Skip to content

build(deps): update non-major dependencies#58

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-deps
Open

build(deps): update non-major dependencies#58
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-deps

Conversation

@renovate

@renovate renovate Bot commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@tailwindcss/postcss (source) 4.3.04.3.1 age confidence devDependencies patch
@tanstack/vue-query (source) 5.100.145.101.0 age confidence dependencies minor
@types/node (source) 25.9.125.9.3 age confidence devDependencies patch
@vitest/coverage-v8 (source) 4.1.84.1.9 age confidence devDependencies patch
@vue/test-utils 2.4.102.4.11 age confidence devDependencies patch
actions/checkout (changelog) de0fac2df4cb1c action digest
baseline-browser-mapping 2.10.332.10.37 age confidence dependencies patch
caniuse-lite 1.0.300017931.0.30001799 age confidence dependencies patch
codecov/codecov-action (changelog) 75cd1160fb7174 action digest
github.com/caarlos0/env/v11 v11.4.0v11.4.1 age confidence require patch
github.com/go-chi/chi/v5 v5.2.5v5.3.0 age confidence require minor
github.com/rs/zerolog v1.34.0v1.35.1 age confidence require minor
github.com/urfave/cli/v3 v3.7.0v3.10.0 age confidence require minor
golangci/golangci-lint-action (changelog) 1e7e51e82606bf action digest
googleapis/release-please-action (changelog) 16a9c905c625bf action digest
oxlint (source) 1.68.01.70.0 age confidence devDependencies minor
prettier (source) 3.8.33.8.4 age confidence devDependencies patch
prettier-plugin-tailwindcss ^0.7.2^0.8.0 age confidence devDependencies minor
tailwindcss (source) 4.3.04.3.1 age confidence devDependencies patch
vitest (source) 4.1.84.1.9 age confidence devDependencies patch
vue (source) 3.5.353.5.38 age confidence dependencies patch
vue-tsc (source) 3.3.33.3.5 age confidence devDependencies patch

Release Notes

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.1

Compare Source

Added
  • Add --silent option to suppress output in @tailwindcss/cli (#​20100)
Fixed
  • Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#​20028)
  • Canonicalization: don't crash when plugin utilities throw for unsupported values (#​20052)
  • Allow @apply to be used with CSS mixins (#​19427)
  • Ensure not-* correctly negates @container queries, including style(…) queries (#​20059)
  • Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#​20080)
  • Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#​20103)
  • Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#​20027)
  • Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)]px-[calc(1rem+0)]) (#​20127)
  • Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px]left-[99999px], not left-24999.75) (#​20130)
  • Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#​20137)
  • Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#​20139)
  • Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#​20198)
  • Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#​19588)
  • Allow @variant to be used inside addBase (#​19480)
  • Ensure @source globs with symlinks are preserved (#​20203)
  • Ensure later @source rules can re-include files excluded by earlier @source not rules (#​20203)
  • Upgrade: don't migrate empty class rules to invalid @utility rules (#​20205)
  • Ensure transitions between inset-shadow-none and other inset shadows work correctly (#​20208)
  • Ensure explicitly referenced @source directories are scanned even when ignored by git (#​20214)
  • Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#​20217)
  • Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)]w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#​20221)
  • Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#​20228)
Changed
  • Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#​20196)
  • Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#​20196)
TanStack/query (@​tanstack/vue-query)

v5.101.0

Compare Source

Patch Changes
vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.9

Compare Source

🐞 Bug Fixes
  • Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
  • browser:
    • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
    • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
  • mocker:
    • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
  • pool:
    • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)
View changes on GitHub
vuejs/test-utils (@​vue/test-utils)

v2.4.11

Compare Source

compare changes

🩹 Fixes
  • Drop legacy Mutation Event listener entries (#​2844)
  • Handle setData() correctly for components using both setup() and data() (#​2846)
  • Export GlobalMountOptions type (#​2851)
  • Set spec-compliant event.code on keydown/keyup (#​2850)
❤️ Contributors
web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.10.37

Compare Source

v2.10.36

Compare Source

v2.10.35

Compare Source

v2.10.34

Compare Source

browserslist/caniuse-lite (caniuse-lite)

v1.0.30001799

Compare Source

v1.0.30001797

Compare Source

caarlos0/env (github.com/caarlos0/env/v11)

v11.4.1

Compare Source

Changelog

Bug fixes
Documentation updates
Other work

Released with GoReleaser Pro!

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.0

Compare Source

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

PR #​967 introduced middleware.ClientIP, a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

rs/zerolog (github.com/rs/zerolog)

v1.35.1

Compare Source

v1.35.0

Compare Source

urfave/cli (github.com/urfave/cli/v3)

v3.10.0

Compare Source

What's Changed

Full Changelog: urfave/cli@v3.9.1...v3.10.0

v3.9.1

Compare Source

What's Changed

Full Changelog: urfave/cli@v3.9.0...v3.9.1

v3.9.0

Compare Source

What's Changed

New Contributors

Full Changelog: urfave/cli@v3.8.0...v3.9.0

v3.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: urfave/cli@v3.7.0...v3.8.0

oxc-project/oxc (oxlint)

v1.70.0

Compare Source

🚀 Features
  • 2e8bda4 linter/vue: Implement no-dupe-keys rule (#​23350) (bab)
  • 1490a0a linter/react: Implement react-compiler rule (#​23202) (Boshen)
  • dd560ae linter/unicorn: Implement no-array-fill-with-reference-type rule (#​23397) (Mikhail Baev)
  • af36c2f linter: Add schema for react/jsx-curly-brace-presence (#​23400) (WaterWhisperer)
  • 47d34a3 linter: Add schema for react/jsx-handler-names (#​23393) (WaterWhisperer)
  • f4250d0 linter: Add schema for unicorn/import-style (#​23386) (WaterWhisperer)
  • 30c74ce linter: Add schema for jsx_a11y/no-noninteractive-element-to-interactive-role (#​23384) (Sysix)
  • cfbe8dc linter: Add schema for jsx_a11y/no-interactive-element-to-noninteractive-role (#​23382) (WaterWhisperer)
  • d15b7ff linter: Add schema for typescript/no-restricted-types (#​23381) (WaterWhisperer)
  • 028a811 linter: Add schema for jsx-a11y/media-has-caption (#​23377) (Sysix)
  • b3b1038 linter: Add schema for jsx-a11y/label-has-associated-control (#​23376) (Sysix)
  • 7ada6b2 linter: Add schema for jsx_a11y/no-distracting-elements (#​23379) (WaterWhisperer)
  • ee3dd49 linter: Add schema for jsx-a11y/img-redundant-alt (#​23374) (Sysix)
  • df5f8dd linter: Add short descriptions to most lint rules. (#​23365) (Connor Shea)
  • e3fd735 linter: Add schema for jsx_a11y/alt-text (#​23369) (Sysix)
  • 0f2fff4 linter: Add schema for react/exhaustive-deps (#​23372) (Mikhail Baev)
  • e3e4e10 linter: Add schema for react_perf/jsx-no-new-object-as-prop (#​23368) (Mikhail Baev)
  • 9366d44 linter: Add schema for unicorn/prefer-at (#​23366) (WaterWhisperer)
  • f57b55d linter: Add schema for typescript/array-type (#​23355) (Sysix)
  • 0dcf912 linter: Add schema for typescript/ban-ts-comment (#​23354) (Sysix)
  • 51fa83e linter: Add schema for react/no-did-update-set-state (#​23357) (Mikhail Baev)
  • 59db0bd linter: Add schema for consistent-generic-constructors (#​23353) (Sysix)
  • c4775c0 linter: Add schema for typescript/consistent-type-assertions (#​23349) (Sysix)
  • 6e516f7 linter: Add schema for typescript/consistent-type-imports (#​23348) (Sysix)
  • 012134d linter: Add schema for react/jsx-no-target-blank (#​23345) (WaterWhisperer)
  • 0806aae linter: Add schema for jsx_a11y/no-noninteractive-tabindex (#​23337) (Mikhail Baev)
  • 0708b5a linter: Add schema for react/jsx-filename-extension (#​23315) (Mikhail Baev)
  • 150bce1 linter: Add schema for typescript/no-empty-object-type (#​23309) (Sysix)
  • f9e36f1 linter: Add schema for typescript/no-duplicate-type-constituents (#​23308) (Sysix)
  • 937accf linter: Add schema for typescript/no-invalid-void-type (#​23307) (Sysix)
  • 3e042b9 linter: Add schema for typescript/no-misused-promises (#​23306) (Sysix)
  • da212d1 linter: Add schema for typescript/no-unnecessary-condition (#​23305) (Sysix)
  • f8f0d38 linter: Add schema for typescript/parameter-properties (#​23304) (Sysix)
  • 2275fc7 linter: Add schema for typescript/prefer-nullish-coalescing (#​23302) (Sysix)
  • d353858 linter: Add schema for typescript/prefer-string-starts-ends-with (#​23301) (Sysix)
  • 03060f5 linter: Add schema for typescript/triple-slash-reference (#​23300) (Sysix)
  • 6619cee linter: Add schema for promise/param-names (#​23298) (Sysix)
  • 8bf108e linter: Add schema for promise/catch-or-return (#​23297) (Sysix)
  • 48158d0 linter: Add schema for vitest/consistent-each-for (#​23294) (Sysix)
  • 7e74c98 linter: Add schema for vitest/consistent-test-filename (#​23293) (Sysix)
  • ff94d4a linter: Add schema for vitest/consistent-vitest-vi (#​23292) (Sysix)
  • 2409a10 linter: Add schema for vitest/prefer-import-in-mock (#​23291) (Sysix)
  • 3d782b7 linter: Add schema for react/no-unstable-nested-components (#​23287) (Mikhail Baev)
  • 0a0bc2f linter/jsx-a11y: Add allowedRedundantRoles option to no-redundant-roles (#​22820) (bab)
  • 80758a5 linter/vue: Implement no-side-effects-in-computed-properties rule (#​23282) (bab)
  • e3869ac linter: Add schema for react/no-object-type-as-default-prop (#​23279) (Mikhail Baev)
  • 4480609 linter: Add schema for react/jsx-props-no-spreading (#​23276) (Mikhail Baev)
  • 08d68a5 linter/react: Implement jsx-no-literals rule (#​23145) (kapobajza)
  • 9a2788b linter/unicorn: Implement prefer-export-from rule (#​22935) (AliceLanniste)
  • bdb723c linter/unicorn: Implement prefer-single-call rule (#​23235) (Yuzhe Shi)
  • 31543ed linter: Add schema for vue/define-props-destructuring (#​23252) (Sysix)
  • 21b6c3d linter: Add schema for oxc/no-async-endpoint-handlers (#​23251) (Sysix)
  • e77ff81 linter: Add schema for unicorn/prefer-object-from-entries (#​23249) (Mikhail Baev)
  • bcac2d6 linter: Add schema for jest/vitest/no-restricted-matchers (#​23247) (Sysix)
  • 539f036 linter: Add schema for jest/vitest/no-restricted-*-methods (#​23246) (Sysix)
  • dd1b927 linter/vue: Implement require-default-prop rule (#​22951) (bab)
  • 3f018e7 linter: Add schema for unicorn/no-instanceof-builtins (#​23225) (Mikhail Baev)
  • e0d0f78 linter: Verify promise/no-callback-in-promise schema (#​23141) (beanscg)
  • 123d4f4 linter: Add schema for jest/vitest/valid-expect (#​23185) (Sysix)
  • 46c8a21 linter: Add schema for jest/vitest/require-top-level-describe (#​23184) (Sysix)
  • 41465cf linter: Add schema for jest/vitest/prefer-snapshot-hint (#​23183) (Sysix)
  • d068b9b linter: Add schema for jest/vitest/prefer-expect-assertions (#​23181) (Sysix)
  • 064a1ee linter: Add schema for jest/prefer-ending-with-an-expect (#​23180) (Sysix)
  • d046797 linter: Add schema for jest/vitest/no-standalone-expect (#​23179) (Sysix)
  • 137b9a6 linter: Add schema for jest/vitest/no-large-snapshots (#​23178) (Sysix)
  • 0f3e4a5 linter: Add schema for jest/vitest/no-hooks (#​23177) (Sysix)
  • cd0b384 linter: Add schema for unicorn/explicit-length-check (#​23155) (Mikhail Baev)
  • 01b74c4 linter: Add schema for jest/no-deprecated-functions (#​23136) (Sysix)
  • 9d6a387 linter: Add schema for unicorn/catch-error-name (#​23137) (Mikhail Baev)
  • 0da8efa linter: Add schema for jest/vitest/max-nested-describe (#​23131) (Sysix)
  • d71c9fd linter: Add schema for eslint/no-use-before-define (#​23129) (Sysix)
🐛 Bug Fixes
  • 26ddac6 linter: Avoid config schema generation for jsx_a11y/no-noninteractive-element-interactions (#​23385) (Sysix)
  • 40556ad linter: Parse jsx-a11y/control-has-associated-label config with DefaultRuleConfig (#​23373) (Sysix)
  • 71e9648 linter: Expose no-noninteractive-element-interactions schema (#​23283) (camc314)
  • 6c86d1c linter/react-perf: Correct nativeAllowList all schema (#​23229) (camc314)
  • 4dd52de linte

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/non-major-deps branch 2 times, most recently from 77df121 to e450aee Compare May 1, 2026 22:40
@renovate renovate Bot force-pushed the renovate/non-major-deps branch 3 times, most recently from 455e6cc to d102417 Compare May 17, 2026 17:28
@renovate renovate Bot force-pushed the renovate/non-major-deps branch 9 times, most recently from bce482b to 1bc1b78 Compare May 28, 2026 20:42
@renovate renovate Bot force-pushed the renovate/non-major-deps branch 11 times, most recently from bebf000 to 4c629ae Compare June 6, 2026 08:53
@renovate renovate Bot force-pushed the renovate/non-major-deps branch 5 times, most recently from c625870 to 3121928 Compare June 9, 2026 19:51
@renovate renovate Bot force-pushed the renovate/non-major-deps branch 9 times, most recently from 51255c7 to b0c659f Compare June 15, 2026 13:17
@renovate renovate Bot force-pushed the renovate/non-major-deps branch from b0c659f to 387023c Compare June 16, 2026 02:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants