});

await page.locator('#dropzone').drop({
  data: {
    'text/plain': 'hello world',
    'text/uri-list': 'https://example.com',
  },
});

🎯 Aria snapshots

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:

test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});

New APIs

Browser, Context and Page
Locators and Assertions
Network
  • webSocketRoute.protocols() returns the WebSocket subprotocols requested by the page.
  • New option noDefaults in browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.
Errors and Reporting
Test runner
  • New {testFileBaseName} token in testProject.snapshotPathTemplate — file name without extension.
  • Test runner now errors when a config tries to override a non-option fixture, and rejects workers: 0 or negative values.

🛠️ Other improvements

  • HTML reporter:
    • npx playwright show-report accepts .zip files directly — no need to unzip first.
    • Steps that contain attachments inside nested children show an indicator on the parent step.
    • The repeatEachIndex is shown in the test header when non-zero.
  • Trace Viewer adds a pretty-print toggle for JSON / form request and response bodies in the network details panel.

Breaking Changes ⚠️

  • Removed long-deprecated APIs:
    • Locator.ariaRef() — use the standard locator.ariaSnapshot() pipeline.
    • handle option on BrowserContext.exposeBinding and Page.exposeBinding.
    • logger option on BrowserType.connect and BrowserType.connectOverCDP — use tracing instead.
    • Context options videosPath / videoSize — use recordVideo instead.

Browser Versions

  • Chromium 148.0.7778.96
  • Mozilla Firefox 150.0.2
  • WebKit 26.4

This version was also tested against the following stable channels:

  • Google Chrome 147
  • Microsoft Edge 147
pnpm/pnpm (pnpm)

v10.33.4: pnpm 10.33.4

Compare Source

Patch Changes

  • Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

    A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

  • Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #​11341.

Platinum Sponsors

Bit

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v10.33.3

Compare Source

v10.33.2

Compare Source

v10.33.1: pnpm 10.33.1

Compare Source

Patch Changes
  • When a project's packageManager field selects pnpm v11 or newer, commands that v10 would have passed through to npm (version, login, logout, publish, unpublish, deprecate, dist-tag, docs, ping, search, star, stars, unstar, whoami, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example, pnpm version --help print npm's help on a project with packageManager: pnpm@11.0.0-rc.3 #​11328.
Platinum Sponsors
Bit
Gold Sponsors
Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
postcss/postcss (postcss)

v8.5.14

Compare Source

v8.5.13

Compare Source

  • Fixed postcss-scss commend regression.

v8.5.12

Compare Source

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

v8.5.11

Compare Source

  • Fixed nested brackets parsing performance (by @​offset).

v8.5.10

Compare Source

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

v8.5.9

Compare Source

  • Speed up source map encoding paring in case of the error.
react-hook-form/react-hook-form (react-hook-form)

v7.75.0: Version 7.75.0

Compare Source

🦧 feat: improve get dirty fields prune empty fields (#​13363)

+ dirtyFields: { test: [{ data: false }] }
- dirtyFields: {} // removed the empty node with false value

🎹 typescript 6.0 (#​13330)
🌡️ chore: minor improvement on setValue & reset (#​13366)
🐞 fix #​13403: include setValues in FormProvider context value (#​13404)
🐞 fix: recompute isDirty after re-registering a previously unregistered field (#​13399)
🐞 fix: preserve watch updates on field array unmount fixes #​13375 (#​13385)
🐞 fix: prevent useWatch re-render when unrelated field validation is … (#​13398)

thanks to @​dfedoryshchev, @​cyky & @​gkarabelos

v7.74.0: Version 7.74.0

Compare Source

🪇 feat: setValues (#​13201)

setValues((data) => {
  return {
    ...data,
    name: 'test'
  }
})

setValues(formValues);

🐞 fix: preserve previous field value when useController name changes (#​13395)
🐞 fix: handle null parent when unregistering nested field (#​13396)
🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#​13388)
🪢 fix build to exclude test files (#​13387)

thanks to @​Yihao-G & @​mixelburg

v7.73.1

Compare Source

fastify/safe-regex2 (safe-regex2)

v5.1.1

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/safe-regex2@v5.1.0...v5.1.1

vercel/turborepo (turbo)

v2.9.12: Turborepo v2.9.12

Compare Source

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.9.11...v2.9.12

v2.9.11: Turborepo v2.9.11

Compare Source

What's Changed

Changelog

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Apr 4, 2026
@renovate renovate Bot requested a review from Zeryther as a code owner April 4, 2026 01:56
@vercel

vercel Bot commented Apr 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sdk-harmony Ready Ready Preview, Comment May 12, 2026 4:12pm

Request Review

@changeset-bot

changeset-bot Bot commented Apr 4, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: d9a91c5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate Bot changed the title chore(deps): update dependency @effect/platform to ^0.94.5 || ^0.96.0 chore(deps): update all non-major dependencies Apr 6, 2026
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7ade729 to 7fa850e Compare April 6, 2026 02:06
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7fa850e to d3b985f Compare April 7, 2026 20:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from d3b985f to 331957e Compare April 8, 2026 05:14
@socket-security

socket-security Bot commented Apr 8, 2026

Copy link
Copy Markdown

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 331957e to 4918fdd Compare April 9, 2026 10:45
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 4918fdd to 7c344c5 Compare April 10, 2026 09:23
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7c344c5 to d2bbeee Compare April 10, 2026 17:33
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from d2bbeee to 47ec870 Compare April 11, 2026 17:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 47ec870 to cf4b745 Compare April 11, 2026 21:12
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from cf4b745 to 7edb3ff Compare April 13, 2026 21:56
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7edb3ff to 9f8f308 Compare April 16, 2026 10:07
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9f8f308 to 1eebc36 Compare April 17, 2026 22:03
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 1eebc36 to 58e0e34 Compare April 18, 2026 22:03
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7f4c1dc to 9810281 Compare April 25, 2026 09:52
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9810281 to 754f466 Compare April 25, 2026 13:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 754f466 to ee95f8b Compare April 25, 2026 17:14
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from ee95f8b to 71f7f9e Compare April 25, 2026 20:50
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 71f7f9e to bc2f8a1 Compare April 25, 2026 22:33
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from bc2f8a1 to 4de4005 Compare April 26, 2026 13:20
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 4de4005 to 319c886 Compare April 26, 2026 17:32
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 319c886 to 9d80f62 Compare April 28, 2026 17:46
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 9d80f62 to 96ea25b Compare April 29, 2026 15:50
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 96ea25b to e0264b4 Compare April 30, 2026 22:34
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from e0264b4 to 34e95b4 Compare May 1, 2026 13:51
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 34e95b4 to b708d33 Compare May 2, 2026 02:29
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from b708d33 to a23618e Compare May 2, 2026 04:44
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from a23618e to d01a393 Compare May 2, 2026 13:12
@socket-security

socket-security Bot commented May 7, 2026

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants