chore(deps): update all non-major dependencies - #1526
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
16 times, most recently
from
September 14, 2026 08:22
ba0e6b1 to
ccc31a2
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
September 17, 2026 09:58
038a51a to
e6fe0f2
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 17, 2026 10:52
e6fe0f2 to
08b57b0
Compare
danielroe
approved these changes
Sep 17, 2026
danielroe
enabled auto-merge
September 17, 2026 11:13
commit: |
Contributor
CLI benchmark
Full report
|
| Setting | Value |
|---|---|
| Baseline | ref:b0a0ff4c500cd30812f159d84e3ae35d35d40cfc (v4.0.0-alpha.1) |
| Head | local packages/nuxt-cli at ae65414 (v4.0.0-alpha.1) |
| Node | v24.21.0 |
| OS | Linux 6.17.0 (kernel 6.17.0-1022-azure) |
| CPU | AMD EPYC 7763 64-Core Processor x 4 |
| Memory | 15.6 GB |
| Load average at start | 1.71, 0.49, 0.17 |
| Run started | 2026-09-17T11:16:06.709Z |
Cold CLI startup
Median of 15 interleaved runs per command, one warmup discarded.
| Command | baseline v4.0.0-alpha.1 median | head v4.0.0-alpha.1 median | Delta | baseline v4.0.0-alpha.1 min / p95 | head v4.0.0-alpha.1 min / p95 |
|---|---|---|---|---|---|
nuxt --version |
64 ms | 63 ms | -0.4% | 62 ms / 69 ms | 61 ms / 65 ms |
nuxt --version (first output byte) |
60 ms | 59 ms | -0.7% | 58 ms / 63 ms | 57 ms / 61 ms |
nuxt --help |
142 ms | 140 ms | -1.5% | 138 ms / 144 ms | 136 ms / 143 ms |
nuxt --help (first output byte) |
137 ms | 134 ms | -1.8% | 133 ms / 139 ms | 130 ms / 138 ms |
nuxt dev --help |
106 ms | 104 ms | -1.7% | 102 ms / 108 ms | 102 ms / 108 ms |
nuxt dev --help (first output byte) |
101 ms | 99 ms | -2.0% | 98 ms / 103 ms | 97 ms / 103 ms |
nuxt <unknown-command> (no-op) |
152 ms | 149 ms | -1.6% | 148 ms / 156 ms | 147 ms / 152 ms |
nuxt <unknown-command> (no-op) (first output byte) |
147 ms | 144 ms | -1.6% | 142 ms / 151 ms | 142 ms / 147 ms |
Module load cost
Counted with a module.registerHooks load hook, compile cache disabled. Counts every JS module actually evaluated on that code path (built-ins excluded, native addons excluded).
| Command | baseline v4.0.0-alpha.1 modules | head v4.0.0-alpha.1 modules | Delta | baseline v4.0.0-alpha.1 source bytes | head v4.0.0-alpha.1 source bytes | Delta |
|---|---|---|---|---|---|---|
nuxt --version |
37 | 37 | 0.0% | 302.3 kB | 302.3 kB | 0.0% |
nuxt --help |
147 | 139 | -5.4% | 1.04 MB | 1.03 MB | -1.0% |
nuxt dev --help |
82 | 82 | 0.0% | 642.0 kB | 642.0 kB | 0.0% |
Install footprint and published tarball
Each version installed on its own into an empty project with nothing but @nuxt/cli as a dependency, so the tree is exactly the CLI and its transitive dependencies. npm cache is warm and the registry is only consulted for metadata, so install wall time is indicative, not a network benchmark.
| Metric | baseline v4.0.0-alpha.1 | head v4.0.0-alpha.1 | Delta |
|---|---|---|---|
Direct dependencies of @nuxt/cli |
22 | 22 | 0.0% |
| Packages in the installed tree (unique name@version) | 39 | 38 | -2.6% |
| Unique package names | 38 | 38 | 0.0% |
| Package directories on disk (cross-check) | 32 | 31 | -3.1% |
Installed node_modules on disk |
2.48 MB | 2.35 MB | -5.3% |
| Installed files | 433 | 407 | -6.0% |
| Install wall time (warm npm cache, median of 3) | 1.26 s | 1.25 s | -0.9% |
| Published tarball (packed) | 227.3 kB | 227.3 kB | -0.0% |
| Published tarball (unpacked) | 742.0 kB | 742.0 kB | +0.0% |
| Files in tarball | 84 | 84 | 0.0% |
Interleaved runs on a shared runner: trust the deltas, not the absolute timings. The dev, restart and build suites run locally via pnpm bench:cli.
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.3.0→^9.5.1^1.7.0→^1.8.1^1.7.0→^1.8.1^4.2.0→^4.3.2^24.13.3→^24.13.5^0.1.0→^0.1.1^0.2.4→^0.3.1^10.9.1→^10.10.064.3.2→64.5.164.5.2^4.9.0→^4.10.1^6.33.0→^6.35.16.36.022→22.23.224.20.0→24.21.0^0.6.9→^0.6.10^2.3.1→^2.3.3^2.3.1→^2.3.3^3.0.1→^3.1.0^4.63.1→^4.63.3^1.0.3→^1.0.5^1.0.1→^1.0.3^1.3.0→^1.3.1^1.3.0→^1.3.1^0.22.14→^0.23.0^8.10.0→^8.10.2^5.3.0→^5.3.1^5.3.0→^5.3.15.3.0→5.3.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
antfu/eslint-config (@antfu/eslint-config)
v9.5.1Compare Source
🐞 Bug Fixes
antislopplugins composition, refactor - by @antfu (a213d)View changes on GitHub
v9.5.0Compare Source
🚀 Features
View changes on GitHub
v9.4.1Compare Source
🚀 Features
View changes on GitHub
v9.4.0Compare Source
🚀 Features
jsdoc v64unicorn v74e18e v0.8solid v0.17- by @antfu (33a41)minimumReleaseAgeExcludePruneby default - by @antfu (9526c)View changes on GitHub
bombshell-dev/clack (@clack/prompts)
v1.8.1Compare Source
Patch Changes
8bd9129Thanks @gameroman! - Return type for prompts now correctly specifiesCANCEL_SYMBOLinstead ofsymbolUpdated dependencies [
8bd9129]:v1.8.0Compare Source
Minor Changes
#592
caa32e8Thanks @gameroman! - ExportCANCEL_SYMBOLconstant from@clack/coreand@clack/prompts#594
37fca4eThanks @dreyfus92! - Add tab-completion to thepathprompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type/and Tab again). Powered by a new opt-incompleteOnTaboption onautocomplete, which also shows aTab: completehint in the instructions footer. Defaultautocompletebehavior is unchanged.#583
ae636ddThanks @43081j! - Add async validation support to prompts, and validation state rendering to text prompts.Patch Changes
#588
6506135Thanks @danielroe! - Style the guide bar rendered bybox({ withGuide: true })in grey so it matches the gutter drawn bylog,noteand the spinner#599
0547d6fThanks @43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.Updated dependencies [
227583e,caa32e8,37fca4e,ae636dd,b20fa2b]:nuxt/test-utils (@nuxt/test-utils)
v4.3.2Compare Source
👉 Changelog
compare changes
🩹 Fixes
vitest/environmentsimport opaque to rolldown (6d1195d38)❤️ Contributors
v4.3.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
^5as peer dependency (#1809)🏡 Chore
e68ecfa28)🎉 New Contributors
❤️ Contributors
v4.3.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
unmockNuxtImporthelper (#1795)🩹 Fixes
✅ Tests
🎉 New Contributors
❤️ Contributors
danielroe/clickable-path (clickable-path)
v0.1.1Compare Source
👉 Changelog
compare changes
🚀 Enhancements
hyperlink()export (#25)🤖 CI
❤️ Contributors
eslint/eslint (eslint)
v10.10.0Compare Source
gajus/eslint-plugin-jsdoc (eslint-plugin-jsdoc)
v64.5.1Compare Source
Bug Fixes
v64.5.0Compare Source
Features
ts-ban-ts-comments: add rule mirrorring typescript-eslint'sban-ts-commentsrule (afff498)v64.4.0Compare Source
Features
convert-to-jsdoc-comments,no-bad-blocks: add LibreJS tags (99d2abf)v64.3.10Compare Source
Bug Fixes
convert-to-jsdoc-comments: merge stacked line comments into a single JSDoc block (64a8dca), closes #1764v64.3.9Compare Source
Bug Fixes
no-undefined-types: recognize class members from the class's own JSDoc (eade377), closes #1762v64.3.8Compare Source
Bug Fixes
getJsdocProcessorPlugin: key positions by file; drop suggestions (1b3c339)v64.3.7Compare Source
Bug Fixes
no-undefined-types: recognize sibling class members from a property's JSDoc (5cac70a), closes #1760v64.3.6Compare Source
Bug Fixes
no-unnecessarry-type-assertion: avoid treating as redundant object annotations which clarify method argument types (342b6f6)no-unnecessary-type-assertion: handle array literal annotations whose element type is a literal or union of literals narrowing element type (543b24f)v64.3.5Compare Source
Bug Fixes
no-unnecessary-type-assertion: don't flag array-to-tuple assertions; addpreferConstToLiteralTuples(8546f77), closes #1756v64.3.4Compare Source
Bug Fixes
require-asterisk-prefix: avoid crashing on custom languages (8f78214)v64.3.3Compare Source
Bug Fixes
convert-to-jsdoc-comments: handle "any" context and avoid extra line break when there is already multiline text; fixes #1747 (ca2668b)no-blank-block-descriptions: strip out initial line breaks when text is present (with or without tags); fixes #1748 (0ad1ae2)dubzzz/fast-check (fast-check)
v4.10.1Compare Source
Fix fake-timer compatibility in timeout and interrupt plugins
[Code][Diff]
Fixes
interruptAfterTimeLimitpluginv4.10.0Compare Source
New plugin API and deprecations ahead of v5
