Skip to content

WEB-818: Update all non-major dependencies#3735

Closed
renovate[bot] wants to merge 1 commit into
devfrom
renovate/all-minor-patch
Closed

WEB-818: Update all non-major dependencies#3735
renovate[bot] wants to merge 1 commit into
devfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@angular/build 20.3.27 → 20.3.32 age confidence devDependencies patch
@angular/cli 20.3.27 → 20.3.32 age confidence devDependencies patch
@angular/compiler-cli (source) 20.3.24 → 20.3.26 age confidence devDependencies patch
@angular/language-service (source) 20.3.24 → 20.3.26 age confidence devDependencies patch
@playwright/test (source) 1.60.0 → 1.61.1 age confidence devDependencies minor
@types/node (source) 24.13.1 → 24.13.3 age confidence devDependencies patch
@typescript-eslint/eslint-plugin (source) 8.61.0 → 8.65.0 age confidence devDependencies minor
@typescript-eslint/parser (source) 8.61.0 → 8.65.0 age confidence devDependencies minor
actions/checkout v6.0.3 → v6.1.0 age confidence action minor
eslint (source) 9.39.4 → 9.39.5 age confidence devDependencies patch
lycheeverse/lychee-action v2.8.0 → v2.9.0 age confidence action minor
nginx 1.31.1-alpine3.23-slim → 1.31.2-alpine3.23-slim age confidence final patch
node (source) 24.16.0 → 24.18.0 age confidence minor
node 24.16.0 → 24.18.0 age confidence uses-with minor
prettier (source) 3.8.3 → 3.9.5 age confidence devDependencies minor
prettier-plugin-multiline-arrays 4.1.9 → 4.1.10 age confidence devDependencies patch
step-security/harden-runner v2.19.4 → v2.20.0 age confidence action minor
unzipper 0.12.3 → 0.12.5 age confidence overrides patch

Release Notes

angular/angular-cli (@​angular/build)

v20.3.32

Compare Source

v20.3.31

Compare Source

@​angular-devkit/build-angular
Commit Type Description
4ea787cd0 fix bump undici to 7.28.0
@​angular/build
Commit Type Description
df5a2cc2b fix bump vite to 7.3.6

v20.3.30

Compare Source

@​angular/build
Commit Type Description
36adca99c fix bump @​babel/core to 7.29.7
7f236cfea fix bump esbuild to 0.28.1
94fb3c122 fix bump piscina to 5.2.0
1f283a41c fix bump vite to 7.3.5

v20.3.29

Compare Source

@​angular/cli
Commit Type Description
5f7c0328c fix update pacote to 21.5.1
@​angular/ssr
Commit Type Description
a75d78e68 fix prioritize options over environment variables in AngularNodeAppEngine

v20.3.28

Compare Source

@​angular/cli
Commit Type Description
e3d564667 fix fallback to deprecated versions when resolving ranges if no non-deprecated version is found
f12e17025 fix remove forceAuth and unscoped credential parsing
angular/angular (@​angular/compiler-cli)

v20.3.26

Compare Source

compiler-cli
Commit Type Description
406aaa31e6 fix update babel dependencies to latest v7
core
Commit Type Description
26831d0cbd fix avoid caching missing locale data
8eb7aea08b fix reject dynamic script host elements
http
Commit Type Description
b963f61028 fix prevent caching of responses with Set-Cookie headers
service-worker
Commit Type Description
1fdf234168 fix preserve referrer in asset requests
baa093ba68 fix preserve referrer policy in asset requests

v20.3.25

Compare Source

Deprecations

platform-server
  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.
common
Commit Type Description
9f443bc24c fix Limits date format string length
566ad05f20 fix skip transfer cache for uncacheable HTTP traffic
1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation
compiler
Commit Type Description
a68ec702a0 fix sanitize two-way properties
core
Commit Type Description
768a349e6e fix harden TransferState restoration against DOM clobbering
ca48b4728d fix validate lowercase SVG animation attribute names (#​69270)
http
Commit Type Description
06be298267 fix preserve empty referrer option in HttpRequest
fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a fix skip transfer cache for fetch credentialed requests
platform-server
Commit Type Description
49368c1859 fix harden platform location origin validation during SSR
d55c94ad81 refactor deprecate ServerXhr (#​69256)
service-worker
Commit Type Description
d65a5f457b fix Strips sensitive headers on cross-origin redirects
microsoft/playwright (@​playwright/test)

v1.61.1

Compare Source

v1.61.0

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();
New APIs
Network
Browser and Screencast
  • New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
  • New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
  • The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.
Test runner
  • The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
  • Supported expect.soft.poll(...).
  • New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
  • New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
  • testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
  • New -G command line shorthand for --grep-invert.
🛠️ Other improvements
  • Playwright now supports Ubuntu 26.04.
  • HAR and trace recordings now include WebSocket requests.
Browser Versions
  • Chromium 149.0.7827.55
  • Mozilla Firefox 151.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 149
  • Microsoft Edge 149
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.65.0

Compare Source

🚀 Features
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#​12578)
  • add warning when TS 7 is detected (#​12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#​12527, #​19562, #​11889)
🩹 Fixes
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#​12568)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#​12448)
  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#​12515)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

Compare Source

🚀 Features
  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#​12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#​12543)
🩹 Fixes
  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#​12512)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

Compare Source

🚀 Features
  • eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#​12426)
🩹 Fixes
  • eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#​12492)
  • eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#​12491, #​12485)
  • eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#​12447, #​12446)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

Compare Source

🩹 Fixes
  • eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#​12443, #​12418)
  • eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#​12365)
  • eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#​12328)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features
  • remove redundant package.json "files" (#​12444)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

Compare Source

🩹 Fixes
  • eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#​12388)
  • eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#​12413)
  • eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#​12394, #​12393)
  • eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#​12281)
  • eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#​12396, #​10577)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.65.0

Compare Source

🚀 Features
  • add warning when TS 7 is detected (#​12529)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#​12465)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features
  • remove redundant package.json "files" (#​12444)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

actions/checkout (actions/checkout)

v6.1.0

Compare Source

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

Documentation

Chores

  • 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
  • 202117b chore: package.json update for @​eslint/js release (Jenkins)
  • d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
  • 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
  • daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
  • daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
  • 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)
lycheeverse/lychee-action (lycheeverse/lychee-action)

v2.9.0

Compare Source

Summary

This release updates the default lychee version from v0.23.0 to v0.24.2.

The main reason for this release is compatibility with the new lychee 0.24.x release artifacts. Starting with lychee v0.24.0, the archive layout changed, and the lychee binary may now be packaged inside a subdirectory. lychee-action now detects that layout automatically, so users can upgrade without changing their workflows.

If you use:

uses: lycheeverse/lychee-action@v2

you will get the new version once the floating v2 tag has been updated. If you pin exact versions, update to:

uses: lycheeverse/lychee-action@v2.9.0

What’s new from lychee v0.24.x

Better diagnostics

lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.

Text fragment checking

lychee can now check URL text fragments, such as links containing #:~:text=.... This helps catch links that point to a valid page but no longer points to the intended highlighted text.

Sitemap support

lychee can now read sitemap.xml inputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.

JUnit output

lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.

Redirect and remap visibility

lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.

Multiple config files

lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.

Timeout handling

lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.

Fixes and reliability improvements

Fixed lychee 0.24.x archive compatibility

lychee-action now handles the new lychee release archive layout by detecting whether the lychee binary is inside a subdirectory.

This fixes compatibility with lychee 0.24.x.

More stable installation path

The action now installs lychee into $RUNNER_TEMP/lychee/bin instead of $HOME.

This avoids failures on runners where $HOME differs between composite action steps. In those environments, the action could add one directory to PATH but install the binary somewhere else, causing lychee: command not found.

Safer automatic lychee version updates

The workflow that checks for new lychee releases now guards against null release versions before creating update PRs. This prevents invalid automated PRs such as “Update lycheeVersion to null”.

Dependency updates
  • Updated actions/checkout from v6 to v7
  • Updated actions/cache from v5 to v6

Upstream lychee changelog

For the full lychee changelog, see:

What’s Changed

Full Changelog: lycheeverse/lychee-action@v2.8.0...v2.9.0

nodejs/node (node)

v24.18.0: 2026-06-23, Version 24.18.0 'Krypton' (LTS), @​richardlau prepared by @​sxa

Compare Source

Notable Changes
  • [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #​63527
  • [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #​64004
  • [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #​63597
  • [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #​62527
  • [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #​62527
  • [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #​62183
  • [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #​63155
  • [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #​63079
  • [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #​63834
Commits

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Jul 20, 2026
@renovate
renovate Bot requested a review from a team July 20, 2026 03:52
@renovate

renovate Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: mifosx-web-app@1.0.0
npm error Found: @angular/compiler@20.3.24
npm error node_modules/@angular/compiler
npm error   @angular/compiler@"20.3.24" from the root project
npm error   peer @angular/compiler@"^20.0.0" from @angular/build@20.3.32
npm error   node_modules/@angular/build
npm error     dev @angular/build@"^20.3.24" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/compiler@"20.3.26" from @angular/compiler-cli@20.3.26
npm error node_modules/@angular/compiler-cli
npm error   dev @angular/compiler-cli@"20.3.26" from the root project
npm error   peer @angular/compiler-cli@"^20.0.0" from @angular/build@20.3.32
npm error   node_modules/@angular/build
npm error     dev @angular/build@"^20.3.24" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-21T03_20_29_402Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-21T03_20_29_402Z-debug-0.log

@renovate renovate Bot added the renovate label Jul 20, 2026
@IOhacker IOhacker closed this Jul 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@IOhacker