ci(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@commitlint/cli (source)	20.5.0 → 20.5.3			devDependencies	patch
@commitlint/config-conventional (source)	20.5.0 → 20.5.3			devDependencies	patch
@eslint/js (source)	9.39.3 → 9.39.4			devDependencies	patch
@formatjs/intl (source)	4.1.7 → 4.1.11			dependencies	patch	4.1.12
@formatjs/intl-locale	5.3.2 → 5.3.8			dependencies	patch
@types/express-session (source)	1.18.2 → 1.19.0			pnpm.overrides	minor
@types/express-session (source)	1.18.2 → 1.19.0			devDependencies	minor
@types/node (source)	22.19.0 → 22.19.19			devDependencies	patch
@types/react (source)	19.2.14 → 19.2.15			pnpm.overrides	patch
@types/react (source)	19.2.14 → 19.2.15			devDependencies	patch
ace-builds	1.43.6 → 1.44.0			dependencies	minor
axios (source)	1.15.0 → 1.16.1			dependencies	minor
baseline-browser-mapping	2.10.23 → 2.10.31			devDependencies	patch	2.10.32
copy-to-clipboard	4.0.0 → 4.0.2			dependencies	patch
country-flag-icons	1.6.16 → 1.6.17			dependencies	patch
cypress (source)	15.13.1 → 15.15.0			devDependencies	minor	15.16.0
eslint (source)	9.39.3 → 9.39.4			devDependencies	patch
eslint-plugin-formatjs	6.4.5 → 6.4.10			devDependencies	patch	6.4.12 (+1)
express-rate-limit	8.3.2 → 8.5.2			dependencies	minor
globals	17.5.0 → 17.6.0			devDependencies	minor
gravatar-url	4.0.1 → 4.0.2			dependencies	patch
jiti	2.6.1 → 2.7.0			devDependencies	minor
node	22.22.2-alpine3.23 → 22.22.3-alpine3.23			container	patch
node-gyp	12.2.0 → 12.3.0			dependencies	minor
nodemailer (source)	8.0.5 → 8.0.7			dependencies	patch	8.0.9 (+1)
pnpm (source)	10.24.0 → 10.33.4			packageManager	minor	10.34.0
postcss (source)	8.5.12 → 8.5.15			devDependencies	patch
prettier (source)	3.8.2 → 3.8.3			devDependencies	patch
prettier-plugin-tailwindcss	0.7.2 → 0.8.0			devDependencies	minor
react-animate-height	3.2.3 → 3.2.4			dependencies	patch
react-aria	3.47.0 → 3.48.0			dependencies	minor
semver	7.7.4 → 7.8.0			dependencies	minor	7.8.1
tsc-alias (source)	1.8.16 → 1.8.17			devDependencies	patch
typescript (source)	5.4.5 → 5.9.3			devDependencies	minor
undici (source)	8.1.0 → 8.3.0			dependencies	minor
zod (source)	4.3.6 → 4.4.3			dependencies	minor

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.5.2

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

eslint/eslint (@​eslint/js)

v9.39.4

Compare Source

formatjs/formatjs (@​formatjs/intl)

v4.1.11

Compare Source

v4.1.10

Compare Source

v4.1.9

Compare Source

v4.1.8

Compare Source

ajaxorg/ace-builds (ace-builds)

v1.44.0

Compare Source

Features

• Extension to show whitespaces in selection (#​5844) (9498a7f)
• mode: Add Cedar and CedarSchema language modes for Ace Editor (#​5944) (c5c19dc)
• rust: Include raw borrow operator in keyword list (#​5942) (93581d6)
• update Flix keywords (#​5931) (f45eb67)

Bug Fixes

• mode type to accept both SyntaxMode and string across definitions and implementations (#​5925) (a6b1cb1)
• row calculation for fractional coords in virtual_renderer (#​5914) (a6724b7)

1.43.6 (2026-01-23)

Bug Fixes

• the text completer didn't export its id (#​5847) (b256c10)

1.43.5 (2025-12-02)

1.43.4 (2025-10-17)

Bug Fixes

• Update for compliance with typescript 5.9.2 (#​5855) (6e110b0)

1.43.3 (2025-09-02)

Bug Fixes

• firefox textarea autocomplete corruption (#​5860) (23ac02f)

1.43.2 (2025-07-15)

Features

• Implement text markers (#​5835) (085730f)

1.43.1 (2025-07-02)

Bug Fixes

• a11y: aria-describedby to gutter elements (#​5838) (bf27c15)

1.42.1 (2025-06-20)

Features

• Add scroll diff decorators (#​5807) (b45e94c)

axios/axios (axios)

v1.16.1

Compare Source

v1.16.0

Compare Source

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

• Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#​10795)
• Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#​10822)
• Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#​10825)
• parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#​10729)
• Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#​7378)
• transformRequest input typing change was reverted. The typing change introduced in #​10745 was reverted in #​10810 after follow-up review — net behavior is unchanged from 1.15.2. (#​10745, #​10810)

🚀 New Features

• QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#​10802)
• ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #​6485). (#​10680)
• Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#​6897)

🐛 Bug Fixes

• HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#​10794, #​10800, #​6241, #​10822, #​10825)
• HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#​10708, #​10819, #​7149)
• Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#​10795, #​10772, #​10806, #​7260)
• XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#​10787)
• Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#​10724, #​7276, #​10729)
• Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#​7414, #​6389, #​6460)
• UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#​7378)
• Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#​10833)

🔧 Maintenance & Chores

• Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#​10588, #​7419)
• Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#​10820, #​10791, #​10796)
• Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#​10821, #​10782, #​10759, #​10804)
• Reverted: Reverted the transformRequest input typing change from #​10745 after follow-up review. (#​10745, #​10810)
• Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#​10785, #​10813, #​10814)
• Release: Updated changelog and packages, and prepared the 1.16.0 release. (#​10790, #​10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​singhankit001 (#​10588)
• @​cuiweixie (#​7419)
• @​iruizsalinas (#​10787)
• @​MarcosNocetti (#​10680)
• @​deepview-autofix (#​10729)
• @​atharvasingh7007 (#​10745)
• @​OfekDanny (#​10772)
• @​mnahkies (#​7414)
• @​tboyila (#​10759)
• @​Kingo64 (#​6897)
• @​ramram1048 (#​6389)
• @​FLNacif (#​6460)
• @​zozo123 (#​10806)
• @​pierluigilenoci (#​10802)
• @​afurm (#​10708)
• @​karan-lrn (#​7378)
• @​ebeigarts (#​7149)
• @​Raymondo97 (#​10782)
• @​mixelburg (#​10821)
• @​ashishkr96 (#​10822)
• @​cyphercodes (#​10819)
• @​Jye10032 (#​7260)
• @​VeerShah41 (#​7276)

Full Changelog

v1.15.2

Compare Source

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

• Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#​10779)
• SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#​10777)
• Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#​10776)

🚀 New Features

• allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#​10777)

🐛 Bug Fixes

• Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #​10780). (#​10788)

🔧 Maintenance & Chores

• Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#​10781)

Full Changelog

v1.15.1

Compare Source

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.10.31

Compare Source

v2.10.30

Compare Source

v2.10.29

Compare Source

v2.10.28

Compare Source

v2.10.27

Compare Source

v2.10.25

Compare Source

v2.10.24

Compare Source

sudodoki/copy-to-clipboard (copy-to-clipboard)

v4.0.2

Compare Source

compare changes

🩹 Fixes

• Make sure execCommand works in fullscreen (#​158)

🏡 Chore

• Bump axios from 1.14.0 to 1.15.2 (#​155)
• Bump follow-redirects from 1.15.11 to 1.16.0 (#​157)
• Bump basic-ftp from 5.2.0 to 5.3.0 (#​156)

❤️ Contributors

• Джон, Просто Джон (@​sudodoki)

v4.0.1

Compare Source

compare changes

🏡 Chore

• Fix copy in modal for execCommand fallback (#​151)
• Add changelog (#​153)

✅ Tests

• Add e2e scenario for modal tests (#​152)

❤️ Contributors

• Джон, Просто Джон (@​sudodoki)

catamphetamine/country-flag-icons (country-flag-icons)

v1.6.17

Compare Source

cypress-io/cypress (cypress)

v15.15.0

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-15-0

v15.14.2

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-14-2

v15.14.1

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-14-1

v15.14.0

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-14-0

eslint/eslint (eslint)

v9.39.4

Compare Source

Bug Fixes

• f18f6c8 fix: update dependency minimatch to ^3.1.5 (#​20564) (Milos Djermanovic)
• a3c868f fix: update dependency @​eslint/eslintrc to ^3.3.4 (#​20554) (Milos Djermanovic)
• 234d005 fix: minimatch security vulnerability patch for v9.x (#​20549) (Andrej Beles)
• b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#​20538) (루밀LuMir)

Documentation

• 4675152 docs: add deprecation notice partial (#​20520) (Milos Djermanovic)

Chores

• b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#​20596) (Francesco Trotta)
• 71b2f6b chore: package.json update for @​eslint/js release (Jenkins)
• 1d16c2f ci: pin Node.js 25.6.1 (#​20563) (Milos Djermanovic)

express-rate-limit/express-rate-limit (express-rate-limit)

v8.5.2

Compare Source

You can view the changelog here.

v8.5.1

Compare Source

You can view the changelog here.

v8.5.0

Compare Source

You can view the changelog here.

v8.4.1

Compare Source

You can view the changelog here.

v8.4.0

Compare Source

sindresorhus/globals (globals)

v17.6.0

Compare Source

sindresorhus/gravatar-url (gravatar-url)

v4.0.2

Compare Source

• Fix support for undefined Gravatar URL options d244597
• Fix type for default option (#​11) 23859ff

---

unjs/jiti (jiti)

v2.7.0

Compare Source

compare changes

🚀 Enhancements

• Add explicit resource management (using/await using) support (#​422)
• Support opt-in tsconfigPaths (#​427)
• Support virtual modules option (#​428)
• Add jiti/static export (#​430)

🔥 Performance

• interopDefault: Add caching to reduce proxy overhead by ~2x (#​421)

🩹 Fixes

• require: Passthrough resolve options (#​412)
• ci: Skip --coverage flag for node 18 (fe264b4)
• require: Fallback to transpilation when tryNative fails (#​413)
• Fallback for ENAMETOOLONG when evaluating esm (#​429)

📦 Build

• Upgrade rspack (55194fb)
• Experimental rolldown config (8c0243f)

🏡 Chore

• Fix lint issues (4045c7a)
• Update deps (e88ac44)
• Update deps (498e8d7)
• Add missing prettier dep (650bc48)
• Lint (058d91a)
• Init agents.md (c49c54e)
• Update agents.md (4deba16)
• Update deps (08fc868)
• Update tsconfig (8c7822e)
• Update release script (27fe3f2)

✅ Tests

• Ignore jsx test for bun/cjs (3a744ca)
• Update (9ee314f)

🤖 CI

• Update node test matrix (0abda72)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)
• Espen Hovlandsdal (@​rexxars)
• Rintaro Itokawa (@​re-taro)
• Matteo Collina (@​mcollina)

nodejs/node (node)

v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @​marco-ippolito

Compare Source

Commits

• [4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #​61788
• [4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #​62485
• [e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #​62164
• [0226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #​62382
• [e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #​62256
• [73cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #​62151
• [ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #​61730
• [b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #​61603
• [bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #​62150
• [22ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #​61930
• [f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #​61928
• [1a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #​61925
• [d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #​61879
• [3ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #​61834
• [b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #​61827
• [ffda97afd4] - deps: update googletest to 2461743 (Node.js GitHub Bot) #​62484
• [79aa32cf4f] - deps: update googletest to 73a63ea (Node.js GitHub Bot) #​61927
• [b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #​62629
• [3a27669063] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #​62629
• [d568a1bb53] - deps: upgrade npm to 10.9.8 (npm team) #​62463
• [ec11f3c1d5] - deps: V8: backport 85b3900 (Thibaud Michaud) #​62783
• [08609712ed] - deps: V8: backport 1b27e46 (Thibaud Michaud) #​62783
• [dcc60d5ab2] - deps: V8: backport 9997fc0 (Thibaud Michaud) #​62783
• [1d1f4451fb] - deps: V8: cherry-pick b96e40d (Clemens Backes) #​62783
• [2268567237] - deps: V8: cherry-pick 7cb6188 (Thibaud Michaud) #​62783
• [92804cdbea] - deps: V8: cherry-pick e7ccf0a (Thibaud Michaud) #​62783
• [eae2c27a40] - deps: V8: cherry-pick 8e214ec (Thibaud Michaud) #​62783
• [a1799a49bb] - deps: V8: backport 63b8849 (Thibaud Michaud) #​62783
• [a2df2d8731] - deps: V8: backport 3239427 (Thibaud Michaud) #​62783
• [[e3d65c7dca](https://redirect.github.c

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[cypress]

seerr    Run #3409

Run Properties:   Passed #3409  •  598505f149: chore(deps): update all non-major dependencies

Project	seerr
Branch Review	renovate/all-minor-patch
Run status	Passed #3409
Run duration	02m 12s
Commit	598505f149: chore(deps): update all non-major dependencies
Committer	renovate[bot]
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	0
Skipped	0
Passing	32
View all changes introduced in this branch ↗︎

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.