Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@types/node (source)	25.9.3 → 25.9.4					devDependencies	patch
knip (source)	6.16.1 → 6.17.1					devDependencies	minor
node (source)	24.16.0 → 24.17.0						minor
oxfmt (source)	^0.54.0 → ^0.55.0					devDependencies	minor
oxlint (source)	1.69.0 → 1.70.0					devDependencies	minor
rolldown (source)	1.1.1 → 1.1.2					devDependencies	patch
yarn (source)	4.16.0 → 4.17.0					packageManager	minor

---

Release Notes

webpro-nl/knip (knip)

v6.17.1: Release 6.17.1

Compare Source

• Remove ignoreBinaries w/ tar (b13d0ca)
• Wrap up docs/refs (29f3e46)
• Update dependencies (7b2f345)
• Fix up vscode-languageclient imports (820c233)

v6.17.0: Release 6.17.0

Compare Source

• chore(mcp): add package metadata links (#​1783) (e3d93b9) - thanks @​sh962214-hub!
• fix(capacitor): detect iOS platform with Swift Package Manager (#​1787) (e6cc533) - thanks @​jthrilly!
• Support ignoreIssues per workspace (resolve #​1782) (15a329a)
• Add commitlint.config.mts (resolve #​1784) (fa8eb6d)
• Treat scoped and tilde SCSS imports as packages (resolve #​1786) (98aa962)
• Add followCursor setting for Imports/Exports views (resolve #​1788) (67a0be8)
• Flag undeclared sibling imports in published workspaces (resolve #​1792) (aeabff7)
• Fix type-check errors in vscode-knip (12f266e)
• Note Markdown formatting with pnpm remark (bdffeec)
• Bump some doc-related dependencies (3334193)
• Update vscode-knip tool descriptions (be34178)
• Overhaul docs (55e3f3b)
• Improve mcp guidance (67483f0)
• Fix repeated --fix-type arg (9bb0512)
• Resolve module paths from selected tsconfig (resolve #​1794) (1c2f398)
• Update sanity snapshot (4ebce9c)
• Add tar to globally ignored binaries (resolve #​1796) (8c028e5)

nodejs/node (node)

v24.17.0: 2026-06-18, Version 24.17.0 'Krypton' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
• (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
• (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
• (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
• (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
• (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
• (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
• (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
• (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
• (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
• (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

• [9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
• [cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
• [a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #​62891
• [66e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #​62891
• [dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #​63820
• [684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #​63820
• [3a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #​62656
• [cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #​63703
• [138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
• [be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
• [cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
• [9224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
• [cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
• [a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
• [e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
• [a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
• [31beb4f707] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
• [8e75c73f91] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

oxc-project/oxc (oxfmt)

v0.55.0

Compare Source

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#​22935) (AliceLanniste)

oxc-project/oxc (oxlint)

v1.70.0

Compare Source

🚀 Features

• 2e8bda4 linter/vue: Implement no-dupe-keys rule (#​23350) (bab)
• 1490a0a linter/react: Implement react-compiler rule (#​23202) (Boshen)
• dd560ae linter/unicorn: Implement no-array-fill-with-reference-type rule (#​23397) (Mikhail Baev)
• af36c2f linter: Add schema for react/jsx-curly-brace-presence (#​23400) (WaterWhisperer)
• 47d34a3 linter: Add schema for react/jsx-handler-names (#​23393) (WaterWhisperer)
• f4250d0 linter: Add schema for unicorn/import-style (#​23386) (WaterWhisperer)
• 30c74ce linter: Add schema for jsx_a11y/no-noninteractive-element-to-interactive-role (#​23384) (Sysix)
• cfbe8dc linter: Add schema for jsx_a11y/no-interactive-element-to-noninteractive-role (#​23382) (WaterWhisperer)
• d15b7ff linter: Add schema for typescript/no-restricted-types (#​23381) (WaterWhisperer)
• 028a811 linter: Add schema for jsx-a11y/media-has-caption (#​23377) (Sysix)
• b3b1038 linter: Add schema for jsx-a11y/label-has-associated-control (#​23376) (Sysix)
• 7ada6b2 linter: Add schema for jsx_a11y/no-distracting-elements (#​23379) (WaterWhisperer)
• ee3dd49 linter: Add schema for jsx-a11y/img-redundant-alt (#​23374) (Sysix)
• df5f8dd linter: Add short descriptions to most lint rules. (#​23365) (Connor Shea)
• e3fd735 linter: Add schema for jsx_a11y/alt-text (#​23369) (Sysix)
• 0f2fff4 linter: Add schema for react/exhaustive-deps (#​23372) (Mikhail Baev)
• e3e4e10 linter: Add schema for react_perf/jsx-no-new-object-as-prop (#​23368) (Mikhail Baev)
• 9366d44 linter: Add schema for unicorn/prefer-at (#​23366) (WaterWhisperer)
• f57b55d linter: Add schema for typescript/array-type (#​23355) (Sysix)
• 0dcf912 linter: Add schema for typescript/ban-ts-comment (#​23354) (Sysix)
• 51fa83e linter: Add schema for react/no-did-update-set-state (#​23357) (Mikhail Baev)
• 59db0bd linter: Add schema for consistent-generic-constructors (#​23353) (Sysix)
• c4775c0 linter: Add schema for typescript/consistent-type-assertions (#​23349) (Sysix)
• 6e516f7 linter: Add schema for typescript/consistent-type-imports (#​23348) (Sysix)
• 012134d linter: Add schema for react/jsx-no-target-blank (#​23345) (WaterWhisperer)
• 0806aae linter: Add schema for jsx_a11y/no-noninteractive-tabindex (#​23337) (Mikhail Baev)
• 0708b5a linter: Add schema for react/jsx-filename-extension (#​23315) (Mikhail Baev)
• 150bce1 linter: Add schema for typescript/no-empty-object-type (#​23309) (Sysix)
• f9e36f1 linter: Add schema for typescript/no-duplicate-type-constituents (#​23308) (Sysix)
• 937accf linter: Add schema for typescript/no-invalid-void-type (#​23307) (Sysix)
• 3e042b9 linter: Add schema for typescript/no-misused-promises (#​23306) (Sysix)
• da212d1 linter: Add schema for typescript/no-unnecessary-condition (#​23305) (Sysix)
• f8f0d38 linter: Add schema for typescript/parameter-properties (#​23304) (Sysix)
• 2275fc7 linter: Add schema for typescript/prefer-nullish-coalescing (#​23302) (Sysix)
• d353858 linter: Add schema for typescript/prefer-string-starts-ends-with (#​23301) (Sysix)
• 03060f5 linter: Add schema for typescript/triple-slash-reference (#​23300) (Sysix)
• 6619cee linter: Add schema for promise/param-names (#​23298) (Sysix)
• 8bf108e linter: Add schema for promise/catch-or-return (#​23297) (Sysix)
• 48158d0 linter: Add schema for vitest/consistent-each-for (#​23294) (Sysix)
• 7e74c98 linter: Add schema for vitest/consistent-test-filename (#​23293) (Sysix)
• ff94d4a linter: Add schema for vitest/consistent-vitest-vi (#​23292) (Sysix)
• 2409a10 linter: Add schema for vitest/prefer-import-in-mock (#​23291) (Sysix)
• 3d782b7 linter: Add schema for react/no-unstable-nested-components (#​23287) (Mikhail Baev)
• 0a0bc2f linter/jsx-a11y: Add allowedRedundantRoles option to no-redundant-roles (#​22820) (bab)
• 80758a5 linter/vue: Implement no-side-effects-in-computed-properties rule (#​23282) (bab)
• e3869ac linter: Add schema for react/no-object-type-as-default-prop (#​23279) (Mikhail Baev)
• 4480609 linter: Add schema for react/jsx-props-no-spreading (#​23276) (Mikhail Baev)
• 08d68a5 linter/react: Implement jsx-no-literals rule (#​23145) (kapobajza)
• 9a2788b linter/unicorn: Implement prefer-export-from rule (#​22935) (AliceLanniste)
• bdb723c linter/unicorn: Implement prefer-single-call rule (#​23235) (Yuzhe Shi)
• 31543ed linter: Add schema for vue/define-props-destructuring (#​23252) (Sysix)
• 21b6c3d linter: Add schema for oxc/no-async-endpoint-handlers (#​23251) (Sysix)
• e77ff81 linter: Add schema for unicorn/prefer-object-from-entries (#​23249) (Mikhail Baev)
• bcac2d6 linter: Add schema for jest/vitest/no-restricted-matchers (#​23247) (Sysix)
• 539f036 linter: Add schema for jest/vitest/no-restricted-*-methods (#​23246) (Sysix)
• dd1b927 linter/vue: Implement require-default-prop rule (#​22951) (bab)
• 3f018e7 linter: Add schema for unicorn/no-instanceof-builtins (#​23225) (Mikhail Baev)
• e0d0f78 linter: Verify promise/no-callback-in-promise schema (#​23141) (beanscg)
• 123d4f4 linter: Add schema for jest/vitest/valid-expect (#​23185) (Sysix)
• 46c8a21 linter: Add schema for jest/vitest/require-top-level-describe (#​23184) (Sysix)
• 41465cf linter: Add schema for jest/vitest/prefer-snapshot-hint (#​23183) (Sysix)
• d068b9b linter: Add schema for jest/vitest/prefer-expect-assertions (#​23181) (Sysix)
• 064a1ee linter: Add schema for jest/prefer-ending-with-an-expect (#​23180) (Sysix)
• d046797 linter: Add schema for jest/vitest/no-standalone-expect (#​23179) (Sysix)
• 137b9a6 linter: Add schema for jest/vitest/no-large-snapshots (#​23178) (Sysix)
• 0f3e4a5 linter: Add schema for jest/vitest/no-hooks (#​23177) (Sysix)
• cd0b384 linter: Add schema for unicorn/explicit-length-check (#​23155) (Mikhail Baev)
• 01b74c4 linter: Add schema for jest/no-deprecated-functions (#​23136) (Sysix)
• 9d6a387 linter: Add schema for unicorn/catch-error-name (#​23137) (Mikhail Baev)
• 0da8efa linter: Add schema for jest/vitest/max-nested-describe (#​23131) (Sysix)
• d71c9fd linter: Add schema for eslint/no-use-before-define (#​23129) (Sysix)

🐛 Bug Fixes

• 26ddac6 linter: Avoid config schema generation for jsx_a11y/no-noninteractive-element-interactions (#​23385) (Sysix)
• 40556ad linter: Parse jsx-a11y/control-has-associated-label config with DefaultRuleConfig (#​23373) (Sysix)
• 71e9648 linter: Expose no-noninteractive-element-interactions schema (#​23283) (camc314)
• 6c86d1c linter/react-perf: Correct nativeAllowList all schema (#​23229) (camc314)
• 4dd52de linter/react-perf: Re-generate stale snapshots (#​23228) (camc314)
• 8f3db61 linter: Allow options for eslint/capitalized-comments (#​23139) (Sysix)

⚡ Performance

• f09707e linter: jest/no-deprecated-functions store config version as usize (#​23138) (Sysix)

📚 Documentation

• f682e25 linter: Remove manually written options doc for eslint/prefer-arrow-callback (#​23438) (Mikhail Baev)
• 64c942c linter: Remove manually written options doc for eslint/no-sequences (#​23420) (Mikhail Baev)
• 14abf32 linter/react-perf: Use autogenerated docs (#​23227) (camc314)

rolldown/rolldown (rolldown)

v1.1.2

Compare Source

🚀 Features

• add option named for invalid return type errors for more places (#​9846) by @​shulaoda
• add option names for invalid return type errors (#​9821) by @​sapphi-red
• transform: infer decorator strictNullChecks from tsconfig (#​9590) by @​kylecannon
• expose React Compiler options for rolldown and Vite users (#​9801) by @​Boshen
• tracing: gate chrome-json trace layer behind chrome-tracing feature (#​9773) by @​hyf0
• dev: align test-dev-server with Vite dev server (#​9668) by @​h-a-n-a

🐛 Bug Fixes

• plugin_timings: point doc link to existing checks reference page (#​9837) by @​hyf0
• generator: correct contradictory panic message in cjs cross-chunk symbol lookup (#​9836) by @​hyf0
• esm: preserve with clause on export * from external (#​9796) by @​hyf0
• Make external_import_binding_merger deterministic (#​9755) by @​naruaway
• surface invalid manualCodeSplitting group test regex as an error (#​9792) by @​shulaoda
• avoid panic on output.file without a file name (#​9789) by @​shulaoda
• avoid O(N^2) rendering of high-volume diagnostics (#​9748) (#​9749) by @​IWANABETHATGUY
• avoid panic on JSON numbers outside f64 range (#​9788) by @​shulaoda
• deps: bump mimalloc-safe to 0.1.63 to fix worker_threads segfault (#​9785) by @​shulaoda
• cache ESM evaluation errors (#​9784) by @​sapphi-red
• wrap node require helper in pure IIFE (#​9783) by @​kb019
• lazy-barrel: load locally-used imports on a re-exported record (#​9757) by @​shulaoda
• avoid dangling wrapped-ESM init call across chunks (#​9502) (#​9717) by @​IWANABETHATGUY
• dev: detect same-second rewrites in CI poll watcher (#​9736) by @​h-a-n-a
• dev: force rebuild after HMR errors (#​9686) by @​h-a-n-a
• dev: print build errors on browser refresh after a failed build (#​9652) by @​h-a-n-a

🚜 Refactor

• single-source the chunk $N symbol-naming algorithm (#​9831) by @​Dunqing
• simplify common_dir helper (#​9857) by @​IWANABETHATGUY
• drop commondir crate in favor of in-house helper (#​9849) by @​Boshen
• binding: extract helpers from normalize_binding_options (#​9842) by @​Boshen
• move rolldown_filter_analyzer to tasks and scope oxc cfg feature (#​9839) by @​Boshen
• options: merge manualCodeSplitting into codeSplitting object form (#​9805) by @​IWANABETHATGUY
• options: support codeSplitting object form in CodeSplittingMode (#​9804) by @​IWANABETHATGUY
• diagnostic: reuse ByteLocator for per-source line lookup (#​9762) by @​IWANABETHATGUY
• remove redundant Arc around tracing spans (#​9778) by @​camc314
• remove unnecessary Arc around sourcemap sender (#​9777) by @​camc314
• rolldown_plugin_vite_wasm_fallback: remove the plugin (#​9775) by @​sapphi-red
• binding: remove infer-able napi(ts_type) (#​9737) by @​sapphi-red
• remove preprocessor span dedup (#​9734) by @​hyf0
• identify AST nodes by NodeId instead of Span/Address (#​9609) by @​IWANABETHATGUY

📚 Documentation

• tsconfig: align auto-discovery docs with oxc-resolver behavior (#​9845) by @​shulaoda
• relocate meta/design to internal-docs, split design from implementation (#​9826) by @​h-a-n-a
• meta: add options normalization design doc (#​9818) by @​IWANABETHATGUY
• document why the napi tracing feature is enabled (#​9766) by @​Boshen
• dev: move test-dev-server test guidance into the testing docs (#​9809) by @​h-a-n-a

⚡ Performance

• drop unused regex unicode property tables from the binding (#​9848) by @​Boshen
• drop urlencoding crate in favor of percent-encoding (#​9851) by @​Boshen
• drop owo-colors supports-colors feature in vite reporter (#​9824) by @​Boshen
• skip enum member value extraction for non-TypeScript modules (#​9840) by @​shulaoda
• rolldown: use unstable sort for itertools sorted_by at unique-key sites (#​9827) by @​Boshen
• cheaper deterministic ordering in external import binding merger (#​9810) by @​IWANABETHATGUY
• disable idna's ICU backend by pinning idna_adapter to 1.0.0 (-129 KB) (#​9811) by @​Boshen
• size: use unstable sort where stability is unneeded (#​9803) by @​Boshen
• remove num-format dependency from vite reporter (#​9795) by @​Boshen
• reduce js callback error size (#​9776) by @​Boshen
• rolldown_error: remove Debug supertrait from BuildEvent (#​9798) by @​Boshen
• reduce plugin hook order code size (#​9761) by @​Boshen
• deps: disable infer default features to reduce binary size (#​9765) by @​Boshen
• reduce pluginable monomorphization size (#​9771) by @​Boshen
• avoid rebuilding replace plugin values (#​9764) by @​Boshen
• defer link-stage-output drop to rayon workers after output is produced (#​9733) by @​Brooooooklyn
• tree-shaking: hoist already-included guard to call sites in inclusion DFS (#​9738) by @​Brooooooklyn
• renamer: dedup before allocating the owned name in add_symbol_in_root_scope (#​9740) by @​Brooooooklyn

🧪 Testing

• allocs: track allocation counts for rolldown_sourcemap (#​9835) by @​hyf0
• bench: add CodSpeed micro-benchmarks for rolldown_sourcemap (#​9834) by @​hyf0
• add cjs named export mutation test (#​9823) by @​sapphi-red
• dev: restore shared-page reliability conventions in AGENTS.md (#​9786) by @​h-a-n-a
• dev: add AGENTS.md test guidance for agents (#​9763) by @​h-a-n-a
• dev: split out initial-build-error into its own playground (#​9772) by @​h-a-n-a
• dev: align e2e suite with Vite and parallelize playgrounds (#​9759) by @​h-a-n-a
• remove unnecessary module namespace object JSON serializations in tests (#​9725) by @​sapphi-red
• use assert.deepStrictEqual instead of assert.deepEqual by using assert/strict instead of assert (#​9724) by @​sapphi-red
• hmr: add test case for #​5301 (#​5302) by @​sapphi-red
• dev: add tests for dev-engine principles (#​9720) by @​h-a-n-a
• dev: align dev-engine test harness with Vite (#​9684) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• deps: update napi to 3.9.3 (#​9862) by @​shulaoda
• deps: update oxc to 0.137.0 (#​9856) by @​Boshen
• re-enable default lld linker on x86_64-unknown-linux-gnu (#​9855) by @​Boshen
• deps: bump vite-plus to 0.2.1 (#​9850) by @​Boshen
• skills: translate _config.json when encoding rolldown REPL links (#​9847) by @​IWANABETHATGUY
• deps: update oxc_resolver and oxc_resolver_napi to 11.21.3 (#​9841) by @​Boshen
• pin vite-plus (vp) CLI to 0.1.24 in setup-vp (#​9830) by @​Boshen
• add crate/package-level CODEOWNERS (#​9819) by @​IWANABETHATGUY
• drop unused derive_more display feature from rolldown_plugin (#​9820) by @​Boshen
• remove auto-assign PR workflow (#​9807) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.62.0 (#​9780) by @​rolldown-guard[bot]
• deps: update esbuild for tests to 0.28.1 (#​9779) by @​rolldown-guard[bot]
• deps: update test262 submodule for tests (#​9781) by @​rolldown-guard[bot]
• deps: update oxc to 0.136.0 (#​9770) by @​Boshen
• add pull request template (#​9756) by @​sapphi-red
• clarify rolldown_plugin_vite_* is compatible for the same minor (#​9774) by @​sapphi-red
• deps: update github actions (#​9745) by @​renovate[bot]
• deps: update rust crates (#​9747) by @​renovate[bot]
• deps: update napi to v3.9.2 (#​9744) by @​renovate[bot]
• deps: update npm packages (#​9746) by @​renovate[bot]
• deps: update @​napi-rs/cli and emnapi deps (#​9741) by @​Brooooooklyn
• generator: fix vp fmt on Windows (#​9727) by @​sapphi-red
• ban importing from assert and recommend assert/strict (#​9726) by @​sapphi-red

❤️ New Contributors

• @​naruaway made their first contribution in #​9755
• @​kb019 made their first contribution in #​9783

yarnpkg/berry (yarn)

v4.17.0: v4.17.0

Compare Source

What's Changed

• Adds support for package map generation by @​arcanis in #​7184
• fix: add catalog settings to yarnrc schema by @​cyphercodes in #​7179
• docs: clarify background job exit codes by @​StantonMatt in #​7167
• fix: explain peer-default dependencies in why by @​StantonMatt in #​7168
• Docs: fix npmMinimalAgeGate default by @​clemyan in #​7181
• feat(plugin-npm): allow npmMinimalAgeGate per npmScope by @​erlandasz in #​7156

New Contributors

• @​cyphercodes made their first contribution in #​7179
• @​StantonMatt made their first contribution in #​7167
• @​erlandasz made their first contribution in #​7156

Full Changelog: https://github.com/yarnpkg/berry/compare/@yarnpkg/cli/4.16.0...@​yarnpkg/cli/4.17.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.