chore(deps): update all non-major dependencies#446
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
9c4e39b to
5bfebea
Compare
5bfebea to
7804f68
Compare
renovate
Bot
changed the title
7804f68 to
2d975ff
Compare
2d975ff to
0104ff1
Compare
0104ff1 to
8120e32
Compare
8120e32 to
5ec9f5e
Compare
5ec9f5e to
efcb3b7
Compare
efcb3b7 to
1a61aec
Compare
1a61aec to
cf8e7f8
Compare
cf8e7f8 to
2b13cf8
Compare
6132302 to
360e116
Compare
360e116 to
aa97a8b
Compare
aa97a8b to
714cf9d
Compare
714cf9d to
bdbb60c
Compare
bdbb60c to
9343bf3
Compare
9343bf3 to
fb7fea7
Compare
fb7fea7 to
556aaae
Compare
commit: |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This PR contains the following updates:
^9.1.0→^9.2.0^3.2.4→^3.3.1^1.0.2→^1.0.3^3.65.2→^3.65.3^3.58.1→^3.65.3^0.1.0→^0.3.0v0.0.9-mp→v0.0.9v6.0.1→v6.1.0v10.0.0→v10.4.0^0.17.0→^0.17.1^20.11.0→^20.11.1^1.0.0→^1.1.0^0.140.0→^0.141.011.15.1→11.16.011.17.0^1.404.1→^1.407.11.407.2^1.0.0→^1.407.11.407.2^3.0.0→^3.2.3^6.3.0→^6.3.1^3.3.7→^3.3.8Release Notes
antfu/eslint-config (@antfu/eslint-config)
v9.2.0Compare Source
🚀 Features
🐞 Bug Fixes
scripts-infoin package.json sorting - by @antfu (09680)eslint-plugin-astrov2 to resolve unmet peer warning - by @ycs77 in #855 (5ada5)View changes on GitHub
nuxt/devtools (@nuxt/devtools-kit)
v3.3.1Compare Source
No significant changes
View changes on GitHub
nuxt/module-builder (@nuxt/module-builder)
v1.0.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
📦 Build
🏡 Chore
resolutions/pnpm.overridestopnpm-workspace.yaml(cfb45fb)afcf2fa)aeb1d38)92eb2af)✅ Tests
809c89f)9412c91)#appornuxt/appin generated declarations (#727)🤖 CI
604d5b3)4442a14)f7be1a6)reproduction(57e7ce9)c3c8e72)d87d217)54c5f13)🎉 New Contributors
❤️ Contributors
Hebilicious/reproduire (Hebilicious/reproduire)
v0.0.9Compare Source
compare changes
actions/checkout (actions/checkout)
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
actions/stale (actions/stale)
v10.4.0Compare Source
What's Changed
Bug Fix
only-issue-typesvalidation by @trueberryless in #1338Dependency Updates
New Contributors
Full Changelog: actions/stale@v10.3.0...v10.4.0
v10.3.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.3.0
v10.2.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.2.0
v10.1.1Compare Source
What's Changed
Bug Fix
only-issue-typesby @Bibo-Joshi in #1298Improvement
Dependency Upgrades
New Contributors
Full Changelog: actions/stale@v10...v10.1.1
v10.1.0Compare Source
What's Changed
only-issue-typesoption to filter issues by type by @Bibo-Joshi in #1255New Contributors
Full Changelog: actions/stale@v10...v10.1.0
harlan-zw/eslint-plugin-harlanzw (eslint-plugin-harlanzw)
v0.17.1Compare Source
🐞 Bug Fixes
View changes on GitHub
capricorn86/happy-dom (happy-dom)
v20.11.1Compare Source
Rich-Harris/magic-string (magic-string)
v1.1.0Compare Source
Bug Fixes
Performance Improvements
Mapfor tracking chunks (#313) (25d7461)oxc-project/oxc (oxc-parser)
v0.141.0💥 BREAKING CHANGES
54cc121ast: [BREAKING] SplitMetaPropertyintoImportMetaandNewTarget(#24557) (camc314)🚀 Features
7b045cdminfier: Drop last break from last switch case (#24673) (Armano)3d22307parser: AddParseOptions::enable_ident_hashes(#24491) (Boshen)pnpm/pnpm (pnpm)
v11.16.0: pnpm 11.16Compare Source
Minor Changes
The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it.