[Code][Diff]
Features
beforeEachplugin to hook in life-cycleafterEachpluginbeforeEachplugintimeoutplugin to stop long running predicatesonAllRunsCompletereporterandasyncReporterfrom parametersfailOnInterrupton the plugingeneratevia Pluginsunbiasedplugin to generate without biasFixes
interruptAfterTimeLimitwebpro-nl/knip (knip)
v6.35.1: Release 6.35.1Compare Source
37b2642) - thanks @WooWan!0d9cf34)2659063)7be11aa)v6.35.0: Release 6.35.0Compare Source
c6497a1) - thanks @gioboa!9ce68ed) - thanks @gioboa!2e7d498) - thanks @devYRPauli!a21f972) - thanks @gioboa!3178940) - thanks @s-h-a-d-o-w!aaab35a) - thanks @gioboa!6c27aab) - thanks @gioboa!a092e40) - thanks @gioboa!pnpm.overridesis read from the root manifest only (f69a7f6)3662c95)90b384d) - thanks @renovate[bot]!16d03f7) - thanks @bytedoe!a4c7a93)cwdif its missing at therootlevel (#2020) (f66c9f1) - thanks @JayaKrishnaNamburu!75d5628) - thanks @gioboa!cyclesissue type/reporter (resolve #2021) (f1e690b)e2bd3fc)1cc979b)db6d891)4afbbcf)v6.34.0: Release 6.34.0Compare Source
3c785f5)node:fs/promisesglob(#1977) (44faf08) - thanks @DreamLongYT!f93ad09)1c90b49)964085d)8f9490a)ab90e24) - thanks @devYRPauli!462ae45) - thanks @gioboa!#sharedimports from the shared directory (#1991) (cc47061) - thanks @DreamLongYT!c4e0f08)@types/webpack(96ff2df)f0cf11d)nodejs/node (node)
v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolitoCompare Source
This is a security release.
Notable Changes
Commits
4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#9353fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #6471422efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #6375251123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9260566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#9270d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @RafaelGSSCompare Source
This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).
Commits
41d2ee13be] - build: switch coverage-windows towindows-2022(Richard Lau) #63940eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #63711a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #628910f48583512] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #6289138c869fc05] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #61136290667c84f] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790c9f3da76aa] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #5878660890be563] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #572695024c7d5d8] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #638207f4eb5af2e] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820ebb4ec78a8] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #626565763d40826] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045c551a51d0c] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#8680a22d40180] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846c79968e108] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8550c37bff2ff] - http2: fix DEP0194 message (KaKa) #58669ea5dc6b529] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #582939b6af26132] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#86728dcd38864] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#8732f62693801] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#8701662a3ea09] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854718d5d0e2c] - test: skiptest-fs-utimes-y2K38on armv7 (Richard Lau) #63836041185b61f] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #62238fd890ba01d] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85439d1d09684] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#8572197a47144] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @marco-ippolitoCompare Source
Commits
4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #617884a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #621640226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #6225673cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #6215022ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #619281a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #618793ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #61834b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827ffda97afd4] - deps: update googletest to2461743(Node.js GitHub Bot) #6248479aa32cf4f] - deps: update googletest to73a63ea(Node.js GitHub Bot) #61927b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #626293a27669063](https://redirect.github.com/nodejs/node/commiConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.