Update all dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@fontsource-variable/geist (source)	5.2.9 → 5.3.0
@fontsource-variable/geist-mono (source)	5.2.8 → 5.3.0
@kobalte/core (source)	0.13.11 → 0.13.12
@solid-primitives/event-listener (source)	2.4.5 → 2.4.6
@solidjs/router	^0.16.3 → ^1.0.0
@solidjs/router	0.16.3 → 1.0.0
@solidjs/start (source)	2.0.0-rc.1 → 2.0.0-rc.8
eslint (source)	10.7.0 → 10.8.0
globals	17.7.0 → 17.8.0
pnpm (source)	11.9.0 → 11.18.0
prettier (source)	3.8.4 → 3.9.6
solid-js (source)	1.9.12 → 1.9.14
tailwindcss (source)	4.3.1 → 4.3.3
typescript (source)	^6.0.3 → ^7.0.0
vite (source)	8.1.3 → 8.1.5

---

Release Notes

fontsource/font-files (@​fontsource-variable/geist)

v5.3.0

Compare Source

fontsource/font-files (@​fontsource-variable/geist-mono)

v5.3.0

Compare Source

solidjs-community/solid-primitives (@​solid-primitives/event-listener)

v2.4.6

Compare Source

Patch Changes

• 62e331d: Fix named imports breaking under Rolldown (Vite 8+ / Storybook 10.4.6+) bundlers.

  These packages re-export their public API via export * from "./x.js" barrels. Rollup resolves named imports through these at link time, but Rolldown's static analysis doesn't reliably follow export * for named-export resolution, causing errors like:

  "createEventListener" is not exported by "@​solid-primitives/event-listener/dist/index.js"
  

  The build now also emits explicit export { name } from "./x.js" lines for every runtime export reachable through a barrel's export *, derived automatically from each submodule's compiled output — so dist/ is bundler-agnostic regardless of how a given tool resolves star re-exports.

• Updated dependencies [62e331d]

  • @​solid-primitives/utils@​6.4.1

solidjs/solid-router (@​solidjs/router)

v1.0.0

Major Changes

• Declare the router stable as 1.0.0. This is a version realignment, not a breaking change: the code is functionally identical to the 0.16 line, which has held API-stable for years, and ^1.0.0 finally gets normal caret semantics instead of the pinned-minor treatment resolvers give 0.x releases. It also aligns major numbers across the ecosystem — router 1.x pairs with Solid 1.x (and SolidStart 2.0), while the in-progress Solid 2 router moves from 1.0.0-next.* to 2.0.0-next.* prereleases under the next tag.

Patch Changes

• 1211a89: Restore scroll with a single scroll once routing settles, dropping the ResizeObserver that re-asserted the offset while the document was still growing (<Router scrollRestoration>, added in 0.16.3). Settling after the navigation commits is what makes the offset reachable, and it is the strategy every peer router ships (SvelteKit, TanStack Router, React Router, Next); TanStack's equivalent MutationObserver sits commented out in their source. The chase carried real downside for a case none of them try to cover: with no bound, a target that is never reachable (a list that is genuinely shorter now) left the observer connected for the life of the page, re-clamping the viewport to the bottom on every subsequent resize, and scroll-induced layout changes can feed it back into itself. It was also untestable in jsdom, which has no ResizeObserver, so the branch had no coverage. Content committing after the navigation settles — an image without reserved space, a boundary below the fold — now keeps whatever offset the document can hold.

solidjs/solid-start (@​solidjs/start)

v2.0.0-rc.8

Compare Source

Patch Changes

• 3573985: Await asynchronous serverFunctions.onError handlers before serializing server function errors.
  Preserve the original error if the handler throws or rejects.

v2.0.0-rc.7

Compare Source

Patch Changes

• 87d73e1: chore: bump seroval to v1.6.0

v2.0.0-rc.6

Compare Source

Minor Changes

• bac24b2: Add a serverFunctions.onError option naming a module that observes and replaces what a server function threw, before it is serialized into the response

Patch Changes

• 27c2877: Remove leftover debug console.log calls from the server functions inspector, which logged on every server function request in dev.
• f15724b: Declare @solidjs/router as an optional peer dependency constrained to >=0.16.0 <2.0.0-0. Router v2 is expected to target Solid v2, so installing it alongside @solidjs/start v2 now surfaces a peer warning instead of silently producing an incompatible pairing. The peer is marked optional, so apps that do not use the router are unaffected.
• 5c8612f: Apply cookies set on a returned or thrown response during single flight mutations. redirect(to, { headers: { "Set-Cookie": ... } }) previously only reached the browser: the single flight re-render of the redirect target still ran with the old request cookies, so queries reading that cookie saw stale values. Those cookies are now merged into the request the re-render sees, matching what a browser round trip would have sent.
• 83122ed: Reject server function calls when the response is a 5xx without an X-Error header, instead of resolving with the parsed error body

v2.0.0-rc.5

Compare Source

Minor Changes

• 4c803e5: Add serialization.plugins to configure custom Seroval plugins for server functions.

  Values Seroval has no built-in support for (Mongo's ObjectId, Prisma's Decimal, Temporal, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins:

  // vite.config.ts
  solidStart({
    serialization: {
      plugins: "src/seroval-plugins.ts",
    },
  });

  // src/seroval-plugins.ts
  import { createPlugin } from "@​solidjs/start/serialization";

  The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by solid-js/web.

  Also adds a @solidjs/start/serialization entrypoint re-exporting Seroval's createPlugin, OpaqueReference, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with.

Patch Changes

• e117d91: Route module ids now end in the source extension, so ecosystem plugins apply inside src/routes.

  Route files are imported through an id carrying the picked exports in the query (routes/api.ts?pick=GET), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (/\.[cm]?[jt]sx?$/, the default for unplugin-auto-import, unplugin-macros and others) silently skipped every route file. The id now ends with a lang.<ext> marker, the same convention Vue SFCs use for ?vue&type=script&lang.ts. Chunk filenames are unchanged.

• d8f1ea8: Apply the configured nonce to the two script tags that were still missing it, so a strict script-src CSP no longer needs unsafe-inline:

  • The client-side redirect that streaming mode emits after the shell has already flushed (<script>window.location=...</script>) now carries the nonce.
  • The SPA entry script tag now carries the nonce, matching the SSR entry script.

• 27fca88: Fix actions returning json() or reload() leaving no-JS form submissions stranded on the /_server endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no Location header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so useSubmission().result matches the JS path.

• 75debc3: Scope the built-in ~ alias to the app package, so files in other workspace packages can map ~ to their own root through an importer-aware plugin such as vite-tsconfig-paths. In stylesheets and asset URLs (CSS @import, url(), new URL(..., import.meta.url)) ~ still always means the app root, since Vite resolves those without running plugins.

v2.0.0-rc.4

Compare Source

Patch Changes

• b6dfaac: Updated dependencies, including cookie-es to 3, shiki to 4, srvx to 0.12.4, oxc-parser to 0.141 and seroval to 1.5.6. parseSetCookie now returns undefined for cookies with a forbidden name or an empty name and value, and those cookies are no longer forwarded to nested server function requests.
• 02cd41e: Stop the dev toolbar from reporting benign ResizeObserver loop notifications as application errors. Browsers dispatch these as window error events carrying no error object, so the toolbar was capturing the raw ErrorEvent and force-opening the error panel over the app on every resize.
• d3c2af2: Don't send server error stack traces to the client in production builds. When a server function throws, the error is serialized and rethrown on the client, and seroval included Error.prototype.stack by default, leaking server file paths and internal function names. Stacks are still serialized in development.

v2.0.0-rc.3

Compare Source

Patch Changes

• d9018d6: fix(types): add missing properties to SolidStartOptions and expose them via Vite plugin configuration
• e26cef0: Fix TS2883/TS2742 when emitting declarations for entry-server.tsx. createHandler now returns StartHandler, a type owned by @solidjs/start, instead of h3's H3, so the inferred type of export default createHandler(...) no longer has to be named through a nested node_modules/@​solidjs/start/node_modules/h3 path.
• 7c8dbe6: keep TypeScript namespace members in route files during production builds
• b3c7aaf: Update h3 to 2.0.1-rc.26.
• b3c7aaf: Fixed event response status and headers set during server-side rendering with deferred async resources, not being applied on the outgoing response.

v2.0.0-rc.2

Compare Source

Minor Changes

• eeff49a: add new dev toolbar

Patch Changes

• bd8cb01: Update srvx to version 0.12.0.
• 4e98ac0: Restore the optional routerLoad third argument to createHandler, which primes custom routers (e.g. TanStack Router) on the server before SSR rendering. It was accidentally dropped in the v2 rewrite.

eslint/eslint (eslint)

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

sindresorhus/globals (globals)

v17.8.0

Compare Source

• Update globals (2026-07-01) (#​347) 7394811

---

pnpm/pnpm (pnpm)

v11.18.0: pnpm 11.18

Compare Source

Minor Changes

• Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through optionalDependencies is installable on the current system but one of its regular dependencies is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with MODULE_NOT_FOUND. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped #​13286.

• pnpm setup now appends PNPM_HOME and the global bin directory to the GitHub Actions environment files (GITHUB_ENV and GITHUB_PATH), so later steps in the same job can run pnpm add --global and other global commands #​9191.

• Added support for publishConfig.name, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents, pnpm-lock.yaml, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check of pnpm publish -r, its registry selection, and the release-planning probes of pnpm change status and pnpm version -r #​13345.

• pnpm self-update no longer takes any instruction from the project it is run in:

  • pnpm is fetched through the same trusted registry and auth configuration used when switching pnpm versions, so a project .npmrc or pnpm-workspace.yaml can no longer redirect the download or attach credentials to it, and the project's default .pnpmfile.(c|m)js is no longer loaded. Pnpmfiles from trusted sources (the pnpmfile setting, the global pnpmfile, config dependencies) still apply.
  • The minimumReleaseAge settings in pnpm-workspace.yaml no longer affect self-update. They still govern the project's own dependencies; for self-update the cooldown now comes from the built-in default, your global config, a PNPM_CONFIG_* environment variable, or a command-line flag. This fixes self-update failing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it.
  • The same applies to the trustPolicy settings and to ci: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses.

  When self-update refuses a version that is younger than the cutoff, an interactive run now offers to update anyway; non-interactive runs still fail. CI never prompts, even on a runner that attaches a TTY.

Patch Changes

• Fixed pnpm licenses list to report every version when the same package is installed under multiple aliases pnpm/pnpm#13438.

• Sort pnpm dedupe --check snapshot changes for stable output across pnpm implementations.

• Strip Unicode formatting characters from registry- and manifest-derived terminal output.

• Speed up installs after compatible catalog or direct dependency range changes by retaining the locked version without resolving the dependency graph again.

• Speed up installs after safe override changes by reusing unambiguous compatible dependency resolutions, pruning obsolete dependencies, applying independent replacements and removals together, and handling parent-scoped "-" overrides without full lockfile resolution.

• Installing a local file: directory dependency with the global virtual store enabled no longer fails with TypeError: Cannot read properties of undefined (reading 'split') #​13335.

  Local directory dependencies — file: directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.

• The Workspace column of pnpm update --interactive now falls back to the project's path when its name is only whitespace, as it already did for a missing or empty one — all three render an equally blank label otherwise.

• Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither pnpm outdated nor pnpm update reads the workflow files unless --include-github-actions is passed or update.githubActions is set to true in pnpm-workspace.yaml. Reading them runs git ls-remote against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) #​13254.

  pnpm outdated accepts the --include-github-actions option too.

• pnpm update --interactive now measures its table in terminal columns rather than in characters. A package name, workspace name, or version containing wide characters (CJK, most emoji) no longer knocks its row's columns out of line with the rest of the group, and a wide character in a version no longer aborts the command with Subject parameter value width cannot be greater than the container width #​13357.

• The Workspace column of pnpm update --interactive is more informative in two cases. A dependency outdated at the same version in several workspace projects is offered as one choice, since selecting it updates every project — that choice now names all of them instead of only the first. And a workspace project without a name is now labelled with its path rather than left blank, so several unnamed projects can be told apart.

• An auto-installed optional peer is no longer hoisted at a version the workspace root's own dependency on that package excludes. resolvePeersFromWorkspaceRoot already made the workspace root's specifier decide which version a missing required peer is installed at; the optional-peer picker ignored it and always took the highest version present anywhere in the graph. In a workspace whose root pins postcss: 8.5.10, an importer that depends on webpack and declares no postcss of its own got postcss@8.5.22 hoisted for terser-webpack-plugin's optional postcss peer, leaving two postcss@8.5.x instances in the graph #​13320.

• overrides now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because autoInstallPeers is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with overrides: { react: npm:react@19.2.0 } and a lone lucide-react dependency, pnpm installed react@18.3.1; it now installs the pinned react@19.2.0 #​13320.

• Under resolvePeersFromWorkspaceRoot, a workspace root dependency declared with link: or file: (or the path form of workspace:, such as workspace:../pkg) now satisfies another project's missing peer dependency at the linked package's own version, instead of being hoisted as a path. Those specifiers are relative to the project that declares them, so the same specifier reached a different directory — or none — from the project the peer was hoisted into, leaving a broken link. The root now has the same authority over the peer as it has when it declares the package with a version range #​13373.

• Installs through a pnpr server now apply the project's whole verification policy. minimumReleaseAgeExclude, minimumReleaseAgeIgnoreMissingTime, trustPolicy, trustPolicyExclude, trustPolicyIgnoreAfter, and trustLockfile were ignored, so excluded packages were still held back and a lockfile containing them could be rejected.

  trustPolicy: no-downgrade no longer fails with TRUST_POLICY_INCOMPATIBLE_WITH_PNPR when a pnpr server is configured.

  --frozen-lockfile and --no-prefer-frozen-lockfile are now honored on the pnpr path, instead of resolving and rewriting the lockfile anyway. Since frozenLockfile defaults to true on CI, a CI install through a pnpr server now fails on an out-of-date lockfile rather than updating it.

• Workspace installs through a pnpr server no longer crash with Cannot read properties of undefined (reading 'filter') after linking, when minimumReleaseAge is active #​13275.

• Fixed pnpm dedupe updating valid catalog resolutions when another matching version exists in the lockfile.

• pnpm -r run "/pattern/" --no-bail no longer exits zero when one of a project's matched scripts fails and a later one passes. The run summary carries a single status per project, and the passing script overwrote the recorded failure.

• Restored the store block a first install prints, naming how packages were materialized and where the stores live #​13315:

  Packages are hard linked from the content-addressable store to the virtual store.
    Content-addressable store is at: ~/.local/share/pnpm/store/v11
    Virtual store is at:             node_modules/.pnpm
  

• The root project's pnpm:devPreinstall script now runs before resolution and linking, as it does in pnpm 11. It is skipped under --ignore-scripts, --lockfile-only and --dry-run, by pnpm fetch and pnpm rebuild, and by a repeat install that is already up to date. Workspaces that use the hook to prepare state the install depends on — such as next.js, which generates a placeholder next bin with it — were left with dependents linked against files that were never created #​13313.

• Prevented pnpm dedupe --check from removing an incompatible node_modules directory.

• pnpm update --workspace no longer links dependencies the user never named:

  • Running it with updateConfig.ignoreDependencies configured no longer fails with ERR_PNPM_WORKSPACE_PACKAGE_NOT_FOUND for a dependency that is only published to the registry. Such dependencies keep their specifiers, as they already did when no dependencies were ignored.
  • Passing package selectors that match no direct dependency no longer falls back to linking every workspace dependency.

Platinum Sponsors

Gold Sponsors

v11.17.0: pnpm 11.17

Compare Source

Minor Changes

• Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #​13220.

  pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

  Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes

• The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.

• Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #​13232.

• Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #​13164.

• Revert script ordering change for pnpm run --sequential /regex/

• Support the from-git argument in the pnpm version command.

• When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors

Gold Sponsors

v11.16.0: pnpm 11.16

Compare Source

Minor Changes

• The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.

• Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.

• Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.

• Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:

  update:
    ignoreDeps: # was updateConfig.ignoreDependencies
      - webpack
      - "@​babel/*"
  
  audit:
    level: high # was auditLevel
    ignore: # was auditConfig.ignoreGhsas
      - GHSA-xxxx-yyyy-zzzz

  update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

  The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

• Fixed `pn

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 2 workspace projects
? Verifying lockfile against supply-chain policies (679 entries)...
✓ Lockfile passes supply-chain policies (679 entries in 7.3s)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 31, reused 0, downloaded 0, added 0
Progress: resolved 35, reused 0, downloaded 0, added 0
Progress: resolved 37, reused 0, downloaded 0, added 0
Progress: resolved 39, reused 0, downloaded 0, added 0
Progress: resolved 161, reused 0, downloaded 0, added 0
Progress: resolved 211, reused 0, downloaded 0, added 0
Progress: resolved 223, reused 0, downloaded 0, added 0
Progress: resolved 226, reused 0, downloaded 0, added 0
Progress: resolved 229, reused 0, downloaded 0, added 0
Progress: resolved 260, reused 0, downloaded 0, added 0
Progress: resolved 400, reused 0, downloaded 0, added 0
Progress: resolved 475, reused 0, downloaded 0, added 0
Progress: resolved 538, reused 0, downloaded 0, added 0
Progress: resolved 674, reused 0, downloaded 0, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 3 versions do not meet the minimumReleaseAge constraint:
  h3@2.0.1-rc.26 was published at 2026-07-24T18:49:24.063Z, within the minimumReleaseAge cutoff (2026-07-23T04:29:04.227Z)
  seroval-plugins@1.6.0 was published at 2026-07-29T14:43:04.553Z, within the minimumReleaseAge cutoff (2026-07-23T04:29:04.227Z)
  seroval@1.6.0 was published at 2026-07-29T14:43:04.800Z, within the minimumReleaseAge cutoff (2026-07-23T04:29:04.227Z)

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[netlify]

❌ Deploy Preview for solid-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	ebbc9fb
🔍 Latest deploy log	https://app.netlify.com/projects/solid-docs/deploys/6a6ad326bd1759000859805a