chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@vitest/coverage-v8 (source)	^3.0.2 -> ^3.0.8
changelogen	^0.5.7 -> ^0.6.1
eslint (source)	^9.18.0 -> ^9.21.0
h3	^1.13.1 -> ^1.15.1
pathe	^2.0.2 -> ^2.0.3
pnpm (source)	9.15.4 -> 9.15.7
prettier (source)	^3.4.2 -> ^3.5.3
typescript (source)	^5.7.3 -> ^5.8.2
unbuild	^3.3.1 -> ^3.5.0
unstorage	^1.14.4 -> ^1.15.0
vitest (source)	^3.0.2 -> ^3.0.8

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v3.0.8

Compare Source

   🐞 Bug Fixes

• Fix fetch cache multiple writes  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7546 (1a8b4)
• Use browser.isolate instead of config.isolate  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7560 (4b5ed)
• Remove vestigial spy stub, import directly from @vitest/spy  -  by @​mrginglymus in https://github.com/vitest-dev/vitest/issues/7575 (7f7ff)
• Correctly split the argv string  -  by @​btea in https://github.com/vitest-dev/vitest/issues/7533 (4325a)
• browser:
  • Remove @​testing-library/dom from dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7555 (5387a)
  • Improve source map handling for bundled files  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7534 (e2c57)
  • Print related test file and potential test in unhandled errors  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7564 (fee90)
• runner:
  • Fix beforeEach/All cleanup callback timeout  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7500 (0c292)
  • Fix and simplify Task.suite initialization  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7414 (ca9ff)
• snapshot:
  • Allow inline snapshot calls on same location with same snapshot  -  by @​jycouet and @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7464 (d5cb8)
• vite-node:
  • Fix buildStart on Vite 6  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7480 (c0f47)

    View changes on GitHub

v3.0.7

Compare Source

   🐞 Bug Fixes

• browser: Support webdriverio 9  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7553 (b1949)
• deps: Update all non-major dependencies  -  in https://github.com/vitest-dev/vitest/issues/7543 (365ff)
• expect: Correct generic MatchersObject this type in expect.extend  -  by @​Workingstiff-s in https://github.com/vitest-dev/vitest/issues/7526 (d5765)
• mocker: Include more modules to prefix-only module list  -  by @​btea in https://github.com/vitest-dev/vitest/issues/7524 (a12ec)
• spy: Clear/reset/restore mocks in stack order  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7499 (f7100)

   🏎 Performance

• browser: Do wdio context switching only once per file  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7549 (aaa58)

    View changes on GitHub

v3.0.6

Compare Source

   🐞 Bug Fixes

• Fix getMockedSystemTime for useFakeTimer  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7405 (03912)
• Compat for jest-image-snapshot  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7390 (9542b)
• Ensure project names are readable in dark terminals  -  by @​rgrove in https://github.com/vitest-dev/vitest/issues/7371 (bb94c)
• Exclude queueMicrotask from default fake timers to not break node fetch  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7505 (167a9)
• browser:
  • Fix mocking modules out of root  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7415 (d3acb)
  • Fix toHaveClass typing  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7383 (7ef23)
  • Relax locator selectors methods  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7422 (1b8c5)
  • Resolve thread count from maxWorkers  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7483 (adbb2)
  • Cleanup timeout on resolve and give more information in the error  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7487 (5a45a)
• coverage:
  • vite-node to pass correct execution wrapper offset  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7417 (1f2e5)
  • Preserve moduleExecutionInfo in non-isolated runs  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7486 (f31a0)
• deps:
  • Update all non-major dependencies  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7363 (e348b)
  • Update all non-major dependencies  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7507 (6cc40)
• init:
  • Invalid browser config  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7475 (8fe64)
• reporters:
  • Render tasks in tree when in TTY  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7503 (027ce)
• vite-node:
  • Remove fake first line mapping on Vite 6  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7124 (b9973)
• watch:
  • Properly remove cache after removing existing test files  -  by @​soc221b in https://github.com/vitest-dev/vitest/issues/7399 (01a59)
• workspace:
  • Forward inspect related cli options  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7373 (ed15b)

    View changes on GitHub

v3.0.5

Compare Source

This release includes security patches for:

• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

🚀 Features

• ui: Insert message "no tests found" in ui - by @​DevJoaoLopes in https://github.com/vitest-dev/vitest/issues/7366 (92da4)

🐞 Bug Fixes

• Validate websocket request - by @​hi-ogawa and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7317 (191ef)
• Don't toggle cli cursor on non-TTY - by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7336 (3c805)
• vite-node: Differentiate file url with hash and query - by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7365 (926ca)

View changes on GitHub

v3.0.4

Compare Source

This release includes security patches for:

• Browser mode serves arbitrary files | CVE-2025-24963

   🐞 Bug Fixes

• Filter projects eagerly during config resolution  -  by @​sheremet-va and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7313 (dff44)
• Apply development|production condition on Vites 6 by @​hi-ogawa and @​sheremet-va (#​7301) (ef146)
• browser: Restrict served files from /__screenshot-error  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7340 (ed9ae)
• deps: Update all non-major dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7297 (38ea8)
• runner: Timeout long sync hook  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7289 (c60ee)
• typechecking: Support typechecking parsing with Vite 6  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7335 (bff70)
• types: Fix public types  -  by @​mrginglymus and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7328 (ce6af)

    View changes on GitHub

v3.0.3

Compare Source

   🐞 Bug Fixes

• browser:
  • Don't throw a validation error if v8 coverage is used with filtered instances  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7306 (fa463)
  • Don't fail when running --browser.headless if the browser projest is part of the workspace  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/7311 (e43a8)

   🏎 Performance

• reporters: Update summary only when needed  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7291 (7f36b)

    View changes on GitHub

unjs/changelogen (changelogen)

v0.6.1

Compare Source

compare changes

🩹 Fixes

• Pass cwd in more places before running commands (#​266)

🏡 Chore

• Update deps (f728b52)
• Update tsconfig (e5dced7)

✅ Tests

• Update snapshot (ec2618f)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Daniel Roe (@​danielroe)

v0.6.0

Compare Source

compare changes

🚀 Enhancements

• Update jiti to v2 (6e85d32)
• Add check for breaking changes in commit body (#​228)
• Hide author email address via flag (#​247)
• Add noAuthors option (#​183)

🩹 Fixes

• Use https proto for author's github link (#​225)
• Use https proto for author's github link in tests (#​226)
• Release version regex supporting pre versions (#​259)
• Use correct compare changes URL for Bitbucket (#​257)
• Use tag template for version title and compare change link (#​255)
• Render usernames in github changelog (#​265)

💅 Refactors

• Use consola for colors (49e0401)
• Use confbox for yaml parsing (19e940c)

📦 Build

• ⚠️ Esm-only dist (4a22de6)

🏡 Chore

• Lint (031cfd6)
• Update deps (b184f23)
• Update ci (8662c4e)
• Update esm-only deps (0d5e31d)

✅ Tests

• Add tests for parsing co-authors from commit body (#​229)

⚠️ Breaking Changes

• ⚠️ Esm-only dist (4a22de6)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Klein Petr (@​kleinpetr)
• Jasper Zonneveld (@​JaZo)
• Thorsten Seyschab (@​toddeTV)
• Philipp Kief (@​PKief)
• Jan-Henrik Damaschke jdamaschke@outlook.de
• Damian Głowala (@​DamianGlowala)

eslint/eslint (eslint)

v9.21.0

Compare Source

Features

• 418717f feat: introduce new deprecated types for rules (#​19238) (fnx)
• 5c5b802 feat: Add --ext CLI option (#​19405) (Milos Djermanovic)

Bug Fixes

• db5340d fix: update missing plugin message template (#​19445) (Milos Djermanovic)
• d8ffdd4 fix: do not exit process on rule crash (#​19436) (Francesco Trotta)

