Skip to content

chore(deps): update all non-major dependencies#6753

Open
renovate[bot] wants to merge 1 commit into
v4from
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#6753
renovate[bot] wants to merge 1 commit into
v4from
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@ai-sdk/anthropic (source) ^4.0.14 → ^4.0.18 age confidence
@ai-sdk/gateway (source) ^4.0.19 → ^4.0.27 age confidence
@ai-sdk/mcp (source) ^2.0.12 → ^2.0.16 age confidence
@ai-sdk/vue (source) ^4.0.26 → ^4.0.35 age confidence
@comark/vue (source) ^0.5.0 → ^0.5.1 age confidence
@iconify-json/lucide ^1.2.117 → ^1.2.118 age confidence
@iconify-json/simple-icons ^1.2.90 → ^1.2.91 age confidence
@nuxt/content (source) ^3.15.0 → ^3.15.2 age confidence
@nuxt/module-builder ^1.0.2 → ^1.0.3 age confidence
@nuxtjs/mdc ^0.22.1 → ^0.22.2 age confidence
@regle/core (source) ^1.28.3 → ^1.28.4 age confidence
@regle/rules (source) ^1.28.3 → ^1.28.4 age confidence
@tailwindcss/postcss (source) ^4.3.2 → ^4.3.3 age confidence
@tailwindcss/vite (source) ^4.3.2 → ^4.3.3 age confidence
@tanstack/vue-virtual (source) ^3.13.32 → ^3.13.34 age confidence
@unhead/vue (source) ^2.1.15 → ^2.1.16 age confidence
@vitejs/plugin-vue (source) ^6.0.7 → ^6.0.8 age confidence
ai (source) ^7.0.26 → ^7.0.35 age confidence
happy-dom ^20.10.6 → ^20.11.1 age confidence
nuxt-og-image (source) ^6.7.2 → ^6.7.4 age confidence
nuxt-schema-org (source) ^6.2.3 → ^6.2.7 age confidence
pnpm (source) 11.13.0 → 11.16.0 age confidence
prettier (source) ^3.9.5 → ^3.9.6 age confidence
tailwindcss (source) ^4.3.2 → ^4.3.3 age confidence
vue (source) ^3.5.39 → ^3.5.40 age confidence
vue-component-meta (source) ^3.3.7 → ^3.3.8 age confidence
vue-component-type-helpers (source) ^3.3.7 → ^3.3.8 age confidence
vue-router (source) ^5.1.0 → ^5.2.0 age confidence
vue-tsc (source) ^3.3.7 → ^3.3.8 age confidence

Release Notes

vercel/ai (@​ai-sdk/anthropic)

v4.0.18

Compare Source

Patch Changes
  • 97de198: Warn when an unknown model uses the default 4096 max output token limit.

v4.0.17

Compare Source

Patch Changes
  • b72fc7c: fix(amazon-bedrock): sanitize unsupported JSON Schema constraints in native Anthropic structured output
  • 9218ebe: fix(provider/anthropic): warn when parallel tool use is requested with JSON tool structured output
  • Updated dependencies [02ffdcb]
  • Updated dependencies [76cb673]

v4.0.16

Compare Source

Patch Changes

v4.0.15

Compare Source

Patch Changes
vercel/ai (@​ai-sdk/gateway)

v4.0.27

Compare Source

Patch Changes
  • 2112ff1: chore(provider/gateway): update gateway model settings files

v4.0.26

Compare Source

Patch Changes
  • 7c16f21: feat(google): add gemini-3.6-flash and gemini-3.5-flash-lite models

v4.0.25

Compare Source

Patch Changes

v4.0.24

Compare Source

Patch Changes
  • cefa3b1: chore(provider/gateway): remove hipaaCompliant provider option
  • 8fbb89c: chore(provider/gateway): update gateway model settings files

v4.0.23

Compare Source

Patch Changes

v4.0.22

Compare Source

Patch Changes
  • 341616a: feat: add kimi-k3 model and reasoningEffort provider option
  • 70fc45c: chore(provider/gateway): update gateway model settings files

v4.0.21

Compare Source

Patch Changes
  • 7069785: chore(provider/gateway): update gateway model settings files
  • 4bf9ac2: feat (provider/gateway): add gateway.experimental_transcription.getToken for minting transcription-bound client secrets

v4.0.20

Compare Source

Patch Changes
vercel/ai (@​ai-sdk/mcp)

v2.0.16

Compare Source

Patch Changes

v2.0.15

Compare Source

Patch Changes

v2.0.14

Compare Source

Patch Changes

  • 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:

    • Runtime-validate _meta.ui and drop malformed or non-string fields.
    • Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist.
    • Derive a concrete postMessage target origin and validate inbound message origins.
    • Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link.
    • Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources.

v2.0.13

Compare Source

Patch Changes
vercel/ai (@​ai-sdk/vue)

v4.0.35

Compare Source

Patch Changes
  • Updated dependencies [7f6650b]
  • Updated dependencies [106ea59]
    • ai@​7.0.35

v4.0.34

Compare Source

Patch Changes
  • ai@​7.0.34

v4.0.33

Compare Source

Patch Changes

v4.0.32

Compare Source

Patch Changes
  • Updated dependencies [6cd7c74]
  • Updated dependencies [e35bcae]
  • Updated dependencies [a4eb3f3]
    • ai@​7.0.32

v4.0.31

Compare Source

Patch Changes

v4.0.30

Compare Source

Patch Changes
  • ai@​7.0.30

v4.0.29

Compare Source

Patch Changes
  • ai@​7.0.29

v4.0.28

Compare Source

Patch Changes
  • Updated dependencies [0bc8d4f]
    • ai@​7.0.28

v4.0.27

Compare Source

Patch Changes
comarkdown/comark (@​comark/vue)

v0.5.1: @​comark/nuxt v0.5.1

Compare Source

0.5.1 (2026-07-14)

nuxt/content (@​nuxt/content)

v3.15.2

Compare Source

Bug Fixes
  • dev: ignore temporary files in content source paths (#​3784) (a019e70)
  • security: reject SQL function calls in query WHERE clauses (#​3819) (847d523)

v3.15.1

Compare Source

Bug Fixes
nuxt/module-builder (@​nuxt/module-builder)

v1.0.3

Compare Source

v1.0.3 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes
  • update command defaults and descriptions (#​677)
📦 Build
🏡 Chore
  • migrate to pnpm v11 (#​738)
  • remove shamefully-hoist (#​580)
  • migrate resolutions/pnpm.overrides to pnpm-workspace.yaml (cfb45fb)
  • migrate npm badges and links to npmx.dev (afcf2fa)
  • revert pnpm trust policy and restore provenance action (aeb1d38)
  • update pnpm to 10.21 and enable trust policy (92eb2af)
✅ Tests
  • accept nuxt/app specifier for NuxtError in snapshot (809c89f)
  • update v4.5 error type as well (9412c91)
  • accept either #app or nuxt/app in generated declarations (#​727)
🤖 CI
  • use uppt release workflow (604d5b3)
  • add agent-scan workflow to flag bot-authored PRs (4442a14)
  • rename workflow (f7be1a6)
  • avoid checkout in reproduction (57e7ce9)
  • pin github actions to full-length commit shas (c3c8e72)
  • add provenance action to check for downgrades in provenance (d87d217)
  • run tests on node 20 (54c5f13)
🎉 New Contributors
❤️ Contributors
nuxt-content/mdc (@​nuxtjs/mdc)

v0.22.2

Compare Source

compare changes

🩹 Fixes
  • security: All attributes should validate (#​496)
❤️ Contributors
victorgarciaesgi/regle (@​regle/core)

v1.28.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.3

Compare Source

Fixed
  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)
tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.3

Compare Source

Fixed
  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)
TanStack/virtual (@​tanstack/vue-virtual)

v3.13.34

Compare Source

Patch Changes

v3.13.33

Compare Source

Patch Changes
unjs/unhead (@​unhead/vue)

v2.1.16

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features
Bug Fixes
vercel/ai (ai)

v7.0.35

Compare Source

Patch Changes
  • 7f6650b: Return response piping promises so callers can catch stream read and write errors.
  • 106ea59: feat(ai): add per-step first content timeout for streaming generations
  • Updated dependencies [2112ff1]

v7.0.34

Compare Source

Patch Changes

v7.0.33

Compare Source

Patch Changes

v7.0.32

Compare Source

Patch Changes
  • 6cd7c74: fix: correct the onToolCall callback result documentation
  • e35bcae: Allow UI message chunks to include fields added by newer server versions.
  • a4eb3f3: Propagate abort reasons when generation is cancelled during tool execution.
  • Updated dependencies [cefa3b1]
  • Updated dependencies [8fbb89c]

v7.0.31

Compare Source

Patch Changes

v7.0.30

Compare Source

Patch Changes

v7.0.29

Compare Source

Patch Changes

v7.0.28

Compare Source

Patch Changes
  • 0bc8d4f: Fix chat onFinish handling when overlapping requests clear the active response before a resume stream finishes.

