chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	OpenSSF	Age	Confidence
crate-ci/typos	action	patch	v1.47.0 → v1.47.2
pnpm (source)	packageManager	minor	11.4.0 → 11.5.1	11.5.2
vite (source)	devDependencies	patch	8.0.13 → 8.0.16

---

Release Notes

crate-ci/typos (crate-ci/typos)

v1.47.2

Compare Source

[1.47.2] - 2026-06-04

Fixes

• Don't correct inferrable
• Correct unused inferible variant

v1.47.1

Compare Source

[1.47.1] - 2026-06-03

Fixes

• Don't correct requestors

pnpm/pnpm (pnpm)

v11.5.1

Compare Source

Patch Changes

• Improve pnpm audit performance by pruning non-vulnerable lockfile subtrees and stopping path enumeration once vulnerable findings reach the path cap.
• Avoid crashing when the workspace state cache is partially written or malformed.
• Set npm_config_user_agent for root lifecycle scripts during headless installs.
• Preserve the integrity field of a remote (non-registry) tarball dependency when its lockfile entry is rebuilt. Re-resolving such a dependency without re-fetching it (for example via pnpm update, or when another dependency changes) produced a resolution with no integrity — URL/tarball resolvers only learn the integrity after the tarball is downloaded — so the previously recorded integrity was dropped, making later installs fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY #​12067.
• Normalize a string repository field into the { type, url } object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a string repository with a 500 Internal Server Error during pnpm publish #​12099.
• Preserve compatible optional peer versions already present in the lockfile when resolving dependencies.
• Fixed inconsistent resolution of a peer dependency that is shared through a diamond. When a package peer-depends on both another package and one of that package's own peer dependencies (for example @typescript-eslint/eslint-plugin peer-depends on both @typescript-eslint/parser and typescript, and @typescript-eslint/parser peer-depends on typescript), pnpm no longer reuses a hoisted instance of the shared peer that was resolved against a different version #​12079.

v11.5.0

Compare Source

Minor Changes

• Added a new hoistingLimits setting for nodeLinker: hoisted installs, mirroring yarn's nmHoistingLimits. It accepts none (the default — hoist as far as possible), workspaces (hoist only as far as each workspace package), or dependencies (hoist only up to each workspace package's direct dependencies). Originally proposed in #​6468, closing #​6457.

• Replaced enquirer with @inquirer/prompts for all interactive prompts. Fixes the update -i scrolling overflow bug where long choice lists were clipped in the terminal #​6643.

  User-facing changes:

  • pnpm update -i / pnpm update -i --latest: Scrolling now works correctly when many packages are available; the new library uses visual-line-aware pagination via usePagination
  • pnpm audit --fix -i: Same scrolling fix for vulnerability selection
  • pnpm approve-builds: Interactive build approval prompts updated
  • pnpm patch: Version selection and "apply to all" prompts updated
  • pnpm patch-remove: Patch removal selection updated
  • pnpm publish: Branch confirmation prompt updated
  • pnpm login: Credential prompts updated
  • pnpm run / pnpm exec (with verifyDepsBeforeRun=prompt): Confirmation prompt updated

  Vim-style j/k keys still work for up/down navigation in all interactive prompts.

  Internal: The OtpEnquirer and LoginEnquirer DI interfaces changed from { prompt } to { input } / { input, password } respectively. Plugins or custom builds that inject their own enquirer mock will need to update.

• Staged publishes are now recognized in the trust scale. When a package version's registry metadata carries an approver field, it is treated as the strongest trust evidence (ranked above trusted publishers and provenance attestations), since staged publishes require 2FA publish approvals. This prevents false-positive trust downgrade errors when moving from a staged publish to a lower trust level #​11887.

Patch Changes

• Fix pnpm hanging during peer resolution when an aliased install pulls in transitive packages with mutual peer cycles at different depths in the dependency tree (for example, pnpm i nuxt@npm:nuxt-nightly@5x). Cycles whose members hit the findHit cache instead of running their own calculateDepPath are now short-circuited by sibling resolutions at the level where the cycle is detected, so the cached path promises no longer deadlock. #​11999.

• Fix pnpm dist-tag add and pnpm dist-tag rm against npmjs.org failing without --otp with [ERR_PNPM_UNAUTHORIZED] You must be logged in to set dist-tag … "You must provide a one-time pass. Upgrade your client to npm@latest in order to use 2FA.". pnpm now sends npm-auth-type: web on dist-tag writes and surfaces the resulting OTP challenge through the existing browser-based 2FA flow (the same withOtpHandling helper used by pnpm publish), so the browser opens, the user authenticates, and the dist-tag is set on retry. --otp=<code> continues to work via the classic flow.

• Fix minimumReleaseAgeExclude handling in npm resolution fast paths so excluded packages do not get pinned to stale versions. Excludes are honored consistently during publishedBy metadata selection and cache-mtime shortcuts.

• Fix the integrity field being dropped from the lockfile entry of a remote (non-registry) https-tarball dependency when an unrelated package is installed afterwards. URL/tarball resolvers do not return an integrity (it is only known after the tarball is downloaded), so when such a dependency was reused from the lockfile without being re-fetched, its integrity was lost. It is now carried over from the existing resolution. With pnpm's lockfile-integrity hardening, the missing integrity made subsequent --frozen-lockfile installs fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY. #​12001.

• Skip dependency re-resolution when pnpm-lock.yaml is missing but node_modules/.pnpm/lock.yaml exists and still satisfies the manifest. pnpm install now reuses the materialized snapshot to regenerate pnpm-lock.yaml instead of walking the registry to rebuild it from scratch, turning the cache+node_modules variation into a near-no-op for users who deleted the lockfile but kept the install #​11993.

  --frozen-lockfile still refuses to proceed when pnpm-lock.yaml is absent — the regenerated lockfile must be committed, so failing loudly is the correct behavior for CI.

vitejs/vite (vite)

v8.0.16

Compare Source

Bug Fixes

• deps: reject UNC paths for launch-editor-middleware (#​22571) (50b9512)
• reject windows alternate paths (#​22572) (dc245c7)

v8.0.15

Compare Source

Features

• send 408 on request timeout (#​22476) (c85c9ee)
• update rolldown to 1.0.3 (#​22538) (646dbed)

Bug Fixes

• capitalize error messages and remove spurious space in parse error (#​22488) (85a0eff)
• deps: update all non-major dependencies (#​22511) (2686d7d)
• dev: fix html-proxy cache key mismatch for /@​fs/ HTML paths (#​21762) (47c4213)
• glob: error on relative glob in virtual module when no files match (#​22497) (5c8e98f)
• optimizer: close the rolldown bundle when write() rejects (#​22528) (e3cfb9d)
• resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#​22509) (40985f1)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​22566) (3052a67)

Code Refactoring

• correct logic in collectAllModules function (#​22562) (6978a9c)

v8.0.14

Compare Source

Features

• update rolldown to 1.0.2 (#​22484) (96efc88)

Bug Fixes

• deps: update all non-major dependencies (#​22471) (98b8163)
• dev: handle errors when sending messages to vite server (#​22450) (e8e9a34)
• html: handle trailing slash paths in transformIndexHtml (#​22480) (5d94d1b)
• optimizer: pass oxc jsx options to transformSync in dependency scan (#​22342) (b3132da)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​22470) (7cb728e)
• remove irrelevant commits from changelog (2c69495)

Code Refactoring

• glob: do not rewrite import path for absolute base (#​22310) (0ae2844)

Tests

• css: sass does not use main field (#​22449) (ebf39a0)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (197 entries)...

   ╭─────────────────────────────────────────╮
   │                                         │
   │   Update available! 11.5.1 → 11.5.2.    │
   │   Changelog: https://pnpm.io/v/11.5.2   │
   │    To update, run: pnpm add -g pnpm     │
   │                                         │
   ╰─────────────────────────────────────────╯

✓ Lockfile passes supply-chain policies (197 entries in 10s)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 14, reused 0, downloaded 0, added 0
Progress: resolved 16, reused 0, downloaded 0, added 0
Progress: resolved 108, reused 0, downloaded 0, added 0
Progress: resolved 166, reused 0, downloaded 0, added 0
Progress: resolved 197, reused 0, downloaded 0, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 19 versions do not meet the minimumReleaseAge constraint:
  @oxc-project/types@0.133.0 was published at 2026-05-26T06:30:02.095Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-android-arm64@1.0.3 was published at 2026-05-27T11:48:03.147Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-darwin-arm64@1.0.3 was published at 2026-05-27T11:47:39.757Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-darwin-x64@1.0.3 was published at 2026-05-27T11:46:54.917Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-freebsd-x64@1.0.3 was published at 2026-05-27T11:47:20.180Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-linux-arm-gnueabihf@1.0.3 was published at 2026-05-27T11:47:26.933Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-linux-arm64-gnu@1.0.3 was published at 2026-05-27T11:47:34.109Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-linux-arm64-musl@1.0.3 was published at 2026-05-27T11:47:45.104Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-linux-ppc64-gnu@1.0.3 was published at 2026-05-27T11:48:21.292Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-linux-s390x-gnu@1.0.3 was published at 2026-05-27T11:48:14.848Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-linux-x64-gnu@1.0.3 was published at 2026-05-27T11:47:07.199Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-linux-x64-musl@1.0.3 was published at 2026-05-27T11:47:13.920Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-openharmony-arm64@1.0.3 was published at 2026-05-27T11:47:50.576Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-wasm32-wasi@1.0.3 was published at 2026-05-27T11:48:08.241Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-win32-arm64-msvc@1.0.3 was published at 2026-05-27T11:47:56.973Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  @rolldown/binding-win32-x64-msvc@1.0.3 was published at 2026-05-27T11:47:00.892Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  rolldown@1.0.3 was published at 2026-05-27T11:49:15.029Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  tinyglobby@0.2.17 was published at 2026-05-30T19:57:21.717Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)
  vite@8.0.16 was published at 2026-06-01T09:50:43.261Z, within the minimumReleaseAge cutoff (2026-05-22T09:40:16.927Z)