-
Notifications
You must be signed in to change notification settings - Fork 40
chore(deps): update all non-major dependencies #60
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
03e1381 to
a1f5c01
Compare
a1f5c01 to
2e381fb
Compare
2e381fb to
e2d3588
Compare
e2d3588 to
ac2786a
Compare
ac2786a to
2090d6f
Compare
2090d6f to
7a79f26
Compare
7a79f26 to
4db1beb
Compare
4db1beb to
31173bb
Compare
| nuxt-component-meta@https://pkg.pr.new/nuxt-component-meta@e3eb2c4: | ||
| resolution: {tarball: https://pkg.pr.new/nuxt-component-meta@e3eb2c4} | ||
| version: 0.14.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The @nuxt/[email protected] upgrade pulls a transitive dependency on nuxt-component-meta from a temporary PR preview URL instead of the stable npm registry, which creates build reproducibility and reliability issues.
View Details
Analysis
@nuxt/[email protected] pulls nuxt-component-meta from inaccessible PR preview URL
What fails: Fresh installs in new environments will fail when trying to fetch nuxt-component-meta from https://pkg.pr.new/nuxt-component-meta@e3eb2c4, which returns HTTP 404
How to reproduce:
# In fresh environment without cached packages:
rm -rf node_modules pnpm-lock.yaml
pnpm installResult: Installation succeeds only if package is cached; URL returns 404 causing build reproducibility issues in CI/CD and fresh deployments
Expected: Should use stable npm registry version ([email protected] is available on npm)
The issue stems from @nuxt/[email protected] specifying the PR preview URL directly in its dependencies. While current installs work due to caching, this creates a build reproducibility risk.
This PR contains the following updates:
^1.2.71->^1.2.72^1.2.55->^1.2.57^3.7.1->^3.8.0^1.9.0->^1.10.0^9.38.0->^9.39.110.19.0->10.20.0^3.1.2->^3.1.3Release Notes
nuxt/content (@nuxt/content)
v3.8.0Compare Source
Features
Bug Fixes
Performance Improvements
nuxt/eslint (@nuxt/eslint)
v1.10.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
eslint/eslint (eslint)
v9.39.1Compare Source
v9.39.0Compare Source
pnpm/pnpm (pnpm)
v10.20.0Compare Source
Minor Changes
--alloption inpnpm --helpto list all commands #8628.Patch Changes
latestversion doesn't satisfy the maturity requirement configured byminimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.createcommand should not verify patch info.managePackageManagerVersionstofalse, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.vuejs/language-tools (vue-tsc)
v3.1.3Compare Source
Features
<template>(#5734) - Thanks to @KazariEX!Bug Fixes
lang="html"(#5728) - Thanks to @serkodev!Other Changes
Configuration
📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.