Documentation

• c5561ea docs: Update README (GitHub Actions Bot)
• 80b0485 docs: replace var with let and const in rule example (#​19434) (Tanuj Kanti)
• f67d5e8 docs: Update README (GitHub Actions Bot)
• 75afc61 docs: Update README (GitHub Actions Bot)
• 0636cab docs: Update Eleventy from v2 to v3 (#​19415) (Amaresh S M)
• dd7d930 docs: Update README (GitHub Actions Bot)

Chores

• a8c9a9f chore: update @eslint/eslintrc and @eslint/js (#​19453) (Francesco Trotta)
• 265e0cf chore: package.json update for @​eslint/js release (Jenkins)
• 3401b85 test: add test for Rule.ReportDescriptor type (#​19449) (Francesco Trotta)
• e497aa7 chore: update rewrite dependencies (#​19448) (Francesco Trotta)
• dab5478 chore: better error message for missing plugin in config (#​19402) (Tanuj Kanti)
• ebfe2eb chore: set js language for bug report issue config block (#​19439) (Josh Goldberg ✨)
• 5fd211d test: processors can return subpaths (#​19425) (Milos Djermanovic)

v9.20.1

Compare Source

Bug Fixes

• 274f054 fix: fix RuleContext type (#​19417) (Francesco Trotta)

Documentation

• fe3ccb2 docs: allow typing in search box while dropdown is open (#​19424) (Amaresh S M)
• 93c78a5 docs: Add instructions for pnpm compat (#​19422) (Nicholas C. Zakas)
• b476a93 docs: Fix Keyboard Navigation for Search Results (#​19416) (Amaresh S M)
• ccb60c0 docs: Update README (GitHub Actions Bot)

v9.20.0

Compare Source

Features

• e89a54a feat: change behavior of inactive flags (#​19386) (Milos Djermanovic)

Bug Fixes

• 91d4d9f fix: Bring types in sync with @​eslint/core (#​19157) (Nicholas C. Zakas)
• fa25c7a fix: Emit warning when empty config file is used (#​19399) (Nicholas C. Zakas)
• 31a9fd0 fix: Clearer error message for wrong plugin format (#​19380) (Nicholas C. Zakas)
• 61d99e3 fix: Better error message for unserializable parser (#​19384) (Nicholas C. Zakas)
• db1b9a6 fix: Ensure module scope is checked for references in consistent-this (#​19383) (Nicholas C. Zakas)
• 8bcd820 fix: arrow-body-style crash with single-token body (#​19379) (Milos Djermanovic)

Documentation

• b7012c8 docs: rewrite examples with var using let and const (#​19407) (Mueez Javaid Hashmi)
• 6406376 docs: Update README (GitHub Actions Bot)
• 350f2b9 docs: rewrite some examples with var using let and const (#​19404) (Mueez Javaid Hashmi)
• 93c325a docs: rewrite examples with var using let and const (#​19398) (Mueez Javaid Hashmi)
• 56ff404 docs: replace var with let or const in rules docs (#​19396) (Daniel Harbrueger)
• 4053226 docs: change sourceType in no-eval examples (#​19393) (Milos Djermanovic)
• 1324af0 docs: replace var with let and const in rules docs (#​19392) (Daniel Harbrueger)
• 8b87e00 docs: replace var with const and let in rules (#​19389) (Tanuj Kanti)
• 758c66b docs: Explain what frozen rules mean (#​19382) (Nicholas C. Zakas)
• 0ef8bb8 docs: additional checks for rule examples (#​19358) (Milos Djermanovic)
• 58ab2f6 docs: fix order of installation steps in getting started (#​19326) (Tanuj Kanti)

Chores

• 979097a chore: upgrade @​eslint/js@​9.20.0 (#​19412) (Francesco Trotta)
• 031734e chore: package.json update for @​eslint/js release (Jenkins)
• d4c47c3 test: avoid empty config warning in test output (#​19408) (Milos Djermanovic)
• 67dd82a chore: update dependency @​eslint/json to ^0.10.0 (#​19387) (renovate[bot])
• 15ac0e1 chore: add permissions: read-all to stale.yml workflow (#​19374) (Josh Goldberg ✨)

v9.19.0

Compare Source

Features

• 1637b8e feat: add --report-unused-inline-configs (#​19201) (Josh Goldberg ✨)

Bug Fixes

• aae6717 fix: sync rule type header comments automatically (#​19276) (Francesco Trotta)

Documentation

• cfea9ab docs: Clarify overrideConfig option (#​19370) (Nicholas C. Zakas)
• 2b84f66 docs: Update README (#​19362) (Nicholas C. Zakas)
• 044f93c docs: clarify frozen rule description (#​19351) (Pavel)
• 797ee7c docs: fix Bluesky links (#​19368) (Milos Djermanovic)
• 81a9c0e docs: Update README (GitHub Actions Bot)
• 093fb3d docs: replace var with let and const in rule examples (#​19365) (Tanuj Kanti)
• 417de32 docs: replace var with const in rule examples (#​19352) (jj)
• 17f2aae docs: update getting-started config to match default generated config (#​19308) (0xDev)
• 8a0a5a8 docs: better global ignores instruction (#​19297) (Jacopo Marrone)
• 6671a2c docs: Update README (GitHub Actions Bot)
• e39d3f2 docs: fix divider for rule category (#​19264) (Tanuj Kanti)
• e0cf53f docs: fix search result box position for small screens (#​19328) (Tanuj Kanti)
• f92a680 docs: replace var with let or const in rule examples (#​19331) (Ravi Teja Kolla)
• b04b84b docs: revert accidental changes in TS config files docs (#​19336) (Francesco Trotta)

Chores

• 9b9cb05 chore: upgrade @​eslint/js@​9.19.0 (#​19371) (Milos Djermanovic)
• 58560e7 chore: package.json update for @​eslint/js release (Jenkins)
• 2089707 test: fix failing test in Node.js v22.13.0 (#​19345) (Francesco Trotta)

unjs/h3 (h3)

v1.15.1

Compare Source

compare changes

🩹 Fixes

• setCookie: Properly merge and dedup set-cookie header (#​981)

v1.15.0

Compare Source

compare changes

• Migrate from unenv v1 to node-mock-http (#​970)

v1.14.0

Compare Source

compare changes

🚀 Enhancements

• session: Allow using with crossws hooks (#​960)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kanonji (@​kanonji)

unjs/pathe (pathe)

v2.0.3

Compare Source

compare changes

📦 Build

• Fix matchesGlob import (c72a8a7)

🏡 Chore

• Update deps (e628ea0)
• Fix ci (2994efc)

❤️ Contributors

• Pooya Parsa (@​pi0)

pnpm/pnpm (pnpm)

v9.15.7: pnpm 9.15.7

Compare Source

Patch Changes

• pnpm self-update should not leave a directory with a broken pnpm installation if the installation fails.
• Allow scope registry CLI option without --config. prefix such as --@​scope:registry=https://scope.example.com/npm #​9089.
• pnpm self-update should not read the pnpm settings from the package.json file in the current working directory.
• pnpm update -i should list only packages that have newer versions #​9206.
• Fix a bug causing entries in the catalogs section of the pnpm-lock.yaml file to be removed when dedupe-peer-dependents=false on a filtered install. #​9112

Platinum Sponsors

Gold Sponsors

v9.15.6: pnpm 9.15.6

Compare Source

Patch Changes

• Fix instruction for updating pnpm with corepack #​9101.
• Print pnpm's version after the execution time at the end of the console output.
• The pnpm version specified by packageManager cannot start with v.
• Fix a bug causing catalog snapshots to be removed from the pnpm-lock.yaml file when using --fix-lockfile and --filter. #​8639
• Fix a bug causing catalog protocol dependencies to not re-resolve on a filtered install #​8638.

v9.15.5: pnpm 9.15.5

Compare Source

Patch Changes

• Verify that the package name is valid when executing the publish command.
• When running pnpm install, the preprepare and postprepare scripts of the project should be executed #​8989.
• Quote args for scripts with shell-quote to support new lines (on POSIX only) #​8980.
• Proxy settings should be respected, when resolving Git-hosted dependencies #​6530.
• Replace strip-ansi with the built-in util.stripVTControlCharacters #​9009.

Platinum Sponsors

Gold Sponsors

	config help if that's undesired. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.