[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	^24.9.2 → ^24.19.2
@vitest/coverage-v8 (source)	^3.2.4 → ^3.2.7
eslint (source)	^9.38.0 → ^9.39.5
eslint-config-unjs	^0.5.0 → ^0.6.2
pnpm (source)	10.20.0 → 10.34.9
prettier (source)	^3.6.2 → ^3.9.10
undici (source)	^6.22.0 → ^6.29.1
vitest (source)	^3.2.4 → ^3.2.7

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v3.2.7

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10679 (b795e)

    View changes on GitHub

v3.2.6

Compare Source

   🐞 Bug Fixes

• Pin last supported vite-node version  -  by @​sheremet-va (16f12)

    View changes on GitHub

v3.2.5

Compare Source

   🚀 Features

• api: Add allowWrite and allowExec options to api [backport to v3]  -  by @​hi-ogawa and Codex in #​10445 (af88b)

   🐞 Bug Fixes

• browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3]  -  by @​hi-ogawa and Codex in #​10456 (385a1)

    View changes on GitHub

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

v9.39.4

Compare Source

Bug Fixes

• f18f6c8 fix: update dependency minimatch to ^3.1.5 (#​20564) (Milos Djermanovic)
• a3c868f fix: update dependency @​eslint/eslintrc to ^3.3.4 (#​20554) (Milos Djermanovic)
• 234d005 fix: minimatch security vulnerability patch for v9.x (#​20549) (Andrej Beles)
• b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#​20538) (루밀LuMir)

Documentation

• 4675152 docs: add deprecation notice partial (#​20520) (Milos Djermanovic)

Chores

• b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#​20596) (Francesco Trotta)
• 71b2f6b chore: package.json update for @​eslint/js release (Jenkins)
• 1d16c2f ci: pin Node.js 25.6.1 (#​20563) (Milos Djermanovic)

v9.39.3

Compare Source

Bug Fixes

• 791bf8d fix: restore TypeScript 4.0 compatibility in types (#​20504) (sethamus)

Chores

• 8594a43 chore: upgrade @​eslint/js@9.39.3 (#​20529) (Milos Djermanovic)
• 9ceef92 chore: package.json update for @​eslint/js release (Jenkins)
• af498c6 chore: ignore /docs/v9.x in link checker (#​20453) (Milos Djermanovic)

v9.39.2

Compare Source

Bug Fixes

• 5705833 fix: warn when eslint-env configuration comments are found (#​20381) (sethamus)

Build Related

• 506f154 build: add .scss files entry to knip (#​20391) (Milos Djermanovic)

Chores

• 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#​20394) (Francesco Trotta)
• c43ce24 chore: package.json update for @​eslint/js release (Jenkins)
• 4c9858e ci: add v9.x-dev branch (#​20382) (Milos Djermanovic)

v9.39.1

Compare Source

Bug Fixes

• 650753e fix: Only pass node to JS lang visitor methods (#​20283) (Nicholas C. Zakas)

Documentation

• 51b51f4 docs: add a section on when to use extends vs cascading (#​20268) (Tanuj Kanti)
• b44d426 docs: Update README (GitHub Actions Bot)

Chores

• 92db329 chore: update @eslint/js version to 9.39.1 (#​20284) (Francesco Trotta)
• c7ebefc chore: package.json update for @​eslint/js release (Jenkins)
• 61778f6 chore: update eslint-config-eslint dependency @​eslint/js to ^9.39.0 (#​20275) (renovate[bot])
• d9ca2fc ci: Add rangeStrategy to eslint group in renovate config (#​20266) (唯然)
• 009e507 test: fix version tests for ESLint v10 (#​20274) (Milos Djermanovic)

v9.39.0

Compare Source

Features

• cc57d87 feat: update error loc to key in no-dupe-class-members (#​20259) (Tanuj Kanti)
• 126552f feat: update error location in for-direction and no-dupe-args (#​20258) (Tanuj Kanti)
• 167d097 feat: update complexity rule to highlight only static block header (#​20245) (jaymarvelz)

Bug Fixes

• 15f5c7c fix: forward traversal step.args to visitors (#​20253) (jaymarvelz)
• 5a1a534 fix: allow JSDoc comments in object-shorthand rule (#​20167) (Nitin Kumar)
• e86b813 fix: Use more types from @​eslint/core (#​20257) (Nicholas C. Zakas)
• 927272d fix: correct Scope typings (#​20198) (jaymarvelz)
• 37f76d9 fix: use AST.Program type for Program node (#​20244) (Francesco Trotta)
• ae07f0b fix: unify timing report for concurrent linting (#​20188) (jaymarvelz)
• b165d47 fix: correct Rule typings (#​20199) (jaymarvelz)
• fb97cda fix: improve error message for missing fix function in suggestions (#​20218) (jaymarvelz)

Documentation

• d3e81e3 docs: Always recommend to include a files property (#​20158) (Percy Ma)
• 0f0385f docs: use consistent naming recommendation (#​20250) (Alex M. Spieslechner)
• a3b1456 docs: Update README (GitHub Actions Bot)
• cf5f2dd docs: fix correct tag of no-useless-constructor (#​20255) (Tanuj Kanti)
• 10b995c docs: add TS options and examples for nofunc in no-use-before-define (#​20249) (Tanuj Kanti)
• 2584187 docs: remove repetitive word in comment (#​20242) (reddaisyy)
• 637216b docs: update CLI flags migration instructions (#​20238) (jaymarvelz)
• e7cda3b docs: Update README (GitHub Actions Bot)
• 7b9446f docs: handle empty flags sections on the feature flags page (#​20222) (sethamus)

