chore: update all non-major dependencies

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	21.2.1 → 21.2.3
@commitlint/config-conventional (source)	21.2.0 → 21.2.3
@semantic-release/github	12.0.9 → 12.0.10
@tsconfig/node24 (source)	24.0.4 → 24.0.5
@types/node (source)	24.13.3 → 24.19.1
@vercel/ncc	0.44.1 → 0.45.0
lefthook	2.1.10 → 2.1.17
oxfmt (source)	0.59.0 → 0.72.0
oxlint (source)	1.74.0 → 1.87.0
regenerate (source)	1.4.2 → 1.5.0
semantic-release	25.0.8 → 25.0.9
tsx (source)	4.23.1 → 4.23.15
vite (source)	8.1.5 → 8.3.3
yaml (source)	2.9.0 → 2.9.1
zod (source)	4.4.3 → 4.6.5

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.3

Compare Source

Bug Fixes

• lint: trim trailing whitespace off the message handed to ignore matchers (#​4960) (a6f279b)

v21.2.2

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.2.3

Compare Source

Bug Fixes

• rules: report the case that matched in case rule failure messages (#​4962) (9f5f7bc)

v21.2.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

semantic-release/github (@​semantic-release/github)

v12.0.10

Compare Source

Bug Fixes

• deps: update dependency @​octokit/plugin-paginate-rest to v15 (#​1284) (a63f458)

tsconfig/bases (@​tsconfig/node24)

v24.0.5

Compare Source

vercel/ncc (@​vercel/ncc)

v0.45.0

Compare Source

Features

• update @​vercel/webpack-asset-relocator-loader to 1.10.3 (#​1342) (cb1f1f0)

evilmartians/lefthook (lefthook)

v2.1.17

Compare Source

Changelog

• 8d8073d fix: diff push files against the merge base with the default branch (#​1565)
• c12bccd fix: don't hash submodules when checking fail_on_changes (#​1566)
• 03225ef refactor: naming of helpers (#​1568)
• 66746ac refactor: working with git (#​1564)

v2.1.16

Compare Source

• fix: test staging fixed files with partially staged by @​mrexox
• fix: preserve unrelated unstaged changes on conflict (#​1483) by @​Sakshamm-Goyal
• deps: bump mod and text deps to resolve CVEs (#​1560) by @​devindavies
• ci: refactor publishing scripts (#​1559) by @​mrexox

v2.1.15

Compare Source

• fix: do not pipe stdin into post-checkout git-lfs hook (#​1523) by @​rwinkelman
• fix: remove color blending (#​1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#​1485) by @​hamodywe
• test: regression for valid fish shell completion output (#​1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#​1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#​1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#​1547) by @​Yash121l

v2.1.14

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.12

Compare Source

• fix: fail the hook when staging fixed files errors (#​1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#​1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#​1508) by @​mariokresic

oxc-project/oxc (oxfmt)

v0.72.0: oxfmt v0.72.0

Compare Source

💥 BREAKING CHANGES

• e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#​27256) (leaysgur)

🚀 Features

• b538e3c formatter_css: Parse embedded CSS as a block's contents (#​27284) (leaysgur)

🐛 Bug Fixes

• 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#​27334) (leaysgur)
• 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#​27331) (leaysgur)
• e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#​27326) (leaysgur)
• df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#​27325) (leaysgur)
• 7f65b75 formatter: Format assignment target property as assignment-like (#​27289) (leaysgur)
• 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#​27288) (leaysgur)
• 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#​27283) (leaysgur)
• 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#​27278) (leaysgur)
• dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#​27277) (leaysgur)
• 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#​27275) (leaysgur)
• fd4ddce formatter_json: Flatten block comment only array|object (#​27274) (leaysgur)
• 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#​27241) (leaysgur)
• 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#​27237) (Nicolas Le Cam)
• c2de02b formatter: Decide embedded template layout from AST, not source shape (#​27218) (leaysgur)
• c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#​27216) (leaysgur)
• 36e14df formatter: Keep comments between callee and its opener on the callee side (#​27172) (leaysgur)
• 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#​27130) (leaysgur)
• e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#​27129) (leaysgur)
• 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#​27128) (leaysgur)

⚡ Performance

• 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#​27333) (leaysgur)
• cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#​27211) (leaysgur)
• 0aba566 oxfmt: Do not resolve root js config from nested context (#​27147) (leaysgur)

📚 Documentation

• 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#​27327) (leaysgur)
• 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#​27279) (leaysgur)
• 66545bf formatter_markdown: Record setext heading wrap divergence (#​27221) (leaysgur)
• af4b269 oxfmt: Document why format() API does not take cwd (#​27131) (leaysgur)

v0.71.0: oxfmt v0.71.0

Compare Source

🚀 Features

• e0b1f9f oxfmt: Bump bundled Prettier version to 3.9.9 (#​27002) (leaysgur)
• 342527d oxfmt: Bump bundled Prettier version to 3.9.8 (#​26999) (leaysgur)

🐛 Bug Fixes

• eeba1db formatter: Skip test-call layout when arguments have comments (#​27119) (leaysgur)
• 1f7b8ad oxfmt: Allow repeated CLI calls in the same process (#​27051) (Liang)
• 7bcb807 formatter_markdown: Keep blank line between HTML and nested list (#​27112) (leaysgur)
• 10b10c5 formatter: Keep comments around = on their side and line (#​27041) (leaysgur)
• 9aad365 formatter: Keep comments deferred before an assignment operator (#​26997) (waltu)
• 8fbddb1 formatter/jsdoc: More alignment with original plugin (#​27039) (leaysgur)
• 50be18e formatter: Keep trailing spaces on normal block comments (#​27037) (leaysgur)
• 56d1880 formatter: Nestle adjacent block comments (#​27036) (leaysgur)
• 3be5d94 formatter: Treat /*** comments as JSDoc (#​27035) (leaysgur)
• cd45f71 formatter: Keep trailing double spaces on JSDoc lines (#​26861) (John Costa)
• fd695f4 formatter_markdown: Fix more mismatches found in ecosystem-ci repos (#​27003) (leaysgur)
• 4e77d59 formatter_markdown: Keep a math span after a kept line break from opening a block (#​27001) (leaysgur)
• 584b8b0 formatter_markdown: Keep a shape line after a multi-line inline node or link title (#​27000) (leaysgur)
• b939645 formatter_markdown: Keep a line break before an inline liquid tag under preserve (#​26998) (leaysgur)

v0.70.0: oxfmt v0.70.0

Compare Source

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#​26763) (leaysgur)

v0.69.0

Compare Source

v0.68.0

Compare Source

v0.67.0

Compare Source

🛡️ Security

• 9a612d5 deps: Update npm packages (#​26178) (renovate[bot])

v0.66.0

Compare Source

v0.65.0

Compare Source

v0.64.0

Compare Source

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#​25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#​25572) (leaysgur)

v0.63.0

Compare Source

v0.62.0

Compare Source

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#​25008) (leaysgur)

v0.61.0

Compare Source

v0.60.0

Compare Source

mathiasbynens/regenerate (regenerate)

v1.5.0

Compare Source

semantic-release/semantic-release (semantic-release)

v25.0.9

Compare Source

Bug Fixes

• do not expose the authenticated repository URL in EGITNOPERMISSION errors (#​4283) (8d905a5)

privatenumber/tsx (tsx)

v4.23.15

Compare Source

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

Compare Source

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#​802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

Compare Source

Bug Fixes

• cache: bound shared transform cache memory (#​835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

Compare Source

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#​829) (ed9d330), closes #​828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

Compare Source

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

Compare Source

Bug Fixes

• support nyc coverage discovery (#​710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

Compare Source

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

Compare Source

Bug Fixes

• preserve package subpath resolution (be1315e)
• preserve typeless ESM dependency exports (70dfc5e)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.7

Compare Source

Bug Fixes

• prevent tsImport cache collisions (4e5a138)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.6

Compare Source

Bug Fixes

• compose resolver URL metadata (5040762)
• preserve Node resolution with allowJs (2046d9e)
• preserve resolver URL metadata (a91df46)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.5

Compare Source

Bug Fixes

• detect the Node inspector enabled via NODE_OPTIONS (3c1d051)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.4

Compare Source

Bug Fixes

• cli: allow async process.once() signal handlers to finish (#​827) (2afc7bb)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.3

Compare Source

Bug Fixes

• preserve listenerCount overload semantics (#​823) (b6574d4)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.2

Compare Source

Bug Fixes

• watch: exit with 128 + signal number when interrupted (#​820) (0b00bc8)

---

This release is also available on:

• npm package (@​latest dist-tag)

vitejs/vite (vite)

v8.3.3

Compare Source

Bug Fixes

• deps: update launch-editor to v2.14.2 (#​23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#​23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#​23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#​23656) (c3e06f9)

v8.3.2

Compare Source

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#​23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#​23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#​23568) (bc598a6)
• deps: update all non-major dependencies (#​23601) (9944fa6)
• deps: update rolldown-related dependencies (#​23602) (88c1741)
• html: resolve percent-encoded srcset urls (#​23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#​23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#​23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#​23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#​23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#​23586) (744269e)
• server: handle file watcher errors without crashing (#​23503) (6894f5c)
• server: release previous environments after initialization (#​23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#​23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#​23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#​23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#​23510) (cf5c028)
• only register time middleware when debug logging is enabled (#​23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#​23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#​23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

v8.3.1

Compare Source

Bug Fixes

• deps: update all non-major dependencies (#​23482) (3c752c8)
• deps: update all non-major dependencies (#​23537) (e8990c4)
• deps: update rolldown-related dependencies (#​23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#​23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#​23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#​23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#​23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#​23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#​23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#​23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#​23566) (63567c7)
• update optimizeDeps.include comment (#​23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#​23491) (f4b4431)
• remove duplicate configurations (#​23532) (9abd99b)
• replace find with some (#​23554) (af7cdf6)

v8.3.0

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)
• devtools: enable dev server integration (#​23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#​23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#​23110) (e17d2d5)
• add top-level tsconfig option (#​23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#​23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#​23042) (a500dee)
• config: warn on named imports from JSON modules (#​23378) (472385e)
• css: minify style tag (#​23183) (8156684)
• searched params attached to workers are now preserved (#​22280) (517b97f)
• support subpath imports in dynamic import statements (#​23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#​22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#​22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#​22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#​23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #​17467) (#​23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#​23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#​23373) (a6d43bc)
• deps: update all non-major dependencies (#​23445) (fc7c104)
• html: don't inline preload link targets (fix #​13355) (#​23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#​23356) (8492422)
• shortcuts extend error (#​23447) (4ec58d1)
• config: close bundles when generation fails (#​23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#​23265) (4f9d2f4)
• deps: update all non-major dependencies (#​23337) (d550815)
• deps: update all non-major dependencies (#​23404) (238ad81)
• deps: update rolldown-related dependencies (#​23338) (76e8082)
• deps: update rolldown-related dependencies (#​23405) (b882566)
• dev: run closeBundle after buildEnd failure (#​23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#​23171) (6162968)
• utils: handle dot in srcset density descriptor (#​23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#​23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creatio

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.