chore(deps): update build, lint, and test tooling

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/coverage-v8 (source)	4.1.9 → 4.1.10
@vitest/ui (source)	4.1.9 → 4.1.10
eslint (source)	9.39.4 → 9.39.5
eslint-plugin-turbo (source)	2.10.0 → 2.10.5
knip (source)	5.60.2 → 5.88.1
nock	14.0.15 → 14.0.16
prettier (source)	3.8.4 → 3.9.5
tsx (source)	4.22.4 → 4.23.1
turbo (source)	2.10.0 → 2.10.5
vite (source)	8.1.0 → 8.1.5
vitest (source)	4.1.9 → 4.1.10

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

vercel/turborepo (eslint-plugin-turbo)

v2.10.5: Turborepo v2.10.5

Compare Source

What's Changed

Changelog

• perf: Evaluate simple include globs without wax compilation by @​anthonyshew in #​13285
• chore: Dogfood native Cargo support in this repository by @​anthonyshew in #​13283
• release(turborepo): 2.10.4 by @​github-actions[bot] in #​13286
• ci: Remove dead sccache configuration by @​anthonyshew in #​13289
• feat: Serve the Remote Cache as an sccache backend for Cargo tasks by @​anthonyshew in #​13288
• fix: Reject output path traversal by @​anthonyshew in #​13290
• fix: Disable the sccache proxy when remote cache use is off by @​anthonyshew in #​13291
• feat: Embed sccache so the Cargo compile cache needs no installation by @​anthonyshew in #​13293
• release(turborepo): 2.10.5-canary.1 by @​github-actions[bot] in #​13294
• fix: Pin a flag-aware turbo canary for the eve-agent deployment by @​anthonyshew in #​13295
• fix: Make the sccache compile cache actually cache by @​anthonyshew in #​13296
• release(turborepo): 2.10.5-canary.2 by @​github-actions[bot] in #​13297
• fix: Stop ambient CARGO_INCREMENTAL from suppressing compile cache injection by @​anthonyshew in #​13298
• fix: Never let compile cache storage failures fail the build by @​anthonyshew in #​13299
• test: Add outputs path-traversal negative-case regression tests by @​dnukumamras in #​13300
• release(turborepo): 2.10.5-canary.3 by @​github-actions[bot] in #​13302
• ci: Authenticate to Remote Cache via OIDC token exchange by @​anthonyshew in #​13303
• fix: Keep pnpm patches with version range keys during prune by @​anthonyshew in #​13307
• test: Scrub ambient turbo configuration from integration test children by @​anthonyshew in #​13306
• fix: Show toolchain tasks in the TUI and never run in silence by @​anthonyshew in #​13308
• ci: Fix change detection on push events by @​anthonyshew in #​13304
• refactor: Rename the Cargo toolchain id to rust by @​anthonyshew in #​13311
• fix: Remove extraneous bun.lock entries during prune by @​anthonyshew in #​13317
• feat: Require a user-declared name for the Cargo workspace package by @​anthonyshew in #​13312
• feat: Parse and validate the task command field by @​anthonyshew in #​13313
• chore: Harden turbo-vsc to invoke turbo without a shell by @​dnukumamras in #​13319
• feat: Resolve and execute task command overrides by @​anthonyshew in #​13315
• release(turborepo): 2.10.5-canary.4 by @​github-actions[bot] in #​13325
• feat: Run the Rust workspace tests through nextest via command override by @​anthonyshew in #​13316
• feat: Engage the Remote Cache and sccache compile cache for Rust CI by @​anthonyshew in #​13292
• ci: Pin GitHub Actions to full commit SHAs by @​XananasX7 in #​13143
• fix: Make npm prune rehoisting deterministic and complete by @​anthonyshew in #​13323
• feat: Report incremental cache reuse in the run summary by @​anthonyshew in #​13327
• chore: Remove planning docs by @​anthonyshew in #​13329
• docs: Migrate docs site to @​vercel/geistdocs package by @​molebox in #​13320
• ci: Update Remote Cache action by @​anthonyshew in #​13330
• release(turborepo): 2.10.5-canary.5 by @​github-actions[bot] in #​13331
• ci: Remove path-based workflow scheduling by @​anthonyshew in #​13332
• fix: Resolve EADDRINUSE in kitchen-sink api dev script by @​ashusnapx in #​13328
• ci: Disable telemetry messages in workflows by @​anthonyshew in #​13334
• fix: Prevent Cargo run tasks from being cached by @​anthonyshew in #​13335
• fix: Isolate Cargo cache by host platform by @​anthonyshew in #​13337
• fix: Continue TUI text selection beyond viewport by @​anthonyshew in #​13338
• ci: Dogfood Cargo target restoration by @​anthonyshew in #​13336
• fix: Require current Cargo lockfiles for caching by @​anthonyshew in #​13339
• fix: Reject unsupported Cargo local packages by @​anthonyshew in #​13340
• fix: Allow outputs outside package roots by @​anthonyshew in #​13342
• fix: Resolve Cargo lock dependencies by source by @​anthonyshew in #​13343
• docs: Update Cargo workspace support by @​anthonyshew in #​13349
• fix: Build Ghostty for baseline CPUs by @​anthonyshew in #​13352
• fix: Preserve watch rerun semantics for task inputs by @​anthonyshew in #​13351
• fix: Isolate Command Overrides From Toolchain Cache I/O by @​anthonyshew in #​13354
• release(turborepo): 2.10.5-canary.6 by @​github-actions[bot] in #​13355
• fix: Include patched Ghostty crate in Cargo workspace by @​anthonyshew in #​13357
• ci: Shard Rust tests across runners by @​anthonyshew in #​13356
• fix: Hash Cargo build environment inputs by @​anthonyshew in #​13348
• fix: Synchronize Cargo prune Docker lockfile by @​anthonyshew in #​13350
• chore: Update agents app Eve dependency by @​anthonyshew in #​13364
• fix: Preserve Yarn package extension ranges when pruning by @​anthonyshew in #​13363
• refactor: Add Toolchain output availability by @​anthonyshew in #​13360