pnpm version -randpnpm change statuscheck the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at1100.0.0with aminorchangeset is therefore published as1100.0.0rather than skipping straight to1100.1.0.Added a
--changesetflag topnpm update. Setupdate.changesettotrueinpnpm-workspace.yamlto enable this behavior by default, and use--no-changesetto override the setting for one update. After the update completes, pnpm writes a.changeset/pnpm-update-<suffix>.mdfile declaring a patch bump for every workspace package whosedependenciesoroptionalDependencieswere changed by the update and a major bump whenpeerDependencieschanged, including packages that consume an updated catalog entry via thecatalog:protocol. Private packages, packages without a name, and packages listed in theignorearray of.changeset/config.jsonare skipped. If.changeset/config.jsondoes not exist, a warning is printed and no changeset is generated.Added GitHub Actions dependencies to
pnpm outdatedand interactivepnpm update. Non-interactive updates can include them with--include-github-actionsor by settingupdate.githubActionstotrueinpnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.Added
updateandauditsettings sections topnpm-workspace.yaml, superseding the awkwardly namedupdateConfig,auditConfig, and top-levelauditLevelsettings:update.ignoreDepslists dependency name patterns thatpnpm updateandpnpm outdatedshould skip.audit.levelandaudit.ignoretunepnpm audit.The deprecated
updateConfig,auditConfig, andauditLevelsettings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.Patch Changes
pnpm add --save-exact/--save-prefixandpnpm updatewriting a package's version with thepeerDependenciesrange's prefix (e.g.^19.2.7instead of the requested19.2.7) whenever the same package also appeared inpeerDependencies. A realdependencies/devDependencies/optionalDependenciesentry now takes precedence over a same-namedpeerDependenciesentry when computing the current specifiers #13108.Platinum Sponsors
Gold Sponsors
PostHog/posthog-js (posthog-js)
v1.407.1Compare Source
1.407.1
Patch Changes
33f0bd7Thanks @marandaneto! - Send ISO feature flag timestamps in request bodies, use numericsent_atquery timestamps for capture POSTs, and preserve_cache busting for dynamic GET requests.(2026-07-23)
v1.407.0Compare Source
1.407.0
Minor Changes
#4222
0f2407bThanks @turnipdabeets! - feat: add a default-value option toisFeatureEnabledisFeatureEnabled(key, { defaultValue: false })now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows toboolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. WithoutdefaultValue, behavior is unchanged:boolean | undefined. (2026-07-22)Patch Changes
#4203
90e7483Thanks @posthog! - fix(conversations): let users start a new conversation while a ticket is still openThe support widget now surfaces the ticket list navigation (and its "New conversation"
button) whenever the user has any ticket, instead of only when they have multiple tickets
or a single resolved one. Previously a user sitting on one open, unresolved ticket was
locked into that conversation with no way to raise a second issue. (2026-07-22)
#4221
da6e082Thanks @posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callableThe wrapped
window.onerror,window.onunhandledrejection, andconsole.errorhandlerschained to the page's original handler using optional chaining, which only guards against
null/undefined. When a page had one of these set to a truthy non-callable value (e.g.via
Object.defineProperty, or clobbered by another script/extension), our wrapper threw aTypeErrorfrom inside its own handler. We now check the original handler is actuallycallable before invoking it and fall back to
falseotherwise. (2026-07-22)#4209
569fc62Thanks @posthog! - Session recording no longer emits an uncaughtTypeError: Illegal invocationfrom the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronousoriginal.set.call(this, value)still ran with a non-nativethis(a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-nativethisis skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler andgetInputTypeare similarly guarded against reading native accessors on a non-nativethis.(2026-07-22)
#4068
d5e1188Thanks @posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.(2026-07-22)
#4205
de3ad61Thanks @posthog! - Warn when session recording masking options inposthog.initshadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.(2026-07-22)
Updated dependencies [
0f2407b]:v1.406.2Compare Source
1.406.2
Patch Changes
#4206
a3112d9Thanks @posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flagRecurring surveys could re-display and record a duplicate response when the eligibility
check ran against a cached internal targeting flag before fresh flags had loaded. The
display loop now waits for feature flags to actually load before trusting the internal
targeting flag, and forces a flag reload after a survey is completed so the flag recomputes
promptly. (2026-07-21)
v1.406.1Compare Source
1.406.1
Patch Changes
220fa2cThanks @sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts(2026-07-21)
v1.406.0Compare Source
1.406.0
Minor Changes
d39b903Thanks @dustinbyrne! - Move shared browser utility implementations into@posthog/browser-commonand consume them directly fromposthog-js.(2026-07-21)
Patch Changes
ba977d0Thanks @turnipdabeets! - Keep autocapture off when a remote config response omitsautocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field.(2026-07-21)
d39b903]:v1.405.3Compare Source
1.405.3
Patch Changes
91505baThanks @pauldambra! - fix: apply the active full snapshot interval as soon as a recording trigger matches(2026-07-21)
v1.405.2Compare Source
1.405.2
Patch Changes
fbfc84fThanks @pauldambra! - feat: make the pending session recording trigger buffer interval configurable(2026-07-20)
fbfc84f]:v1.405.1Compare Source
1.405.1
Patch Changes
dec8fe7Thanks @turnipdabeets! - Internal restructuring of remote config failure handling across SDK extensions; no behavior change.(2026-07-20)
v1.405.0Compare Source
1.405.0
Minor Changes
#4172
9621830Thanks @haacked! - send minimal$feature_flag_calledevents when the server enables itWhen the v2
/flagsresponse carriesminimalFlagCalledEvents: true(or, for posthog-node local evaluation, the flag-definitions payload carriesminimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false),$feature_flag_calledevents are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties,$set/$set_once, the$feature/<key>enumeration,$active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags,has_experimentunknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration.before_sendruns after the filter and may re-add stripped properties. (2026-07-20)Patch Changes
9621830]:unjs/unhead (unhead-v3-fixture>@unhead/vue)
v3.2.3Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.2.2Compare Source
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
v3.2.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.2.0Compare Source
🚀 Features
prepareTemplate- by @harlan-zw in #830 (0b8ca)🐞 Bug Fixes
🏎 Performance
View changes on GitHub
v3.1.8Compare Source
🐞 Bug Fixes
mediaon icon links - by @harlan-zw in #821 (ce57f)View changes on GitHub
v3.1.7Compare Source
🐞 Bug Fixes
🏎 Performance
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.