fix(deps): update all non-major dependencies - #1667
Merged
Merged
Conversation
Coverage Report
File CoverageNo changed files found. |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 31, 2026 13:12
8e116bf to
b436cc6
Compare
dawsontoth
approved these changes
Aug 31, 2026
dawsontoth
left a comment
dawsontoth
left a comment
Contributor
There was a problem hiding this comment.
Approved — verified locally on 8e116bf3
Batch of note: pnpm 11.22.0 → 11.24.0 (packageManager), harper 5.2.4 → 5.2.6, @tanstack/react-router 1.170.31 → 1.170.32, @harperfast/skills 1.12.2 → 1.12.4, create-harper 1.12.0 → 1.12.1, react-hook-form 7.85.0 → 7.86.0, @types/react-dom 19.2.4 → 19.2.5, plus .nvmrc and the e2e Dockerfile base image both 24.19.0 → 24.20.0.
Local run (Node 24.17.0, pnpm 11.24.0):
| step | result |
|---|---|
pnpm install --frozen-lockfile |
exit 0 — lock is in sync |
npx tsc -b --force |
exit 0 |
npx dprint check |
exit 0 |
npx vitest run |
330 files / 2750 passed, 11 skipped |
Two things I checked deliberately rather than assuming:
- No orphaned pnpm patch.
patchedDependenciesis gone frompnpm-workspace.yaml, so the hazard that dominated the July/August router bumps (a@tanstack/router-corepatch pinned to an exact version that the bump orphans →ERR_PNPM_UNUSED_PATCH) simply doesn't apply anymore. Thereact-router1.170.31 → 1.170.32 move is clean. - The
undicioverrides are untouched and still correctly floored at^8.9.0on both the>=7.0.0and<6.27.0keys — i.e. this batch doesn't quietly walk back the CVE-2026-13697 fix.
The harper 5.2.4 → 5.2.6 bump here is a pnpm resolution and does not hit the npm lockfile-pruning problem that broke HarperFast/agent#156 on the same version bump.
CI green (Verify Commits, Verify PR).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.0.76→4.0.864.0.88(+1)7.9.0→7.10.07.9.0→7.10.01.12.2→1.12.45.101.4→5.102.85.101.4→5.102.81.170.31→1.170.329.1.2→9.2.39.2.416.3.2→16.3.319.2.4→19.2.56.1.0→6.1.17.0.73→7.0.837.0.85(+1)1.19.0→1.20.01.12.0→1.12.11.12.220.11.6→20.11.1220.12.0(+3)5.2.4→5.2.65.2.71.33.0→1.35.01.38.0(+2)11.17.0→11.17.224.19.0→24.20.024.19.0-bookworm→24.20.0-bookworm1.79.0→1.80.011.22.0→11.24.02.6.3→2.6.47.85.0→7.86.07.87.0Release Notes
vercel/ai (@ai-sdk/react)
v4.0.86Compare Source
Patch Changes
8dd86a9]fda13b3]957146c]ce6849a]v4.0.85Compare Source
Patch Changes
3e125ba]v4.0.82Compare Source
Patch Changes
b251584]1175434]591d25b]9de0baf]v4.0.81Compare Source
Patch Changes
96970bb]v4.0.80Compare Source
Patch Changes
b74971f]b352a6a]v4.0.79Compare Source
Patch Changes
c6d57f3]76fb75d]677a707]v4.0.77Compare Source
Patch Changes
DataDog/browser-sdk (@datadog/browser-rum)
v7.10.0Compare Source
Public Changes:
Internal Changes:
HarperFast/skills (@harperfast/skills)
v1.12.4Compare Source
Documentation
6bf676d(9c2e32d)v1.12.3Compare Source
Documentation
aa74b1c(680ebde)TanStack/query (@tanstack/react-query)
v5.102.8Compare Source
Patch Changes
v5.102.7Compare Source
Patch Changes
v5.102.6Compare Source
Patch Changes
#11305
ac2b612- fix(react-query): throw falsy errors fromuseQueriesanduseSuspenseQueriesto the error boundaryUpdated dependencies []:
v5.102.5Compare Source
Patch Changes
578e5c2]:v5.102.4Compare Source
Patch Changes
a05df6a]:v5.102.3Compare Source
Patch Changes
v5.102.2Compare Source
Patch Changes
80fbf73]:v5.102.1Compare Source
Patch Changes
134890d]:v5.102.0Compare Source
Minor Changes
e674826- react-query: update usePrefetchQuery and usePrefetchInfiniteQuery to use queryClient.query and queryClient.infiniteQueryPatch Changes
#11245
37127db- revert: remove NoInfer from useQuery return types#10373
6e3d521- fix(types): propagate generic type parameters touseMutationStateselect callback#11224
294d4e6- FixqueryOptionsandinfiniteQueryOptionsreturn types so exported inferred options can be emitted in declaration files without leaking internal data tag symbols.#11147
cb6c9d3- DefaultTDataofUseInfiniteQueryOptionsandUseSuspenseInfiniteQueryOptionstoInfiniteData<TQueryFnData>so it matches the hook generics.#8737
2215bb0- fix: make mutation variables optional whenundefined extends TVariables#11221
1ef4208- Remove experimental render-time prefetching and thepromiseproperty from query results.#11228
fb6c3fa- Avoid emitting a runtime import for React Query's type-only exports.#11130
8834267- fix(react-query): don't show optimistic fetching for unsubscribed useQueries#11233
b866a95- remove unused experimental_beforeQuery and experimental_afterQuery hooks#11144
e546d03- fix: remove placeholderData from suspense infinite queryUpdated dependencies [
34f7cee,b4368c4,5bb089d,ba4650c,294d4e6,1f631b3,01a02bf,18c1c1e,5448063,2215bb0,1ef4208,5981771,4a9bef6,bef4bc7,9656dc4,326aaf1,3e83601,c6fc17c]:TanStack/query (@tanstack/react-query-devtools)
v5.102.8Compare Source
Patch Changes
v5.102.7Compare Source
Patch Changes
v5.102.6Compare Source
Patch Changes
ac2b612]:v5.102.5Compare Source
Patch Changes
ef1eff1]:v5.102.4Compare Source
Patch Changes
v5.102.3Compare Source
Patch Changes
v5.102.2Compare Source
Patch Changes
v5.102.1Compare Source
Patch Changes
v5.102.0Compare Source
Patch Changes
37127db,6e3d521,294d4e6,cb6c9d3,2215bb0,1ef4208,fb6c3fa,8834267,b866a95,e546d03,e674826]:TanStack/router (@tanstack/react-router)
v1.170.32Compare Source
Patch Changes
#8130
cb281d7- preserve context during reloadsUpdated dependencies [
fa65287,cb281d7]:TanStack/table (@tanstack/react-table)
v9.2.3Compare Source
Patch Changes
468f267,3b94648]:testing-library/react-testing-library (@testing-library/react)
v16.3.3Compare Source
Bug Fixes
vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.1.1Compare Source
Add
compiler.logDiagnosticsoptionRecoverable React Compiler diagnostics are no longer logged by default. Set
compiler.logDiagnosticstotrueto log them through Vite. Fatal diagnostics are always logged and fail the transform.Respect environment sourcemap option for React Compiler transform when
builder.sharedPluginsis enabled (#1439)The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental
builder.sharedPluginswas enabled.vercel/ai (ai)
v7.0.83Compare Source
Patch Changes
8dd86a9: Validate persisted typed tool calls against current input and output schemas.Schema-incompatible empty or error inputs and terminal history from unavailable
tools remain loadable as dynamic tool parts instead of exposing unvalidated
values under current static tool types.
fda13b3: Allow chats to continue automatically after tool approval denials reach theoutput-deniedstate.957146c: add operation-level outcomes to UI message stream end callbacksce6849a: fix(ai): handle stitchable stream cancellation before an inner stream is registeredv7.0.82Compare Source
Patch Changes
3e125ba: Allow manual tool approval statuses to include a reason and preserve it acrosscore, model, and UI approval requests. OPA
requires-approvaldecisions nowsurface their reason to human approvers. UI request chunks serialize the
optional
reason, while UI messages retain it asapproval.requestReasonseparately from an approver's response
reason.0e7994c]3e125ba]v7.0.79Compare Source
Patch Changes
b251584: Preserve active text and reasoning parts when another merged UI message stream finishes a step, and align workflow stream normalization with the explicit part end chunks.591d25b: feat: add batch completion webhooks.experimental_startTextBatchaccepts awebhookUrl, and the gateway provider registers it through the batchcallbackUrlcontract and exports typed async-job metadata. Direct Anthropic and OpenAI batch providers return an unsupported warning when the option is provided.9de0baf: Parse structured generateText output when providers omit finishReason but return text.591d25b]v7.0.78Compare Source
Patch Changes
96970bb: Continue approvedgenerateText,streamText, andWorkflowAgentturns with a model-visible tool error when revalidated tool input is invalid.e12e068]v7.0.77Compare Source
Patch Changes
b74971f]a371615]v7.0.76Compare Source
Patch Changes
c6d57f3: fix(ai): prevent duplicate text and reasoning part ids677a707: fix(ai): allow nullish metadata schemas for UI messages with branded IDsv7.0.74Compare Source
Patch Changes
5941bd6]9a4337d]axios/axios (axios)
v1.20.0Compare Source
v1.20.0 — August 19, 2026
This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.
🔒 Security Fixes
🐛 Bug Fixes
🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog (axios/axios@v1.19.0...v1.20.0)
HarperFast/create-harper (create-harper)
v1.12.1Compare Source
Bug Fixes
capricorn86/happy-dom (happy-dom)
v20.11.12Compare Source
👷♂️ Patch fixes
v20.11.11Compare Source
v20.11.10Compare Source
v20.11.9Compare Source
v20.11.8Compare Source
👷♂️ Patch fixes
v20.11.7Compare Source
👷♂️ Patch fixes
harperfast/harper (harper)
v5.2.6Compare Source
Transactions and data integrity
transaction()was not atomic when the context's transaction slot already held a released placeholder (HarperFast#2325, cherry-picked as HarperFast#2327). In that state — and on a context that never held a transaction at all, such as an instance load —txnForContextinstalls anImmediateTransaction, which reports itself open but whosesave()is the commit. Both join sites gated on the open flag alone, sotransaction(ctx, cb)ran the callback and returned without ever reaching its own commit: every write self-committed as it happened, a throw partway through left the earlier writes durable, the error path'sabort()never ran, and the handler still returned success. Both join sites now gate on whether the transaction stages its writes for a later commit, so an explicittransaction()on a released slot is atomic exactly as it is on a fresh one. Reachable in 5.2.1 through 5.2.5.Restarts and shutdown
shutdownWorkersNow(), closing the window where a debounced component reload could pre-start an HTTP replacement inside a process that is already exiting.sleep— so a successful spawn was not evidence it would ever fire. It now emits a readiness token once both facilities are proven, and arming reports failure unless that token arrives, so the "restart teardown is unbounded" warning reaches operators in exactly the environments that need it.tini -gas PID 1 (HarperFast#2316). This gives the container a reaper and makes a reliable SIGKILL fallback possible, while preserving compatibility with volumes written by earlier PID-1 images. Worth knowing on upgrade: group signal forwarding changes which signals component subprocesses receive ondocker stop; the user-visible consequences are recorded inDESIGN.md.Also in this release
Full Changelog: HarperFast/harper@v5.2.5...v5.2.6
v5.2.5Compare Source
Transactions and data integrity
ImmediateTransactionwhose native handle the commit path then discarded, staged writes and all. There was no error and no log line: the caller'sawaitresolved normally over a record that was never written. On 5.2.4 this failed Central Manager'sPOST /Clusteron every request. 5.1 and 5.2.0 were unaffected — the loss is latent in the commit path but only became reachable once a completed scope started leaving a released-transaction placeholder in the slot.await getContext().transaction.commit()— had each subsequent write in that scope serviConfiguration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.