New Contributors

• @​dnukumamras made their first contribution in #​13300
• @​XananasX7 made their first contribution in #​13143
• @​ashusnapx made their first contribution in #​13328

Full Changelog: vercel/turborepo@v2.10.4...v2.10.5

v2.10.4: Turborepo v2.10.4

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.3 by @​github-actions[bot] in #​13222
• ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by @​anthonyshew in #​13240
• perf: Use mimalloc as the global allocator by @​anthonyshew in #​13237
• perf: Parse yarn v1 lockfiles in a single pass by @​anthonyshew in #​13241
• ci: Fix cache outputs for Eve app by @​anthonyshew in #​13243
• perf: Stop materializing spans for the disabled daemon log layer by @​anthonyshew in #​13244
• fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by @​anthonyshew in #​13236
• perf: Overlap external dependency hashing with package file hashing by @​anthonyshew in #​13234
• perf: Build tracked repo index concurrently with package graph by @​anthonyshew in #​13232
• perf: Release tokio runtime at exit so background DNS lookups never stall the user by @​anthonyshew in #​13231
• perf: Overhaul pnpm lockfile parsing and dependency closure computation by @​anthonyshew in #​13228
• feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by @​anthonyshew in #​13227
• feat: Introduce toolchain provider abstraction by @​anthonyshew in #​13235
• perf: Parse Berry lockfiles in a single pass by @​anthonyshew in #​13242
• fix: Apply input exclusion globs to the filesystem walk by @​anthonyshew in #​13224
• fix: Stop root-directory packages from claiming every file in change mapping by @​anthonyshew in #​13225
• chore: Rename turborepo-repository napi package to @​turbo/repository by @​anthonyshew in #​13226
• perf: Hash git blobs with hardware-accelerated SHA-1 by @​anthonyshew in #​13245
• release(turborepo): 2.10.4-canary.1 by @​github-actions[bot] in #​13247
• feat: Discover Cargo crates as packages by @​anthonyshew in #​13248
• perf: Reuse per-package external dependency hashes in run summaries by @​anthonyshew in #​13249
• perf: Stat workspace turbo.json files concurrently during discovery by @​anthonyshew in #​13251
• chore: Add tracing spans to workspace discovery and globwalk phases by @​anthonyshew in #​13252
• fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by @​anthonyshew in #​13256
• perf: Memoize resolved task definitions during engine construction by @​anthonyshew in #​13257
• perf: Compute transitive closures and external dependency hashes concurrently with run setup by @​anthonyshew in #​13250
• perf: Probe microfrontends configs in parallel by @​anthonyshew in #​13262
• feat: Execute Cargo crate tasks via cargo by @​anthonyshew in #​13261
• perf: Pre-size engine task collections by @​anthonyshew in #​13265
• feat: Expose resolved experimentalCI task configuration in turbo query by @​anthonyshew in #​13264
• feat: Derive input and output globs for Cargo tasks by @​anthonyshew in #​13263
• perf: Parse large pnpm lockfile sections in parallel by @​anthonyshew in #​13266
• feat: Hash Cargo external dependencies per-crate by @​anthonyshew in #​13267
• ci: Install pnpm 10 in musl containers for Library Release by @​anthonyshew in #​13269
• ci: Force pnpm overwrite in Library Release musl containers by @​anthonyshew in #​13270
• perf: Defer the untracked-scan barrier to first file-hash use by @​anthonyshew in #​13268
• ci: Fetch API-created commit before updating local ref by @​anthonyshew in #​13271
• release(library): 0.0.1-canary.22 by @​github-actions[bot] in #​13272
• perf: Remove lock and dispatch overhead from task hash precomputation by @​anthonyshew in #​13273
• fix: Fall back to lockfile detection in @​turbo/repository when package manager is undeclared by @​anthonyshew in #​13275
• test: Add end-to-end coverage for Cargo workspaces by @​anthonyshew in #​13274
• release(library): 0.0.1-canary.23 by @​github-actions[bot] in #​13276
• release(turborepo): 2.10.4-canary.2 by @​github-actions[bot] in #​13278
• fix: Collapse nested package-manager fallback conditional by @​anthonyshew in #​13279
• feat: Make turbo watch Cargo-aware by @​anthonyshew in #​13280
• perf: Skip dependency-closure assembly for toolchains that derive nothing by @​anthonyshew in #​13277
• feat: Make turbo prune Cargo-aware by @​anthonyshew in #​13281
• fix: Raise the open-file soft limit at startup by @​anthonyshew in #​13282
• fix: Stop flagging relative imports that resolve into node_modules in boundaries by @​anthonyshew in #​13284

Full Changelog: vercel/turborepo@v2.10.3...v2.10.4

v2.10.3: Turborepo v2.10.3

Compare Source

What's Changed

Changelog

• feat: Add nub to create-turbo options by @​anthonyshew in #​13173
• release(turborepo): 2.10.2 by @​github-actions[bot] in #​13174
• release(turborepo): 2.10.3-canary.1 by @​github-actions[bot] in #​13176
• fix: Normalize package manager versions by @​anthonyshew in #​13177
• fix: Use singular workspace in package resolution error by @​anthonyshew in #​13178
• fix: Support nub native lockfiles by @​anthonyshew in #​13179
• perf(build): Enable thin LTO + codegen-units=1 for release builds by @​lukesandberg in #​13160
• release(turborepo): 2.10.3-canary.2 by @​github-actions[bot] in #​13181
• feat: Add aube package manager support by @​anthonyshew in #​13183
• release(turborepo): 2.10.3-canary.3 by @​github-actions[bot] in #​13184
• fix: Normalize package manager version output by @​anthonyshew in #​13185
• release(turborepo): 2.10.3-canary.4 by @​github-actions[bot] in #​13186
• refactor: Richer internal dependency data by @​anthonyshew in #​13188
• fix(repository): honor semver ranges in devEngines.packageManager.version by @​colinhacks in #​13189
• fix: Skip node_modules in boundaries checks by @​anthonyshew in #​13191
• fix: Add token exchange recovery guidance by @​anthonyshew in #​13192
• feat: Add --production flag to turbo prune by @​anthonyshew in #​13190
• release(turborepo): 2.10.3-canary.5 by @​github-actions[bot] in #​13193
• feat: Accept Bun lockfile version 2 by @​tsushanth in #​13119
• fix: Handle task executor join errors as internal errors by @​gwagjiug in #​13148
• fix: Tweaks for nub support by @​colinhacks in #​13187
• release(turborepo): 2.10.3-canary.6 by @​github-actions[bot] in #​13194
• release(turborepo): 2.10.3-canary.7 by @​github-actions[bot] in #​13195
• chore: Upgrade TypeScript to 7.0.1-rc by @​anthonyshew in #​13144
• docs: Add filtered installs to Vercel guide by @​anthonyshew in #​13196
• examples: add with-mcp-servers by @​Nishant-Chaudhary5338 in #​12997
• fix: Report malformed JSON parse errors instead of panicking by @​anthonyshew in #​13198
• fix: Improve error messaging when platform binary is missing by @​anthonyshew in #​13199
• release(turborepo): 2.10.3-canary.8 by @​github-actions[bot] in #​13200
• fix(watch): Recover from slow initial hash instead of timing out by @​lukesandberg in #​13159
• chore: Update vitest example to vitest 4 and use native test merging by @​abhiaagarwal in #​13202
• feat: Toggle between the TUI and streamed logs by @​anthonyshew in #​13203
• fix: Resolve Bun scoped package deps that share a name with a dependency by @​anthonyshew in #​13207
• feat: Select tasks by clicking rows in the TUI task list by @​anthonyshew in #​13206
• perf: Avoid deep-cloning dependency maps in lockfile closure cache by @​anthonyshew in #​13209
• perf: Cache root internal dependencies in package graph by @​anthonyshew in #​13211
• feat: Automatically copy TUI selection to clipboard on mouse release by @​anthonyshew in #​13208
• perf: Cache env wildcard matches across tasks during hashing by @​anthonyshew in #​13210
