fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #109 · escapace/esroll

renovate · 2026-03-02T00:41:14Z

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	`20.4.1` → `20.4.3`
@commitlint/config-conventional (source)	`20.4.1` → `20.4.3`
@microsoft/api-extractor (source)	`^7.56.3` → `^7.57.7`
@microsoft/api-extractor-model (source)	`^7.32.2` → `^7.33.4`
es-toolkit (source)	`^1.44.0` → `^1.45.1`
eslint (source)	`9.39.2` → `9.39.4`
knip (source)	`5.83.1` → `5.86.0`
lefthook	`2.1.1` → `2.1.4`
mdast-util-from-markdown	`^2.0.2` → `^2.0.3`
mlly	`^1.8.0` → `^1.8.1`
rollup (source)	`^4.57.1` → `^4.59.0`
syncpack	`14.0.0` → `14.2.0`

Release Notes

conventional-changelog/commitlint (@commitlint/cli)

`v20.4.3`

Compare Source

Bug Fixes

footer parser does not escape special chars for regex #4560 (#4634) (8ff7c7f)

`v20.4.2`

Compare Source

Note: Version bump only for package @commitlint/cli

conventional-changelog/commitlint (@commitlint/config-conventional)

`v20.4.3`

Compare Source

Bug Fixes

footer parser does not escape special chars for regex #4560 (#4634) (8ff7c7f)

`v20.4.2`

Compare Source

Note: Version bump only for package @commitlint/config-conventional

microsoft/rushstack (@microsoft/api-extractor)

`v7.57.7`

Compare Source

Mon, 09 Mar 2026 15:14:07 GMT

Patches

Bump minimatch version from 10.2.1 to 10.2.3 to address CVE-2026-27903.

`v7.57.6`

Compare Source

Wed, 25 Feb 2026 21:39:42 GMT

Patches

Bump @microsoft/tsdoc-config to ~0.18.1 to mitigate CVE-2025-69873.

`v7.57.5`

Compare Source

Wed, 25 Feb 2026 00:34:29 GMT

Version update only

`v7.57.4`

Compare Source

Tue, 24 Feb 2026 01:13:27 GMT

Version update only

`v7.57.3`

Compare Source

Mon, 23 Feb 2026 00:42:21 GMT

Patches

Add missing "./extends/*.json" to the package.json "exports" field so that "@microsoft/api-extractor/extends/tsdoc-base.json" is importable.

`v7.57.2`

Compare Source

Fri, 20 Feb 2026 16:14:49 GMT

Patches

Bump minimatch from 10.1.2 to 10.2.1

`v7.57.1`

Compare Source

Fri, 20 Feb 2026 00:15:03 GMT

Patches

Add "node" condition before "import" in the "exports" map so that Node.js uses the CJS output (which handles extensionless imports), while bundlers still use ESM via "import". Fixes #5644.

`v7.57.0`

Compare Source

Thu, 19 Feb 2026 00:04:52 GMT

Minor changes

Normalize package layout. CommonJS is now under lib-commonjs, DTS is now under lib-dts, and ESM is now under lib-esm. Imports to lib still work as before, handled by the "exports" field in package.json.

microsoft/rushstack (@microsoft/api-extractor-model)

`v7.33.4`

Compare Source

Wed, 25 Feb 2026 21:39:42 GMT

Patches

Bump @microsoft/tsdoc-config to ~0.18.1 to mitigate CVE-2025-69873.

`v7.33.3`

Compare Source

Wed, 25 Feb 2026 00:34:30 GMT

Version update only

`v7.33.2`

Compare Source

Tue, 24 Feb 2026 01:13:27 GMT

Version update only

`v7.33.1`

Compare Source

Fri, 20 Feb 2026 00:15:03 GMT

Patches

Add "node" condition before "import" in the "exports" map so that Node.js uses the CJS output (which handles extensionless imports), while bundlers still use ESM via "import". Fixes #5644.

`v7.33.0`

Compare Source

Thu, 19 Feb 2026 00:04:52 GMT

Minor changes

Normalize package layout. CommonJS is now under lib-commonjs, DTS is now under lib-dts, and ESM is now under lib-esm. Imports to lib still work as before, handled by the "exports" field in package.json.

toss/es-toolkit (es-toolkit)

`v1.45.1`

Compare Source

Released on March 4th, 2026.

Reverted the return type of sample to not include undefined.
Fixed Deno install command to include jsr: prefix. ([#1627])

We sincerely thank @mwln for their contributions. We appreciate your great efforts!

`v1.45.0`

Compare Source

Released on March 2nd, 2026.

Fixed findIndex to add missing default parameter for doesMatch. ([#1373])
Fixed sample to include undefined in return union type. ([#1302])
Fixed cloneDeep to support cloning Error objects.
Fixed retry to correctly match retry count with the retries option.
Fixed missing Map and Set in check-dist entrypoints.
Fixed missing packages in publishConfig. ([#1597])
Reverted the overload for runtime-determined key arrays in omit. ([#1595])
Added AI Integration page with llms.txt documentation to docs.

We sincerely thank @D-Sketon, @dayongkr, @matthiasfeist, @raon0211, and @screendriver for their contributions. We appreciate your great efforts!

eslint/eslint (eslint)

`v9.39.4`

Compare Source

Bug Fixes

f18f6c8 fix: update dependency minimatch to ^3.1.5 (#20564) (Milos Djermanovic)
a3c868f fix: update dependency @eslint/eslintrc to ^3.3.4 (#20554) (Milos Djermanovic)
234d005 fix: minimatch security vulnerability patch for v9.x (#20549) (Andrej Beles)
b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#20538) (루밀LuMir)

Documentation

4675152 docs: add deprecation notice partial (#20520) (Milos Djermanovic)

Chores

b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#20596) (Francesco Trotta)
71b2f6b chore: package.json update for @eslint/js release (Jenkins)
1d16c2f ci: pin Node.js 25.6.1 (#20563) (Milos Djermanovic)

`v9.39.3`

Compare Source

Bug Fixes

791bf8d fix: restore TypeScript 4.0 compatibility in types (#20504) (sethamus)

Chores

8594a43 chore: upgrade @eslint/js@9.39.3 (#20529) (Milos Djermanovic)
9ceef92 chore: package.json update for @eslint/js release (Jenkins)
af498c6 chore: ignore /docs/v9.x in link checker (#20453) (Milos Djermanovic)

webpro-nl/knip (knip)

`v5.86.0`: Release 5.86.0

Compare Source

Rewrite import specifiers to use .ts extensions, remove tsx (#1548) (58674ad) - thanks @wojtekmaj!
Add .spec-d to vitest entry files (#1556) (3123ab7) - thanks @yamachi4416!
Update docs for tsx → node (0418eba)
Auto-format (7142fd7)
Add Qwik plugin (#1557) (fc668f4) - thanks @azat-io!
Fix Bun plugin to handle directory arguments in bun test (c112b6c)
Update FAQ (b105a42)
fix(plugin): swc with externalHelpers setting ignores @swc/helpers dependency (#1560) (4bcb1f5) - thanks @bobaaaaa!
chore: git ignore artifacts (#1563) (4878724) - thanks @unional!
Fix Vite plugin to respect root option for index.html entries (#1561) (67a5647) - thanks @azat-io!
Fix Astro sharpImageService() false positive for unused sharp (#1559) (c36247c) - thanks @azat-io!
Fix up gitignore test (b2c3d08)
fix: normalize Windows backslash paths in fs.watch listener to fix --watch on Windows (#1558) (b86b421) - thanks @Aiudadadadf!
Fix wrangler plugin not enabled by jsonc config (#1564) (00bb1be) - thanks @DaniFoldi!
Edit AGENTS.md (a2aaf2f)
Fix tsconfig presets marked as unlisted in strict mode (resolve #1568) (463d67d)
oxcellent (8a602c7)
Refactor format test and use prettier for consistent results (b6afc01)
Sort package.json (d3a521b)
Add .git to GLOBAL_IGNORE_PATTERNS (resolve #1571) (4e95ffb)
Detect Yarn plugins that are listed by their path alone (#1574) (de4c7d8) - thanks @robintown!
Start using unbash (a5de2c4)
Bump unbash & simplify bash parser further (57896d3)
Fix refs in workspaces fixture (#1578) (fbee342)
Include a few more entry patterns with pageExtensions (resolve #1581) (c6a6d9e)
Clean exit if --fix fixes all issues (resolve #1577) (c182c29)
Document JSDoc tag hints (0e7b6ae)
Update AGENTS.md (f845462)
Add openapi-ts plugin (#1579) (42d1b3f) - thanks @jonahsnider!
Migrate from js-yaml → yaml (fb042ae)
pnpm dedupe (2586254)
Fix plugin list order (#1587) (519ae3a) - thanks @ikeyan!
Fix confusing test fixtures for openapi-ts plugin (#1591) (f0083ca) - thanks @jonahsnider!
Off-by-1 (7d7dec6)
Don't fix compiled files (pos off) (a9fdc77)
Add aliases from any tsconfig file in typescript plugin (resolve #1347) (ced77c7)
Support auto-imports in Nuxt plugin (#1517) (4ce27b2)
Fix + lint .ts extension in import specifiers (d349de3)
Safe ts.isInTopLevelContext → isInTopLevelScope (1819c20)
Wrap session.handleFileChanges in try/catch (185afb8)
Improve MDX compiler (9205e2a)
fix(playwright): Add missing built-in null reporter (#1596) (0f1ce7d) - thanks @shrink!
Add package.json#imports as entry points (1fbe286)
Update some dependencies + dedupe (381241e)
Add support for extends in nuxt plugin (9fcbdf5)
Update release script (f446b4f)

`v5.85.0`: Release 5.85.0

Compare Source

Fix require.context regex matching for path-aware patterns (#1547) (c33d93a) - thanks @jstaab!
Make knip compatible with erasableSyntaxOnly (#1541) (f63089b) - thanks @wojtekmaj!
feat: add Payload CMS plugin (#1546) (58d99de) - thanks @Robot-Inventor!
Look everywhere for manifest/robots file in next plugin (9da6205)
Merge some next glob patterns (8c5f35f)
Add SAP & Google Gemini to projects using Knip (c8ab895)
Bump remark-preset-webpro & dedupe (b9372cd)
Document CLI usage for LS (97fe1cf)
fix: tsdown entry compatibility issues #1550 (#1554) (95051eb) - thanks @huijiewei!
Fix incorrect coverage provider being reported (#1552) (2d0b5cd) - thanks @rexxars!
Temp disable npmx in ecosystem run (a5cd986)
Fix OOM in gitignore walk for large monorepos (f192a6b)
Release knip@5.85.0 (e28a3e7)

`v5.84.1`: Release 5.84.1

Compare Source

Fix false positives for arrow-wrapped dynamic imports assigned to variables (#1544) (75a42c3) - thanks @jantimon!
Improve pnpm arg handling (df8c353)
Ignore module.register if 2nd arg is not import.meta.url (#1535) (970fdb1)

`v5.84.0`: Release 5.84.0

Compare Source

Post-release shenanigans (e7965cb)
Move most compilers to plugins & register from there (61beafe)
Minor refactor (e20a682)
Fix lint issues (d2bbc13)
Add missing catalog property to rules in JSON schema (#1518) (5d49dea) - thanks @Mohmdev!
feat(plugins): add @typescript/native-preview (tsgo) support (#1513) (babfb10) - thanks @jgoux!
Fix up quoting for spaced args (resolve #1515) (2b735cb)
Switch to tsconfig-aware module resolver in input handler (634d0f6)
Use bun test positionals as entry points (resolve #1521) (da94725)
Edit docs (327726f)
Minor refactor while at it (dc87e8e)
Add config hints for unused ignore and ignoreFiles items (a4989ee)
Accept known bins only behind double-dash (resolve #1524) (b9214e3)
feat(plugins): add support for bun test preloaded files (#1525) (14ee32a) - thanks @jgoux!
Add date to IGNORED_GLOBAL_BINARIES (#1476) (f08f92b) - thanks @duci9y!
Fix edge case for binaries in scripts (82331ee)
Report ignore/files config hints only if sure & relevant (4c3bd08)
Add consistent repository fields (781a0fd)
Add language-server bin (13d7845)
Use --stdio if no transport provided (bedb21a)
Refactor from "enabled" to "deferSession" (resolve #1499) (15e3360)
Use initializationOptions.config or default fallback config obj (resolve #1503) (0abe568)
Also publish ls + mcp with pkg-pr-new (7806526)
Auto-format (51b7dc1)
Remove chdir shenanigans (close #1516) (0cbee8f)
Bind console.* to distinguish internal↔ external logs (3eac278)
Add early bail-outs for changed files we can ignore (36c2dd5)
Avoid unnecessary module graph updates for unmodified files (f94c41f)
Fix typo in pkg-pr-new-pkg-dir (7e7a8b0)
Add .DS_Store to .gitignore (#1530) (40fe5cc) - thanks @wojtekmaj!
Ignore RNC CLI and metro internals in react-native projects (#1528) (0f892ae) - thanks @wojtekmaj!
Support nested _generated dirs in Convex plugin (#1531) (bd75e9f) - thanks @kvnwolf!
Housekeep cli help output (c24e746)
Fix up gitignore test (6bc640c)
Introduce isFilterTransitiveDependencies flag (close #1507, close #1101) (8678df2)
Housekeep webpack plugin (2cc1306)
Move up plugin.setup & tear down plugin.teardown (4dbf23d)
Skip config file loading if only external re-exports (ab775b1)
Improve & optimize ignore pattern handling (c3d3912)
Housekeep compiler registration (2aaf9fc)
Edit docs re. config file location (79bfb35)
Register visitors from plugins (9b059f8)
importMetaGlobCall visitor for Vite plugin (1874b19)
Extend registerVisitors with script visitor support (728c814)
Move execa script visitor to execa plugin (71c739a)
Move zx script visitor to zx plugin (5ac24c7)
Add require.context visitor to webpack plugin (100f174)
Add module.register() visitor for Node.js loader API (resolve #1535) (742407c)
Add .DS_Store in fixtures to .gitignore (#1534) (90fa677) - thanks @wojtekmaj!
Mention that depcheck recommends knip (#1536) (75d00ff) - thanks @ArtskydJ!
Remove @source matcher from tailwind plugin (resolve #1537) (b7149b6)
Fix -w → -W flag for Yarn (f305250)
Update AGENTS.md (ec83887)
Extract and extend react-native plugin (#1538) (9fd04a8)
Add pm2 plugin (#1540) (3bb4203) - thanks @wojtekmaj!
Fix Yarn (Berry) plugins and binaries reported as unused (#1523) (4f0a307) - thanks @wojtekmaj!
Update docs (ed23dd2)
Minor refactor while at it (4115b97)
Add @knip/create-config to release script (1135b82)

evilmartians/lefthook (lefthook)

`v2.1.4`

Compare Source

pkg: fix scripts (#1348) by @mrexox
fix: bring back {lefthook_job_name} template (#1347) by @mrexox
pkg: refactor packaging (2) (#1346) by @mrexox
fix: separate more commands' non-option args with -- (#1339) by @scop
docs: change logo to point to landing page instead of itself (#1343) by @igas
pkg: make it easier to read (#1340) by @mrexox
pkg: refactor packaging scripts (#1308) by @mrexox

`v2.1.3`

Compare Source

chore: switch artifact attestations gen to actions/attest v4 (#1338) by @scop
chore: describe ENV variables usage in CLI help output (#1337) by @mrexox
fix: support git debug versions (#1334) by @mrexox
deps: March 2026 (#1330) by @mrexox
feat: update minimum go version (#1331) by @mrexox

`v2.1.2`

Compare Source

feat: introduce setup hook option (#1326) by @mrexox
refactor: recovering logic for changesets (#1324) by @mrexox
fix: rollback auto-staged changes if unwanted changes detected (#1251) by @tuchfarber
docs: improve docs ui (#1323) by @mrexox
docs: additional skip example and note about reinstallation (#1319) by @iloveitaly
docs: fix incorrect --verbose usage (#1318) by @iloveitaly
pkg: fix python packages publishing by @mrexox

syntax-tree/mdast-util-from-markdown (mdast-util-from-markdown)

`v2.0.3`

Compare Source

Fix

971e026 Fix passing encoding: undefined w/ options

Full Changelog: syntax-tree/mdast-util-from-markdown@2.0.2...2.0.3

unjs/mlly (mlly)

`v1.8.1`

Compare Source

compare changes

🩹 Fixes

Extract variable names ignoring function calls (#336)

🏡 Chore

Update deps (12913db)
Lint (33495f9)

❤️ Contributors

Pooya Parsa (@pi0)
Daniel Roe (@danielroe)

JamieMason/syncpack (syncpack)

`v14.2.0`

Compare Source

Features

groups: extend and improve sameMinor policy (42c31a3)

Bug Fixes

cli: fix link to DiffersToHighestOrLowestSemver docs (51bf8ff), closes #324

`v14.1.0`

Compare Source

Features

cli: add --reporter json to fix and format commands (5522ffe), closes #322
cli: add statusType property to json output (5a82a85), closes #322
write: detect indentation when config is not set (66c0493), closes #318

`v14.0.2`

Compare Source

Bug Fixes

globs: ignore node_modules (467cb57), closes #321

`v14.0.1`

Compare Source

Bug Fixes

cargo: update dependencies (c85144b)
core: handle negated source globs (aaf5032), closes #319

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

socket-security · 2026-03-14T11:09:17Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@commitlint/cli@20.4.1 ⏵ 20.4.3			⁺¹
mlly@1.8.0 ⏵ 1.8.1		⁺¹
mdast-util-from-markdown@2.0.2 ⏵ 2.0.3
eslint@9.39.2 ⏵ 9.39.4	⁺¹
@microsoft/api-extractor@7.56.3 ⏵ 7.57.7	^-2	⁺¹	⁺²
es-toolkit@1.44.0 ⏵ 1.45.1	⁺¹
lefthook@2.1.1 ⏵ 2.1.4	⁺¹
@microsoft/api-extractor-model@7.32.2 ⏵ 7.33.4		⁺¹	⁺⁸
knip@5.83.1 ⏵ 5.86.0		⁺¹	⁺²
syncpack@14.0.0 ⏵ 14.2.0	⁺¹		⁺¹
@commitlint/config-conventional@20.4.1 ⏵ 20.4.3			⁺¹

View full report

renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 41f4012 to ea72229 Compare March 8, 2026 21:12

renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 0175180 to 3d2b678 Compare March 14, 2026 11:08

renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 0f3e7c9 to a0ec782 Compare March 16, 2026 17:17

fix(deps): update all non-major dependencies

f7ae555

renovate Bot force-pushed the renovate/all-minor-patch branch from a0ec782 to f7ae555 Compare March 19, 2026 09:08

github-actions Bot merged commit 2d7671e into trunk Mar 19, 2026
8 checks passed

github-actions Bot deleted the renovate/all-minor-patch branch March 19, 2026 10:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all non-major dependencies#109

fix(deps): update all non-major dependencies#109
github-actions[bot] merged 1 commit intotrunkfrom
renovate/all-minor-patch

renovate Bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

Bug Fixes

Patches

Patches

Patches

Patches

Patches

Minor changes

Patches

Patches

Minor changes

Bug Fixes

Documentation

Chores

Bug Fixes

Chores

v5.86.0: Release 5.86.0

v5.85.0: Release 5.85.0

v5.84.1: Release 5.84.1

v5.84.0: Release 5.84.0

Fix

🩹 Fixes

🏡 Chore

❤️ Contributors

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Configuration

Uh oh!

socket-security Bot commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 2, 2026 •

edited

Loading

`v5.86.0`: Release 5.86.0

`v5.85.0`: Release 5.85.0

`v5.84.1`: Release 5.84.1

`v5.84.0`: Release 5.84.0

socket-security Bot commented Mar 14, 2026 •

edited

Loading