v7.0.27

Compare Source

Patch Changes
  • ac01b79: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.
  • 2696562: experimental_streamTranscribe result promises now resolve without consuming fullStream: accessing any result promise consumes the stream internally. Previously await result.text alone deadlocked on transform backpressure. Because live transcription streams can be unbounded, fullStream is explicitly single-consumer (no replay buffering): access it once, before any result promise, when both stream parts and final results are needed.
  • Updated dependencies [31c7be8]
  • Updated dependencies [4d096f6]
capricorn86/happy-dom (happy-dom)

v20.11.1

Compare Source

v20.11.0

Compare Source

🎨 Features
nuxt-modules/og-image (nuxt-og-image)

v6.7.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.7.3

Compare Source

compare changes

🩹 Fixes
  • Parse queries from event paths (#​642)
🏡 Chore
❤️ Contributors
harlan-zw/nuxt-schema-org (nuxt-schema-org)

v6.2.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.2.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.2.5

Compare Source

compare changes

🩹 Fixes
❤️ Contributors

v6.2.4

Compare Source

compare changes

🏡 Chore
❤️ Contributors
pnpm/pnpm (pnpm)

v11.16.0: pnpm 11.16

Compare Source

Minor Changes

  • The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.

  • Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.

  • Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.

  • Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:

    update:
  ignoreDeps: # was updateConfig.ignoreDependencies
    - webpack
    - "@&#8203;babel/*"

audit:
  level: high # was auditLevel
  ignore: # was auditConfig.ignoreGhsas
    - GHSA-xxxx-yyyy-zzzz

    update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

    The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

  • Fixed pnpm add --save-exact/--save-prefix and pnpm update writing a package's version with the peerDependencies range's prefix (e.g. ^19.2.7 instead of the requested 19.2.7) whenever the same package also appeared in peerDependencies. A real dependencies/devDependencies/optionalDependencies entry now takes precedence over a same-named peerDependencies entry when computing the current specifiers #​13108.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Paris)

  • Branch creation
    • Between 06:00 AM and 09:59 AM, only on Monday (* 6-9 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from benjamincanac as a code owner July 20, 2026 06:14
@github-actions github-actions Bot added the v4 #4488 label Jul 20, 2026
@socket-security

socket-security Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedhappy-dom@​20.11.1661008895100
Added@​tanstack/​vue-virtual@​3.13.341001006697100
Added@​ai-sdk/​gateway@​4.0.27701008798100
Added@​ai-sdk/​vue@​4.0.35751007398100
Added@​ai-sdk/​anthropic@​4.0.18751008898100
Added@​comark/​vue@​0.5.17610010093100
Added@​iconify-json/​simple-icons@​1.2.911001007696100
Added@​iconify-json/​lucide@​1.2.1181001007996100
Addedtailwindcss@​4.3.31001008497100
Added@​regle/​rules@​1.28.4931008496100
Added@​regle/​core@​1.28.4921008496100
Addedai@​7.0.358610010099100
Added@​nuxt/​module-builder@​1.0.39810010087100
Added@​tailwindcss/​vite@​4.3.31001008997100
Added@​nuxt/​content@​3.15.2961009097100
Added@​ai-sdk/​mcp@​2.0.169010010098100
Addedvue-router@​5.2.0911009790100
Addedvue@​3.5.401001009197100
Addedvue-tsc@​3.3.81001009197100
Added@​vitejs/​plugin-vue@​6.0.810010010093100
Added@​nuxtjs/​mdc@​0.22.29710010094100
Addednuxt-schema-org@​6.2.7991009595100
Addednuxt-og-image@​6.7.4961009896100
Added@​unhead/​vue@​2.1.1610010010096100
Addedprettier@​3.9.6991009799100
Addedvue-component-meta@​3.3.810010010097100
Addedvue-component-type-helpers@​3.3.81001009797100
Added@​tailwindcss/​postcss@​4.3.39910010098100

View full report

@socket-security

socket-security Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm happy-dom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/happy-dom@20.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 2526c31 to d445c97 Compare July 21, 2026 00:08
@pkg-pr-new

pkg-pr-new Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown 
npm i https://pkg.pr.new/@nuxt/ui@6753

commit: 59177ee

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d445c97 to 09e6253 Compare July 21, 2026 15:10
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 09e6253 to 81c59d0 Compare July 21, 2026 22:10
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 81c59d0 to d79aede Compare July 22, 2026 03:51
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d79aede to 70afa7a Compare July 22, 2026 08:55
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 70afa7a to c5cbcd4 Compare July 22, 2026 19:37
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from c5cbcd4 to 59177ee Compare July 23, 2026 11:55
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 59177ee to 5e70989 Compare July 23, 2026 16:41
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 5e70989 to 35b9325 Compare July 24, 2026 00:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@benjamincanac benjamincanac Awaiting requested review from benjamincanac benjamincanac is a code owner

Assignees

No one assigned

Labels

v4 #4488

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants