chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #39 · unplugin/unplugin-lightningcss

renovate · 2025-12-29T02:10:12Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@typescript/native-preview (source)	`7.0.0-dev.20260122.3` → `7.0.0-dev.20260414.1`
pnpm (source)	`10.28.1` → `10.33.0`
tsdown (source)	`^0.20.0` → `^0.21.0`
tsdown-preset-sxzz	`^0.3.1` → `^0.5.0`

Release Notes

microsoft/typescript-go (@typescript/native-preview)

pnpm/pnpm (pnpm)

`v10.33.0`

Compare Source

`v10.32.1`: pnpm 10.32.1

Compare Source

Patch Changes

Fix a regression where pnpm-workspace.yaml without a packages field caused all directories to be treated as workspace projects. This broke projects that use pnpm-workspace.yaml only for settings (e.g. minimumReleaseAge) without defining workspace packages #10909.

Platinum Sponsors

Gold Sponsors

`v10.32.0`: pnpm 10.32

Compare Source

Minor Changes

Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #10136.

Patch Changes

Reverted change related to setting explicitly the npm config file path, which caused regressions.
Reverted fix related to lockfile-include-tarball-url. Fixes #10915.

Platinum Sponsors

Gold Sponsors

`v10.31.0`

Compare Source

`v10.30.3`

Compare Source

`v10.30.2`

Compare Source

`v10.30.1`: pnpm 10.30.1

Compare Source

Patch Changes

Use the /-/npm/v1/security/audits/quick endpoint as the primary audit endpoint, falling back to /-/npm/v1/security/audits when it fails #10649.

Platinum Sponsors

Gold Sponsors

`v10.30.0`: pnpm 10.30

Compare Source

Minor Changes

pnpm why now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.

Patch Changes

Revert pnpm why dependency pruning to prefer correctness over memory consumption. Reverted PR: #7122.
Optimize pnpm why and pnpm list performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #10596.

Platinum Sponsors

Gold Sponsors

`v10.29.3`

Compare Source

`v10.29.2`

Compare Source

`v10.29.1`: pnpm 10.29.1

Compare Source

Minor Changes

The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
Support configuring auditLevel in the pnpm-workspace.yaml file #10540.
Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #10436.

Patch Changes

Fixed pnpm list --json returning incorrect paths when using global virtual store #10187.
Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #10290.
Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.
Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #10176.
Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #10281.
Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #10460.
Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #10540.
update tar to version 7.5.7 to fix security issue

Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842
Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #10325.
Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #10271.
pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #10561.
Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #10457.

Platinum Sponsors

Gold Sponsors

`v10.28.2`: pnpm 10.28.2

Compare Source

Patch Changes

Security fix: prevent path traversal in directories.bin field.
When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

bolt-new-by-stackblitz · 2025-12-29T02:10:15Z

Run & review this pull request in StackBlitz Codeflow.

pkg-pr-new · 2025-12-29T02:10:42Z

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-lightningcss@39

commit: b5c6ef5

socket-security · 2026-01-08T09:55:41Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

socket-security · 2026-03-06T02:11:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
tsdown-preset-sxzz@0.3.1 ⏵ 0.5.0	⁺¹	⁺¹	⁺²
@typescript/native-preview@7.0.0-dev.20260122.3 ⏵ 7.0.0-dev.20260414.1	⁺¹	⁺¹
tsdown@0.20.0 ⏵ 0.21.8		^-4

View full report

renovate bot added the dependencies label Dec 29, 2025

renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from 9aea6eb to dac8bec Compare January 5, 2026 08:56

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from c4e0483 to 558f461 Compare January 8, 2026 09:55

renovate bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from 1f5110d to f7e4fcd Compare January 13, 2026 17:03

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from ecb4aca to 3c4b791 Compare January 22, 2026 16:44

renovate bot changed the title ~~fix(deps): update all non-major dependencies~~ fix(deps): update all non-major dependencies - autoclosed Jan 22, 2026

renovate bot closed this Jan 22, 2026

renovate bot deleted the renovate/all-minor-patch branch January 22, 2026 17:44

renovate bot changed the title ~~fix(deps): update all non-major dependencies - autoclosed~~ chore(deps): update all non-major dependencies Jan 26, 2026

renovate bot reopened this Jan 26, 2026

renovate bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 5855856 to fa38aa7 Compare February 1, 2026 21:32

renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 8224c6b to 8b74bc2 Compare February 5, 2026 08:57

chore(deps): update all non-major dependencies

b5c6ef5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies#39

chore(deps): update all non-major dependencies#39
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

renovate bot commented Dec 29, 2025 •

edited

Loading

Uh oh!

bolt-new-by-stackblitz bot commented Dec 29, 2025

Uh oh!

pkg-pr-new bot commented Dec 29, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Jan 8, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Mar 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v10.32.1: pnpm 10.32.1

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.32.0: pnpm 10.32

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.30.1: pnpm 10.30.1

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.30.0: pnpm 10.30

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.29.1: pnpm 10.29.1

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.28.2: pnpm 10.28.2

Patch Changes

Configuration

Uh oh!

bolt-new-by-stackblitz bot commented Dec 29, 2025

Uh oh!

pkg-pr-new bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Dec 29, 2025 •

edited

Loading

`v10.32.1`: pnpm 10.32.1

`v10.32.0`: pnpm 10.32

`v10.30.1`: pnpm 10.30.1

`v10.30.0`: pnpm 10.30

`v10.29.1`: pnpm 10.29.1

`v10.28.2`: pnpm 10.28.2

pkg-pr-new bot commented Dec 29, 2025 •

edited

Loading

socket-security bot commented Jan 8, 2026 •

edited

Loading

socket-security bot commented Mar 6, 2026 •

edited

Loading