Skip to content

chore(deps): Update all non-major dependencies - #828

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/all-non-major-dependencies
Oct 13, 2026
Merged

chore(deps): Update all non-major dependencies#828
renovate[bot] merged 1 commit into
mainfrom
renovate/all-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF
@nx/js (source) devDependencies minor 23.2.1 → 23.3.0 OpenSSF Scorecard
actions/setup-node action minor v7.0.0 → v7.1.0 OpenSSF Scorecard
knip (source) devDependencies minor ^6.39.0 → ^6.41.0 OpenSSF Scorecard
lefthook devDependencies minor ^2.1.16 → ^2.2.1 OpenSSF Scorecard
nx (source) devDependencies minor 23.2.1 → 23.3.0 OpenSSF Scorecard
pnpm (source) packageManager minor 12.9.1 → 12.11.2 OpenSSF Scorecard

Release Notes

nrwl/nx (@​nx/js)

v23.3.0

Compare Source

23.3.0 (2026-10-07)

🚀 Features
  • angular: support ngrx v22 (#​36950)
  • angular-rspack: scaffold and run SSR apps on the @​angular/ssr application engine (#​36298)
  • core: emit a runbook and per-step instructions for orchestrated migrate runs (#​36766)
  • core: report the cache location alongside usage (#​36959)
  • core: share one workspace walk across processes through the files archive (#​36980)
  • core: hash a continuous dependency's inputs into the task it serves (#​37017)
  • core: guarantee terminal output files and add an agent-friendly summary output style (#​36703)
  • core: add includeIgnored filesets and let the workspace context own the daemon's watch (#​37025)
  • core: cache plugin capabilities so reading them costs at most one load (#​36999)
  • core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#​36918)
  • core: add sandbox target configuration for observed-IO opt-out (#​36853)
  • core: hash tasks from Nx Cloud I/O snapshots (#​37036)
  • core: replace the sandbox target property with ultracache (#​37165)
  • core: opt in to selecting affected tasks instead of projects (#​36825)
  • core: record unresolved migrations and cap retries in orchestrated migrate runs (#​36986)
  • core: report an active orchestrated migrate run instead of resuming it (#​36988)
  • core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#​36989)
  • core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#​37242)
  • core: explain why each task is affected with --explain (#​36885)
  • core: run a final agent validation pass at the end of an orchestrated migrate run (#​37069)
  • js: cache TypeScript reference expansion during createNodes (#​37003, #​37002)
  • linter: add a batched @​nx/oxlint:lint executor (#​36827)
  • nx-cloud: add nx cloud demo link to cloud prompts (#​36956)
  • nx-cloud: remove the never option from the nx cloud prompt (#​37079)
  • repo: add a .NET example for @​nx/dotnet (#​36701)
  • testing: support cypress v16 (#​36953)
  • vitest: support vitest 5 (#​37142)
🩹 Fixes
  • angular: correct declaration maps and exports of buildable libraries (#​36373, #​36357)
  • angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#​36972, #​36970)
  • angular-rspack: keep class field closures per instance in minified builds (#​37066, #​37050)
  • angular-rspack: update piscina to address critical vulnerability (#​37252)
  • bundling: write the esbuild bundle to an overridden outputPath (#​37101, #​37091)
  • bundling: clear typescript update timer when a rollup build closes its watch program (#​37196)
  • core: separate daemon runtime env from graph identity (#​36565, #​36564)
  • core: validate the migrations path before extracting package migrations (#​36887)
  • core: release per-run process listeners and task history results (#​36866)
  • core: read the pnpm 12 min-release-age policy instead of deferring to an install (#​36915, #​36914)
  • core: carry minimumReleaseAge into pruned pnpm deploy output (#​36900, #​36899)
  • core: report how a plugin worker was lost instead of always calling it an exit (#​36894)
  • core: keep the cache in the workspace on CI (#​36922)
  • core: restore the wasm walker imports dropped by a stray cfg attribute (#​36924)
  • core: avoid mutating target options when resolving configurations (#​36934)
  • core: carry pnpm's package-manager document into the pruned lockfile (#​36947)
  • core: keep agentic migrations within the Windows command line limit (#​36578, #​36551)
  • core: give plugin workers a minute to receive the load message (#​36977)
  • core: detect changes in paths that git escapes (#​36660, #​35722)
  • core: combine Windows watcher recursive root and rescan recovery (#​36912)
  • core: deduplicate external inputs before hash plan allocation (#​36992)
  • core: make nx planning and hashing faster (#​36994)
  • core: keep continuous dependencies reached through a project without the target (#​37024)
  • core: load the native binding from one path per vitest worker (#​37039)
  • core: bump smol-toml to 1.7.1 for GHSA-7w5x-hrqm-74c2 (#​37059, #​37011)
  • core: make nx migrate resolve the requested nx version under npm 12 (#​36901, #​36762)
  • core: send task workers a task graph without run results (#​37015)
  • core: carry task terminal outputs to plugins by path (#​36787)
  • core: accept pr and canary releases in the migrate provenance check (#​36976)
  • core: show the underlying errors when the project graph fails (#​37103)
  • core: resolve project glob groups by prefix and literal lookup when hashing (#​37068)
  • core: skip Nx Console and AI agents checks in CI and speed up e2e browser and port helpers (#​37119)