• perf: Replace per-package graph traversals in scope filtering by @​anthonyshew in #​13212
• perf: Derive dirty hash from repo index by @​anthonyshew in #​13213
• fix: Include untracked symlinks in repo-index dirty hash by @​anthonyshew in #​13218
• refactor: Use upstream libghostty-vt crates instead of vendored bindings by @​anthonyshew in #​13205
• fix: Remove devtools feature flag by @​anthonyshew in #​13219
• fix: Harden TUI terminal restore during shutdown by @​anthonyshew in #​13220
• fix: Correct gitignore precedence in untracked walk and memoize matcher chains by @​anthonyshew in #​13221

New Contributors

• @​lukesandberg made their first contribution in #​13160
• @​tsushanth made their first contribution in #​13119
• @​Nishant-Chaudhary5338 made their first contribution in #​12997
• @​abhiaagarwal made their first contribution in #​13202

Full Changelog: vercel/turborepo@v2.10.2...v2.10.3

v2.10.2: Turborepo v2.10.2

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.1 by @​github-actions[bot] in #​13156
• docs: Prefer devEngines packageManager by @​anthonyshew in #​13155
• fix: Install Zig for LSP builds by @​anthonyshew in #​13158
• ci: Pin macOS Rust builds to macOS 15 by @​anthonyshew in #​13167
• feat: Recognize nub as a package manager by @​colinhacks in #​13120
• fix: Preserve 3-level nested Bun lockfile entries during prune by @​anthonyshew in #​13168
• fix: Avoid following nested symlinked cache outputs by @​anthonyshew in #​13166
• feat: Add nub package manager support to JavaScript packages by @​anthonyshew in #​13169
• fix: Link ghostty-vt statically on Windows MSVC by @​anthonyshew in #​13171
• release(turborepo): 2.10.2-canary.1 by @​github-actions[bot] in #​13172

New Contributors

• @​colinhacks made their first contribution in #​13120

Full Changelog: vercel/turborepo@v2.10.1...v2.10.2

v2.10.1: Turborepo v2.10.1

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.0 by @​github-actions[bot] in #​13131
• docs: Add Turborepo 2.10 release post and update docs by @​anthonyshew in #​13096
• perf: Avoid normalizing git index path joins by @​anthonyshew in #​12944
• chore: Remove tbx package by @​anthonyshew in #​13133
• feat: Migrate TUI virtual terminals from vt100 to Ghostty by @​anthonyshew in #​13135
• chore: Add examples maintenance agent by @​anthonyshew in #​13136
• chore: Remove a few pre-push hooks by @​anthonyshew in #​13137
• ci: Making sure Zig works in releases by @​anthonyshew in #​13138
• release(turborepo): 2.10.1-canary.1 by @​github-actions[bot] in #​13139
• fix: Support Corepack packageManager integrity hashes by @​gwagjiug in #​13123
• fix(env): Add XDG_DATA_* to pass-through by @​vercel[bot] in #​13145
• release(turborepo): 2.10.1-canary.2 by @​github-actions[bot] in #​13147
• feat: Support devEngines.packageManager by @​lachieh in #​12388
• feat: Support devEngines packageManager in workspaces by @​anthonyshew in #​13150
• release(turborepo): 2.10.1-canary.3 by @​github-actions[bot] in #​13149
• feat: Update add package manager codemod by @​anthonyshew in #​13151
• feat: Update workspace package manager declarations by @​anthonyshew in #​13154

New Contributors

• @​lachieh made their first contribution in #​12388

Full Changelog: vercel/turborepo@v2.10.0...v2.10.1

webpro-nl/knip (knip)

v5.88.1

Compare Source

v5.88.0

Compare Source

v5.87.0

Compare Source

v5.86.0: Release 5.86.0

Compare Source

• Rewrite import specifiers to use .ts extensions, remove tsx (#​1548) (58674ad) - thanks @​wojtekmaj!
• Add .spec-d to vitest entry files (#​1556) (3123ab7) - thanks @​yamachi4416!
• Update docs for tsx → node (0418eba)
• Auto-format (7142fd7)
• Add Qwik plugin (#​1557) (fc668f4) - thanks @​azat-io!
• Fix Bun plugin to handle directory arguments in bun test (c112b6c)
• Update FAQ (b105a42)
• fix(plugin): swc with externalHelpers setting ignores @swc/helpers dependency (#​1560) (4bcb1f5) - thanks @​bobaaaaa!
• chore: git ignore artifacts (#​1563) (4878724) - thanks @​unional!
• Fix Vite plugin to respect root option for index.html entries (#​1561) (67a5647) - thanks @​azat-io!
• Fix Astro sharpImageService() false positive for unused sharp (#​1559) (c36247c) - thanks @​azat-io!
• Fix up gitignore test (b2c3d08)
• fix: normalize Windows backslash paths in fs.watch listener to fix --watch on Windows (#​1558) (b86b421) - thanks @​Aiudadadadf!
• Fix wrangler plugin not enabled by jsonc config (#​1564) (00bb1be) - thanks @​DaniFoldi!
• Edit AGENTS.md (a2aaf2f)
• Fix tsconfig presets marked as unlisted in strict mode (resolve #​1568) (463d67d)
• oxcellent (8a602c7)
• Refactor format test and use prettier for consistent results (b6afc01)
• Sort package.json (d3a521b)
• Add .git to GLOBAL_IGNORE_PATTERNS (resolve #​1571) (4e95ffb)
• Detect Yarn plugins that are listed by their path alone (#​1574) (de4c7d8) - thanks @​robintown!
• Start using unbash (a5de2c4)
• Bump unbash & simplify bash parser further (57896d3)
• Fix refs in workspaces fixture (#​1578) (fbee342)
• Include a few more entry patterns with pageExtensions (resolve #​1581) (c6a6d9e)
• Clean exit if --fix fixes all issues (resolve #​1577) (c182c29)
• Document JSDoc tag hints (0e7b6ae)
• Update AGENTS.md (f845462)
• Add openapi-ts plugin (#​1579) (42d1b3f) - thanks @​jonahsnider!
• Migrate from js-yaml → yaml (fb042ae)
• pnpm dedupe (2586254)
• Fix plugin list order (#​1587) (519ae3a) - thanks @​ikeyan!
• Fix confusing test fixtures for openapi-ts plugin (#​1591) (f0083ca) - thanks @​jonahsnider!
• Off-by-1 (7d7dec6)
• Don't fix compiled files (pos off) (a9fdc77)
• Add aliases from any tsconfig file in typescript plugin (resolve #​1347) (ced77c7)
• Support auto-imports in Nuxt plugin (#​1517) (4ce27b2)
• Fix + lint .ts extension in import specifiers (d349de3)
• Safe ts.isInTopLevelContext → isInTopLevelScope (1819c20)
• Wrap session.handleFileChanges in try/catch (185afb8)
• Improve MDX compiler (9205e2a)
• fix(playwright): Add missing built-in null reporter (#​1596) (0f1ce7d) - thanks @​shrink!
• Add

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[edelauna]

knip - Requires zod to be updated to v4 first in order to CI to pass.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!