fix(deps): update npm dependencies

[GiteaBot]

This PR contains the following updates:

Package	Change	Age	Confidence
@citation-js/core (source)	0.7.21 → 0.8.1
@citation-js/plugin-bibtex (source)	0.7.21 → 0.8.1
@citation-js/plugin-csl (source)	0.7.22 → 0.8.1
@​codemirror/state	6.7.0 → 6.7.1
@​codemirror/view	6.43.4 → 6.43.6
@types/node (source)	26.1.0 → 26.1.1
@typescript-eslint/parser (source)	8.62.1 → 8.63.0
@vitest/eslint-plugin	1.6.20 → 1.6.22
eslint-plugin-playwright	2.10.4 → 2.10.5
pnpm (source)	11.9.0 → 11.10.0
typescript-eslint (source)	8.62.1 → 8.63.0
vite (source)	8.1.3 → 8.1.4
vitest (source)	4.1.9 → 4.1.10
vue-chartjs (source)	5.3.3 → 5.3.4
vue-tsc (source)	3.3.6 → 3.3.7

---

Release Notes

citation-js/citation-js (@​citation-js/core)

v0.8.1

Compare Source

Bug Fixes

• deps: update peer dependencies (3298e31)

v0.8.0

Compare Source

• feat(plugin-csl)!: update bundled CSL styles and locales (a149dd8)
• chore(plugin-ris)!: remove deprecated config object (6af5f66)
• chore(plugin-wikidata)!: remove deprecated input parsers (d31a9e5)
• chore(cli)!: remove deprecated "-u, --url" option (98ad239)

chore

• drop Node.js v16, v18 (02792df)

Features

• plugin-csl: default to CSL 1.0.2 (c57c3e8), closes #​276
• plugin-csl: rename template option to style (0c9bc83), closes #​169
• plugin-csl: throw error for unknown style names (68e1d53), closes #​219
• plugin-ris: error for invalid RIS specifications (914d211)

BREAKING CHANGES

• plugin-csl: user-supplied styles requiring CSL 1.0.1 should use the
  option downgradeCsl in the 'bibliography' and 'citation' formats.
  Bundled styles are patched to support CSL 1.0.2.
• CSL styles and locales are updated to their versions
  as per d506f4c and bc0a222 in their respective repositories. To use
  earlier versions of the styles and locales, please download them
  personally and add them to the plugin as documented.
• plugin-csl: specifying unknown template/style values now throws an
  error. Check if styles exist with plugins.config.get('@​csl').styles.has()
• plugin-ris: The ris output format now throws an error if an
  unknown, non-null value is passed to the spec option.
• The @​ris plugin no longer registers a config object.
  For the outputSpec option, use the spec option of the ris format
  instead.
• Remove "@​wikidata/prop" and "@​wikidata/type" input
  parsers.
• The deprecated "-u, --url" option is removed, please
  use "-t, --text" instead.
• minimum Node version now 20

0.7.22 (2025-12-31)

Features

• plugin-wikidata: map P13046 to 'genre' (ab4760e)

0.7.21 (2025-10-20)

Bug Fixes

• core: handle empty type values when cleaning CSL (cc70c09), closes #​247
• plugin-ris: handle empty lines, convert non-standard type (#​248) (2b8a18f)

0.7.20 (2025-07-05)

Bug Fixes

• plugin-wikidata: account for missing data on countries (c95d47d)

0.7.19 (2025-05-12)

Bug Fixes

• plugin-wikidata: omit keywords without labels (a121afd)
• plugin-wikidata: use 'mul' labels as fallback (7699ec5)

0.7.18 (2025-01-28)

Bug Fixes

• plugin-doi: improve handling of Crossref data (91c1741), closes #​243
• plugin-wikidata: fix parser for multiple API responses (1233bf7)
• plugin-wikidata: update wikibase-sdk (2f84aa6), closes #​242

0.7.17 (2024-12-31)

Bug Fixes

• plugin-bibtex: use 'organization' for conferences (1202ee2), closes #​236

0.7.16 (2024-09-23)

Bug Fixes

• plugin-bibtex: correctly escape syntax in output (ef9aaff), closes #​232
• plugin-ris: account for CSL with numeric ids (43267df), closes #​238

0.7.15 (2024-08-11)

Bug Fixes

• plugin-wikidata: replace deprecated wikidata-sdk (32d1527)

0.7.14 (2024-06-12)

Bug Fixes

• core: fix regression in 4ae7fbc (c2dcb6a), closes #​229

0.7.13 (2024-06-06)

Bug Fixes

• core: handle errors in user agent determination (4ae7fbc), closes #​227
• core: only use node-fetch until node 16 is dropped (4b29a5d)

0.7.12 (2024-05-07)

Features

• plugin-bibtex: add option to force use of label (d5631e2)

0.7.11 (2024-04-17)

Bug Fixes

• plugin-ris: fall back to default type (a3d0391), closes #​225

Features

• core: normalize non-lowercase type values (1ab0d2f), closes #​225
• plugin-csl: add option to hyperlink URLs and DOIs (4c15804)

0.7.10 (2024-03-27)

Bug Fixes

• plugin-ris: handle output of literal dates (6f6b85a)

Features

• plugin-wikidata: update type mappings (e9493d1)

0.7.9 (2024-03-05)

Bug Fixes

• plugin-bibtex: allow list delimiters in text in environments (da0c64b)

Features

• core: normalize ORCIDs on authors (e91b580)
• plugin-bibtex: implement data annotations (68a8ec6)
• plugin-bibtex: map ORCIDs to data annotations (5c3951a)

0.7.8 (2024-01-22)

Bug Fixes

• plugin-bibtex: do not case-protect commands in output (50333d1)
• plugin-bibtex: fix math-mode unicode escapes (f05e45c), closes #​192
• plugin-bibtex: remove lone diacritics (49e9100)
• plugin-wikidata: handle no/unkown value claims (673e35c), closes #​217

Features

• plugin-bibtex: add config to keep all unicode (cd018f9), closes #​177
• plugin-doi: parse DOIs with square, angle brackets (5434d5a), closes #​182

0.7.7 (2024-01-20)

Features

• plugin-wikidata: meaningful errors for 404s (280274a), closes #​221

0.7.6 (2024-01-17)

Bug Fixes

• plugin-doi: map non-standard dissertation type (5f75243), closes #​220

0.7.5 (2023-12-31)

Features

• plugin-bibtex: add mappings for plainnat fields (208bd96), closes #​204

0.7.4 (2023-11-01)

Bug Fixes

• plugin-ris: fix output of certain date fields (796dce3)
• plugin-ris: parse year numbers on certain items (d300c33)

0.7.3 (2023-11-01)

Bug Fixes

• plugin-ris: always set PY in RIS output (2979ae2), closes #​213

0.7.2 (2023-10-14)

Bug Fixes

• plugin-bibtex: do not map "howpublished" url to publisher (d4e3296)

0.7.1 (2023-09-23)

Bug Fixes

• update peer dependency statements (95ea6bb)

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.63.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitest-dev/eslint-plugin-vitest (@​vitest/eslint-plugin)

v1.6.22

Compare Source

   🐞 Bug Fixes

• Handle expect.any separately from Chai any flag  -  by @​nami8824 in #​925 (34157)

    View changes on GitHub

v1.6.21

Compare Source

   🐞 Bug Fixes

• Support Chai-style expect chains  -  by @​nami8824 in #​920 (52692)
• prefer-called-with: Map calledOnce matcher to exact once with  -  by @​nami8824 in #​918 (8f671)

    View changes on GitHub

mskelton/eslint-plugin-playwright (eslint-plugin-playwright)

v2.10.5

Compare Source

Bug Fixes

• handle optional chaining in missing-playwright-await (#​472) (c02becc)

pnpm/pnpm (pnpm)

v11.10.0

Compare Source

Minor Changes

• e2e3c81: Added the issues command as an alias of bugs, so pnpm issues opens the package's bug tracker URL in the browser.

• 8491f8e: Added the prefix command which prints the current package prefix directory (or global prefix directory if -g / --global is used).

• 3425e80: Added an _auth setting for configuring registry authentication as a single structured (URL-keyed) value. It can be set in the global pnpm config (config.yaml) or, for CI, via the pnpm_config__auth environment variable. The env form sidesteps the GitHub Actions / bash / zsh limitation that broke the existing pnpm_config_//host/:_authToken=… form (env var names containing /, :, or . are silently dropped). Closes #​12314.

  The value is keyed by registry URL so each secret is explicitly bound to the host that may receive it. Registry URL keys must use http or https and must not include credentials, query strings, or fragments:

  export pnpm_config__auth='{"https://registry.npmjs.org":{"@​":{"authToken":"npm-token"},"@​org":{"authToken":"org-token"}}}'

  The equivalent in the global config.yaml:

  _auth:
    https://registry.npmjs.org:
      "@​":
        authToken: npm-token
      "@​org":
        authToken: org-token

  Within each registry URL, @ means registry-wide/default credentials and package scopes like @org bind credentials to that scope on the same host. The only supported credential field is authToken (maps to _authToken / bearer auth); the deprecated basicAuth / username + password forms are intentionally not accepted here.

  Each entry also infers a trusted registry route: @ routes the default registry (and pnpm add <pkg> resolves there), and @org routes that scope. Because the credential and destination host arrive in one trusted value, repo-controlled pnpm-workspace.yaml or project .npmrc cannot redirect the token to a different host. _auth is honored only from the env var and the global config — it is ignored in a project pnpm-workspace.yaml / .npmrc, so repo-controlled config can never supply registry auth. Precedence: CLI flags (--registry, --@​scope:registry) > pnpm_config__auth > global config.yaml _auth > pnpm-workspace.yaml.

  Both pnpm_config__auth (lowercase, documented form) and PNPM_CONFIG__AUTH (all-caps, the shell convention some CI runners apply) are honored. If both are set, lowercase wins unless it is empty, in which case uppercase is used. The env var wins over the global config.yaml _auth on a conflicting key. tokenHelper is not supported in _auth. Parsing is strict: a malformed value (bad JSON, wrong shape, invalid registry URL or scope, an unsupported credential field) fails fast with an error rather than being silently dropped.

  Pacquet parity note: the pacquet (Rust) port supports the same single credential field as the TS CLI: authToken.

• a33eeec: pnpm self-update and packageManager version-switching can now install and link pnpm v12 (the Rust port), published with equal content under both the pnpm and @pnpm/exe names on the next-12 dist-tag. Its native binaries ship as @pnpm/exe.<platform>-<arch> packages, which pnpm's built-in installer links directly — no Node.js launcher, so the command pays no Node startup cost. v12 is initialized exactly like @pnpm/exe, including per-platform global-virtual-store hashing. From v12 onward the install converges on the unscoped pnpm package (the Rust exe) — even when updating from the SEA @pnpm/exe build.

• 1dd12bd: When resolving through a pnpr install-accelerator server, pnpm no longer forwards its own upstream registry credentials in the resolve request. Only the Authorization header identifying the caller to pnpr is sent. The pnpr server now selects upstream credentials from its own route policy (operator-configured upstream credential aliases), so private dependencies resolve through a pnpr-managed alias the caller is authorized to use, rather than by sending the client's registry tokens to the server.

• 1e81761: Expose web authentication authUrl and doneUrl in JSON error output when OTP is required in a non-interactive terminal #​12724.

Patch Changes

• 2f389d6: Added the Node.js release team's new signing key (Stewart X Addison, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD) to the embedded Node.js release keys, so runtimes whose SHASUMS256.txt is signed by the new releaser verify successfully.

• acbdb94: Fixed shell tab completion not suggesting workspaces after the -F alias for --filter option.

• dcabb78: Fixed pnpm up -r <pkg> bumping unrelated packages that have open semver ranges. Previously, any update mutation nullified the lockfile-derived preferredVersions globally, so packages with ^x.y.z ranges could re-resolve to newer compatible versions even though the user only asked to update a specific package. The install layer now always seeds preferredVersions from the lockfile, and caller-supplied preferred versions (such as the vulnerability penalties of pnpm audit --fix) layer on top of the seed instead of replacing it. The targeted package still bumps: the per-resolve updateRequested flag makes the resolver ignore the target's own lockfile pins.

  Closes #​10662.

• d539172: Fixed pnpm pack and pnpm publish failing when prepack generates files that are included in the package and postpack cleans them up.

• be6505a: Hardened global package management:

  • On Windows, removing or updating a global package now also cleans up the node.exe flavor of a bin, so a stale node.exe no longer survives on PATH after uninstall, and a new global install no longer silently overwrites an existing node.exe.
  • pnpm add -g pnpm@<version> (and @pnpm/exe@<version>) is now rejected like the bare pnpm form, pointing to pnpm self-update.
  • Dependency aliases read from a global package's manifest are validated before being joined onto node_modules paths, preventing a tampered manifest from escaping the install directory.
  • Each global install group is created in its own freshly-made directory (no longer reusing a colliding or pre-existing path).
  • Removing or updating a global package no longer unlinks a bin that belongs to a different globally installed package.

• 25c7388: pnpm now rejects jsr: specifiers whose package name is not a valid npm package name — an empty scope or name (e.g. jsr:@​scope/), path separators inside the name, or any other shape validate-npm-package-name rejects — with ERR_PNPM_INVALID_JSR_PACKAGE_NAME instead of silently converting them into a malformed @jsr/... npm package name.

• 25c7388: pnpm now rejects named-registry specifiers (e.g. gh:) whose package name is not a valid npm package name — an empty scope (e.g. gh:@​/bar), path separators inside the name (e.g. gh:@​scope/../name), or any other shape validate-npm-package-name rejects — with ERR_PNPM_INVALID_NAMED_REGISTRY_PACKAGE_NAME instead of passing the name through to registry URLs and metadata cache file paths.

• 96da7c5: node-gyp's gyp_main.py and gyp entrypoints are now packed with the executable bit in the pnpm and @pnpm/exe tarballs. Without it, building native addons from source could fail with a permission error.

• 99982b9: Sped up resolution and reduced memory use against registries that ignore npm's abbreviated metadata format and always return the full package document (for example, Azure DevOps Artifacts). pnpm now strips such documents down to the abbreviated field set before caching them. Resolution output is unchanged, and registries that honor the abbreviated format (such as the npm registry) pay no extra cost.

• 11a7fdd: Sped up offline and --prefer-offline resolution on large workspaces (e.g. pnpm dedupe --offline, pnpm install --offline). Package metadata loaded from the local cache is now kept in memory, so each package's metadata is parsed once per command instead of once per dependent that references it.

• 2c7369d: pnpm pack-app now rejects --entry / pnpm.app.entry and --output-dir / pnpm.app.outputDir values that are absolute paths or escape the project directory via .. (or a symlink that resolves outside it), and refuses to write the produced executable when its target path already exists as a symlink (or other non-regular file). This prevents a repository-controlled package.json from embedding host files (such as an SSH key) into the produced executable, writing build artifacts outside the project, or overwriting an arbitrary file through a committed symlink. The new error codes are ERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT, ERR_PNPM_PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT, and ERR_PNPM_PACK_APP_OUTPUT_FILE_NOT_REGULAR.

  When ad-hoc signing macOS targets, pnpm pack-app now runs the system codesign by absolute path and resolves ldid to a location outside the project, so a repository-controlled node_modules/.bin on PATH cannot hijack the signer.

• ce5d5a5: Relative paths in patchedDependencies are now resolved against the lockfile directory when computing patch file hashes, so running pnpm install from a subdirectory no longer fails with ENOENT looking for the patch file in the wrong location #​12762.

• ebb4096: pnpm peers no longer reports a conflict for a missing peer dependency that is ignored via pnpm.peerDependencyRules.ignoreMissing.

• dcabb78: Fixed a prototype-pollution hazard when seeding preferred versions: a dependency named __proto__ in a manifest or in pnpm-lock.yaml could write through Object.prototype (or crash the install) while the preferred-versions map was being built. The maps are now null-prototype objects, so crafted package names land as plain keys.

• f38e696: Hardened pnpm deploy --force so it refuses unsafe deploy targets such as workspace roots, parent directories, out-of-workspace paths, and symlinked target parents.

• 806c3ec: pnpm no longer warns about ignored project-level auth settings when PNPM_CONFIG_NPMRC_AUTH_FILE points at the project .npmrc — setting it to that file is an explicit opt-in to trusting it, so auth env variables in it are expanded pnpm/pnpm#12480.

• 991405e: Restore differential rendering (ansi-diff) to fix duplicated output lines introduced by #​12351.

• c121235: Fixed the topological order of --filtered commands (pnpm run, pnpm exec, pnpm publish, pnpm pack, pnpm rebuild) when the selected projects depend on each other only transitively through projects that were not selected. Previously such selected projects could run concurrently or in the wrong order; now a project always runs after the selected projects it transitively depends on, while projects without a real dependency relationship still run concurrently. This now also holds for prod-only filters (--filter-prod), which resolve order through the production dependency graph so transitive production dependencies are respected without pulling back the dev dependencies the filter drops, and for selections that mix --filter with --filter-prod #​8335.

• d539172: pnpm pack and pnpm publish no longer follow a symlinked workspace LICENSE file when injecting it into a package that has no license of its own. Following the symlink could pack bytes from outside the workspace into the published tarball.

• dcabb78: Fixed pnpm up <pkg> producing a different result than a fresh install of the same manifests would. The resolver now distinguishes updateRequested (true only for packages that match the user's update target) from the broader update flag, and for the targeted package ignores only its own lockfile-derived preferred-version pins — so the target re-resolves exactly as if its lockfile entries were deleted and pnpm install ran. Preferred versions a fresh install applies (manifest pins, versions propagated down the dependency chain, and the vulnerability-avoidance penalties of pnpm audit --fix) stay in effect, so an update never installs duplicate versions that a reinstall from scratch would not reproduce. When a preferred version holds the update target below the newest version its range admits, pnpm now prints a warning explaining that reaching the newer version everywhere requires an override.

• dcabb78: pnpm update <dep>@&#8203;<version> now prints a warning when <dep> is only present as a transitive dependency: the requested version cannot be applied there (updates resolve the target the way a fresh install would), and the warning recommends adding the version to pnpm.overrides instead, which is the mechanism that does pin transitive dependencies. Closes #​12744.

• a6c4d5f: When a dependency cannot be found in the registry (404) or the registry has no matching version, and a workspace project with the same name exists only at non-matching versions, the error now reports the available workspace versions (ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE) instead of the raw registry failure pnpm/pnpm#1379. Other registry failures (authorization, network, server errors) still propagate unchanged. The pacquet (Rust) resolver applies the same behavior.

typescript-eslint/typescript-eslint (typescript-eslint)

v8.63.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitejs/vite (vite)

v8.1.4

Compare Source

Features

• legacy: prefer oxc as minifier (fix #​21973) (#​22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#​22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#​22839) (f1f90ed)
• deps: update all non-major dependencies (#​22865) (d4295a9)
• deps: update rolldown-related dependencies (#​22866) (7cf07e4)
• html: avoid backtracking in import-only check (#​22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#​22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#​22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#​22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#​22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#​22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#​22876) (ea22fb3)

Tests

• avoid warnings (#​22851) (af21ab6)

Build System

• remove the custom onLog function (#​22878) (2c4a217)
• replace deprecated onwarn with onLog (#​22741) (c581b55)

vitest-dev/vitest (vitest)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

apertureless/vue-chartjs (vue-chartjs)

v5.3.4

Compare Source

vuejs/language-tools (vue-tsc)

v3.3.7

Compare Source

language-core

• fix: wrap single expression event handlers to avoid ASI after return (#​6115) - Thanks to @​KazariEX!

typescript-plugin

• fix: filter const globals from template completions

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[silverwind]

The vite warnings are because of citatation-js pulling in node-fetch v3 which does not bundle cleanly because of node: imports. citation-js/citation-js#277 will fix this, meanwhile I will pin the dependency here to last good version.

[GiteaBot]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.