  • core: watch with notify's CORE event mask so file reads cannot overflow inotify (#​37136)
  • core: support pnpm 12 install configuration and shims (#​37116)
  • core: reduce package-json inference overhead (#​37089)
  • core: narrow workspace glob searches to literal directory prefixes (#​37126)
  • core: read glob syntax from the glob parser in one place (#​37169)
  • core: prevent stale lockfile caches from breaking the project graph (#​37210)
  • core: pass only ultracache config to the snapshot eligibility walk (#​37212)
  • core: speed up daemon start by collecting ignore files in one walk (#​37211)
  • core: copy cached outputs into the workspace in parallel (#​37085, #​37090)
  • core: remove axios from the published nx package (#​36706)
  • core: make glob escapes work the same on every platform (#​37215)
  • core: build the daemon's ignore rules from the file scan (#​37220)
  • core: traverse past module-format package.json stubs when locating npm dependencies (#​36985, #​36984)
  • core: cache only declared outputs under ultracache (#​37243)
  • core: treat a cache record whose artifacts are missing as a miss (#​37111, #​37110)
  • core: close the task DB before nx reset deletes workspace-data (#​37250)
  • core: let nx reset finish after the Nx Cloud cleanup step (#​37251)
  • core: skip batch cache lookups for deferred tasks until their deps run (#​37259)
  • core: keep ultracache exclusions with the globs they trim (#​37285)
  • core: answer daemon output tracking from the workspace context (#​37217, #​37086)
  • core: stop merging declared negations into ultracache file groups (#​37304)
  • core: omit empty user next steps in create-nx-workspace agent output (#​37277)
  • core: reuse the stored ultracache configurations without an age limit (#​37305)
  • core: size the default cache bound from its own filesystem (#​37269)
  • core: accept --final-validation with a migrate CLI pinned below 23.2.0 (#​37294)
  • docker: skip unused git lookups during target inference (#​37124)
  • dotnet: declare evaluated inputs, invalidate on imports, and keep restore products out of cached outputs (#​36958)
  • dotnet: ship the ci-workflow templates and detect Microsoft.Testing.Platform projects (#​36981)
  • expo: gate the sdk 54 jest migration on the jest config instead of package.json (#​36834, #​35669)
  • js: resolve tsconfig to absolute path so ${configDir} paths type-check without baseUrl (#​36445)
  • js: handle empty npm view output in release-publish executor (#​36397, #​36358)
  • js: export NodeExecutorOptions from @​nx/js/executors (#​37143)
  • js: keep internal tsconfig project references on Windows (#​37058, #​37053)
  • linter: reuse the project graph inside ESLint concurrency workers (#​37080)
  • linter: reduce repeated path normalization during ESLint inference (#​37125)
  • misc: scan package projects for env vars (#​36847)
  • misc: record pnpm 11 build script decisions in generators (#​36814)
  • module-federation: skip undeclared default packages when sharing (#​37223, #​37108)
  • nextjs: bundle the server entry of Rollup-built libraries (#​36778)
  • nextjs: use out/ as default output dir when output is export (#​34530)
  • nx-dev: stop reading removed NextRequest.geo in AI api routes (#​37275)
  • react: make freshly generated react and rspack workspaces usable (#​36964)
  • release: exclude AI coding agents from the changelog Thank You section (#​36892)
  • release: use the release group name when resolving the previous tag for fixed groups (#​36554)
  • release: redact the token in the GitHub and GitLab release error output (#​36852)
  • release: optimize publish metadata query for JS projects (#​37013)
  • release: preserve private dev-only workspace dependencies (#​37193, #​37192)
  • repo: provision JDK 17 for Gradle builds with mise (#​36965)
  • repo: guard JAVA17_HOME against an uninstalled JDK (#​36969)
  • repo: force-fetch the website branch in the docs sync skill (#​36973)
  • repo: pin npm 11 for nightly e2e tests (#​37018)
  • repo: bump next past the critical RCE advisories (#​36983)
  • repo: point a seeded e2e workspace at the local pnpm store (#​37140)
  • repo: run pnpm -v outside the repo in e2e utils (#​37151)
  • repo: make e2e base workspace template failures clean and uncached (#​37194)
  • repo: pin hyperfine to 1.20.0 in CI agents (c8dda36996)
  • repo: hash local registry storage from sources again (#​37303)
  • rspack: write the normalized cache option in NxAppRspackPlugin (#​36905, #​36878)
  • testing: resolve coverageDirectory like jest and emit forward-slash outputs (#​37074, #​36910)
  • testing: hold the Cypress 16 migration only when a Vite component testing project resolves Vite 7 (#​37123)
  • vite: correct tsconfig paths fallback resolution (#​36424, #​36400)
  • vite: wait for raced esm modules before retrying config load (#​37042)
  • vite: defer nxViteTsPaths tsconfig parsing during graph construction (#​37182)
  • vitest: memoize ancestor tsconfig walks in createNodes (#​37027)
  • vitest: widen the vitest peerDependency to allow v5 (#​37055, #​37051)
  • vitest: infer inputs for setup files outside the project root (#​36920)
  • web: add --port to @​nx/web:app and reserve e2e ports (#​37254)
  • webpack: cap the generated webpack version below 5.111.0 (#​37034)
❤️ Thank You
actions/setup-node (actions/setup-node)

