fix(deps): update all non-major dependencies with stable versions (patch) by renovate[bot] · Pull Request #802 · Kong/spec-renderer

renovate · 2026-02-23T05:27:44Z

This PR contains the following updates:

Package	Change	Age	Confidence
@floating-ui/vue (source)	`^1.1.10` → `^1.1.11`
@types/sanitize-html (source)	`^2.16.0` → `^2.16.1`
@vitejs/plugin-vue (source)	`^6.0.4` → `^6.0.5`
autoprefixer	`^10.4.24` → `^10.4.27`
eslint (source)	`^9.39.2` → `^9.39.4`
flatted	`^3.3.3` → `^3.3.4`
glob@>=10.2.0 <10.5.0	[`>=13.0.5` → `>=13.0.6`](https://renovatebot.com/diffs/npm/glob@>=10.2.0 <10.5.0/13.0.5/13.0.6)
httpsnippet	`^3.0.9` → `^3.0.10`
minimatch@<10.2.3	`>=10.2.3` → `>=10.2.4`
postcss (source)	`^8.5.6` → `^8.5.8`
rollup-plugin-visualizer	`^6.0.5` → `^6.0.11`
rollup@>=4.0.0 <4.59.0 (source)	[`>=4.60.0` → `>=4.60.1`](https://renovatebot.com/diffs/npm/rollup@>=4.0.0 <4.59.0/4.60.0/4.60.1)
sanitize-html (source)	`^2.17.1` → `^2.17.2`
undici@<6.24.0 (source)	`>=6.24.0` → `>=6.24.1`
undici@>=7.0.0 <7.24.0 (source)	[`>=7.24.0` → `>=7.24.6`](https://renovatebot.com/diffs/npm/undici@>=7.0.0 <7.24.0/7.24.0/7.24.6)
vue (source)	`^3.5.28` → `^3.5.31`
vue-tsc (source)	`^3.2.4` → `^3.2.6`

Release Notes

floating-ui/floating-ui (@floating-ui/vue)

`v1.1.11`

Patch Changes

Update dependencies: @floating-ui/dom@1.7.6, @floating-ui/utils@0.2.11

vitejs/vite-plugin-vue (@vitejs/plugin-vue)

`v6.0.5`

Miscellaneous Chores

remove Vite 8 beta from supported range (#746) (b3f23e4)

postcss/autoprefixer (autoprefixer)

`v10.4.27`

Compare Source

Removed development key from package.json.

`v10.4.26`

Compare Source

Reduced package size.

`v10.4.25`

Compare Source

Fixed broken gradients on CSS Custom Properties (by @serger777).

eslint/eslint (eslint)

`v9.39.4`

Compare Source

Bug Fixes

f18f6c8 fix: update dependency minimatch to ^3.1.5 (#20564) (Milos Djermanovic)
a3c868f fix: update dependency @eslint/eslintrc to ^3.3.4 (#20554) (Milos Djermanovic)
234d005 fix: minimatch security vulnerability patch for v9.x (#20549) (Andrej Beles)
b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#20538) (루밀LuMir)

Documentation

4675152 docs: add deprecation notice partial (#20520) (Milos Djermanovic)

Chores

b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#20596) (Francesco Trotta)
71b2f6b chore: package.json update for @eslint/js release (Jenkins)
1d16c2f ci: pin Node.js 25.6.1 (#20563) (Milos Djermanovic)

`v9.39.3`

Compare Source

Bug Fixes

791bf8d fix: restore TypeScript 4.0 compatibility in types (#20504) (sethamus)

Chores

8594a43 chore: upgrade @eslint/js@9.39.3 (#20529) (Milos Djermanovic)
9ceef92 chore: package.json update for @eslint/js release (Jenkins)
af498c6 chore: ignore /docs/v9.x in link checker (#20453) (Milos Djermanovic)

isaacs/node-glob (glob@>=10.2.0 <10.5.0)

`v13.0.6`

Compare Source

Kong/httpsnippet (httpsnippet)

`v3.0.10`

Compare Source

What's Changed

fix: Pin all external github actions to their corresponding commit SHAs by @balugeorge in #378
fix: critical and high vulnerabilities [KHCP-18541] by @ValeryG in #385
chore: bump deps to fix vulns by @ryan-willis in #390
fix: use insomnia-automation app for release by @ryan-willis in #391
fix: identify automation app by @ryan-willis in #392

New Contributors

@balugeorge made their first contribution in #378
@ValeryG made their first contribution in #385
@ryan-willis made their first contribution in #390

Full Changelog: Kong/httpsnippet@v3.0.9...v3.0.10

isaacs/minimatch (minimatch@<10.2.3)

`v10.2.4`

Compare Source

postcss/postcss (postcss)

`v8.5.8`

Compare Source

Fixed Processor#version.

`v8.5.7`

Compare Source

Improved source map annotation cleaning performance (by CodeAnt AI).

btd/rollup-plugin-visualizer (rollup-plugin-visualizer)

`v6.0.11`

Compare Source

Identical to 6.0.5 to have latest v6 that is not deprecated

`v6.0.8`

Compare Source

Not published (rolled back, moved to 7.0.0)

rollup/rollup (rollup@>=4.0.0 <4.59.0)

`v4.60.1`

Compare Source

2026-03-30

Bug Fixes

Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

#6286: fix: skip dropping side-effects on namespaceReexportsByName cache hit (#6274) (@littlegrayss, @TrickyPi)
#6317: chore(deps): pin dependencies (@renovate[bot], @lukastaegert)
#6318: chore(deps): update msys2/setup-msys2 digest to cafece8 (@renovate[bot], @lukastaegert)
#6319: chore(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
#6320: chore(deps): pin dependency typescript to v5 (@renovate[bot], @lukastaegert)
#6321: chore(deps): update openharmony-rs/setup-ohos-sdk action to v1 (@renovate[bot], @lukastaegert)
#6322: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)
#6323: chore(deps): lock file maintenance (@renovate[bot])
#6324: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

apostrophecms/apostrophe (sanitize-html)

`v2.17.2`

Compare Source

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &#0000001) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

nodejs/undici (undici@<6.24.0)

`v6.24.1`

Compare Source

Full Changelog: nodejs/undici@v6.24.0...v6.24.1

vuejs/core (vue)

`v3.5.31`

Compare Source

Bug Fixes

compiler-sfc: allow Node.js subpath imports patterns in asset urls (#13045) (95c3356), closes #9919
compiler-sfc: support template literal as defineModel name (#14622) (bd7eef0), closes #14621
reactivity: normalize toRef property keys before dep lookup + improve types (#14625) (1bb28d0), closes #12427 #12431
runtime-core: invalidate detached v-for memo vnodes after unmount (#14624) (560def4), closes #12708 #12710
runtime-core: preserve nullish event handlers in mergeProps (#14550) (5725222)
runtime-core: prevent merging model listener when value is null or undefined (#14629) (b39e032)
runtime-dom: defer teleport mount/update until suspense resolves (#8619) (88ed045), closes #8603
runtime-dom: handle activeElement check in Shadow DOM for v-model (#14196) (959ded2)
server-renderer: cleanup component effect scopes after SSR render (#14548) (862f11e)
suspense: avoid unmount activeBranch twice if wrapped in transition (#9392) (908c6ad), closes #7966
suspense: update suspense vnode's el during branch self-update (#12922) (a2c1700), closes #12920
transition: skip enter guard while hmr updating (#14611) (be0a2f1), closes #14608
types: prevent shallowReactive marker from leaking into value unions (#14493) (3b561db), closes #14490

`v3.5.30`

Compare Source

Bug Fixes

compat: add entities to @vue/compat deps to fix CJS edge cases (#12514) (e725a67), closes #10609
custom-element: ensure child component styles are injected in correct order before parent styles (#13374) (1398bf8), closes #13029
custom-element: properly locate parent when slotted in shadow dom (#12480) (f06c81a), closes #12479
custom-element: should properly patch as props for vue custom elements (#12409) (740983e), closes #12408
reactivity: avoid duplicate raw/proxy entries in Set.add (#14545) (d943612)
reactivity: fix reduce on reactive arrays to preserve reactivity (#12737) (16ef165), closes #12735
reactivity: handle Set with initial reactive values edge case (#12393) (5dc27ca), closes #8647
runtime-core: warn about negative number in v-for (#12308) (9438cc5)
ssr: prevent watch from firing after async setup await (#14547) (6cda71d), closes #14546
types: make generics with runtime props in defineComponent work (fix #11374) (#13119) (cea3cf7), closes #13763
types: narrow useAttrs class/style typing for TSX (#14492) (bbb8977), closes #14489

`v3.5.29`

Compare Source

Bug Fixes

runtime-core: prevent instance leak in withAsyncContext (#14445) (702284f), closes nuxt/nuxt#33644
server-renderer: render className as escaped string (#14469) (da6690c)
transition: prevent enter if leave is in progress (#14443) (df059f8), closes #12091 #12133

vuejs/language-tools (vue-tsc)

`v3.2.6`

Compare Source

language-core

fix: generate $slots type in template correctly with defineSlots (#5984) - Thanks to @KazariEX!
fix: infer only readonly component of arrays in v-for (#5987) - Thanks to @ascott18!
fix: avoid false positives for destructured props detection on binding property names (#5994) - Thanks to @KazariEX!

vscode

fix: use regex for TS extension patching to support VS Code 1.110+ (#5983) - Thanks to @ebiryu!

`v3.2.5`

Compare Source

language-core

fix: re-parse template when interpolation syntax breaks (#5971) - Thanks to @Dsaquel!

language-service

fix: use default html data provider for document symbols (#5968) - Thanks to @liangmiQwQ!

language-plugin-pug

fix: handle backtick attributes containing both quote types (#5970) - Thanks to @baptistejamin!

workspace

docs: document all packages with consistent README structure (#5953)
docs: update tsconfig schema of plugins option - Thanks to @KazariEX!

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) in timezone America/New_York, Automerge - Monday through Friday ( * * * * 1-5 ) in timezone America/New_York.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-04-01T06:33:44Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
 ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 3.0.10 (released 7 days ago) of httpsnippet does not meet the minimumReleaseAge constraint

This error happened while installing a direct dependency of /tmp/renovate/repos/github/Kong/spec-renderer

The latest release of httpsnippet is "3.0.10". Published at 3/25/2026

Other releases are:
  * f1450b121b991ef4751c7f25c7f0f9254ca8f08b: 3.0.2 published at 5/17/2024
  * 49fe515e1db87b997d01debaf271763372ed4059: 3.0.3 published at 5/17/2024
  * 63650f3f6a921e4a617316ba12f14904d9af4b76: 3.0.4 published at 5/17/2024
  * fbd23b56d9065d88476c9585dc4a7fd77ab59edd: 3.0.5 published at 7/12/2024
  * 723581e1daeb94c5d2f59044ee6d26ab2fbb8435: 3.0.6 published at 7/12/2024
  * 889ef62970046ff22597607bf05f5b919cce302c: 3.0.7 published at 10/1/2024
  * 8a1bc90fdcacf9a2ba9e0dde3f75df7765b218c1: 3.0.8 published at 10/1/2024
  * 5b4474df44564aae889423ab26e80d41f99034df: 3.0.9 published at 10/16/2024
  * e4b7070016fb55b5d37dc1e9b17c4717e750fe7a: 3.0.10 published at 3/25/2026

If you need the full list of all 62 published versions run "pnpm view httpsnippet versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot added dependencies renovate-bot labels Feb 23, 2026

renovate bot requested review from a team, DariaYeremina, ValeryG, adamdehaven, jillztom and kongponents-bot as code owners February 23, 2026 05:27

renovate bot enabled auto-merge (squash) February 23, 2026 05:27

renovate bot force-pushed the renovate/patch-all-stable branch 7 times, most recently from 7047972 to 781b8bc Compare March 5, 2026 06:13

renovate bot force-pushed the renovate/patch-all-stable branch from 781b8bc to 8f8a23c Compare March 6, 2026 07:09

renovate bot changed the title ~~chore(deps): update all non-major dependencies with stable versions (patch)~~ fix(deps): update all non-major dependencies with stable versions (patch) Mar 6, 2026

renovate bot force-pushed the renovate/patch-all-stable branch 5 times, most recently from 988a40f to 0374511 Compare March 14, 2026 05:16

renovate bot force-pushed the renovate/patch-all-stable branch 3 times, most recently from e2df9e9 to 946fd3f Compare March 22, 2026 06:18

renovate bot force-pushed the renovate/patch-all-stable branch 3 times, most recently from afd8a4f to e04f3ab Compare March 31, 2026 06:28

renovate bot force-pushed the renovate/patch-all-stable branch from e04f3ab to bbb8a02 Compare April 1, 2026 06:33

fix(deps): update all non-major dependencies with stable versions

fd4b0ca

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot force-pushed the renovate/patch-all-stable branch from bbb8a02 to fd4b0ca Compare April 2, 2026 06:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all non-major dependencies with stable versions (patch)#802

fix(deps): update all non-major dependencies with stable versions (patch)#802
renovate[bot] wants to merge 1 commit intomainfrom
renovate/patch-all-stable

renovate bot commented Feb 23, 2026 •

edited by atlassian bot

Loading

Uh oh!

renovate bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Feb 23, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Miscellaneous Chores

Bug Fixes

Documentation

Chores

Bug Fixes

Chores

What's Changed

New Contributors

Bug Fixes

Pull Requests

Changes

Bug Fixes

Bug Fixes

Bug Fixes

language-core

vscode

language-core

language-service

language-plugin-pug

workspace

Configuration

Uh oh!

renovate bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Feb 23, 2026 •

edited by atlassian bot

Loading

renovate bot commented Apr 1, 2026 •

edited

Loading