[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@commencis/commitlint-config (source)	4.0.0 → 4.1.0
@commencis/eslint-config (source)	3.7.0 → 3.8.0
@commencis/lint-staged-config (source)	3.2.0 → 3.3.0
@commencis/prettier-config (source)	3.3.0 → 3.4.0
@commitlint/cli (source)	21.2.3 → 21.2.4
@commitlint/config-conventional (source)	21.2.3 → 21.2.4
@next/eslint-plugin-next (source)	16.4.0 → 16.4.3
@typescript-eslint/utils (source)	8.71.1 → 8.72.1
@vitest/coverage-v8 (source)	5.0.3 → 5.0.5
eslint-plugin-prettier	5.5.6 → 5.5.7
postcss-styled-syntax	0.7.3 → 0.7.4
tsdown (source)	0.23.1 → 0.23.4
turbo (source)	2.11.7 → 2.11.10
typescript-eslint (source)	8.71.1 → 8.72.1
vitest (source)	5.0.3 → 5.0.5

---

Release Notes

Commencis/js-toolkit (@​commencis/commitlint-config)

v4.1.0

Compare Source

Minor Changes

• Chore: update dependencies #476 adfe3a1 @​ymehmetcan

Commencis/js-toolkit (@​commencis/eslint-config)

v3.8.0

Compare Source

Minor Changes

• Chore: update dependencies #476 6d719dd @​ymehmetcan

Commencis/js-toolkit (@​commencis/lint-staged-config)

v3.3.0

Compare Source

Minor Changes

• Chore: update dependencies #476 72c72be @​ymehmetcan

Commencis/js-toolkit (@​commencis/prettier-config)

v3.4.0

Compare Source

Minor Changes

• Chore: update dependencies #476 9e7e10e @​ymehmetcan

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.4

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.2.4

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

vercel/next.js (@​next/eslint-plugin-next)

v16.4.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#​100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#​100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#​95732)" (#​100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#​100123)
• [lts-active] test: Pin react-virtualized (#​100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#​100572)
• [lts-active] Keep OpenTelemetry request traces together (#​100349, #​100294, #​100324, #​100350, #​100552, #​100583) (#​100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#​100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

Compare Source

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#​99644, #​99732, #​99649) by @​lukesandberg in #​100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#​98823, #​99910, #​100091) by @​sokra in #​100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in #​100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in #​100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in #​100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in #​100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in #​100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in #​100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

typescript-eslint/typescript-eslint (@​typescript-eslint/utils)

v8.72.1

Compare Source

This was a version bump only for utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

Compare Source

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#​12704)

❤️ Thank You

• Junichiro Kasuya @​jksy

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

Compare Source

This was a version bump only for utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

v5.0.4

Compare Source

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in #​11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in #​11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in #​11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in #​11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in #​11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in #​11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in #​11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in #​11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in #​11417 (56b31)
• Fix module graph builtin externals after #​11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11491 and #​11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in #​11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in #​11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in #​11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in #​11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in #​11323 (6f990)
• browser:
  • Close the mock route interception race  -  by @​cplieger and @​sheremet-va in #​8339 and #​11083 (d6620)
  • Allow toHaveTextContent without arguments  -  by @​nomadical in #​11425 (8ebcf)
  • Apply API options without browser config  -  by @​sheremet-va in #​10852 (ad055)
  • Preserve undefined command arguments  -  by @​sheremet-va and @​AriPerkkio in #​11497 (1576d)
  • Wait for setup mocks before importing a test file  -  by @​kasperpeulen in #​11520 (b61d1)
  • Avoid extra scroll outside the iframe  -  by @​sheremet-va in #​11523 (662e8)
  • Run browser instances as workers  -  by @​sheremet-va in #​11525 (bf04b)
    • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.
  • Open one cdp session per tester  -  by @​sheremet-va in #​11542 (69e63)
  • Clean up unmocked and pending mocks  -  by @​sheremet-va in #​11537 (5c955)
• coverage:
  • V8 browser memory leak between test files  -  by @​AriPerkkio in #​11466 (2297d)
  • allowExternal fails to include uncovered files  -  by @​AriPerkkio in #​11513 (4ef00)
  • Filenames containing brackets incorrectly showing as uncovered  -  by @​AriPerkkio in #​11531 (0fa80)
  • Istanbul coverage wrong when module transform warmups  -  by @​AriPerkkio in #​11529 (9f61d)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in #​11167 (c74e0)
• expect:
  • Fix Map and Set deep equality in some assertions  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11402 (b4e79)
  • Check value in chai-style returned  -  by @​sheremet-va in #​11500 (1aca0)
• mocker:
  • Fix native loader mocking edge cases  -  by @​sheremet-va in #​11540 (cd423)
• pretty-format:
  • Support boxed symbols  -  by @​lehni in #​11445 and #​11446 (eba44)
• reporters:
  • Junit to strip ANSI sequences from all XML attributes  -  by @​meganemura and Claude Opus 5.5 in #​11407 (e1a73)
• runner:
  • Don't cache failed fixture setups  -  by @​hamed-bavar in #​11237 and #​11238 (4ee66)
• typecheck:
  • Use typescript pool in toTestSpecification  -  by @​sheremet-va in #​11451 (5f273)
• ui:
  • Remove duplicate browser-open call opening two tabs  -  by @​feastyr69 in #​11356 and #​11358 (d7e13)
  • Simplify explorer filtering + fix nested tests when search matches a suite  -  by @​hi-ogawa, Hiroshi Ogawa, Codex and Claude Opus 5.5 in #​11262 (a627b)
  • Store module graph once per environment  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11421 (af903)
  • Mount index.html handler on the ui base path  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11517 (1bc24)
  • Center split pane resize handle  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11506 (e658b)
• vm:
  • Bind this to module.exports  -  by @​sheremet-va in #​11504 (b618a)

   🏎 Performance

• Reuse fsModuleCache when filtering by source  -  by @​sheremet-va in #​11428 (7ebd9)
• spy: Reset only mocks that were called or reconfigured  -  by @​johan-gorter and Claude Opus 5.5 in #​11197 (28ef9)

    View changes on GitHub

prettier/eslint-plugin-prettier (eslint-plugin-prettier)

v5.5.7

Compare Source

Patch Changes

• #​796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

• #​805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

hudochenkov/postcss-styled-syntax (postcss-styled-syntax)

v0.7.4

Compare Source

• Add missing default export after migrating the package to ESM

rolldown/tsdown (tsdown)

v0.23.4

Compare Source

   🚀 Features

• cjs: Warn when platform is ignored for the CJS format  -  by @​sxzz and @​sxzzbot in #​1111 (58003)
• config: Support multiple env files  -  by @​sxzz and @​sxzzbot in #​1110 (5d558)

   🐞 Bug Fixes

• attw: Apply profiles to file-based problems  -  by @​sxzz and @​sxzzbot in #​1108 (a853d)
• config: Ignore empty env file paths and scope env deps per watcher  -  by @​sxzzbot (17bd0)
• css: Inline ?inline CSS imported from dependencies  -  by @​sxzz and @​sxzzbot in #​1109 (75a78)

   🏎 Performance

• Use tinyps in hooks  -  by @​43081j in #​1112 (f925e)

    View changes on GitHub

v0.23.3

Compare Source

   🐞 Bug Fixes

• Downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support  -  by @​sxzz and @​sxzzbot in #​1107 (0344c)

    View changes on GitHub

v0.23.2

Compare Source

   🚀 Features

• Add JSON schema for config  -  by @​Sandbye and @​sxzz in #​1074 (2410e)

   🐞 Bug Fixes

• css: Respect Lightning CSS modules options  -  by @​sxzz in #​1103 (490ec)

    View changes on GitHub

vercel/turborepo (turbo)

v2.11.10: Turborepo v2.11.10

Compare Source

What's Changed

Changelog

• fix: Allow non-recursive Turbo commands in root tasks by @​sahyl in #​14814
• chore: Release Turborepo 2.11.9 by @​github-actions[bot] in #​14824
• chore(deps): Update dependency @​vercel/geistdocs to v2 by @​vercel-gh-bot-4[bot] in #​14417
• chore: Update with-gatsby example by @​vercel-gh-bot-3[bot] in #​14796
• fix: Avoid pnpm batch-shim shutdown hangs on Windows by @​sahyl in #​14819
• chore(deps): Update dependency @​vercel/geistdocs to v2.11.0 by @​vercel-gh-bot-3[bot] in #​14832
• fix: Exclude tool-managed directories from local dependency inputs by @​PedroRosalba in #​14696
• fix: Match git's text=auto binary detection in file hashing by @​PedroRosalba in #​14697
• fix: Drop @​react-router/dev from Remix match list by @​Pcmhacker-piro in #​14800
• fix: Match package configuration files and directory inputs in task-level affected detection by @​PedroRosalba in #​14804
• fix: Parse pnpm 8 single-project lockfiles by @​PedroRosalba in #​14806
• fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @​PedroRosalba in #​14805
• docs: Generate the sitemap from Geistdocs sources by @​molebox in #​14865
• fix: Restore cached symlinks when outputs are already on disk by @​PedroRosalba in #​14807
• chore: Remove CODEOWNERS file by @​anthonyshew with @​Copilot in #​14810
• feat: Enable WebMCP for Turborepo docs by @​anthonyshew in #​14828
• fix: Exit quietly when turbo ls output is piped to a closed reader by @​drakeo338 in #​14868
• fix: Distrust compromised eMudhra intermediate certificates by @​anthonyshew in #​14876

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

v2.11.9: Turborepo v2.11.9

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.8 by @​github-actions[bot] in #​14789
• perf: Prefetch Cargo metadata during lazy graph construction by @​anthonyshew in #​14497
• perf: Compute Berry lockfile closures once across workspaces by @​anthonyshew in #​14499
• perf: Check cache hit outputs in place instead of on the blocking pool by @​anthonyshew in #​14524
• perf: Speed up Berry lockfile loading by @​anthonyshew in #​14500
• perf: Parse bun.lock without building a JSON syntax tree by @​anthonyshew in #​14502
• perf: Skip the dry run cache batch window when there is no remote cache by @​anthonyshew in #​14505
• perf: Emit lockfile closures pre-sorted and cheapen closure interning by @​anthonyshew in #​14525
• perf: Reuse configuration derived from turbo.json between the shim and the CLI by @​anthonyshew in #​14521
• feat: Report locked tools-only setup plans by @​anthonyshew in #​14483
• perf: Compute Bun lockfile closures once across workspaces by @​anthonyshew in #​14501
• perf: Reuse open parent directories when restoring cache archives by @​anthonyshew in #​14506
• perf: Skip dropping the run right before turbo run exits by @​anthonyshew in #​14507
• perf: Match literal input exclusions without compiling globs by @​anthonyshew in #​14510
• perf: Copy pruned package files in parallel by @​anthonyshew in #​14512
• feat: Report proposed first-lock and refresh setup plans by @​anthonyshew in #​14571
• perf: Compress large cache archives with multithreaded zstd by @​anthonyshew in #​14698
• perf: Read tracked file stats from directory listings on Windows by @​anthonyshew in #​14633
• perf: Diff changed lockfile resolutions with a merge instead of ordered sets by @​anthonyshew in #​14630
• perf: Write dry run text output through one buffered stdout handle by @​anthonyshew in #​14625
• perf: Parse pnpm-workspace.yaml once per command by @​anthonyshew in #​14620
• perf: Write each file trace error to stderr in a single call by @​anthonyshew in #​14618
• perf: Reuse glob validation results when re-validating turbo.json in the language server by @​anthonyshew in #​14615
• perf: Keep git subprocesses off the critical path of dry runs by @​anthonyshew in #​14610
• perf: Classify watch file changes when they arrive instead of on a 100ms poll by @​anthonyshew in #​14600
• perf: Buffer TUI raw-output spool writes by @​anthonyshew in #​14597
• perf: Add the turbo query version key without re-parsing the response by @​anthonyshew in #​14592
• perf: Replay cached task logs in whole-line chunks by @​anthonyshew in #​14590
• perf: Write each boundaries diagnostic to stderr in a single call by @​anthonyshew in #​14587
• perf: Walk leading-globstar input trees in parallel without wax by @​anthonyshew in #​14511
• perf: Reuse open parent directories when writing cache archives by @​anthonyshew in #​14513
• perf: Index Bun lockfile subgraph lookups instead of rescanning all packages by @​anthonyshew in #​14514
• perf: Render the pruned lockfile while package files are copied by @​anthonyshew in #​14515
• feat: Resolve exact native npm lock cohorts by @​anthonyshew in #​14484
• perf: Batch prefixed task output into one write per chunk by @​anthonyshew in #​14588
• perf: Share one allocation per external package identity by @​anthonyshew in #​14528
• perf: Remove quadratic package-name scan from microfrontends discovery by @​anthonyshew in #​14527
• perf: Render file trace errors on several threads by @​anthonyshew in #​14623
• perf: Check boundaries packages in parallel again by @​anthonyshew in #​14598
• perf: Read PTY child output in 8 KiB chunks by @​anthonyshew in #​14594
• perf: Load each package's tsconfig once when checking boundaries by @​anthonyshew in #​14589
• perf: Skip the file watcher round trip when checking outputs for new task hashes by @​anthonyshew in [#​14626](https://redirect.github.com/vercel/turborepo/pull/14626

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Istanbul)

• Branch creation
  • Between 07:00 AM and 09:59 AM, only on Monday (* 7-9 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1e178cf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@commencis/commitlint-config	Patch
@commencis/eslint-config	Patch
@commencis/eslint-plugin	Patch
@commencis/stylelint-config	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR