Comparing changes

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) ([changelog](https://redirect.github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd..df4cb1c069e1874edd31b4311f1884172cec0e10)) | action | digest | `de0fac2` → `df4cb1c` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) ([changelog](https://redirect.github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093..0ebf47130e4866e96fce0953f49152a61190b271)) | action | digest | `0e279bb` → `0ebf471` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) ([changelog](https://redirect.github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10..d23441a48e516b6c34aea4fa41551a30e30af803)) | action | digest | `df4cb1c` → `d23441a` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://redirect.github.com/actions/setup-node) ([changelog](https://redirect.github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e..249970729cb0ef3589644e2896645e5dc5ba9c38)) | action | digest | `48b55a0` → `2499707` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) ([changelog](https://redirect.github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271..0977fd99725f1db4007ccb2928dbb4e90d06cc86)) | action | digest | `0ebf471` → `0977fd9` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

@type

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [lint-staged](https://redirect.github.com/lint-staged/lint-staged) | [`^17.0.8` → `^17.4.1`](https://renovatebot.com/diffs/npm/lint-staged/17.0.8/17.4.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lint-staged/17.4.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lint-staged/17.0.8/17.4.1?slim=true) | devDependencies | minor | | [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`^0.57.0` → `^0.65.0`](https://renovatebot.com/diffs/npm/oxfmt/0.57.0/0.65.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.65.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.57.0/0.65.0?slim=true) | devDependencies | minor | | [oxlint](https://oxc.rs/docs/guide/usage/linter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxlint)) | [`^1.72.0` → `^1.80.0`](https://renovatebot.com/diffs/npm/oxlint/1.72.0/1.80.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxlint/1.80.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxlint/1.72.0/1.80.0?slim=true) | devDependencies | minor | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`10.34.4` → `10.34.5`](https://renovatebot.com/diffs/npm/pnpm/10.34.4/10.34.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.34.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.34.4/10.34.5?slim=true) | packageManager | patch | | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) | `v6.0.9` → `v6.0.10` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/pnpm%2faction-setup/v6.0.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/pnpm%2faction-setup/v6.0.9/v6.0.10?slim=true) | action | patch | | [shell-quote](https://redirect.github.com/ljharb/shell-quote) | [`^1.9.0` → `^1.10.0`](https://renovatebot.com/diffs/npm/shell-quote/1.9.0/1.10.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/shell-quote/1.10.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/shell-quote/1.9.0/1.10.0?slim=true) | dependencies | minor | | [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | `v0.5.7` → `v0.6.3` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/zizmorcore%2fzizmor-action/v0.6.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/zizmorcore%2fzizmor-action/v0.5.7/v0.6.3?slim=true) | action | minor | --- ### Release Notes <details> <summary>lint-staged/lint-staged (lint-staged)</summary> ### [`v17.4.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1741) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.3.0...v17.4.1) ##### Patch Changes - [#1840](https://redirect.github.com/lint-staged/lint-staged/pull/1840) [`efe5b63`](https://redirect.github.com/lint-staged/lint-staged/commit/efe5b63cc4961c80b6363fe40bac3c145e3ddbb2) - This is a version-bump-only release because the previous version `17.4.0` was not published to npmjs.com due to problems with GitHub Actions and Changesets. ### [`v17.3.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1730) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0) ##### Minor Changes - [#1825](https://redirect.github.com/lint-staged/lint-staged/pull/1825) [`16b3f74`](https://redirect.github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4) - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in: ```json { "*.ts": ["first", "second", ["third", "third"], "fourth"] } ``` As a concrete example, *lint-staged*'s own configuration is: ```js /** @type {import('./lib/index.js').Configuration} */ export default { "*": [ [ "oxfmt --check --no-error-on-unmatched-pattern", "oxlint --no-error-on-unmatched-pattern", ], ], "*.ts": () => "tsc", }; ``` which means: 1. for all staged files, run the two commands in parallel with staged filenames appended, for example: - `oxfmt --check --no-error-on-unmatched-pattern lib/index.js` - `oxlint --no-error-on-unmatched-pattern lib/index.js` 2. additionally, if any `*.ts` files are staged, run `tsc` without appending any arguments 3. The two sets of commands also run in parallel ##### Patch Changes - [#1829](https://redirect.github.com/lint-staged/lint-staged/pull/1829) [`15f7e53`](https://redirect.github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43) - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both `HEAD` and `MERGE_HEAD`. ### [`v17.2.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1720) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.1.1...v17.2.0) ##### Minor Changes - [#1823](https://redirect.github.com/lint-staged/lint-staged/pull/1823) [`ee156cc`](https://redirect.github.com/lint-staged/lint-staged/commit/ee156cc7039494f1db11f389b1233c78f588238c) - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like: ```js /** @type {import('lint-staged').Configuration} */ export default { "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project) }; ``` Where the spawned command is literally `"tsc"` without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters. Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked: ```js /** @type {import('lint-staged').Configuration} */ export default { "*.js": { title: "Log staged JS files to console", task: async (files) => { console.log("Staged JS files:", files); }, }, }; ``` ### [`v17.1.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1711) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.1.0...v17.1.1) ##### Patch Changes - [#1820](https://redirect.github.com/lint-staged/lint-staged/pull/1820) [`a626a9f`](https://redirect.github.com/lint-staged/lint-staged/commit/a626a9f269d9ff6498a9b8245490e096f90c4bb7) - It's now possible to set `--max-arg-length=Infinity` to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options `--max-arg-length` and `--concurrency` has been improved. ### [`v17.1.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1710) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.0.8...v17.1.0) ##### Minor Changes - [#1816](https://redirect.github.com/lint-staged/lint-staged/pull/1816) [`7568d4f`](https://redirect.github.com/lint-staged/lint-staged/commit/7568d4fb15ba3c3317a7aec36195461cb2f272d7) - The console output of *lint-staged* has been simplified so that there's less interactive spinners and more explicit messages like *"Started…*" -> "*Done!*". The primary purpose of this was to remove [`Listr2`](https://redirect.github.com/listr2/listr2), a very large dependency. **Before:** Size of `node_modules/` after installing: `1561.7 kB` with 29 packages. Fancy interactive spinners, but output dynamically changes: ```shell ✔ Backed up original state in git stash (0b191303) ✔ Running tasks for staged files... ✔ Staging changes from tasks... ✔ Cleaning up temporary files... ``` **After:** Size of `node_modules/` after installing: `974.0 kB` with 5 packages (37.6 % smaller, 82.7 % less transitive dependencies). Simpler but more explicit output: ```shell ⋯ Backing up original state… ✔ Done backing up original state (35b38ed1)! ⋯ Running tasks for staged files… *.js — 1 file ⋯ oxlint --fix *.{json,md} — 1 file ⋯ oxfmt --write ✔ oxfmt --write ✔ oxlint --fix ✔ Done running tasks for staged files! ⋯ Staging changes from tasks… ✔ Done staging changes from tasks! ⋯ Cleaning up temporary files… ✔ Done cleaning up temporary files! ``` ##### Patch Changes - [#1816](https://redirect.github.com/lint-staged/lint-staged/pull/1816) [`c19079d`](https://redirect.github.com/lint-staged/lint-staged/commit/c19079d808d557b538c34fe69381d2ef970c7acc) - Try to restore hidden unstaged changes when using `--no-revert`. - [#1818](https://redirect.github.com/lint-staged/lint-staged/pull/1818) [`efb23a2`](https://redirect.github.com/lint-staged/lint-staged/commit/efb23a25075d980db9edabd2f71e769fc97d48c8) - Console output colors are enabled/disabled more consistently. - [#1818](https://redirect.github.com/lint-staged/lint-staged/pull/1818) [`26112a1`](https://redirect.github.com/lint-staged/lint-staged/commit/26112a19151f9678861d51ea7416e9f9bef24bbb) - Failed JS function tasks now properly kill other tasks, unless `--continue-on-error` is used. Previously their failure didn't affect other tasks. </details> <details> <summary>oxc-project/oxc (oxfmt)</summary> ### [`v0.65.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.64.0...oxfmt_v0.65.0) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.64.0...oxfmt_v0.65.0) ### [`v0.64.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0640---2026-08-18) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.63.0...oxfmt_v0.64.0) ##### 🚀 Features - [`c07fe7c`](https://redirect.github.com/oxc-project/oxc/commit/c07fe7c) oxfmt: Support `experimentalOperatorPosition` ([#25643](https://redirect.github.com/oxc-project/oxc/issues/25643)) (leaysgur) ##### 📚 Documentation - [`fed6681`](https://redirect.github.com/oxc-project/oxc/commit/fed6681) oxfmt: Skip expanding overrides options ([#25572](https://redirect.github.com/oxc-project/oxc/issues/25572)) (leaysgur) ### [`v0.63.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.62.0...oxfmt_v0.63.0) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.62.0...oxfmt_v0.63.0) ### [`v0.62.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0620---2026-08-03) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.61.0...oxfmt_v0.62.0) ##### 🐛 Bug Fixes - [`e6e584b`](https://redirect.github.com/oxc-project/oxc/commit/e6e584b) oxfmt: Type jsdoc. enum options ([#25008](https://redirect.github.com/oxc-project/oxc/issues/25008)) (leaysgur) ### [`v0.61.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.60.0...oxfmt_v0.61.0) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.60.0...oxfmt_v0.61.0) ### [`v0.60.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.59.0...oxfmt_v0.60.0) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.59.0...oxfmt_v0.60.0) ### [`v0.59.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxfmt/CHANGELOG.md#0590---2026-07-13) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.58.0...oxfmt_v0.59.0) ##### 🐛 Bug Fixes - [`415fe1e`](https://redirect.github.com/oxc-project/oxc/commit/415fe1e) oxfmt: Error on ignorePatterns that cannot match files outside the config directory ([#24286](https://redirect.github.com/oxc-project/oxc/issues/24286)) (leaysgur) ### [`v0.58.0`](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.57.0...oxfmt_v0.58.0) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxfmt_v0.57.0...oxfmt_v0.58.0) </details> <details> <summary>oxc-project/oxc (oxlint)</summary> ### [`v1.80.0`](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.79.0...oxlint_v1.80.0) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.79.0...oxlint_v1.80.0) ### [`v1.79.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1790---2026-08-18) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.78.0...oxlint_v1.79.0) ##### 💥 BREAKING CHANGES - [`8c4552d`](https://redirect.github.com/oxc-project/oxc/commit/8c4552d) linter: \[**BREAKING**] Split react/react-compiler into per-category rules ([#25500](https://redirect.github.com/oxc-project/oxc/issues/25500)) (Boshen) ##### 🐛 Bug Fixes - [`228e8e0`](https://redirect.github.com/oxc-project/oxc/commit/228e8e0) linter: Resolve inactive React compiler rules ([#25830](https://redirect.github.com/oxc-project/oxc/issues/25830)) (Boshen) - [`aa49d86`](https://redirect.github.com/oxc-project/oxc/commit/aa49d86) linter: Allow spread rule options in config types ([#25675](https://redirect.github.com/oxc-project/oxc/issues/25675)) (ch3rry) - [`36f8451`](https://redirect.github.com/oxc-project/oxc/commit/36f8451) linter/eslint/no-eval: Align indirect default with ESLint ([#25656](https://redirect.github.com/oxc-project/oxc/issues/25656)) (camc314) - [`beb724d`](https://redirect.github.com/oxc-project/oxc/commit/beb724d) linter/eslint/no-unused-vars: Report bare underscore parameters ([#25663](https://redirect.github.com/oxc-project/oxc/issues/25663)) (camc314) - [`4004c10`](https://redirect.github.com/oxc-project/oxc/commit/4004c10) linter/eslint/no-irregular-whitespace: Check comments by default ([#25660](https://redirect.github.com/oxc-project/oxc/issues/25660)) (camc314) - [`285820e`](https://redirect.github.com/oxc-project/oxc/commit/285820e) linter/no-large-snapshots: Precompile and document allowed snapshot matchers ([#25611](https://redirect.github.com/oxc-project/oxc/issues/25611)) (Mikhail Baev) - [`4df5835`](https://redirect.github.com/oxc-project/oxc/commit/4df5835) linter: Allow capitalized built-in calls ([#25516](https://redirect.github.com/oxc-project/oxc/issues/25516)) (Boshen) ### [`v1.78.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1780---2026-08-10) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.77.0...oxlint_v1.78.0) ##### 🚀 Features - [`ccb8fe8`](https://redirect.github.com/oxc-project/oxc/commit/ccb8fe8) linter/jsdoc: Implement `no-blank-blocks` rule ([#25207](https://redirect.github.com/oxc-project/oxc/issues/25207)) (Mikhail Baev) - [`d4a897c`](https://redirect.github.com/oxc-project/oxc/commit/d4a897c) linter/eslint: Implement `one-var` rule ([#24470](https://redirect.github.com/oxc-project/oxc/issues/24470)) (Cole Ellison) - [`5ab9340`](https://redirect.github.com/oxc-project/oxc/commit/5ab9340) linter/jsx-a11y/anchor-has-content: Add options to match eslint ([#24571](https://redirect.github.com/oxc-project/oxc/issues/24571)) (Cole Ellison) ##### 🐛 Bug Fixes - [`9573937`](https://redirect.github.com/oxc-project/oxc/commit/9573937) linter/typescript: Validate `ban-ts-comment` description\_format ([#25320](https://redirect.github.com/oxc-project/oxc/issues/25320)) (Mikhail Baev) ### [`v1.77.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1770---2026-08-03) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.76.0...oxlint_v1.77.0) ##### 🐛 Bug Fixes - [`5c0fa61`](https://redirect.github.com/oxc-project/oxc/commit/5c0fa61) linter/eslint/no-warning-comments: Unify config structs and remove manual options docs ([#25151](https://redirect.github.com/oxc-project/oxc/issues/25151)) (Mikhail Baev) ##### 📚 Documentation - [`9dc7756`](https://redirect.github.com/oxc-project/oxc/commit/9dc7756) linter/typescript/no-unnecessary-condition: Clarify options ([#25110](https://redirect.github.com/oxc-project/oxc/issues/25110)) (camc314) ### [`v1.76.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1760---2026-07-27) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.75.0...oxlint_v1.76.0) ##### 🚀 Features - [`8d31dfa`](https://redirect.github.com/oxc-project/oxc/commit/8d31dfa) linter: Verify eslint/no-restricted-globals config schema ([#24598](https://redirect.github.com/oxc-project/oxc/issues/24598)) (vigneshwar) - [`7069621`](https://redirect.github.com/oxc-project/oxc/commit/7069621) linter: Verify jest/vitest prefer-lowercase-title config schema ([#24724](https://redirect.github.com/oxc-project/oxc/issues/24724)) (Bartok) - [`016cf2a`](https://redirect.github.com/oxc-project/oxc/commit/016cf2a) linter/oxc: Add bad-match-all-arg rule ([#24900](https://redirect.github.com/oxc-project/oxc/issues/24900)) (camc314) - [`cdc941e`](https://redirect.github.com/oxc-project/oxc/commit/cdc941e) linter/n: Implement `exports-style` rule ([#24087](https://redirect.github.com/oxc-project/oxc/issues/24087)) (Mikhail Baev) - [`1ad6f6c`](https://redirect.github.com/oxc-project/oxc/commit/1ad6f6c) linter/eslint: Implement `id-denylist` rule ([#24632](https://redirect.github.com/oxc-project/oxc/issues/24632)) (Mikhail Baev) ##### 📚 Documentation - [`3ff2e0e`](https://redirect.github.com/oxc-project/oxc/commit/3ff2e0e) linter: Clarify config extends types ([#24936](https://redirect.github.com/oxc-project/oxc/issues/24936)) (Boshen) ### [`v1.75.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1750---2026-07-20) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.74.0...oxlint_v1.75.0) ##### 🚀 Features - [`dd18383`](https://redirect.github.com/oxc-project/oxc/commit/dd18383) linter/node: Implement no-top-level-await rule ([#24634](https://redirect.github.com/oxc-project/oxc/issues/24634)) (Connor Shea) - [`16a65f2`](https://redirect.github.com/oxc-project/oxc/commit/16a65f2) linter/react: Implement function-component-definition rule ([#24471](https://redirect.github.com/oxc-project/oxc/issues/24471)) (Cole Ellison) - [`7f1f585`](https://redirect.github.com/oxc-project/oxc/commit/7f1f585) linter: Reuse `jest/padding-around-test-blocks` for `vitest/padding-around-test-blocks` ([#24519](https://redirect.github.com/oxc-project/oxc/issues/24519)) (Mikhail Baev) - [`99978a8`](https://redirect.github.com/oxc-project/oxc/commit/99978a8) linter/import/consistent-type-specifier-style: Support `prefer-top-level-if-only-type-imports` option ([#24502](https://redirect.github.com/oxc-project/oxc/issues/24502)) (camc314) ##### 🐛 Bug Fixes - [`8694167`](https://redirect.github.com/oxc-project/oxc/commit/8694167) linter/eslint/prefer-destructuring: Handle typed declarations ([#24616](https://redirect.github.com/oxc-project/oxc/issues/24616)) (camc314) ### [`v1.74.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1740---2026-07-13) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.73.0...oxlint_v1.74.0) ##### 🚀 Features - [`0433a83`](https://redirect.github.com/oxc-project/oxc/commit/0433a83) linter/eslint/no-inner-declarations: Add `namespaces` option ([#24044](https://redirect.github.com/oxc-project/oxc/issues/24044)) (Boshen) ##### 🐛 Bug Fixes - [`8337835`](https://redirect.github.com/oxc-project/oxc/commit/8337835) linter: Error on `ignorePatterns` that cannot match files aoutside the config directory ([#24341](https://redirect.github.com/oxc-project/oxc/issues/24341)) (leaysgur) - [`2ce5a33`](https://redirect.github.com/oxc-project/oxc/commit/2ce5a33) linter: Resolve `ignorePatterns` relative to the config dir ([#24339](https://redirect.github.com/oxc-project/oxc/issues/24339)) (leaysgur) ##### ⚡ Performance - [`7f80cac`](https://redirect.github.com/oxc-project/oxc/commit/7f80cac) linter/vue/prop-name-casing: Precompile `ignoreProps` regex pattern ([#24413](https://redirect.github.com/oxc-project/oxc/issues/24413)) (connorshea) - [`6272051`](https://redirect.github.com/oxc-project/oxc/commit/6272051) linter/typescript/no-require-imports: Compile allow patterns once ([#24417](https://redirect.github.com/oxc-project/oxc/issues/24417)) (connorshea) - [`33805b9`](https://redirect.github.com/oxc-project/oxc/commit/33805b9) linter/jsdoc/require-param: Compile checkTypesPattern regex once ([#24420](https://redirect.github.com/oxc-project/oxc/issues/24420)) (connorshea) ### [`v1.73.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1730---2026-07-06) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.72.0...oxlint_v1.73.0) ##### 🚀 Features - [`a2c97f3`](https://redirect.github.com/oxc-project/oxc/commit/a2c97f3) linter/unicorn: Implement `explicit-timer-delay` rule ([#23612](https://redirect.github.com/oxc-project/oxc/issues/23612)) (Mikhail Baev) - [`85735cb`](https://redirect.github.com/oxc-project/oxc/commit/85735cb) linter/unicorn: Implement `no-confusing-array-with` rule ([#23638](https://redirect.github.com/oxc-project/oxc/issues/23638)) (Shekhu☺️) - [`cb4fbb9`](https://redirect.github.com/oxc-project/oxc/commit/cb4fbb9) linter/eslint: Implement no-unreachable-loop rule ([#23975](https://redirect.github.com/oxc-project/oxc/issues/23975)) (Todor Andonov) - [`dc32112`](https://redirect.github.com/oxc-project/oxc/commit/dc32112) linter/eslint/no-constant-binary-expression: Check relational comparisons ([#24088](https://redirect.github.com/oxc-project/oxc/issues/24088)) (camc314) - [`d963967`](https://redirect.github.com/oxc-project/oxc/commit/d963967) linter/unicorn/no-array-sort: Add `allowAfterSpread` option ([#24043](https://redirect.github.com/oxc-project/oxc/issues/24043)) (Boshen) - [`0a75682`](https://redirect.github.com/oxc-project/oxc/commit/0a75682) linter: Add per-rule timings for type-aware linting ([#22488](https://redirect.github.com/oxc-project/oxc/issues/22488)) (camchenry) - [`743e222`](https://redirect.github.com/oxc-project/oxc/commit/743e222) linter/react: Add `disallowedValues` option for `forbid-dom-props` rule ([#23970](https://redirect.github.com/oxc-project/oxc/issues/23970)) (Mikhail Baev) ##### 🐛 Bug Fixes - [`bdb51c7`](https://redirect.github.com/oxc-project/oxc/commit/bdb51c7) linter/jest/prefer-ending-with-an-expect: Validate config patterns ([#24122](https://redirect.github.com/oxc-project/oxc/issues/24122)) (camc314) - [`45d607d`](https://redirect.github.com/oxc-project/oxc/commit/45d607d) linter/react/forbid-component-props: Make allow/disallow lists optional in schema ([#24024](https://redirect.github.com/oxc-project/oxc/issues/24024)) (Boshen) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v10.34.5`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.34.5): pnpm 10.34.5 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.34.4...v10.34.5) #### Patch Changes - [`78e29fe`](https://redirect.github.com/pnpm/pnpm/commit/78e29fe): Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through. - [`78e29fe`](https://redirect.github.com/pnpm/pnpm/commit/78e29fe): Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker. - [`47ef6f0`](https://redirect.github.com/pnpm/pnpm/commit/47ef6f0): Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.<platform>-<arch>[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it. - [`36928be`](https://redirect.github.com/pnpm/pnpm/commit/36928be): `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`.  #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  </details> <details> <summary>pnpm/action-setup (pnpm/action-setup)</summary> ### [`v6.0.10`](https://redirect.github.com/pnpm/action-setup/compare/v6.0.9...v6.0.10) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.9...v6.0.10) </details> <details> <summary>ljharb/shell-quote (shell-quote)</summary> ### [`v1.10.0`](https://redirect.github.com/ljharb/shell-quote/blob/HEAD/CHANGELOG.md#v1100---2026-07-10) [Compare Source](https://redirect.github.com/ljharb/shell-quote/compare/v1.9.0...v1.10.0) ##### Merged - \[New] `parse`: add opt-in `splitUnquoted` option for shell field-splitting of unquoted expansions [`#1`](https://redirect.github.com/ljharb/shell-quote/pull/1) ##### Commits - \[Fix] `parse`: match nested `${...}` braces so nested parameter expansion is consumed as one substitution [`c0842c8`](https://redirect.github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c) - \[Tests] `parse`: pin single-quote literalness and unmatched-quote handling [`a0d03e3`](https://redirect.github.com/ljharb/shell-quote/commit/a0d03e35c8ede24016502c4433b8f5d6b3100a62) - \[readme] remove the space in js code fences so evalmd evaluates them [`2116fa3`](https://redirect.github.com/ljharb/shell-quote/commit/2116fa36aeea77fe8d561b0db46b1f9b26b8cf1b) - \[Tests] `quote`: pin conservative escaping of `=`, `@`, `^`, `,`, `:`, `!` ([#11](https://redirect.github.com/ljharb/shell-quote/issues/11)) [`1c36f3f`](https://redirect.github.com/ljharb/shell-quote/commit/1c36f3ff77d26d200620c1027e5c271050120b8e) - \[readme] document that `quote` outputs POSIX quoting, not `cmd.exe`/PowerShell [`100e96e`](https://redirect.github.com/ljharb/shell-quote/commit/100e96e0ffadcca97d63dda15651c70b9f83507c) - \[readme] document `parse`'s supported parameter-expansion subset [`e1c75cd`](https://redirect.github.com/ljharb/shell-quote/commit/e1c75cd6e4a3c60003792c7f2802587d328622cb) - \[Fix] `parse`: a backslash inside single quotes must not escape the closing quote [`5d460a3`](https://redirect.github.com/ljharb/shell-quote/commit/5d460a332b54b83153297fe7d1964330b28fa491) - \[readme] fix stale example outputs [`2de86f5`](https://redirect.github.com/ljharb/shell-quote/commit/2de86f5d44f44d3ac9df36413d8a05f3534cdec6) - \[Tests] `quote`: pin that a backslash with whitespace is not doubled in single quotes ([#14](https://redirect.github.com/ljharb/shell-quote/issues/14)) [`190e236`](https://redirect.github.com/ljharb/shell-quote/commit/190e236bcf1d81caa8e40e8ea3bb11998575be71) - \[readme] `quote`: use output verbatim; do not re-quote it ([#11](https://redirect.github.com/ljharb/shell-quote/issues/11)) [`1b36468`](https://redirect.github.com/ljharb/shell-quote/commit/1b364683b1e9e8d078fd3017cde82cf10c9c04a5) - \[Refactor] `parse`: fix swapped `SINGLE_QUOTE`/`DOUBLE_QUOTE` variable names [`801af5c`](https://redirect.github.com/ljharb/shell-quote/commit/801af5c935b27d6dcda63b3975d5e92a7b6f887f) - \[types] fix an error TS v6 ignores but v7 fails on [`59bbf8b`](https://redirect.github.com/ljharb/shell-quote/commit/59bbf8b81bf3236842deb72805744d489f650eba) - \[Dev Deps] update `@arethetypeswrong/cli`, `evalmd` [`a04d475`](https://redirect.github.com/ljharb/shell-quote/commit/a04d47516e1cd5b1b4d3f720ddf97561ed0082fc) - \[Dev Deps] update `@arethetypeswrong/ci`, `eslint` [`d390f9a`](https://redirect.github.com/ljharb/shell-quote/commit/d390f9a92b97a04b1f799298634e90dc581021e6) - \[Tests] `quote`: the tilde test escapes every `~`, not just a leading one ([#9](https://redirect.github.com/ljharb/shell-quote/issues/9)) [`617d119`](https://redirect.github.com/ljharb/shell-quote/commit/617d119795c7b44d6e49a4d41f80195c4aa5735c) </details> <details> <summary>zizmorcore/zizmor-action (zizmorcore/zizmor-action)</summary> ### [`v0.6.3`](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.2...v0.6.3) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.2...v0.6.3) ### [`v0.6.2`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.2) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.1...v0.6.2) zizmor 1.29.0 is now the default version. ### [`v0.6.1`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.1) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.0...v0.6.1) zizmor 1.28.0 is now the default version used by the action. ### [`v0.6.0`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.0) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.5.7...v0.6.0) zizmor 1.27.0 is now the default version used by the action. #### What's Changed - Fold Docker image pull output into a collapsed Actions log group by [@woodruffw](https://redirect.github.com/woodruffw) with [@Copilot](https://redirect.github.com/Copilot) in [#132](https://redirect.github.com/zizmorcore/zizmor-action/pull/132) - Readme: document missing inputs by [@staabm](https://redirect.github.com/staabm) in [#130](https://redirect.github.com/zizmorcore/zizmor-action/pull/130) - ci: block version sync workflow on forks by [@shaanmajid](https://redirect.github.com/shaanmajid) in [#129](https://redirect.github.com/zizmorcore/zizmor-action/pull/129) - Sync zizmor versions by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#137](https://redirect.github.com/zizmorcore/zizmor-action/pull/137) - Add `collect` input by [@woodruffw](https://redirect.github.com/woodruffw) in [#139](https://redirect.github.com/zizmorcore/zizmor-action/pull/139) #### New Contributors - [@woodruffw](https://redirect.github.com/woodruffw) with [@Copilot](https://redirect.github.com/Copilot) made their first contribution in [#132](https://redirect.github.com/zizmorcore/zizmor-action/pull/132) - [@staabm](https://redirect.github.com/staabm) made their first contribution in [#130](https://redirect.github.com/zizmorcore/zizmor-action/pull/130) - [@shaanmajid](https://redirect.github.com/shaanmajid) made their first contribution in [#129](https://redirect.github.com/zizmorcore/zizmor-action/pull/129) **Full Changelog**: <zizmorcore/zizmor-action@v0.5.7...v0.6.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v6.1.0` → `v7.0.1` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7...v7.0.1) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2475](https://redirect.github.com/actions/checkout/pull/2475) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2477](https://redirect.github.com/actions/checkout/pull/2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2478](https://redirect.github.com/actions/checkout/pull/2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2479](https://redirect.github.com/actions/checkout/pull/2479) - Bump actions/checkout from 6 to 7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2488](https://redirect.github.com/actions/checkout/pull/2488) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2476](https://redirect.github.com/actions/checkout/pull/2476) - eslint 9 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2474](https://redirect.github.com/actions/checkout/pull/2474) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2499](https://redirect.github.com/actions/checkout/pull/2499) - skip running unsafe pr check if input is default by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2518](https://redirect.github.com/actions/checkout/pull/2518) - trim only ascii whitespace for branch by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2521](https://redirect.github.com/actions/checkout/pull/2521) - escape values passed to --unset by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2530](https://redirect.github.com/actions/checkout/pull/2530) ### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.1.0...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@actions/core](https://redirect.github.com/actions/core) and [@actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2462](https://redirect.github.com/actions/checkout/pull/2462) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | major | `v6.5.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1577](https://redirect.github.com/actions/setup-node/pull/1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1574](https://redirect.github.com/actions/setup-node/pull/1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1558](https://redirect.github.com/actions/setup-node/pull/1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://redirect.github.com/deiga) in [#1548](https://redirect.github.com/actions/setup-node/pull/1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#1536](https://redirect.github.com/actions/setup-node/pull/1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://redirect.github.com/priya-kinthali) in [#1550](https://redirect.github.com/actions/setup-node/pull/1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#1567](https://redirect.github.com/actions/setup-node/pull/1567) ##### Dependency update: - Upgrade [@actions/cache](https://redirect.github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://redirect.github.com/jasongin) in [#1569](https://redirect.github.com/actions/setup-node/pull/1569) ##### New Contributors - [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) made their first contribution in [#1536](https://redirect.github.com/actions/setup-node/pull/1536) - [@deiga](https://redirect.github.com/deiga) made their first contribution in [#1548](https://redirect.github.com/actions/setup-node/pull/1548) - [@jasongin](https://redirect.github.com/jasongin) made their first contribution in [#1569](https://redirect.github.com/actions/setup-node/pull/1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

The UNC path error was not shown when the third parameter was passed, because the parameter normalization happened after it.

extract the function and add some tests

fixes GHSA-698v-4r3x-3vcv

…156) fixes GHSA-r825-w8mm-5pxw

fixes GHSA-587h-7wmj-h5pm

Navigation Menu

Repository navigation

Comparing changes

Open a pull request

Commits on Jul 1, 2026

Commits on Jul 8, 2026

Commits on Sep 1, 2026

Commits on Oct 2, 2026

Commits on Oct 6, 2026

This comparison is taking too long to generate.

Uh oh!