Chores

• dfe3c1b chore: update @eslint/js version to 9.39.0 (#​20270) (Francesco Trotta)
• 2375a6d chore: package.json update for @​eslint/js release (Jenkins)
• a1f4e52 chore: update @eslint dependencies (#​20265) (Francesco Trotta)
• c7d3229 chore: update dependency @​eslint/core to ^0.17.0 (#​20256) (renovate[bot])
• 27549bc chore: update fuzz testing to not error if code sample minimizer fails (#​20252) (Milos Djermanovic)
• a1370ee ci: bump actions/setup-node from 5 to 6 (#​20230) (dependabot[bot])
• 9e7fad4 chore: add script to auto-generate eslint:recommended configuration (#​20208) (唯然)

unjs/eslint-config (eslint-config-unjs)

v0.6.2

Compare Source

compare changes

🩹 Fixes

• Disable array immutation rules for now (3cde73a)

❤️ Contributors

• Pooya Parsa (@​pi0)

v0.6.1

Compare Source

compare changes

💅 Refactors

• Migrate to @eslint/markdown (2f92a53)
• Update default rules (84cdbad)

📦 Build

• Migrate to obuild (8f36bf1)

🏡 Chore

• Update deps (4347a4f)
• Update globals to v17 (4f168b4)
• Update unicorn to 62 (e737dd7)
• release: V0.6.0 (b683294)

❤️ Contributors

• Pooya Parsa (@​pi0)

v0.6.0

Compare Source

compare changes

💅 Refactors

• Migrate to @eslint/markdown (2f92a53)

📦 Build

• Migrate to obuild (8f36bf1)

🏡 Chore

• Update deps (4347a4f)
• Update globals to v17 (4f168b4)
• Update unicorn to 62 (e737dd7)

❤️ Contributors

• Pooya Parsa (@​pi0)

pnpm/pnpm (pnpm)

v10.34.9: pnpm 10.34.9

Compare Source

Patch Changes

• 0bff20d: The pnpm version that packageManager pins now records that pin in a fresh pnpm-lock.yaml when pnpm 10 switched to it. A later pnpm install --frozen-lockfile then succeeds #​17303.

Platinum Sponsors

Gold Sponsors

v10.34.8: pnpm 10.34.8

Compare Source

Patch Changes

• 7ced81e: Recompute hoisted dependencies when a frozen install removes packages, so public hoist links are handed over to retained versions #​16861.
• debbb4c: When pnpm removes or replaces a direct dependency, it now finishes removing the dependency's bins before it deletes the dependency's directory. Packages that declare bins through directories.bin no longer leave broken shims in node_modules/.bin #​16876.
• 07becba: The standalone pnpm executables now embed Node.js 24.22.1. They embedded Node.js 20, which has reached end of life and still trusts the certificate authority intermediates that Node.js distrusted in October 2026.

Platinum Sponsors

Gold Sponsors

v10.34.7: pnpm 10.34.7

Compare Source

Patch Changes

• 97f550c: Switching to the pnpm version in packageManager now works through registry mirrors that strip npm's signatures or re-sign packages with their own key. pnpm then reads the signature from https://registry.npmjs.org/ and verifies it against the integrity of the downloaded pnpm #​16778.
• b11d7bb: The update notification now suggests the standalone install script instead of pnpm self-update when PNPM_HOME is not set, such as when another package manager installed pnpm. pnpm self-update installs into PNPM_HOME, so in that case it cannot replace the pnpm in use.

Platinum Sponsors

Gold Sponsors

v10.34.6

Compare Source

Patch Changes

• e7888e5: pnpm self-update now resolves and verifies pnpm through registry, authentication, proxy, and TLS settings from trusted non-project configuration. Project configuration and the default project pnpmfile can no longer redirect the pnpm download or disable engine identity verification.

• 46bc7c9: pnpm no longer tells you to update itself with Corepack or with pnpm add -g:

  • The update notification now suggests pnpm self-update, or the standalone install script when pnpm is running under Corepack. It used to suggest corepack use pnpm@<version>, or pnpm add -g pnpm / pnpm add -g @pnpm/exe when pnpm was not installed by the standalone script — but pnpm add -g refuses to install pnpm and points at pnpm self-update anyway, and @pnpm/exe is not published for pnpm v12 or newer, where the unscoped pnpm package is itself the native executable.
  • pnpm self-update under Corepack now points at the standalone install script too, instead of telling you to update pnpm with Corepack.

• 46bc7c9: Updated adm-zip to v0.6.0, which fixes a memory-exhaustion vulnerability where a crafted ZIP file could make it allocate 4 GB of memory. adm-zip is used to extract the Node.js, Bun, and Deno archives that pnpm downloads on Windows.

• Updated the embedded Node.js release keys to the current canonical nodejs/release-keys list.

• Updated the embedded npm registry signing keys to the set currently advertised by npm.

• 702ad5f: Update the embedded Node.js release keys with the new key added to nodejs/release-keys (Stewart X Addison, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD).

Platinum Sponsors

Gold Sponsors

v10.34.5: pnpm 10.34.5

Compare Source

Patch Changes

• 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
• 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
• 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
• 36928be: ${...} environment-variable placeholders in the httpProxy, `httpsProx

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e8eb7729-c7c9-4b87-aa92-61176475793f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn