Skip to content

chore(deps): update deps:workspace-non-major - #712

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/deps-workspace-non-major
Open

chore(deps): update deps:workspace-non-major#712
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/deps-workspace-non-major

Conversation

@renovate

@renovate renovate Bot commented Sep 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@cantoo/pdf-lib (source) 2.9.1 → 2.9.2 age confidence
@swc/core (source) 1.16.1 → 1.16.2 age confidence
@types/google-apps-script (source) 2.0.12 → 2.0.13 age confidence
@types/react-dom (source) 19.2.5 → 19.2.7 age confidence
@typescript-eslint/eslint-plugin (source) 8.68.0 → 8.70.0 age confidence
@typescript-eslint/parser (source) 8.68.0 → 8.70.0 age confidence
eslint (source) 10.9.1 → 10.10.0 age confidence
eslint-plugin-jest 29.16.5 → 29.16.6 age confidence
globals 17.11.0 → 17.12.0 age confidence
jest (source) 30.5.0 → 30.5.1 age confidence
jscpd (source) 5.1.0 → 5.2.0 age confidence
knip (source) 6.33.0 → 6.35.1 age confidence
serialize-javascript 7.0.5 → 7.1.1 age confidence
type-fest 5.8.0 → 5.9.0 age confidence
typescript-eslint (source) 8.68.0 → 8.70.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cantoo-scribe/pdf-lib (@​cantoo/pdf-lib)

v2.9.2

Compare Source

  • Decrypt PDFs whose /Encrypt crypt filters (/CF, /StdCF, …) are
    indirect objects (e.g. iText 2.x). CipherTransformFactory now resolves
    those entries with lookup instead of get.
swc-project/swc (@​swc/core)

v1.16.2

Compare Source

Bug Fixes
Features

  • (es/minifier) Evaluate Math.floor, Math.ceil, Math.round and Mat… (#​12117) (e876e80)

  • (es/parser) Add opt-in parser-only TSRX lowering (#​12120) (61ff097)

Miscellaneous Tasks
Refactor
Testing
Ci
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.70.0

Compare Source

🚀 Features
  • eslint-plugin: [no-generated-empty-object-type] add rule (#​12730)
🩹 Fixes
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#​12780)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#​12728)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#​12729)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

🚀 Features
  • eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#​12603)
🩹 Fixes
  • eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#​12727)
  • eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#​12741)
  • eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#​12731)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.70.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

eslint/eslint (eslint)

v10.10.0

Compare Source

jest-community/eslint-plugin-jest (eslint-plugin-jest)

v29.16.6

Compare Source

Bug Fixes
  • prefer-to-have-been-called: don't crash on matcher without an argument (#​2016) (58e487f)
  • prefer-to-have-length: don't crash on expect chain without a value (#​2014) (3629019)
sindresorhus/globals (globals)

v17.12.0

Compare Source

jestjs/jest (jest)

v30.5.1

Compare Source

Fixes
  • [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#​16411)
  • [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#​16411)
  • [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#​16411)
  • [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #​16390) (#​16417)
  • [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#​16413)
Chore & Maintenance
  • [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#​16404)
kucherenko/jscpd (jscpd)

v5.2.0

Compare Source

New Features
  • Type-2 clone detection: --ignore-identifiers, --ignore-literals, --ignore-annotations — three opt-in flags (config keys ignoreIdentifiers, ignoreLiterals, ignoreAnnotations, GitHub Action inputs of the same names) normalize token classes before hashing, so blocks that differ only in names, literal values or annotations are found. Identifiers hash as one class while keywords keep their value, strings and numbers stay distinct classes, and @Name(...) runs are dropped in Java, Kotlin, Scala, Groovy, Python, Dart, Swift, JavaScript and TypeScript (@interface declarations are kept). Every clone now carries a kind: exact or renamed. A run without the flags is unchanged apart from the additive "kind": "exact" JSON field. See fixtures/type2-demo. (#​998, #​1019)
  • Near-miss clone merging with --max-gap-lines N — a copy with a line inserted, removed or changed in the middle used to show up as two shorter clones. With --max-gap-lines N (config maxGapLines, Action input max-gap-lines, default 0 = off) clones of one file pair whose fragments follow each other in both files with at most N unmatched lines between them are merged into one clone of kind similar with a similarity value (matched tokens over the merged span). A merge whose similarity would fall below 0.5 is refused, duplicated-line statistics count only the matched lines, and a merge of renamed halves is reported as similar. See fixtures/type3-demo. (#​999, #​1020, #​1030)
  • Function-level similarity for JavaScript and TypeScript with --similarity RATIO — edits spread through a function rather than concentrated in one gap still escape a token window. --similarity (config similarity, Action input similarity, a number in (0, 1]; the default 1 means exact matches only, so nothing runs until you lower it) compares every function, method and arrow function by the bag of 4-grams over its syntax-tree node types, indexed with MinHash, and reports pairs at or above the ratio as similar clones spanning the whole functions. Names and literals do not take part: a renamed copy scores 1.0, one inserted line about 0.9, two inserted statements plus renames about 0.75. Every similar clone records its method (gap or ast) because the two scores are not on the same scale. The MCP check_duplication tool accepts the same similarity argument. (#​999, #​727, #​1021)
  • Clone kinds in every reporter — console prints Clone found (javascript, renamed) and Clone found (javascript, similar (gap) ~0.91), ai appends (renamed) / [~0.91 gap], JSON adds kind, similarity and method to each duplicate and renamedClones / similarClones to the statistics, XML adds the same attributes, HTML shows a badge, Xcode a suffix, and SARIF and Code Climate use the rules jscpd/renamed-code and jscpd/similar-code next to jscpd/duplicate-code. (#​1019, #​1021, #​1030)
  • Tips are skipped when stdout is not a terminal — the tips and sponsor lines are printed only on an interactive terminal; a pipe, a file, a CI log or an agent hook no longer receives them. JSCPD_NO_TIPS joins CI as an environment switch and --no-tips stays the explicit one; NO_COLOR only removes the colours. (#​1008, #​1029, thanks @​7487)
  • MCP: fully described tool definitions — the four tools now carry a title, read-only annotations, parameter descriptions with examples and defaults, and descriptions that say when to use each tool and what it returns; the server instructions describe the workflow across them. Tool names and schemas are unchanged. (#​1028)
Bug Fixes
  • Config-file ignorePattern entries without * or ? silently did nothing — such entries were treated as relative paths and joined onto the config directory, so "ignorePattern": ["Copyright 2026 Example Authors"] matched nothing while the same string via --ignore-pattern worked. Config entries are now applied verbatim, and an invalid regex prints a Warning: line instead of being dropped silently. See fixtures/ignore-demo. (#​997)
  • JavaScript/TypeScript files with a recoverable parse error could not match clean files — any parser diagnostic sent the file to the word-split fallback tokenizer, so a file containing, say, a redeclared function was tokenized differently from every well-formed file and never paired with one. Tokens now come from the lexer whenever the parser did not fail outright. Clone counts on codebases with such files change; that is the correction. (#​1023, #​1024)
  • Markdown inherited the C comment style — a /* (a glob like docs/**) or // (any URL) in prose opened a comment that swallowed the rest of the file, so two files sharing a paragraph after such a line were never reported. Markdown now has no comment syntax. (#​1026, thanks @​kwesolowski)
  • Vue template clones were reported with wrong ranges — the wrapper tags of the file and the template body were appended to the html token stream out of source order, so a clone across the seam took its endpoints from opposite ends of the file. The stream is now in source order, and the wrapper tags (<template>, <script>, <style> and their closing tags) are left out of it altogether, so a template clone is reported with the template's own line range and the script and style bodies are not counted as duplicated html. See fixtures/sfc-demo. (#​1031, thanks @​zero-stroke)
Other
  • Runnable demos under fixtures/ — every feature and fix above ships a demo directory (ignore-demo, type2-demo, type3-demo, parse-errors-demo, sfc-demo) whose README lists each command with its expected output, and the same files feed the smoke scan that runs on every pull request.
  • Docs: ignore patterns and inline markers — --ignore-pattern / ignorePattern source-region filtering and the jscpd:ignore-start / jscpd:ignore-end markers are documented in the v5 reference, with license-header recipes and a note on the Rust regex syntax. (#​993, #​996, thanks @​w3lld1)
  • GitHub Action inputs ignore-identifiers, ignore-literals, ignore-annotations, max-gap-lines and similarity for the features above.
Dependencies
  • Add regex 1 to the jscpd crate for --ignore-pattern validation (#​997)
  • Bump taiki-e/install-action from 2.87.2 to 2.87.3 in /.github/workflows (#​995)
Thank You ❤️

Published Packages

  • cpd-core@0.1.12 on crates.io
  • cpd-finder@0.1.15 on crates.io
  • cpd-reporter@0.1.13 on crates.io
  • cpd-tokenizer@0.1.14 on crates.io
  • jscpd@5.2.0 on crates.io
  • cpd@5.2.0 on npm
  • jscpd@5.2.0 on npm
  • jscpd-darwin-arm64@5.2.0 on npm
  • jscpd-darwin-x64@5.2.0 on npm
  • jscpd-linux-x64-gnu@5.2.0 on npm
  • jscpd-linux-arm64-gnu@5.2.0 on npm
  • jscpd-linux-x64-musl@5.2.0 on npm
  • jscpd-linux-arm64-musl@5.2.0 on npm
  • jscpd-windows-x64-msvc@5.2.0 on npm
  • jscpd-windows-arm64-msvc@5.2.0 on npm

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json)
and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

cosign verify-blob \
  --bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt

v5.1.2

Compare Source

New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)

Published Packages

  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json)
and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

cosign verify-blob \
  --bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt

v5.1.1

Compare Source

Bug Fixes

  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.

    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.

Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.

Published Packages

  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
webpro-nl/knip (knip)

v6.35.1: Release 6.35.1

Compare Source

v6.35.0: Release 6.35.0

Compare Source

v6.34.0: Release 6.34.0

Compare Source

yahoo/serialize-javascript (serialize-javascript)

v7.1.1

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

Compare Source

v7.0.6

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

sindresorhus/type-fest (type-fest)

v5.9.0

Compare Source

New types
Improvements
  • SharedUnionFieldsDeep: Ensure it doesn't distribute processed union over mapped type (#​1509) 07a04de
  • TypedArray: Add Float16Array (#​1495) ca27cce
Fixes
typescript-eslint/typescript-eslint (typescript-eslint)

v8.70.0

Compare Source

🩹 Fixes
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#​12780)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 8am on saturday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Update one or more dependencies version label Sep 12, 2026
@renovate
renovate Bot force-pushed the renovate/deps-workspace-non-major branch from 4ea9904 to 3f61ca3 Compare September 12, 2026 09:54
@renovate
renovate Bot force-pushed the renovate/deps-workspace-non-major branch from 3f61ca3 to cca7ad5 Compare September 14, 2026 18:33
@renovate
renovate Bot force-pushed the renovate/deps-workspace-non-major branch from cca7ad5 to 1461583 Compare September 15, 2026 02:36
@renovate
renovate Bot force-pushed the renovate/deps-workspace-non-major branch from 1461583 to 50e266c Compare September 15, 2026 18:46
@renovate
renovate Bot force-pushed the renovate/deps-workspace-non-major branch from 50e266c to c37c666 Compare September 16, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Update one or more dependencies version

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants