danielhaus/danielhaus.de
danielhaus/danielhaus.de
2
1
Fork 0
Code Issues 1 Pull requests Projects Releases 17 Packages 1 Wiki Activity Actions

chore(deps): update all non-major dependencies #153

Merged
renovate-bot merged 1 commit from renovate/all-minor-patch into main 2026-06-18 05:02:19 +00:00
Conversation 1 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-06-18 05:01:22 +00:00
Member
Copy link

This PR contains the following updates:

Package Change Age Confidence Type Update
@playwright/test (source) 1.60.0 → 1.61.0 age confidence devDependencies minor
@sveltejs/kit (source) 2.65.1 → 2.65.2 age confidence devDependencies patch
@vitest/browser-playwright (source) 4.1.8 → 4.1.9 age confidence devDependencies patch
node (source) 24.16.0 → 24.17.0 age confidence minor
playwright (source) 1.60.0 → 1.61.0 age confidence devDependencies minor
prettier-plugin-svelte 4.1.0 → 4.1.1 age confidence devDependencies patch
typescript-eslint (source) 8.61.0 → 8.61.1 age confidence devDependencies patch
vitest (source) 4.1.8 → 4.1.9 age confidence devDependencies patch

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

microsoft/playwright (@​playwright/test)

v1.61.0

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();
New APIs
Network
Browser and Screencast
  • New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
  • New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
  • The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.
Test runner
  • The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
  • Supported expect.soft.poll(...).
  • New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
  • New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
  • testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
  • New -G command line shorthand for --grep-invert.
🛠️ Other improvements
  • Playwright now supports Ubuntu 26.04.
  • HAR and trace recordings now include WebSocket requests.
Browser Versions
  • Chromium 149.0.7827.55
  • Mozilla Firefox 151.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 149
  • Microsoft Edge 149
sveltejs/kit (@​sveltejs/kit)

v2.65.2

Compare Source

Patch Changes

  • fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#​15994)

  • fix: decode base64-serialized fetch bodies before caching them for client-side replay (#​16034)

  • fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#​16024)

  • fix: allow preloadCode to be called during initial page load (#​16028)

  • fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#​16020)

  • fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#​16021)

  • fix: avoid loading universal nodes during build analysis when the app uses a hash router (#​16042)

  • fix: correctly serve client entry during development when using the pnpm global virtual store (#​16045)

  • fix: normalize path separators when comparing config (#​16037)

  • fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#​16058)

  • fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#​16018)

vitest-dev/vitest (@​vitest/browser-playwright)

v4.1.9

Compare Source

🐞 Bug Fixes
  • Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
  • browser:
    • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
    • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
  • mocker:
    • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
  • pool:
    • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)
View changes on GitHub
nodejs/node (node)

v24.17.0: 2026-06-18, Version 24.17.0 'Krypton' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits
sveltejs/prettier-plugin-svelte (prettier-plugin-svelte)

v4.1.1

Compare Source

Patch Changes

  • fix: preserve nested rest patterns in {#each} destructuring (#​537)

  • fix: preserve whitespace inside <textarea> (its content is whitespace-sensitive, like <pre>) (#​540)

  • fix: don't drop <script>/<style> content when the closing tag has whitespace (</script >) (#​539)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.61.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [@playwright/test](https://playwright.dev) ([source](https://github.com/microsoft/playwright)) | [`1.60.0` → `1.61.0`](https://renovatebot.com/diffs/npm/@playwright%2ftest/1.60.0/1.61.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2ftest/1.61.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2ftest/1.60.0/1.61.0?slim=true) | devDependencies | minor | | [@sveltejs/kit](https://svelte.dev) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/kit)) | [`2.65.1` → `2.65.2`](https://renovatebot.com/diffs/npm/@sveltejs%2fkit/2.65.1/2.65.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@sveltejs%2fkit/2.65.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@sveltejs%2fkit/2.65.1/2.65.2?slim=true) | devDependencies | patch | | [@vitest/browser-playwright](https://vitest.dev/config/browser/playwright) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright)) | [`4.1.8` → `4.1.9`](https://renovatebot.com/diffs/npm/@vitest%2fbrowser-playwright/4.1.8/4.1.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fbrowser-playwright/4.1.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fbrowser-playwright/4.1.8/4.1.9?slim=true) | devDependencies | patch | | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | `24.16.0` → `24.17.0` | ![age](https://developer.mend.io/api/mc/badges/age/node-version/node/v24.17.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/node-version/node/v24.16.0/v24.17.0?slim=true) | | minor | | [playwright](https://playwright.dev) ([source](https://github.com/microsoft/playwright)) | [`1.60.0` → `1.61.0`](https://renovatebot.com/diffs/npm/playwright/1.60.0/1.61.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/playwright/1.61.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/playwright/1.60.0/1.61.0?slim=true) | devDependencies | minor | | [prettier-plugin-svelte](https://github.com/sveltejs/prettier-plugin-svelte) | [`4.1.0` → `4.1.1`](https://renovatebot.com/diffs/npm/prettier-plugin-svelte/4.1.0/4.1.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/prettier-plugin-svelte/4.1.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/prettier-plugin-svelte/4.1.0/4.1.1?slim=true) | devDependencies | patch | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.61.0` → `8.61.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.61.0/8.61.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/typescript-eslint/8.61.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/typescript-eslint/8.61.0/8.61.1?slim=true) | devDependencies | patch | | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.8` → `4.1.9`](https://renovatebot.com/diffs/npm/vitest/4.1.8/4.1.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.8/4.1.9?slim=true) | devDependencies | patch | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/121) for more information. --- ### Release Notes <details> <summary>microsoft/playwright (@&#8203;playwright/test)</summary> ### [`v1.61.0`](https://github.com/microsoft/playwright/releases/tag/v1.61.0) [Compare Source](https://github.com/microsoft/playwright/compare/v1.60.0...v1.61.0) ##### 🔑 WebAuthn passkeys New [Credentials](https://playwright.dev/docs/api/class-credentials) virtual authenticator, available via [browserContext.credentials](https://playwright.dev/docs/api/class-browsercontext#browser-context-credentials), lets tests register passkeys and answer `navigator.credentials.create()` / `navigator.credentials.get()` ceremonies in the page — no real hardware key required, works in all browsers: ```js const context = await browser.newContext(); // Seed a passkey your backend provisioned for a test user. await context.credentials.create('example.com', { id: credentialId, userHandle, privateKey, publicKey, }); await context.credentials.install(); const page = await context.newPage(); await page.goto('https://example.com/login'); // The page's navigator.credentials.get() is answered with the seeded passkey. ``` You can also let the app register a passkey once in a setup test, read it back with [credentials.get()](https://playwright.dev/docs/api/class-credentials#credentials-get), and seed it into later tests — see [Credentials](https://playwright.dev/docs/api/class-credentials) for details. ##### 🗃️ Web Storage New [WebStorage](https://playwright.dev/docs/api/class-webstorage) API, available via [page.localStorage](https://playwright.dev/docs/api/class-page#page-local-storage) and [page.sessionStorage](https://playwright.dev/docs/api/class-page#page-session-storage), reads and writes the page's storage for the current origin: ```js await page.localStorage.setItem('token', 'abc'); const token = await page.localStorage.getItem('token'); const items = await page.sessionStorage.items(); ``` ##### New APIs ##### Network - [apiResponse.securityDetails()](https://playwright.dev/docs/api/class-apiresponse#api-response-security-details) and [apiResponse.serverAddr()](https://playwright.dev/docs/api/class-apiresponse#api-response-server-addr) mirror the browser-side [response.securityDetails()](https://playwright.dev/docs/api/class-response#response-security-details) and [response.serverAddr()](https://playwright.dev/docs/api/class-response#response-server-addr). ##### Browser and Screencast - New option `artifactsDir` in [browserType.connectOverCDP()](https://playwright.dev/docs/api/class-browsertype#browser-type-connect-over-cdp) controls where artifacts such as traces and downloads are stored when attached to an existing browser. - New option `cursor` in [screencast.showActions()](https://playwright.dev/docs/api/class-screencast#screencast-show-actions) controls the cursor decoration rendered for pointer actions. - The `onFrame` callback in [screencast.start()](https://playwright.dev/docs/api/class-screencast#screencast-start) now receives a `timestamp` of when the frame was presented by the browser. ##### Test runner - The [testOptions.video](https://playwright.dev/docs/api/class-testoptions#test-options-video) option now supports the same set of modes as `trace`: new `'on-all-retries'`, `'retain-on-first-failure'` and `'retain-on-failure-and-retries'` values. See the [video modes table](https://playwright.dev/docs/test-use-options#video-modes) for which runs are recorded and kept in each mode. - Supported `expect.soft.poll(...)`. - New [fullConfig.argv](https://playwright.dev/docs/api/class-fullconfig#full-config-argv) — a snapshot of `process.argv` from the runner process, handy for reading custom arguments passed after the `--` separator. - New [fullConfig.failOnFlakyTests](https://playwright.dev/docs/api/class-fullconfig#full-config-fail-on-flaky-tests) mirrors the config option, so reporters can explain why a flaky run failed. - [testInfo.errors](https://playwright.dev/docs/api/class-testinfo#test-info-errors) now lists each sub-error of an `AggregateError` as a separate entry. - New `-G` command line shorthand for `--grep-invert`. ##### 🛠️ Other improvements - Playwright now supports Ubuntu 26.04. - HAR and trace recordings now include WebSocket requests. ##### Browser Versions - Chromium 149.0.7827.55 - Mozilla Firefox 151.0 - WebKit 26.5 This version was also tested against the following stable channels: - Google Chrome 149 - Microsoft Edge 149 </details> <details> <summary>sveltejs/kit (@&#8203;sveltejs/kit)</summary> ### [`v2.65.2`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2652) [Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/kit@2.65.1...@sveltejs/kit@2.65.2) ##### Patch Changes - fix: throw an error when prerendering a root +server.js that returns a non-HTML response ([#&#8203;15994](https://github.com/sveltejs/kit/pull/15994)) - fix: decode base64-serialized fetch bodies before caching them for client-side replay ([#&#8203;16034](https://github.com/sveltejs/kit/pull/16034)) - fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers ([#&#8203;16024](https://github.com/sveltejs/kit/pull/16024)) - fix: allow `preloadCode` to be called during initial page load ([#&#8203;16028](https://github.com/sveltejs/kit/pull/16028)) - fix: send `cache-control: private, no-store` on remote function responses so personalized query results can never be cached by shared caches ([#&#8203;16020](https://github.com/sveltejs/kit/pull/16020)) - fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a `handle` hook), instead of reporting a generic 500 ([#&#8203;16021](https://github.com/sveltejs/kit/pull/16021)) - fix: avoid loading universal nodes during build analysis when the app uses a hash router ([#&#8203;16042](https://github.com/sveltejs/kit/pull/16042)) - fix: correctly serve client entry during development when using the pnpm global virtual store ([#&#8203;16045](https://github.com/sveltejs/kit/pull/16045)) - fix: normalize path separators when comparing config ([#&#8203;16037](https://github.com/sveltejs/kit/pull/16037)) - fix: ensure `building` resolves correctly to allow avoiding build-time explicit environment variable validation ([#&#8203;16058](https://github.com/sveltejs/kit/pull/16058)) - fix: prevent unhandled promise rejections when remote function failures are consumed via `current`/`error` instead of `await` ([#&#8203;16018](https://github.com/sveltejs/kit/pull/16018)) </details> <details> <summary>vitest-dev/vitest (@&#8203;vitest/browser-playwright)</summary> ### [`v4.1.9`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.9) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) ##### 🐞 Bug Fixes - Fix `importOriginal` with optimizer and query import \[backport to v4] - by **Hiroshi Ogawa**, **David Harris**, **Codex**and **Vladimir** in [#&#8203;10546](https://github.com/vitest-dev/vitest/issues/10546) [<samp>(a5180)</samp>](https://github.com/vitest-dev/vitest/commit/a5180190c) - **browser**: - Wait for orchestrator readiness before resolving browser sessions \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#&#8203;10555](https://github.com/vitest-dev/vitest/issues/10555) [<samp>(7fb29)</samp>](https://github.com/vitest-dev/vitest/commit/7fb29651a) - Wait for iframe tester readiness before preparing \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#&#8203;10497](https://github.com/vitest-dev/vitest/issues/10497) and [#&#8203;10556](https://github.com/vitest-dev/vitest/issues/10556) [<samp>(fbc62)</samp>](https://github.com/vitest-dev/vitest/commit/fbc626c40) - **mocker**: - Hoist vi.mock() for vite-plus/test imports \[backport to v4] - by **Hiroshi Ogawa**, **LongYinan**, **Claude Opus 4.8** and **Vladimir** in [#&#8203;10548](https://github.com/vitest-dev/vitest/issues/10548) [<samp>(2c955)</samp>](https://github.com/vitest-dev/vitest/commit/2c9559c02) - **pool**: - Prevent test run hang on worker crash \[backport to v4] - by **Ari Perkkiö** and **Jattioui Ismail** in [#&#8203;10543](https://github.com/vitest-dev/vitest/issues/10543) and [#&#8203;10564](https://github.com/vitest-dev/vitest/issues/10564) [<samp>(934b0)</samp>](https://github.com/vitest-dev/vitest/commit/934b0f587) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) </details> <details> <summary>nodejs/node (node)</summary> ### [`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 &#x27;Krypton&#x27; (LTS), @&#8203;aduh95 [Compare Source](https://github.com/nodejs/node/compare/v24.16.0...v24.17.0) This is a security release. ##### Notable Changes - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low ##### Commits - \[[`9e4dfc7bba`](https://github.com/nodejs/node/commit/9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878) - \[[`cb2aed980c`](https://github.com/nodejs/node/commit/cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890) - \[[`a8a0d12875`](https://github.com/nodejs/node/commit/a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#&#8203;62891](https://github.com/nodejs/node/pull/62891) - \[[`66e6203c1c`](https://github.com/nodejs/node/commit/66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#&#8203;62891](https://github.com/nodejs/node/pull/62891) - \[[`dd627ced27`](https://github.com/nodejs/node/commit/dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](https://github.com/nodejs/node/pull/63820) - \[[`684bae568f`](https://github.com/nodejs/node/commit/684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](https://github.com/nodejs/node/pull/63820) - \[[`3a631e7f83`](https://github.com/nodejs/node/commit/3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#&#8203;62656](https://github.com/nodejs/node/pull/62656) - \[[`cf44df3996`](https://github.com/nodejs/node/commit/cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#&#8203;63703](https://github.com/nodejs/node/pull/63703) - \[[`138c70294b`](https://github.com/nodejs/node/commit/138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868) - \[[`be7e719c3f`](https://github.com/nodejs/node/commit/be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846) - \[[`cc7c11b4d1`](https://github.com/nodejs/node/commit/cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855) - \[[`9224427b92`](https://github.com/nodejs/node/commit/9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867) - \[[`cf85d54839`](https://github.com/nodejs/node/commit/cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873) - \[[`a1bbc24f96`](https://github.com/nodejs/node/commit/a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870) - \[[`e3723ff2d6`](https://github.com/nodejs/node/commit/e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854) - \[[`a77af4867b`](https://github.com/nodejs/node/commit/a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854) - \[[`31beb4f707`](https://github.com/nodejs/node/commit/31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857) - \[[`8e75c73f91`](https://github.com/nodejs/node/commit/8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869) </details> <details> <summary>sveltejs/prettier-plugin-svelte (prettier-plugin-svelte)</summary> ### [`v4.1.1`](https://github.com/sveltejs/prettier-plugin-svelte/blob/HEAD/CHANGELOG.md#411) [Compare Source](https://github.com/sveltejs/prettier-plugin-svelte/compare/prettier-plugin-svelte@4.1.0...prettier-plugin-svelte@4.1.1) ##### Patch Changes - fix: preserve nested rest patterns in `{#each}` destructuring ([#&#8203;537](https://github.com/sveltejs/prettier-plugin-svelte/pull/537)) - fix: preserve whitespace inside `<textarea>` (its content is whitespace-sensitive, like `<pre>`) ([#&#8203;540](https://github.com/sveltejs/prettier-plugin-svelte/pull/540)) - fix: don't drop `<script>`/`<style>` content when the closing tag has whitespace (`</script >`) ([#&#8203;539](https://github.com/sveltejs/prettier-plugin-svelte/pull/539)) </details> <details> <summary>typescript-eslint/typescript-eslint (typescript-eslint)</summary> ### [`v8.61.1`](https://github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8611-2026-06-15) [Compare Source](https://github.com/typescript-eslint/typescript-eslint/compare/v8.61.0...v8.61.1) This was a version bump only for typescript-eslint to align it with other projects, there were no code changes. See [GitHub Releases](https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.1) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40My4yIiwidXBkYXRlZEluVmVyIjoiNDMuNDMuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
chore(deps): update all non-major dependencies
Some checks failed
renovate/artifacts Artifact file update failure
Build / Test (pull_request) Failing after 50s
Details
Build / Build (pull_request) Has been skipped
Details
6ee5a36dca
renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-06-18 05:01:22 +00:00
renovate-bot commented 2026-06-18 05:01:22 +00:00
Author
Member
Copy link

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @vitest/browser@4.1.8
npm warn Found: vitest@4.1.9
npm warn node_modules/vitest
npm warn   dev vitest@"4.1.9" from the root project
npm warn   3 more (@testing-library/svelte, vitest-browser-svelte, @vitest/browser-playwright)
npm warn
npm warn Could not resolve dependency:
npm warn peer vitest@"4.1.8" from @vitest/browser@4.1.8
npm warn node_modules/@vitest/browser
npm warn
npm warn Conflicting peer dependency: vitest@4.1.8
npm warn node_modules/vitest
npm warn   peer vitest@"4.1.8" from @vitest/browser@4.1.8
npm warn   node_modules/@vitest/browser
npm error code EBADENGINE
npm error engine Unsupported engine
npm error engine Not compatible with your version of node/npm: abbrev@5.0.0
npm error notsup Not compatible with your version of node/npm: abbrev@5.0.0
npm error notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error notsup Actual:   {"node":"v24.14.0","npm":"11.9.0"}
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-06-18T05_00_38_257Z-debug-0.log
### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: package-lock.json ``` npm warn Unknown env config "store". This will stop working in the next major version of npm. npm warn ERESOLVE overriding peer dependency npm warn While resolving: @vitest/browser@4.1.8 npm warn Found: vitest@4.1.9 npm warn node_modules/vitest npm warn dev vitest@"4.1.9" from the root project npm warn 3 more (@testing-library/svelte, vitest-browser-svelte, @vitest/browser-playwright) npm warn npm warn Could not resolve dependency: npm warn peer vitest@"4.1.8" from @vitest/browser@4.1.8 npm warn node_modules/@vitest/browser npm warn npm warn Conflicting peer dependency: vitest@4.1.8 npm warn node_modules/vitest npm warn peer vitest@"4.1.8" from @vitest/browser@4.1.8 npm warn node_modules/@vitest/browser npm error code EBADENGINE npm error engine Unsupported engine npm error engine Not compatible with your version of node/npm: abbrev@5.0.0 npm error notsup Not compatible with your version of node/npm: abbrev@5.0.0 npm error notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"} npm error notsup Actual: {"node":"v24.14.0","npm":"11.9.0"} npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-06-18T05_00_38_257Z-debug-0.log ```
renovate-bot deleted branch renovate/all-minor-patch 2026-06-18 05:02:19 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
danielhaus/danielhaus.de!153
No description provided.