fix: bump non-breaking dependencies to latest

[aversini]

Automated non-major dependency bump (deps-train).

package.json

• @versini/dev-dependencies-common 14.0.14 → 14.0.15
• pnpm 11.25.0 → 11.27.0

packages/static-server/package.json

• fastify 5.12.3 → 5.12.4
• open 11.0.2 → 11.0.3

packages/secret/package.json

• inquirer 14.2.1 → 14.2.2

packages/bundlecheck/package.json

• @inquirer/select 5.2.4 → 5.2.5

Transitive refresh (pnpm update) — 23 package(s) moved

Show transitive changes

• @oxc-project/types 0.148.0 → 0.149.0
• @rolldown/binding-android-arm-eabi 1.2.7 → 1.2.8
• @rolldown/binding-android-arm64 1.2.7 → 1.2.8
• @rolldown/binding-darwin-arm64 1.2.7 → 1.2.8
• @rolldown/binding-darwin-x64 1.2.7 → 1.2.8
• @rolldown/binding-freebsd-x64 1.2.7 → 1.2.8
• @rolldown/binding-linux-arm-gnueabihf 1.2.7 → 1.2.8
• @rolldown/binding-linux-arm64-gnu 1.2.7 → 1.2.8
• @rolldown/binding-linux-arm64-musl 1.2.7 → 1.2.8
• @rolldown/binding-linux-ppc64-gnu 1.2.7 → 1.2.8
• @rolldown/binding-linux-s390x-gnu 1.2.7 → 1.2.8
• @rolldown/binding-linux-x64-gnu 1.2.7 → 1.2.8
• @rolldown/binding-linux-x64-musl 1.2.7 → 1.2.8
• @rolldown/binding-openharmony-arm64 1.2.7 → 1.2.8
• @rolldown/binding-win32-arm64-msvc 1.2.7 → 1.2.8
• @rolldown/binding-win32-x64-msvc 1.2.7 → 1.2.8
• ast-v8-to-istanbul 1.0.5 → 1.0.6
• magicast 0.5.4 → 0.5.5
• nanoid 3.3.18 → 3.3.19
• obug 2.1.4 → 2.2.1
• rolldown 1.2.7 → 1.2.8
• vite 8.2.2 → 8.3.0
• yaml 2.9.0 → 2.9.1

---

What changed

@versini/dev-dependencies-common 14.0.14 → 14.0.15

dev-dependencies-common: v14.0.15

14.0.15 (2026-09-13)

Bug Fixes

• bump non-breaking dependencies to latest (#930) (dc934dd)

compare 14.0.14…14.0.15 · npm

pnpm 11.25.0 → 11.27.0

pnpm 11.27

Minor Changes

• nodeDownloadMirrors can now be set in the global config file (config.yaml) and through the PNPM_CONFIG_NODE_DOWNLOAD_MIRRORS environment variable, so a Node.js download mirror can be configured once for a machine instead of in every workspace #12124, #13611.

  PNPM_CONFIG_NODE_DOWNLOAD_MIRRORS='{"release":"https://npmmirror.com/mirrors/node/"}'

• Added a new setting trustPolicyExcludePrune (default: false). When enabled, pnpm add, pnpm update, and pnpm remove prune the entries of trustPolicyExclude in pnpm-workspace.yaml that the freshly written lockfile no longer resolves: versions that are gone are dropped (an entry is removed once none of its versions remain), and entries for packages that are no longer in the lockfile are removed too. Name patterns (@scope/*) are always kept. The cleanup is skipped when the install's lockfile does not cover the whole workspace (sharedWorkspaceLockfile: false), since entries another project still needs would look stale.

Patch Changes

• pnpm now reads the packageManager, devEngines.packageManager and runtime pins from the workspace root's package.json when lockfileDir is set. A project that moved its lockfile lost the pins it declared there #14633.

• Fixed pnpm add -g, pnpm update -g, and pnpm remove -g mutating glo

…notes truncated.

pnpm 11.26

Minor Changes

• Catalogs can now resolve workspace dependencies through the workspace: protocol.

• pnpm remove and pnpm update now accept --trust-lockfile, --no-trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after. pnpm remove checks the whole lockfile against the active policies unless --trust-lockfile is set.

• Added pnpm change check for CI validation of package versions against the versioning.epics bands and versioning.fixed groups in pnpm-workspace.yaml.

Patch Changes

• Fetch and tarball errors and retry logs now hide URL credentials, query strings, and fragments that could expose secrets.

• Fixed a race during config dependency updates that could redirect a lockfile write through a symlink #14322.

• pnpm add --allow-build=!<pkg> now correctly denies builds, including in global installs. pnpm approve-builds <pkg> and pnpm approve-builds !<pkg> now save decisions even when the package is not awaiting approval, with a warning #14067.

• Fixed pnpm audit --fix failing without a value or when followed by another flag. pnpm audit --fix=override now respects saveExact and savePrefix when writing overrides #13261, #11523.

• pnpm audit now excludes ignored advisories from vulnerability totals

…notes truncated.

compare 11.25.0…11.27.0 · npm

fastify 5.12.3 → 5.12.4

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

compare 5.12.3…5.12.4 · npm

open 11.0.2 → 11.0.3

v11.0.3

• Fix Windows launches being killed when the parent process exits 734b821

---

sindresorhus/open@v11.0.2...v11.0.3

compare 11.0.2…11.0.3 · npm

inquirer 14.2.1 → 14.2.2

inquirer@14.2.2

inquirer@14.2.2

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

• Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).
• confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

• @inquirer/core@^12.0.3
• @inquirer/prompts@^8.7.2

compare 14.2.1…14.2.2 · npm

@inquirer/select 5.2.4 → 5.2.5

releases · npm