v7.1.0

Compare Source

What's Changed

Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

webpro-nl/knip (knip)

v6.41.0: Release 6.41.0

Compare Source

v6.40.0: Release 6.40.0

Compare Source

evilmartians/lefthook (lefthook)

v2.2.1

Compare Source

v2.2.0

Compare Source

v2.1.17

Compare Source

Changelog

pnpm/pnpm (pnpm)

v12.11.2: pnpm 12.11.2

Compare Source

This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

Patch Changes

  • --workspace-concurrency=Infinity now runs workspace projects with no concurrency limit. It used to fail with invalid digit found in string #​16793.

  • pnpm install and other recursive commands now apply the filter and filterProd that an updateConfig hook sets. They used to run on every workspace project #​16792.

  • enable-modules-dir=false now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.

Platinum Sponsors
Bit OpenAI Notion
CodeRabbit
Gold Sponsors
Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.11.1: pnpm 12.11.1

Compare Source

This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

Patch Changes

  • pnpm install no longer fails when packageManager pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.

  • pnpm install no longer fails with ERR_PNPM_CMD_SHIM_CHMOD when node_modules/.bin holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.

  • enable-modules-dir=false (enableModulesDir: false through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under node_modules. The setting exists for a node_modules that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain --lockfile-only run still fetches nothing.

  • pnpm pack and pnpm publish no longer put .npmignore and .gitignore files in the tarball. A files entry that names one still ships it.

  • pnpm now treats https://registry.npmjs.com/ as an alias of https://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.

  • pnx --package=rust@<channel> <tool> runs a tool of that Rust release, for example pnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets from rust-toolchain.toml and the target of each --target argument.

  • pnpm install now links agent skills for more coding agents. It detects the agent from ANTIGRAVITY_AGENT, COPILOT_AGENT, COPILOT_CLI, CODEX_THREAD_ID, CODEX_SANDBOX, AI_AGENT, and CLAUDE_CODE pnpm/tasks#116.

  • When the registry rejects pnpm stage publish, the error message now starts with "Failed to stage package".

Platinum Sponsors
Bit OpenAI Notion
CodeRabbit
Gold Sponsors

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Lisbon)

  • Branch creation
    • "before 3am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies General dependency updates renovate Created by Renovate bot labels Oct 13, 2026
@github-actions github-actions Bot added the chore Maintenance tasks, dependency updates, housekeeping label Oct 13, 2026
@renovate
renovate Bot merged commit e8a21ec into main Oct 13, 2026
4 checks passed
@renovate
renovate Bot deleted the renovate/all-non-major-dependencies branch October 13, 2026 06:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore Maintenance tasks, dependency updates, housekeeping dependencies General dependency updates renovate Created by Renovate bot

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants