[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/types (source)	^7.29.0 → ^7.29.8
@commitlint/cli (source)	^21.0.1 → ^21.0.2
@commitlint/config-conventional (source)	^21.0.1 → ^21.0.2
@evilmartians/lefthook	^2.1.6 → ^2.1.14
@sindresorhus/slugify	^3.0.0 → ^3.0.1
@vitejs/plugin-vue (source)	^6.0.6 → ^6.0.9
@vitest/ui (source)	^4.1.6 → ^4.1.11
@vue/test-utils	^2.4.10 → ^2.4.11
autoprefixer	^10.5.0 → ^10.5.6
commitizen	^4.3.1 → ^4.3.2
markdown-it-anchor	^9.2.0 → ^9.2.1
markdown-it-attrs	^4.3.1 → ^4.3.2
markdown-it-deflist	^3.0.0 → ^3.0.1
semantic-release	^25.0.3 → ^25.0.9
uuid	^14.0.0 → ^14.0.2
vite-plugin-vue-devtools (source)	^8.1.1 → ^8.1.5
vue (source)	^3.5.34 → ^3.5.42

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

babel/babel (@​babel/types)

v7.29.8

Compare Source

v7.29.7

Compare Source

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

conventional-changelog/commitlint (@​commitlint/cli)

v21.0.2

Compare Source

Bug Fixes

• disallow same commit hash for --from and --to (#​4773) (121005e)

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.0.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

evilmartians/lefthook (@​evilmartians/lefthook)

v2.1.14

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.12

Compare Source

• fix: fail the hook when staging fixed files errors (#​1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#​1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#​1508) by @​mariokresic

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

v2.1.9

Compare Source

• fix: update hooks path after resetting (#​1431) by @​mrexox
• deps: May 2026 (#​1415) by @​mrexox

v2.1.8

Compare Source

• fix: do not warn if local hooks path is equal to default hooks path (#​1421) by @​mrexox

v2.1.7

Compare Source

• fix: use contrast colors (#​1420) by @​mrexox
• fix: apply stage_fixed only if it is safe (#​1418) by @​mrexox
• fix: try to always restore unstaged changes (#​1417) by @​mrexox
• fix: always restore unstaged changes (#​1416) by @​mrexox
• refactor: add new logger without a global state (#​1385) by @​mrexox
• fix: linter, sacrifice optimization for readability by @​mrexox
• fix: separate fallback push branch from pathspecs (#​1396) by @​lawrence3699

sindresorhus/slugify (@​sindresorhus/slugify)

v3.0.1

Compare Source

• Fix contractions and possessives followed by punctuation a1b74b1
• Fix decamelization of acronyms followed by a word whose second letter is s a3b86ea

---

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.9

Bug Fixes

• deps: update all non-major dependencies (#​812) (b2b559d)
• plugin-vue: initialize compiler correctly (#​475) (127b03f)
• plugin-vue: transpile TS in templates with empty script block (#​838) (189148e)

Miscellaneous Chores

• deps: update dependency obug to v3 (#​846) (3180192)

v6.0.8

Features

• plugin-vue: add forced vapor mode option (#​766) (d59c3c0)

Bug Fixes

• deps: update all non-major dependencies (#​781) (d369e5a)

v6.0.7

Features

• use carets for @rolldown/pluginutils version (#​776) (941b651)

Bug Fixes

• deps: update all non-major dependencies (#​762) (9e825b8)
• deps: update all non-major dependencies (#​774) (77dc8bc)

vitest-dev/vitest (@​vitest/ui)

v4.1.11

Compare Source

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in #​10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in #​10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in #​10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in #​10974 (fe5a1)

    View changes on GitHub

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

v4.1.9

Compare Source

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

vuejs/test-utils (@​vue/test-utils)

v2.4.11

Compare Source

compare changes

🩹 Fixes

• Drop legacy Mutation Event listener entries (#​2844)
• Handle setData() correctly for components using both setup() and data() (#​2846)
• Export GlobalMountOptions type (#​2851)
• Set spec-compliant event.code on keydown/keyup (#​2850)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Renato de Leão (@​renatodeleao)
• Matt Van Horn (@​mvanhorn)
• Carsten Brachem (@​cbrachem)
• Ahmad Hanan (@​AhmadHannan037)
• Paul Cochrane (@​paultcochrane)
• Arpit Jain (@​arpitjain099)

postcss/autoprefixer (autoprefixer)

v10.5.6

Compare Source

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

v10.5.5

Compare Source

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

v10.5.4

Compare Source

• Fixed prefixed rule duplication (by @​xianjianlf2).

v10.5.3

Compare Source

• Fixed brackets and gradient parser (@​alanturing881).

v10.5.2

Compare Source

• Moved -webkit-fill-available before -moz-available, so Firefox
  will use -webkit- version which is closer to stretch.

v10.5.1

Compare Source

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

commitizen/cz-cli (commitizen)

v4.3.2

Compare Source

4.3.2 (2026-06-12)

• chore(deps): bump semantic-release to 25 for npm trusted publishing (#​1029) (6eb168c), closes #​1029
• ci(release): bump actions/checkout and actions/setup-node to v4 (#​1024) (f5702c4), closes #​1024
• ci(release): use npm trusted publishing via OIDC (#​1028) (096ed52), closes #​1028
• chore(deps) Update all non-major dependencies (#​1026) (4e98218), closes #​1026
• chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#​1010) (11be6a1), closes #​1010
• fix(ci): fix pipelines and update matrices to node 18/20/22 (#​1023) (48e4b8b), closes #​1023
• docs: update README.md to add contributors (#​985) (3c08866), closes #​985

valeriangalliat/markdown-it-anchor (markdown-it-anchor)

v9.2.1

Compare Source

• Preserve level of inline token in headerLink. ([#​138])

arve0/markdown-it-attrs (markdown-it-attrs)

v4.3.2

Compare Source

What's Changed

• fix: handle null meta on tbody_open for headerless tables (issue #​161) by @​Copilot in #​167

New Contributors

• @​Copilot made their first contribution in #​167

Full Changelog: arve0/markdown-it-attrs@v4.3.1...v4.3.2

markdown-it/markdown-it-deflist (markdown-it-deflist)

v3.0.1

Compare Source

• Correct lazy paragraph continuations, #​11.

semantic-release/semantic-release (semantic-release)

v25.0.9

Compare Source

Bug Fixes

• do not expose the authenticated repository URL in EGITNOPERMISSION errors (#​4283) (8d905a5)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

v25.0.5

Compare Source

Bug Fixes

• revert: next (#​4200) (db8ffaa)

v25.0.4

Compare Source

Bug Fixes

• code-quality: add missing comma in context object for consistency (493d6cd)

uuidjs/uuid (uuid)

v14.0.2

Compare Source

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#​972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#​973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#​965) (a67db57)

v14.0.1

Compare Source

Bug Fixes

• add types condition to node export for moduleResolution bundler (#​961) (27ffae5)

vuejs/devtools (vite-plugin-vue-devtools)

v8.1.5

Compare Source

No significant changes

    View changes on GitHub

v8.1.4

Compare Source

   🐞 Bug Fixes

• kit,shared: Mark packages side-effect-free for treeshaking  -  by @​danielroe in #​1108 (2b9ce)

    View changes on GitHub

v8.1.3

Compare Source

   🐞 Bug Fixes

• vite: Align module field with emitted ESM output  -  by @​itosa-kazu in #​1106 (4720c)

    View changes on GitHub

vuejs/core (vue)

v3.5.42

Compare Source

Bug Fixes

• hydration: handle async component unmount before lazy hydration (#​15252) (6e1814a)
• hydration: handle moving unresolved async fragment (#​15263) (a72036f)
• runtime-core: avoid caching unmounted suspense children (#​15291) (b535917), closes #​15288
• runtime-core: keep .trim result when combined with .number v-model modifier (#​15346) (f8d42e1)
• runtime-core: resolve $el for dev root comment fragment (#​15313) (8654f35), closes #​12680
• runtime-dom: support !important on CSS custom properties in style binding (#​15348) (31da934)
• server-renderer: reject CR in attribute names (#​15266) (a2b40db)
• shared: correctly compare Map and Set values (#​15328) (ef82a26), closes #​15320
• suspense: don't treat the leaving branch as the fallback while its mount is pending (#​15333) (cd19745), closes #​15332
• v-model: re-sync select when model is overridden in change handler (#​15298) (6eaecc1), closes #​10505

v3.5.41

Compare Source

Bug Fixes

• compiler-core: preserve vnode lifecycle in stable v-for (#​11682) (02421cd), closes #​9239 #​12569
• compiler-sfc: handle transformed template AST after cache invalidation (#​15136) (a4440c0), closes #​15126 #​15128
• custom-element: preserve nested async mount order (#​15154) (71f9ff5), closes #​15153
• custom-element: warn when props override native properties (#​12125) (22b53ea), closes #​12124
• runtime-core: avoid re-fetching resource props with unchanged values (#​15105) (a7513a1)
• runtime-core: restore SSR setup state when handling async setup result (#​15114) (b6191cb), closes #​15113
• scheduler: avoid stack overflow when flushing very large post cb arrays (#​15143) (c04a45d), closes #​15142
• slots: handle nullish v-bind slot props (#​15177) (2506700)
• ssr: normalize hidden states during hydration (#​13125) (4e467d7)
• transition: support transition to teleport component child (#​11959) (77061fe), closes #​11910
• types: preserve defineModel inference with factory defaults (#​15097) (0516c43), closes #​15096
• v-model: preserve text input before hydration (#​14411) (2468464), closes #​14403

v3.5.40

Compare Source

Bug Fixes

• compiler-core: avoid leaking slot branch keys (#​15051) (20c9d26), closes #​15048
• hydration: pass namespace when patching dynamic props (#​15082) (e0d2723), closes #​15081 #​15050
• reactivity: handle effect removal during scope stop (#​15084) (378f978), closes #​15083
• runtime-core: skip lazy hydration for detached roots (#​15092) (97f3525), closes #​15091
• runtime-core: unwind dangling blocks when slot content throws (#​15071) (ddc132d), closes #​15070
• runtime-dom: respect current select model type (#​15010) (eb89e93), closes #​15009
• server-renderer: handle errors in optimized component renders (#​12601) (474907c), closes #​12575
• server-renderer: remove package dependency cycle (#​15063) (4d35eca)
• shared: prevent SSR comment escaping from creating closing delimiters (#​15045) (bd962bb)
• types: don't constrain component $el type to Element (#​15040) (164460a)

v3.5.39

Compare Source

Bug Fixes

• compiler-core: correct filter rewrite recursion (#​14959) (be7ce31)
• hydration: force patch dynamic props when hydrating (#​9083) (024cf06), closes #​9033
• hydration: respect data-allow-mismatch on conditional branches (#​12801) (164af63), closes #​12782
• reactivity: avoid triggering effects when set fails (#​14964) (e450973)
• runtime-core: handle non-isomorphic block element update (#​15002) (932ddd0), closes #​6385
• runtime-core: normalize function children for elements and Teleport (#​9108) (2f374cd), closes #​9107
• runtime-core: pause tracking when invoking function refs (#​14985) (3ac052b)
• runtime-core: preserve once event listener name (#​8341) (87b73b6), closes #​8342
• runtime-dom: preserve option modifier event names (#​8338) (4b659e6), closes #​8334
• ssr: dedupe inherited scope ids during vnode rendering (#​15005) (027da6b), closes #​12159 #​12175
• ssr: resolve nested async teleport content (#​9431) (31d0f23), closes #​6207
• teleport: handle teleport unmount edge case (#​12705) (671997a), closes #​12702
• types: support named tuple emits (#​12676) (232f402), closes #​12673
• types: validate defineModel defaults (#​14968) (747f57e), closes #​14966

v3.5.38

Compare Source

v3.5.37

Compare Source

v3.5.36

Compare Source

Bug Fixes

• compiler-core: avoid crash on CDATA at the document root (#​14916) (0ea17e2)
• compiler-core: prefix dynamic keys on v-memo elements (#​14922) (68e978e), closes #​14920
• compiler-sfc: handle vue-ignore on leading intersection/union type (#​14950) (0dcd225), closes #​12254
• compiler-sfc: respect var hoisting in props destructure (48ad452)
• reactivity: preserve watch callback return value when wrapped for once: true (#​14902) (450a8a8)
• runtime-core: add dev warning for silent catch in compat mode and fix test description typo (#​14891) (db3e117)
• runtime-core: force model update when reverted before sync (#​14897) (7f76378), closes #​13524
• runtime-core: skip async component callbacks after unmount (#​14911) (5300ead)
• transition: avoid move transition for hidden v-show group children (#​14895) (c11f6ee), closes #​14894
• watch: trigger immediate callback for empty sources (#​14914) (1f2ca7e), closes #​14898

v3.5.35

Compare Source

Bug Fixes

• compiler-core: avoid double processing v-for keys with v-memo (#​14861) (34a0ded), closes #​14859
• compiler-sfc: resolve top-level exports from files registered as global types (#​14805) (3d077f2), closes nuxt/nuxt#33694
• runtime-core: avoid repeated hydration mismatch checks (#​14857) (170fc95), closes #​14855
• runtime-core: skip idle persisted transition hooks in keep-alive moves (#​14865) (80fc139), closes #​14031
• server-renderer: propagate sync errors from ssrRenderSuspense (#​14804) (4760997), closes nuxt/nuxt#28162
• teleport: skip child unmount when pending mount discarded (#​14876) (#​14877) (584beb1)

Performance Improvements

• reactivity: skip type checks for cached proxies (#​14860) (5734fe9)
• runtime-dom: optimize array event handler dispatch (#​14828) (bb18dc8)
• server-renderer: avoid materializing iterables in ssrRenderList (#​14821) (1b7a2cc)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 85, reused 0, downloaded 0, added 0
Progress: resolved 232, reused 0, downloaded 0, added 0
 ERR_PNPM_TRUST_DOWNGRADE  High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)

This error happened while installing the dependencies of sass@1.99.0

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had provenance attestation, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.