chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@nuxt/eslint-config (source)	^1.11.0 → ^1.13.0			devDependencies	minor
@nuxt/test-utils	^3.21.0 → ^3.23.0			devDependencies	minor
actions/checkout	v6.0.1 → v6.0.2			action	patch
actions/setup-node	v6.1.0 → v6.2.0			action	minor
crawler-user-agents	^1.22.0 → ^1.27.0			devDependencies	minor
eslint (source)	^9.39.1 → ^9.39.2			devDependencies	patch
happy-dom	^20.0.11 → ^20.4.0			devDependencies	minor
playwright (source)	^1.57.0 → ^1.58.1			devDependencies	minor
pnpm (source)	10.25.0 → 10.28.2			packageManager	minor

---

Release Notes

nuxt/eslint (@​nuxt/eslint-config)

v1.13.0

Compare Source

   🚀 Features

• Upgrade eslint-flat-config-utils eslint-plugin-import-lite and eslint-plugin-jsdoc  -  by @​antfu (10bf9)

    View changes on GitHub

v1.12.1

Compare Source

No significant changes

    View changes on GitHub

nuxt/test-utils (@​nuxt/test-utils)

v3.23.0

Compare Source

3.23.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements

• runtime-utils: Support h3 v2 (#​1515)
• module: Add install wizard when freshly installed (#​1538)

🩹 Fixes

• e2e: Ensure $fetch is not typed as any (1f4754ea9)

🏡 Chore

• Remove leftover console.log (aef693340)

✅ Tests

• Add cleanup to resolve-config tests (#​1537)

🤖 CI

• Prepare build environment in autofix workflow (2c0864ed6)

❤️ Contributors

• Daniel Roe (@​danielroe)
• yamachi4416 (@​yamachi4416)

v3.22.0

Compare Source

3.22.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements

• runtime-utils: Unify logic of mount + render helpers (#​1522)
• module: Run vitest in separate process (#​1524)
• runtime-utils: Allow skipping initial route change (fd77ec066)
• runtime: Skip route sync emulation when NuxtPage exists (#​1530)

🔥 Performance

• module: Skip nuxt-root stub plugin when building (#​1512)

🩹 Fixes

• runtime-utils: Reject promise on error render + mount helpers (#​1503)
• runtime-utils: Support new .sync method for syncing route (1148c3cf1)
• e2e: Always override global env options with inline options (c8f881b3d)
• runtime-utils: Avoid missing render warn on reject render + suspend helpers (#​1520)
• e2e: Use server.deps rather than deps (2b3c86921)
• config: Also call sync() in initial setup (ec555192c)
• module: Use devtools:before hook instead of direct config check (#​1532)
• config: Do not override vitest root with nuxt rootDir (#​1531)

💅 Refactors

• runtime-utils: Do not export addCleanup (86b4998bb)
• module: Extract nuxt environment options plugin (5ada22a9f)

📖 Documentation

• Fix link to module authors testing guide (#​1511)

🏡 Chore

• Use nuxt cli command in preference to nuxi (838ed8b6a)
• Add @vitest/ui to example (ffaccd8a1)
• Fix some example package.json names (417102718)
• Skip bun test (c19a659d3)
• Ignore root interfaces (9739057ae)

✅ Tests

• Use local kit version for module (79f1e14d5)
• Add defaultLocale in i18n test (059988fc3)
• Avoid definePageMeta compiler-hint warning (#​1523)

🤖 CI

• Run knip on pull requests (a94098671)

❤️ Contributors

• Daniel Roe (@​danielroe)
• yamachi4416 (@​yamachi4416)
• Maurice Putz (@​Shooteger)

actions/checkout (actions/checkout)

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

actions/setup-node (actions/setup-node)

v6.2.0

Compare Source

monperrus/crawler-user-agents (crawler-user-agents)

v1.27.0

Compare Source

v1.26.0

Compare Source

v1.25.0

Compare Source

v1.24.0

Compare Source

v1.23.0

Compare Source

eslint/eslint (eslint)

v9.39.2

Compare Source

capricorn86/happy-dom (happy-dom)

v20.4.0

Compare Source

🎨 Features

• Adds support for caching the compiled code of EcmaScript modules - By @​capricorn86 in task #​2049
• Improves the way nodes are destroyed and garbage collected - By @​capricorn86 in task #​2049

v20.3.9

Compare Source

👷‍♂️ Patch fixes

• Accept Document nodes as valid boundary points in Selection API - By @​skoch13 in task #​1952

v20.3.8

Compare Source

👷‍♂️ Patch fixes

• The getters for the properties focusNode and focusOffset in the Selection API returned incorrect values - By @​skoch13 in task #​1850

v20.3.7

Compare Source

👷‍♂️ Patch fixes

• Updates README.md for the "@​happy-dom/server-renderer" package - By @​capricorn86 in task #​2035

v20.3.6

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where it wasn't possible to toggle the "open" attribute of <details> by clicking on a child of the <summary> element - By @​Nxooah in task #​1928

v20.3.5

Compare Source

👷‍♂️ Patch fixes

• Use internal property for "location" in BrowserFrameURL to avoid mock interference - By @​marchaos in task #​1964
• Add optional chaining to the "hostname" and pathname" properties to check if they are undefined in CookieURLUtility - By @​marchaos in task #​1968

v20.3.4

Compare Source

v20.3.3

Compare Source

v20.3.2

Compare Source

v20.3.1

Compare Source

👷‍♂️ Patch fixes

• Normalizes the "format" parameter according to the HTML specification in DataTransfer.getData() - By @​marchaos in task #​1965
• Handle partial responses in XMLHttpRequest - By @​rexxars in task #​1890

v20.3.0

Compare Source

🎨 Features

• Use RegExp to convert ASCII character casing to improve performance - By @​TrevorBurnham in task #​1886

v20.2.0

Compare Source

🎨 Features

• Use Element.classList.contains() instead of splitting className in query selectors to improve performance as it's cached - By @​TrevorBurnham in task #​1884

v20.1.1

Compare Source

👷‍♂️ Patch fixes

• Fixes caching in querySelector() - By @​TrevorBurnham in task #​1882
• Avoid sort in querySelector() to improve performance - By @​TrevorBurnham in task #​1882

v20.1.0

Compare Source

🎨 Features

• Adds support for BrowserPage.evaluateModule() and BrowserFrame.evaluateModule() - By @​capricorn86 in task #​1944
• Adds support for module to the browser settings - By @​capricorn86 in task #​1944
  • This makes it possible to add a custom resolver or a node module resolver
• Adds support for dynamic import() to JavaScript evaluation - By @​capricorn86 in task #​1944
  • It was previously only supported when using type="module" on script elements
• Adds support for WebSocket - By @​capricorn86 in task #​1944
• Adds support for CloseEvent - By @​capricorn86 in task #​1944
• Adds support for render.setupScript and render.mode to the configuration in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Changes name from urls to renderItems in the configuration in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Adds support for rendering strings in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Makes JavaScript evaluation disabled by default in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944

👷‍♂️ Patch fixes

• Several fixed to the EcmaScript module compiler (esm) - By @​capricorn86 in task #​1944
• Fixes issue where rendering using Worker's didn't work in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944

microsoft/playwright (playwright)

v1.58.1

Compare Source

Highlights

#​39036 fix(msedge): fix local network permissions
#​39037 chore: update cft download location
#​38995 chore(webkit): disable frame sessions on fronzen builds

Browser Versions

• Chromium 145.0.7632.6
• Mozilla Firefox 146.0.1
• WebKit 26.0

v1.58.0

Compare Source

pnpm/pnpm (pnpm)

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Gold Sponsors

v10.28.1

Compare Source

v10.28.0

Compare Source

v10.27.0

Compare Source

v10.26.2: pnpm 10.26.2

Compare Source

Patch Changes

• Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #​10307.

• Fix installation of Git dependencies using annotated tags #​10335.

  Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out commit hash didn't match the stored tag object hash.

• Binaries of runtime engines (Node.js, Deno, Bun) are written to node_modules/.bin before lifecycle scripts (install, postinstall, prepare) are executed #​10244.

• Try to avoid making network calls with preferOffline #​10334.

Platinum Sponsors

Gold Sponsors

v10.26.1: pnpm 10.26.1

Compare Source

Patch Changes

• Don't fail on pnpm add, when blockExoticSubdeps is set to true #​10324.
• Always resolve git references to full commits and ensure HEAD points to the commit after checkout #​10310.

Platinum Sponsors

Gold Sponsors

v10.26.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.