Skip to content

chore(deps): update all non-major dependencies - #2366

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#2366
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@ai-sdk/gateway (source) ^4.0.37^4.0.42 age confidence
@ai-sdk/mcp (source) ^2.0.22^2.0.26 age confidence
@comark/nuxt (source) ^0.5.1^0.6.0 age confidence
@iconify-json/logos ^1.2.11^1.2.12 age confidence
@iconify-json/simple-icons ^1.2.92^1.2.93 age confidence
@nuxt/devtools (source) ^3.4.0^3.4.1 age confidence
@nuxt/eslint (source) ^1.16.0^1.17.0 age confidence
@nuxt/scripts (source) ^1.3.2^1.3.3 age confidence
@nuxtjs/mcp-toolkit (source) ^0.18.0^0.18.1 age confidence
@takumi-rs/core (source) ^2.5.5^2.5.9 age confidence
@types/semver (source) ^7.7.1^7.8.0 age confidence
@vercel/connect (source) ^0.6.0^0.6.1 age confidence
@vercel/functions (source) ^3.7.6^3.8.0 age confidence
@vue/compiler-sfc (source) ^3.5.40^3.5.41 age confidence
ai (source) ^7.0.48^7.0.54 age confidence
better-sqlite3 ^13.0.2^13.0.3 age confidence
eve (source) ^0.29.4^0.30.8 age confidence
evlog (source) ^2.23.0^2.24.0 age confidence
nuxt-auth-utils ^0.5.29^0.5.30 age confidence
nuxt-og-image (source) ^6.7.5^6.7.6 age confidence
pnpm (source) 11.18.011.20.0 age confidence
shaders ^3.0.446^3.0.448 age confidence
shiki (source) ^4.4.1^4.4.2 age confidence
vue (source) ^3.5.40^3.5.41 age confidence

Release Notes

vercel/ai (@​ai-sdk/gateway)

v4.0.42

Compare Source

Patch Changes

v4.0.41

Compare Source

Patch Changes

v4.0.40

Compare Source

Patch Changes

v4.0.39

Compare Source

Patch Changes

v4.0.38

Compare Source

Patch Changes
  • fb6d2f8: chore(provider/gateway): update gateway model settings files
vercel/ai (@​ai-sdk/mcp)

v2.0.26

Compare Source

Patch Changes

v2.0.25

Compare Source

Patch Changes

v2.0.24

Compare Source

Patch Changes

v2.0.23

Compare Source

Patch Changes
comarkdown/comark (@​comark/nuxt)

v0.6.0: @​comark/react v0.6.0

Compare Source

[!WARNING]
@​comark/react 0.6.0 is a breaking release.

Check out full release notes and predefined prompt for easy upgrade: https://github.com/comarkdown/comark/releases/tag/comark%400.6.0

nuxt/eslint (@​nuxt/eslint)

v1.17.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
nuxt/scripts (@​nuxt/scripts)

v1.3.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
nuxt-modules/mcp-toolkit (@​nuxtjs/mcp-toolkit)

v0.18.1

Compare Source

What's Changed

Bug Fixes 🐞
  • fix(module): send notifications on the stream of the request being handled by @​HugoRCD in #​306
Dependency Updates 📦

Full Changelog: https://github.com/nuxt-modules/mcp-toolkit/compare/@nuxtjs/mcp-toolkit@0.18.0...@​nuxtjs/mcp-toolkit@0.18.1

vuejs/core (@​vue/compiler-sfc)

v3.5.41

Compare Source

Bug Fixes
vercel/ai (ai)

v7.0.54

Compare Source

Patch Changes
  • a6b17a2: Allow ToolLoopAgent prepareCall callbacks to read and override the top-level reasoning option.
  • 5615eb7: Add defaultInstructionsMiddleware for applying default language model instructions while preserving call-level overrides.
  • 36a3ff6: Preserve preceding assistant messages when regenerating a response.

v7.0.52

Compare Source

Patch Changes

v7.0.51

Compare Source

Patch Changes

v7.0.50

Compare Source

Patch Changes
  • 79e133c: async APIs for generateVideo (poll, webhook)

    Adds an asynchronous start/status flow to the experimental video model
    interface (VideoModelV4): models may now implement doStart, doStatus,
    and handleWebhookOption instead of (or in addition to) doGenerate, and
    experimental_generateVideo accepts poll and webhook options to
    orchestrate completion via polling or webhooks. Polling configuration can use
    a custom delay implementation for durable workflow compatibility.

  • da64b51: feat(code-mode): simplify tool caller configuration

  • Updated dependencies [79e133c]

v7.0.49

Compare Source

Patch Changes
WiseLibs/better-sqlite3 (better-sqlite3)

v13.0.3

Compare Source

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

vercel/eve (eve)

v0.30.8

Compare Source

Patch Changes
  • e6f4808: Add a single eve add linear flow that installs and configures both the Linear Channel and Linear MCP connection.
  • f51f866: Tools can now use async generators to stream preliminary output snapshots. eve publishes local snapshots as action.partial events before the final action.result, and the default client reducer exposes provisional output with partial: true.

v0.30.7

Compare Source

Patch Changes
  • e5c9191: Add experimental agent messaging behind experimental.subagentPersistentSessions in agent.ts. Opted-in agents keep delegated children alive after they answer: each child is owned by a lifecycle handle, settles every turn with an explicit outcome carrying its per-turn token usage, and parks instead of terminating. The parent's subagent tools gain an agentId parameter to continue a parked child, discoverable from a per-model-call <agents> system injection that lists only parked (resumable) children. An omitted, empty, or unknown agentId starts a fresh child; continuing a child that is still starting or working fails with AGENT_BUSY. Without the opt-in, children keep running as one-shot tasks. The subagent tool input schema no longer includes the unused description field.
  • bd21332: Cancelling a turn with running delegated children no longer leaks their handles as permanently running. The cancellation epilogue now parks each abandoned child as "(cancelled)", so cancelled children stay resumable and later cancellations no longer stall retrying already-dead children.
  • 1758161: Add guided GitHub channel setup through eve add channel/github. The flow provisions a Vercel Connect GitHub App, routes verified webhooks, scaffolds the channel, and explains how to install and use the app.
  • 56de47b: Show far more of what local traces record in eve traces: span rows carry inline token/cost/tool chips, the header aggregates models, token totals, cost, and errors, and two new flags expose everything else — --verbose expands every span with all attributes and events, and --json dumps the full trace machine-readably.

v0.30.6

Compare Source

Patch Changes
  • 7fa4d36: Accept unmodeled SKILL.md frontmatter when importing a skill from another runtime. These fields are no-ops in eve.

v0.30.5

Compare Source

Patch Changes
  • 5ee18e2: Prevent successful local eve invoke commands from logging a spurious Workflow queue 503 while their temporary development server shuts down.
  • d8fc092: Format registry search results as concise, width-aware entries and limit searches to 10 matches by default. Use --limit to request up to 100 results.
  • 557000b: Add skills.sh as a built-in registry, so eve registry search --registry @skills <query> and eve add @skills/<skill> work without project configuration.
  • 1953d20: Prevent sandbox abort listeners from accumulating across repeated operations in a turn.
  • 7086776: Route session controls and follow-up messages through one durable command inbox shared by stable session IDs and rekeyable channel addresses.

v0.30.4

Compare Source

Patch Changes
  • fc87d23: Dev runtime snapshots no longer copy the .workflow-vitest test cache. In
    workspaces that had run integration tests, this directory was duplicated into
    every generation under .eve/dev-runtime/snapshots — tens of megabytes per
    rebuild that nothing at dev runtime reads.

v0.30.3

Compare Source

Patch Changes
  • 601fb13: Allow just-bash sandboxes to compose a custom filesystem around eve's durable, session-owned workspace.
  • c8bd9c0: Allow declared local subagents to mount extensions under their own extensions/ directory. Contributions, configuration, and overrides are scoped to that subagent and do not extend the root agent.
  • 279b5e6: Use compatible POSIX search fallbacks in sandboxes whose rg implementation lacks the options required by eve, and surface command errors instead of reporting them as empty results.
  • c10ca06: Allow dynamic subagents to declare compile-time build.externalDependencies, so their authored modules can safely use packages that must remain external before runtime resolution.
  • 95b4183: Configure new Linear connectors to receive only Agent Session webhook events, avoiding unrelated default Linear webhook deliveries.
  • 95b4183: Add guided Linear Agent channel setup through eve add channel/linear-agent. The flow provisions a Vercel Connect Linear app, routes verified Agent Session events, scaffolds the channel, and explains how to install and use the agent in Linear.

v0.30.2

Compare Source

Patch Changes
  • 512808c: Allow agents to select Exa or Parallel for the built-in web_search tool by exporting webSearch({ provider }) from agent/tools/web_search.ts. Parallel remains the default for AI Gateway models.

v0.30.1

Compare Source

Patch Changes
  • dae6f73: Upload Vercel sandbox workspace seed files in one compressed SDK request instead of one request per file, substantially reducing fresh template build times for large workspaces.

v0.30.0

Compare Source

Minor Changes
  • f43b22d: localDev() now grants the synthetic local principal based on the deployment (an eve dev or vercel dev process) instead of the request URL host, so a request Host header can no longer obtain local-dev access on a self-hosted server. The previously exported isLoopbackRequest helper is removed. The default eve channel now falls back to [vercelOidc(), localDev(), placeholderAuth()], which keeps local dev working and rejects all production traffic.
Patch Changes
  • 021dbbf: Add /new as an alias of /clear in the eve dev TUI. It clears model-message history while preserving the current session and its durable resources.
  • 136749f: Make Ctrl+C cooperatively cancel or steer a running turn like Esc in the eve dev TUI. At the idle prompt, the first Ctrl+C now shows an exit warning and a second consecutive press exits.
  • 13420ab: Allow dynamic subagent resolvers to return defineRemoteAgent(...). Session and turn selections can now conditionally expose a remote deployment and change its runtime connection settings.
  • ee50ae7: Prevent the dev TUI from duplicating setup panels when an integration setup error includes multiline command output.
  • e1cd7b7: Move eve's internal integration catalog from the Vercel npm scope to @eve/catalog.
  • 56651ee: Update eve's bundled Workflow SDK packages to the latest 5.0.0 beta releases, keeping the core runtime and workflow worlds aligned.

v0.29.5

Compare Source

Patch Changes
  • c0dc572: Rename the TUI /new command to /reset so session reset uses the same name across the client, HTTP, channel, and TUI APIs.
  • 3dce30a: Add manual session compaction through custom-channel helpers, the eve HTTP client, and the eve dev TUI's /compact command. Compaction preserves the session, queues behind an active turn, and does not send synthetic model input.
  • 910805e: Make a single Esc cancel the running turn in the eve dev TUI when no message is queued. Queued messages still use Esc to steer the oldest message into the next turn.
  • 9c51755: Connection search and discovered connection tools now use the same defineDynamic and defineTool pipeline as authored tools. Dynamic tool maps now reject entries that omit defineTool instead of accepting unsupported raw objects.
  • 84aa671: Clarify the dev TUI’s /add flow with consistent integration categories and category-specific browsing labels. MCP connections are now named explicitly, and the flow more clearly explains channels, extensions, and observability integrations.
  • 0c28eb7: Allow declared subagents to export defineDynamic from agent.ts. Session and turn resolvers can now return an agent configuration to expose it or nil to omit it from direct and Workflow delegation.
  • f3bb60d: Add manual session-context clearing through custom-channel helpers, the eve HTTP client, and the eve dev TUI's /clear command. Clearing removes model-message history while preserving the session, agent configuration, durable state, limits, and sandbox.
  • ac7d3c6: Add /cancel to the eve dev TUI. The command cooperatively cancels a running turn from either the live streaming input or the idle prompt while preserving the session and settled context.
atinux/nuxt-auth-utils (nuxt-auth-utils)

v0.5.30

Compare Source

compare changes

🩹 Fixes
  • Use app:suspense:resolve hook (#​505)
🏡 Chore
❤️ Contributors
nuxt-modules/og-image (nuxt-og-image)

v6.7.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
pnpm/pnpm (pnpm)

v11.20.0: pnpm 11.20

Compare Source

Minor Changes

  • Security fix. Affects projects using namedRegistries on pnpm 11.1.0–11.19.x. It is semi-breaking for those projects — see "If you use named registries" below.

    The lockfile recorded no marker for which registry a package came from. Packages were keyed by name@version alone, and entry lookup went through refToRelative(ref, name), so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single packages: entry and whichever resolved first decided the tarball every consumer got.

    That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.

    Packages resolved from a named registry are now recorded under registry-qualified keys (<name>@<registryName>:<version>, e.g. foo@work:1.0.0), so each registry gets its own entry and the lockfile pins which one a dependency came from.

    The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use namedRegistries sees no difference, and older pnpm versions keep reading the file.

If you use named registries

Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.

Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it.

There is no setting to keep the old behavior: the old shape is the vulnerability.

Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the namedRegistries setting on demand.

To use named registries, map your aliases in pnpm-workspace.yaml:

namedRegistries:
  work: https://npm.enterprise.example.com/
New built-in npmjs: alias

npmjs: now resolves to https://registry.npmjs.org/ with no configuration, alongside the existing gh: alias for GitHub Packages. It pins a dependency to the public registry even when registry points elsewhere, such as an internal proxy:

{ "dependencies": { "left-pad": "npmjs:^1.3.0" } }

npm: cannot do this — it is the alias protocol (npm:<name>@<range>) and resolves through whatever registry points at.

If you mirror or proxy npmjs, point the alias at your mirror:

namedRegistries:
  npmjs: https://npm.internal.example.com/

Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on registry.npmjs.org is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, minimumReleaseAge, or trustPolicy check runs. Overriding the alias is the same escape hatch GHES users already have for gh.

Every alias the lockfile references must stay in namedRegistries: reading an entry whose alias is gone fails with ERR_PNPM_MISSING_NAMED_REGISTRY rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it.

Named registry aliases that shadow a reserved dependency specifier prefix (file, link, workspace, runtime, npm, jsr, ...) are now rejected with ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME instead of being silently shadowed by the corresponding resolver.

pnpm licenses and pnpm sbom now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl repository_url qualifier.

Patch Changes

  • An empty http-proxy, https-proxy, proxy, or no-proxy value — from the .npmrc, pnpm-workspace.yaml, the CLI, or the HTTP_PROXY / HTTPS_PROXY / PROXY / NO_PROXY environment variables — no longer fails the install with ERR_PNPM_INVALID_PROXY. Empty settings read as unset, so a shell exporting HTTP_PROXY= disables the proxy, and an empty proxy= in the .npmrc no longer suppresses HTTPS_PROXY #​13533.

    proxy=false in the .npmrc or proxy: false in pnpm-workspace.yaml now turns proxying off instead of being read as a proxy host named false. false and null on https-proxy / http-proxy / no-proxy read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim.

  • The env lockfile no longer pins @pnpm/exe alongside pnpm when the wanted pnpm version is 12 or newer. From v12 the unscoped pnpm package is itself the native executable, so @pnpm/exe is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it.

  • lexCompare and nerfDart are now published as @pnpm/text.ordinal-comparator and @pnpm/config.registry-auth-key. Use these instead of @pnpm/util.lex-comparator and @pnpm/config.nerf-dart.

  • Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs.

  • Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when minimumReleaseAge is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison.

  • Security: pnpm rebuild now refuses a lockfile whose packages key carries a path traversal in the package name (e.g. ../../../escaped@1.0.0), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with ERR_PNPM_INVALID_DEPENDENCY_NAME.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.19.0: pnpm 11.19

Compare Source

Minor Changes

  • pnpm login no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with ERR_PNPM_LOGIN_NON_INTERACTIVE in a non-interactive terminal.

  • The save-prefix setting now accepts =: newly added dependencies are saved with an explicit = operator (=1.2.3) instead of the setting being silently treated as the default ^.

Patch Changes

  • allowBuilds entries can now approve git-hosted packages that pnpm downloads as a tarball, such as github: dependencies (which are fetched from codeload.github.com rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless git+ matching already supported for cloned git dependencies. For example:

    allowBuilds:
      "foo@git+https://github.com/org/foo.git": true

    This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work.

  • pnpm outdated --include-github-actions no longer blocks on an interactive git credential prompt when a workflow uses a private action repo.

  • Prevented minimumReleaseAge from replacing latest with a SemVer-greater version than the registry tag target #​13034.

  • Fixed empty bundledDependencies and bundleDependencies arrays causing nondeterministic lockfile changes. See #​13123.

  • The install summary no longer prints (X is available) when the registry's dist-tags.latest is still held back by the active minimumReleaseAge policy. The hint only ever names the actual latest tag, so an immature latest suppresses the hint instead of advertising the version pnpm just refused to install #​11698.

  • pnpm update keeps the explicit = operator of an exact version pin: a dependency saved as =3.5.1 now updates to =3.5.2 instead of the bare 3.5.2. See #​13168.

  • Preserve a workspace dependency's link: entry when a run does not target it — e.g. pnpm update <other-pkg> (with or without --recursive), or a plain install after a root/catalog dependency change — with injectWorkspacePackages, instead of spuriously rewriting it to a peer-suffixed file: protocol. See #​10433.

  • Workspace dependencies declared with a relative path (e.g. "foo": "workspace:../foo") are no longer silently dropped from the workspace projects graph, so --filter selection and the topological order of recursive commands take them into account.

Platinum Sponsors

<

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Bit
OpenAI

@renovate
renovate Bot requested a review from atinux as a code owner August 3, 2026 14:38
@vercel

vercel Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nuxt Error Error Aug 7, 2026 2:46am

Request Review

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 8b00c18 to 8697fd0 Compare August 3, 2026 20:01
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 8697fd0 to 6309df4 Compare August 4, 2026 03:39
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 6309df4 to 363b896 Compare August 4, 2026 08:51
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 363b896 to aec8bde Compare August 4, 2026 16:18
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from aec8bde to 429e597 Compare August 5, 2026 03:08
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 429e597 to 9c8b91d Compare August 5, 2026 07:05
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9c8b91d to d163986 Compare August 5, 2026 08:06
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d163986 to a78fbfd Compare August 5, 2026 12:05
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from a78fbfd to 0dc735b Compare August 5, 2026 14:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 0dc735b to b06f487 Compare August 5, 2026 20:04
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from b06f487 to bdd3966 Compare August 5, 2026 20:53
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from bdd3966 to 93db820 Compare August 6, 2026 03:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 93db820 to e5006bb Compare August 6, 2026 07:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants