This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@figma/rest-api-spec](https://redirect.github.com/figma/rest-api-spec) | [`~0.36.0` → `~0.37.0`](https://renovatebot.com/diffs/npm/@figma%2frest-api-spec/0.36.0/0.37.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@figma%2frest-api-spec/0.37.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@figma%2frest-api-spec/0.36.0/0.37.0?slim=true) | | [@modelcontextprotocol/sdk](https://modelcontextprotocol.io) ([source](https://redirect.github.com/modelcontextprotocol/typescript-sdk)) | [`~1.28.0` → `~1.29.0`](https://renovatebot.com/diffs/npm/@modelcontextprotocol%2fsdk/1.28.0/1.29.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@modelcontextprotocol%2fsdk/1.29.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@modelcontextprotocol%2fsdk/1.28.0/1.29.0?slim=true) | | [@redocly/openapi-core](https://redirect.github.com/Redocly/redocly-cli) | [`~2.25.0` → `~2.28.0`](https://renovatebot.com/diffs/npm/@redocly%2fopenapi-core/2.25.2/2.28.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@redocly%2fopenapi-core/2.28.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@redocly%2fopenapi-core/2.25.2/2.28.0?slim=true) | | [@sinonjs/fake-timers](https://redirect.github.com/sinonjs/fake-timers) | [`~15.1.0` → `~15.3.0`](https://renovatebot.com/diffs/npm/@sinonjs%2ffake-timers/15.1.1/15.3.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@sinonjs%2ffake-timers/15.3.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@sinonjs%2ffake-timers/15.1.1/15.3.2?slim=true) | | [@types/vscode](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/vscode) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/vscode)) | [`~1.110.0` → `~1.115.0`](https://renovatebot.com/diffs/npm/@types%2fvscode/1.110.0/1.115.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fvscode/1.115.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fvscode/1.110.0/1.115.0?slim=true) | | [@vscode/vsce](https://code.visualstudio.com) ([source](https://redirect.github.com/Microsoft/vsce)) | [`3.7.1` → `3.8.0`](https://renovatebot.com/diffs/npm/@vscode%2fvsce/3.7.1/3.8.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vscode%2fvsce/3.8.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vscode%2fvsce/3.7.1/3.8.0?slim=true) | | [dotenv](https://redirect.github.com/motdotla/dotenv) | [`~17.3.0` → `~17.4.0`](https://renovatebot.com/diffs/npm/dotenv/17.3.1/17.4.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/dotenv/17.4.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/dotenv/17.3.1/17.4.2?slim=true) | | [esbuild](https://redirect.github.com/evanw/esbuild) | [`~0.27.0` → `~0.28.0`](https://renovatebot.com/diffs/npm/esbuild/0.27.4/0.28.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/esbuild/0.28.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/esbuild/0.27.4/0.28.0?slim=true) | | [globby](https://redirect.github.com/sindresorhus/globby) | [`~16.1.0` → `~16.2.0`](https://renovatebot.com/diffs/npm/globby/16.1.1/16.2.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/globby/16.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/globby/16.1.1/16.2.0?slim=true) | | [koa](https://koajs.com) ([source](https://redirect.github.com/koajs/koa)) | [`~3.1.0` → `~3.2.0`](https://renovatebot.com/diffs/npm/koa/3.1.2/3.2.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/koa/3.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/koa/3.1.2/3.2.0?slim=true) | | [lighthouse](https://redirect.github.com/GoogleChrome/lighthouse) | [`~13.0.0` → `~13.1.0`](https://renovatebot.com/diffs/npm/lighthouse/13.0.3/13.1.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lighthouse/13.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lighthouse/13.0.3/13.1.0?slim=true) | | [ngx-markdown](https://redirect.github.com/jfcere/ngx-markdown) | [`~21.1.0` → `~21.2.0`](https://renovatebot.com/diffs/npm/ngx-markdown/21.1.0/21.2.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/ngx-markdown/21.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ngx-markdown/21.1.0/21.2.0?slim=true) | | [sass](https://redirect.github.com/sass/dart-sass) | [`~1.98.0` → `~1.99.0`](https://renovatebot.com/diffs/npm/sass/1.98.0/1.99.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/sass/1.99.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass/1.98.0/1.99.0?slim=true) | | [sass-embedded](https://redirect.github.com/sass/embedded-host-node) | [`~1.98.0` → `~1.99.0`](https://renovatebot.com/diffs/npm/sass-embedded/1.98.0/1.99.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/sass-embedded/1.99.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass-embedded/1.98.0/1.99.0?slim=true) | | [undici](https://undici.nodejs.org) ([source](https://redirect.github.com/nodejs/undici)) | [`6.24.1` → `6.25.0`](https://renovatebot.com/diffs/npm/undici/6.24.1/6.25.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/undici/6.25.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/undici/6.24.1/6.25.0?slim=true) | | [verdaccio](https://verdaccio.org) ([source](https://redirect.github.com/verdaccio/verdaccio)) | [`~6.3.0` → `~6.5.0`](https://renovatebot.com/diffs/npm/verdaccio/6.3.2/6.5.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/verdaccio/6.5.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/verdaccio/6.3.2/6.5.0?slim=true) | | [webpack](https://redirect.github.com/webpack/webpack) | [`~5.105.0` → `~5.106.0`](https://renovatebot.com/diffs/npm/webpack/5.105.4/5.106.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/webpack/5.106.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/webpack/5.105.4/5.106.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/26) for more information. --- ### Release Notes

figma/rest-api-spec (@figma/rest-api-spec)

### [`v0.37.0`](https://redirect.github.com/figma/rest-api-spec/compare/v0.36.0...v0.37.0) [Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/v0.36.0...v0.37.0)

modelcontextprotocol/typescript-sdk (@modelcontextprotocol/sdk)

### [`v1.29.0`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/releases/tag/v1.29.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0) #### What's Changed - fix: treat v1.x as primary branch for npm latest tag (backport [#1577](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1577)) by [@felixweinberger](https://redirect.github.com/felixweinberger) in [#1749](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1749) - \[v1.x] fix: disallow null (infinite) requested TTL by [@LucaButBoring](https://redirect.github.com/LucaButBoring) in [#1339](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1339) - \[v1.x] fix: add missing size field to ResourceSchema by [@olaservo](https://redirect.github.com/olaservo) in [#1575](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1575) - Add typings exports by [@tdraier](https://redirect.github.com/tdraier) in [#1623](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623) - v1.x npm audit fix by [@KKonstantinov](https://redirect.github.com/KKonstantinov) in [#1780](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1780) - v1.x [#1623](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1623) follow up -add missing types to package.json by [@KKonstantinov](https://redirect.github.com/KKonstantinov) in [#1773](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1773) - \[v1.x backport] Allow servers / clients to advertise extensions in the capability object by [@localden](https://redirect.github.com/localden) in [#1811](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1811) - fix(stdio): always set windowsHide on Windows, not just in Electron by [@jnMetaCode](https://redirect.github.com/jnMetaCode) in [#1640](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640) - chore: bump version to 1.29.0 by [@felixweinberger](https://redirect.github.com/felixweinberger) in [#1820](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1820) #### New Contributors - [@tdraier](https://redirect.github.com/tdraier) made their first contribution in [#1623](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623) - [@jnMetaCode](https://redirect.github.com/jnMetaCode) made their first contribution in [#1640](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640) **Full Changelog**:

Redocly/redocly-cli (@redocly/openapi-core)

### [`v2.28.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.28.0) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.27.1...@redocly/openapi-core@2.28.0) ##### Minor Changes - Moved the `remove-unused-components` decorator to the post-bundle phase so that components that become unused only after `$ref` resolution are correctly removed. ##### Patch Changes - Fixed an issue where the discriminator's `defaultMapping` property was not resolved when bundling. - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.28.0. ### [`v2.27.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.27.1) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.27.0...@redocly/openapi-core@2.27.1) ##### Patch Changes - Fixed an issue where `--component-renaming-conflicts-severity` ignored conflicts when different files had components with the same name but different content. **Warning:** Autogenrated component names and `$ref` paths in bundled documents may differ from older releases. - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.27.1. ### [`v2.27.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.27.0) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.26.0...@redocly/openapi-core@2.27.0) ##### Minor Changes - Added support for `junit` output in the `scorecard-classic` command. - Changed `lint` behavior with the `--generate-ignore-file` option. Now `lint` updates only the entries related to the file being linted. Other files' entries are unchanged. ##### Patch Changes - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.27.0. ### [`v2.26.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.26.0) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.25.4...@redocly/openapi-core@2.26.0) ##### Minor Changes - Added support for AsyncAPI v2 and v3 in the split command. - Added `excludedPaths` option to the `no-http-verbs-in-paths` rule, allowing specific paths to be excluded from evaluation. ##### Patch Changes - Fixed the `no-required-schema-properties-undefined` rule to report when a required property is not defined in every `oneOf`/`anyOf` branch. - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.26.0. ### [`v2.25.4`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.25.4) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.25.3...@redocly/openapi-core@2.25.4) ##### Patch Changes - Updated handlebars to v4.7.9. - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.25.4. ### [`v2.25.3`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.25.3) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.25.2...@redocly/openapi-core@2.25.3) ##### Patch Changes - Fixed multiple issues in the `spec-discriminator-defaultMapping` rule that could cause crashes or incorrect validation results. The rule now correctly resolves existing schema names, traverses composite schemas (`allOf`, `anyOf`, `oneOf`) to find required properties, treats `defaultMapping` values as `$ref`s to schemas, resolves `$ref`s correctly across files, and handles cyclic schema dependencies. - Updated [@redocly/respect-core](https://redirect.github.com/redocly/respect-core) to v2.25.3.

sinonjs/fake-timers (@sinonjs/fake-timers)

### [`v15.3.2`](https://redirect.github.com/sinonjs/fake-timers/blob/HEAD/CHANGELOG.md#1532--2026-04-11) [Compare Source](https://redirect.github.com/sinonjs/fake-timers/compare/v15.3.1...v15.3.2) \================== This actually changes some typings, so worth pushing - upgrade eslint-config ([#565](https://redirect.github.com/sinonjs/fake-timers/issues/565)) ### [`v15.3.1`](https://redirect.github.com/sinonjs/fake-timers/blob/HEAD/CHANGELOG.md#1531--2026-04-10) [Compare Source](https://redirect.github.com/sinonjs/fake-timers/compare/v15.3.0...v15.3.1) \================== - fix: type generation and ensure types are always built - chore(deps): bump basic-ftp from 5.2.0 to 5.2.1 ([#560](https://redirect.github.com/sinonjs/fake-timers/issues/560)) - Add missing regression test for [#561](https://redirect.github.com/sinonjs/fake-timers/issues/561) - fix: restore cross-realm Date support in setSystemTime ([#561](https://redirect.github.com/sinonjs/fake-timers/issues/561)) - fix: correct generated typescript types ([#559](https://redirect.github.com/sinonjs/fake-timers/issues/559)) - fix: include missing type ### [`v15.3.0`](https://redirect.github.com/sinonjs/fake-timers/blob/HEAD/CHANGELOG.md#1530--2026-04-02) [Compare Source](https://redirect.github.com/sinonjs/fake-timers/compare/v15.2.2...v15.3.0) \================== - Fix interval loop-limit stack traces and clock-local isolation ([#555](https://redirect.github.com/sinonjs/fake-timers/issues/555)) ### [`v15.2.2`](https://redirect.github.com/sinonjs/fake-timers/blob/HEAD/CHANGELOG.md#1522--2026-04-01) [Compare Source](https://redirect.github.com/sinonjs/fake-timers/compare/v15.2.1...v15.2.2) \================== - fix([#489](https://redirect.github.com/sinonjs/fake-timers/issues/489)): ignore Node 'timers' modules for browser bundlers ### [`v15.2.1`](https://redirect.github.com/sinonjs/fake-timers/blob/HEAD/CHANGELOG.md#1521--2026-04-01) [Compare Source](https://redirect.github.com/sinonjs/fake-timers/compare/v15.2.0...v15.2.1) \================== - fix([#550](https://redirect.github.com/sinonjs/fake-timers/issues/550)): restore timer heap initialization after clearTimeout - document why two data structures (map and heap) are needed ### [`v15.2.0`](https://redirect.github.com/sinonjs/fake-timers/blob/HEAD/CHANGELOG.md#1520--2026-03-31) [Compare Source](https://redirect.github.com/sinonjs/fake-timers/compare/v15.1.2...v15.2.0) \================== The 2000x perf increase release. - fix([#522](https://redirect.github.com/sinonjs/fake-timers/issues/522)): setInterval(0,fn) starved setTimeout(0,fn) - fix: reject non-function callbacks - fix([#534](https://redirect.github.com/sinonjs/fake-timers/issues/534)): remove memory leak and potential security issue - fix: memory leak and performance issues from [#532](https://redirect.github.com/sinonjs/fake-timers/issues/532) ### [`v15.1.2`](https://redirect.github.com/sinonjs/fake-timers/blob/HEAD/CHANGELOG.md#1512--2026-03-31) [Compare Source](https://redirect.github.com/sinonjs/fake-timers/compare/v15.1.1...v15.1.2) \================== - Access to the global object via `globalThis` in test files ([#544](https://redirect.github.com/sinonjs/fake-timers/issues/544)) - Bump flatted from 3.2.9 to 3.4.2 ([#547](https://redirect.github.com/sinonjs/fake-timers/issues/547)) - Bump fast-xml-parser from 5.4.1 to 5.5.7 ([#546](https://redirect.github.com/sinonjs/fake-timers/issues/546)) - new feature: toNotFake:\[] - ref [#540](https://redirect.github.com/sinonjs/fake-timers/issues/540) - Ensure cancelIdleCallback is reset when uninstalling ([#539](https://redirect.github.com/sinonjs/fake-timers/issues/539)) - Fix "TypeError: Cannot convert undefined or null to object" error ([#541](https://redirect.github.com/sinonjs/fake-timers/issues/541)) - Bump undici ([#543](https://redirect.github.com/sinonjs/fake-timers/issues/543)) - make requestIdleCallback spec compliant ([#531](https://redirect.github.com/sinonjs/fake-timers/issues/531)) - Bump minimatch from 3.1.2 to 3.1.5 ([#538](https://redirect.github.com/sinonjs/fake-timers/issues/538)) - Bump basic-ftp from 5.0.5 to 5.2.0 ([#535](https://redirect.github.com/sinonjs/fake-timers/issues/535))

Microsoft/vsce (@vscode/vsce)

### [`v3.8.0`](https://redirect.github.com/microsoft/vscode-vsce/releases/tag/v3.8.0) [Compare Source](https://redirect.github.com/Microsoft/vsce/compare/v3.7.1...v3.8.0) #### Changes: - [#1258](https://redirect.github.com/Microsoft/vsce/issues/1258): fix: run npm audit fix - [#1255](https://redirect.github.com/Microsoft/vsce/issues/1255): Bump brace-expansion - [#1253](https://redirect.github.com/Microsoft/vsce/issues/1253): Bump picomatch from 2.3.1 to 2.3.2 - [#1252](https://redirect.github.com/Microsoft/vsce/issues/1252): Bump yauzl from 2.10.0 to 3.2.1 - [#1250](https://redirect.github.com/Microsoft/vsce/issues/1250): Bump underscore from 1.13.1 to 1.13.8 - [#1249](https://redirect.github.com/Microsoft/vsce/issues/1249): Bump minimatch - [#1243](https://redirect.github.com/Microsoft/vsce/issues/1243): Bump markdown-it from 14.1.0 to 14.1.1 - [#1244](https://redirect.github.com/Microsoft/vsce/issues/1244): Bump qs from 6.14.1 to 6.14.2 - [#1239](https://redirect.github.com/Microsoft/vsce/issues/1239): Bump [@isaacs/brace-expansion](https://redirect.github.com/isaacs/brace-expansion) from 5.0.0 to 5.0.1 - [#1238](https://redirect.github.com/Microsoft/vsce/issues/1238): Bump lodash from 4.17.21 to 4.17.23

See More

- [#1234](https://redirect.github.com/Microsoft/vsce/issues/1234): Bump qs from 6.11.0 to 6.14.1 - [#1233](https://redirect.github.com/Microsoft/vsce/issues/1233): Return non-zero exit code when signature verification fails - [#1232](https://redirect.github.com/Microsoft/vsce/issues/1232): Audit npm package - [#1228](https://redirect.github.com/Microsoft/vsce/issues/1228): Bump jws This list of changes was [auto generated](https://dev.azure.com/monacotools/Monaco/_build/results?buildId=430499\&view=logs).

motdotla/dotenv (dotenv)

### [`v17.4.2`]() [Compare Source](https://redirect.github.com/motdotla/dotenv/compare/v17.4.1...v17.4.2) ### [`v17.4.1`]() [Compare Source](https://redirect.github.com/motdotla/dotenv/compare/v17.4.0...v17.4.1) ### [`v17.4.0`]() [Compare Source](https://redirect.github.com/motdotla/dotenv/compare/v17.3.1...v17.4.0)

evanw/esbuild (esbuild)

### [`v0.28.0`]() [Compare Source](https://redirect.github.com/evanw/esbuild/compare/v0.27.7...v0.28.0) ### [`v0.27.7`]() [Compare Source](https://redirect.github.com/evanw/esbuild/compare/v0.27.5...v0.27.7) ### [`v0.27.5`]() [Compare Source](https://redirect.github.com/evanw/esbuild/compare/v0.27.4...v0.27.5)

sindresorhus/globby (globby)

### [`v16.2.0`](https://redirect.github.com/sindresorhus/globby/releases/tag/v16.2.0) [Compare Source](https://redirect.github.com/sindresorhus/globby/compare/v16.1.1...v16.2.0) - Add [`globalGitignore`](https://redirect.github.com/sindresorhus/globby?tab=readme-ov-file#globalgitignore) option [`51555b2`](https://redirect.github.com/sindresorhus/globby/commit/51555b2) ***

koajs/koa (koa)

### [`v3.2.0`](https://redirect.github.com/koajs/koa/releases/tag/v3.2.0) [Compare Source](https://redirect.github.com/koajs/koa/compare/v3.1.2...v3.2.0) #### What's Changed - docs: remove dead Job Board links by [@Jerry-CodeHub](https://redirect.github.com/Jerry-CodeHub) in [#1926](https://redirect.github.com/koajs/koa/pull/1926) - build(deps-dev): bump qs from 6.14.1 to 6.14.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1927](https://redirect.github.com/koajs/koa/pull/1927) - chore: Add workflow\_dispatch trigger to npm-publish workflow by [@Copilot](https://redirect.github.com/Copilot) in [#1930](https://redirect.github.com/koajs/koa/pull/1930) - feat: defer AsyncLocalStorage creation for v8 startup snapshots by [@killagu](https://redirect.github.com/killagu) in [#1946](https://redirect.github.com/koajs/koa/pull/1946) #### New Contributors - [@Jerry-CodeHub](https://redirect.github.com/Jerry-CodeHub) made their first contribution in [#1926](https://redirect.github.com/koajs/koa/pull/1926) - [@killagu](https://redirect.github.com/killagu) made their first contribution in [#1946](https://redirect.github.com/koajs/koa/pull/1946) **Full Changelog**:

GoogleChrome/lighthouse (lighthouse)

### [`v13.1.0`](https://redirect.github.com/GoogleChrome/lighthouse/blob/HEAD/changelog.md#1310-2026-04-03) [Compare Source](https://redirect.github.com/GoogleChrome/lighthouse/compare/v13.0.3...v13.1.0) [Full Changelog](https://redirect.github.com/GoogleChrome/lighthouse/compare/v13.0.3...v13.1.0) We expect this release to ship in the DevTools of [Chrome 148](https://chromiumdash.appspot.com/schedule), and to PageSpeed Insights within 2 weeks. #### New contributors Thanks to our new contributors 👽🐷🐰🐯🐻! - Iaroslav Shvets [@iaroslavshvets](https://redirect.github.com/iaroslavshvets) #### New Audits - baseline: implement baseline compatibility audit ([#16904](https://redirect.github.com/GoogleChrome/lighthouse/pull/16904)) #### Core - baseline: add baseline icons to baseline audit lighthouse report ([#16927](https://redirect.github.com/GoogleChrome/lighthouse/pull/16927)) - baseline: add web-feature version to audit description ([#16937](https://redirect.github.com/GoogleChrome/lighthouse/pull/16937)) - baseline: add baseline compatibility audit to default config ([#16910](https://redirect.github.com/GoogleChrome/lighthouse/pull/16910)) - network: revert strict wrapping of network requests ([#16949](https://redirect.github.com/GoogleChrome/lighthouse/pull/16949)) - trace: add WebDX feature usage trace category ([#16899](https://redirect.github.com/GoogleChrome/lighthouse/pull/16899)) #### Deps - upgrade deps ([#16943](https://redirect.github.com/GoogleChrome/lighthouse/pull/16943)) - dependabot: less noisy PRs ([#16919](https://redirect.github.com/GoogleChrome/lighthouse/pull/16919)) #### Clients - build: include missing 3P notices in MCP bundle ([#16917](https://redirect.github.com/GoogleChrome/lighthouse/pull/16917)) #### Docs - fix jsdoc link ([#16896](https://redirect.github.com/GoogleChrome/lighthouse/pull/16896)) #### Tests - lantern trace data must now be downloaded manually ([#16789](https://redirect.github.com/GoogleChrome/lighthouse/pull/16789)) - fix CI failures and modernize documentation links ([#16939](https://redirect.github.com/GoogleChrome/lighthouse/pull/16939)) - refresh sample artifacts ([#16916](https://redirect.github.com/GoogleChrome/lighthouse/pull/16916)) - fix smoke tests relying on mozilla.org ([#16901](https://redirect.github.com/GoogleChrome/lighthouse/pull/16901)) - fix CI. execContext count, i18n ICU breakage, loud jsdom parse output ([#16898](https://redirect.github.com/GoogleChrome/lighthouse/pull/16898)) - devtools: sync e2e tests from devtools-frontend ([#16908](https://redirect.github.com/GoogleChrome/lighthouse/pull/16908)) - smoke: smoke tests for the mcp bundle ([#16883](https://redirect.github.com/GoogleChrome/lighthouse/pull/16883)) - smokehouse: fix baseline config to use onlyAudits ([#16931](https://redirect.github.com/GoogleChrome/lighthouse/pull/16931)) #### Misc - fix TS7 compatibility issue (declare module syntax) ([#16926](https://redirect.github.com/GoogleChrome/lighthouse/pull/16926)) - build: shim puppeteer-core in the mcp bundle ([#16895](https://redirect.github.com/GoogleChrome/lighthouse/pull/16895)) - build: remove soft nav from mcp bundle ([#16888](https://redirect.github.com/GoogleChrome/lighthouse/pull/16888)) - build: fix mcp bundle shims ([#16882](https://redirect.github.com/GoogleChrome/lighthouse/pull/16882)) - build: generate third party notices file ([#16887](https://redirect.github.com/GoogleChrome/lighthouse/pull/16887))

jfcere/ngx-markdown (ngx-markdown)

### [`v21.2.0`](https://redirect.github.com/jfcere/ngx-markdown/releases/tag/v21.2.0) [Compare Source](https://redirect.github.com/jfcere/ngx-markdown/compare/v21.1.0...v21.2.0) ##### New features and enhancements - chore(lib): plugin optional packages are no longer installed by default ([#634](https://redirect.github.com/jfcere/ngx-markdown/issues/634)) ([`d552e35`](https://redirect.github.com/jfcere/ngx-markdown/commit/d552e35)) [@hardikpatel043](https://redirect.github.com/hardikpatel043) ##### Security fixes - build(deps): bump tar from 7.5.7 to 7.5.9 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#623](https://redirect.github.com/jfcere/ngx-markdown/pull/623) - build(deps): bump immutable from 5.1.4 to 5.1.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#627](https://redirect.github.com/jfcere/ngx-markdown/pull/627) - build(deps-dev): bump minimatch from 3.1.2 to 3.1.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#625](https://redirect.github.com/jfcere/ngx-markdown/pull/625) - build(deps): bump rollup from 4.53.3 to 4.59.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#626](https://redirect.github.com/jfcere/ngx-markdown/pull/626) - build(deps): bump tar from 7.5.9 to 7.5.10 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#628](https://redirect.github.com/jfcere/ngx-markdown/pull/628) - build(deps): bump tar from 7.5.10 to 7.5.11 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#629](https://redirect.github.com/jfcere/ngx-markdown/pull/629) - build(deps): bump dompurify from 3.3.0 to 3.3.3 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#630](https://redirect.github.com/jfcere/ngx-markdown/pull/630) - build(deps): bump angular to fix vulnerabilities by [@jfcere](https://redirect.github.com/jfcere) in [#633](https://redirect.github.com/jfcere/ngx-markdown/pull/633) - build(deps): bump lodash-es and langium by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#637](https://redirect.github.com/jfcere/ngx-markdown/pull/637) - build(deps): bump lodash from 4.17.23 to 4.18.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#638](https://redirect.github.com/jfcere/ngx-markdown/pull/638) ##### Special Thanks 🥇 Thanks to [@hardikpatel043](https://redirect.github.com/hardikpatel043) for his contribution in ([#634](https://redirect.github.com/jfcere/ngx-markdown/issues/634)) **Full Changelog**:

sass/dart-sass (sass)

### [`v1.99.0`](https://redirect.github.com/sass/dart-sass/blob/HEAD/CHANGELOG.md#1990) [Compare Source](https://redirect.github.com/sass/dart-sass/compare/1.98.0...1.99.0) - Add support for parent selectors (`&`) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as [the scoping root]. [the scoping root]: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Nesting_selector#using_outside_nested_rule - User-defined functions named `calc` or `clamp` are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in `calc()` or `clamp()` function. - User-defined functions whose names begin with `-` and end with `-expression`, `-url`, `-and`, `-or`, or `-not` are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers. - User-defined functions named `EXPRESSION`, `URL`, and `ELEMENT`, those that begin with `-` and end with `-ELEMENT`, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax. See [the Sass website](https://sass-lang.com/d/function-name) for details. - In a future release, calls to functions whose names begin with `-` and end with `-expression` and `-url` will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future. See [the Sass website](https://sass-lang.com/d/function-name) for details. - Calls to functions whose names begin with `-` and end with `-progid:...` are deprecated. See [the Sass website](https://sass-lang.com/d/function-name) for details.

sass/embedded-host-node (sass-embedded)

### [`v1.99.0`](https://redirect.github.com/sass/embedded-host-node/blob/HEAD/CHANGELOG.md#1990) [Compare Source](https://redirect.github.com/sass/embedded-host-node/compare/1.98.0...1.99.0) - Add support for parent selectors (`&`) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as [the scoping root]. [the scoping root]: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Nesting_selector#using_outside_nested_rule - User-defined functions named `calc` or `clamp` are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in `calc()` or `clamp()` function. - User-defined functions whose names begin with `-` and end with `-expression`, `-url`, `-and`, `-or`, or `-not` are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers. - User-defined functions named `EXPRESSION`, `URL`, and `ELEMENT`, those that begin with `-` and end with `-ELEMENT`, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax. See [the Sass website](https://sass-lang.com/d/function-name) for details. - In a future release, calls to functions whose names begin with `-` and end with `-expression` and `-url` will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future. See [the Sass website](https://sass-lang.com/d/function-name) for details. - Calls to functions whose names begin with `-` and end with `-progid:...` are deprecated. See [the Sass website](https://sass-lang.com/d/function-name) for details.

nodejs/undici (undici)

### [`v6.25.0`](https://redirect.github.com/nodejs/undici/releases/tag/v6.25.0) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v6.24.1...v6.25.0) #### What's Changed **Full Changelog**:

verdaccio/verdaccio (verdaccio)

### [`v6.5.0`](https://redirect.github.com/verdaccio/verdaccio/releases/tag/v6.5.0) [Compare Source](https://redirect.github.com/verdaccio/verdaccio/compare/v6.4.0...v6.5.0) ##### Features - update ui to major ([#5794](https://redirect.github.com/verdaccio/verdaccio/issues/5794)) ([b957c6f](https://redirect.github.com/verdaccio/verdaccio/commit/b957c6f0edd909d2c04ba4643d224ef0022c6416)) [@juanpicado](https://redirect.github.com/juanpicado) - Big UI refactoring [#5563](https://redirect.github.com/verdaccio/verdaccio/pull/5563) ##### Bug Fixes - **package-filter:** fix O(n²) complexity in cleanupDistFiles ([b15f622](https://redirect.github.com/verdaccio/verdaccio/commit/b15f62279d86f16a916f4de849cc9376327849f1)) [#5797](https://redirect.github.com/verdaccio/verdaccio/pull/5797) by [@plottodev](https://redirect.github.com/plottodev) - ui search returns no output [#5798](https://redirect.github.com/verdaccio/verdaccio/issues/5798) ([3edd3ee](https://redirect.github.com/verdaccio/verdaccio/commit/3edd3ee8fab6e75c0ee4f3be5ae812dc8893459b)) [@juanpicado](https://redirect.github.com/juanpicado) ### [`v6.4.0`](https://redirect.github.com/verdaccio/verdaccio/releases/tag/v6.4.0) [Compare Source](https://redirect.github.com/verdaccio/verdaccio/compare/v6.3.2...v6.4.0) #### Features ##### Package Filter Plugins ([#5786](https://redirect.github.com/verdaccio/verdaccio/issues/5786), [#5548](https://redirect.github.com/verdaccio/verdaccio/pull/5548)) by [@vsugrob](https://redirect.github.com/vsugrob), [@pyhp2017](https://redirect.github.com/pyhp2017) [@juanpicado](https://redirect.github.com/juanpicado) > ⚠️ Please help us to test this feature (it is pretty new and might be not perfect) ref > The `@verdaccio/package-filter` package is bundled by default but must be enabled by the user. `@verdaccio/package-filter` is a built-in plugin that intercepts package metadata from uplinks and removes versions matching configurable rules. With no rules configured, it acts as a no-op passthrough. ##### Block a compromised package version ```yaml filters: '@verdaccio/package-filter': block: - package: 'event-stream' versions: '3.3.6' ``` ##### Block an entire malicious scope ```yaml filters: '@verdaccio/package-filter': block: - scope: '@malicious' ``` ##### Quarantine recently published versions Hide versions published less than 7 days ago, giving time for review before adoption: ```yaml filters: '@verdaccio/package-filter': minAgeDays: 7 ``` ##### Freeze registry to a point in time Only serve versions published before a specific date: ```yaml filters: '@verdaccio/package-filter': dateThreshold: '2025-01-01' ``` ##### Whitelist trusted packages within blocked rules ```yaml filters: '@verdaccio/package-filter': minAgeDays: 30 allow: - scope: '@my-company' - package: 'trusted-pkg' ``` ##### Replace instead of remove Substitute a blocked version with the nearest older safe version, useful when removing it would break transitive dependencies: ```yaml filters: '@verdaccio/package-filter': block: - package: 'compromised-lib' versions: '>=3.0.0' strategy: replace ``` ##### Full example ```yaml filters: '@verdaccio/package-filter': minAgeDays: 7 block: - scope: '@malicious' - package: 'typosquat-pkg' - package: 'compromised-lib' versions: '>=3.0.0' strategy: replace allow: - scope: '@my-org' - package: 'compromised-lib' versions: '3.0.1' ``` #### Bug Fixes - fix(deps): Updated lodash to v4.18.1 ([#5777](https://redirect.github.com/verdaccio/verdaccio/issues/5777)) - fix(deps): Updated core @verdaccio/\* dependencies ([#5674](https://redirect.github.com/verdaccio/verdaccio/issues/5674), [#5780](https://redirect.github.com/verdaccio/verdaccio/issues/5780)) - fix(middleware): stream is not readable (http 500) [#5655](https://redirect.github.com/verdaccio/verdaccio/pull/5655) [@mbtools](https://redirect.github.com/mbtools) - fix: handle missing host header in URL basename resolution [`eabde8c`](https://redirect.github.com/verdaccio/verdaccio/commit/eabde8c980ea56c2bb0520e6cd24767458ebd9a0) [@juanpicado](https://redirect.github.com/juanpicado) - fix: replace deprecated `pseudoRandomBytes` with `randomBytes` from `node:crypto` [`eabde8c`](https://redirect.github.com/verdaccio/verdaccio/commit/eabde8c980ea56c2bb0520e6cd24767458ebd9a0) [@juanpicado](https://redirect.github.com/juanpicado) **Full Changelog**:

webpack/webpack (webpack)

### [`v5.106.1`](https://redirect.github.com/webpack/webpack/blob/HEAD/CHANGELOG.md#51061) [Compare Source](https://redirect.github.com/webpack/webpack/compare/v5.106.0...v5.106.1) ##### Patch Changes - Fix two ES5-environment regressions in the anonymous default export `.name` fix-up: the generated code referenced an undeclared `__WEBPACK_DEFAULT_EXPORT__` binding causing `ReferenceError`, and used `Reflect.defineProperty` which is not available in pre-ES2015 runtimes. The fix-up now references the real assignment target and uses `Object.defineProperty` / `Object.getOwnPropertyDescriptor`. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20796](https://redirect.github.com/webpack/webpack/pull/20796)) - Prevent `!important` from being renamed as a local identifier in CSS modules. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20798](https://redirect.github.com/webpack/webpack/pull/20798)) - Use compiler context instead of module context for CSS modules local ident hashing to avoid hash collisions when files with the same name exist in different directories. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20799](https://redirect.github.com/webpack/webpack/pull/20799)) ### [`v5.106.0`](https://redirect.github.com/webpack/webpack/blob/HEAD/CHANGELOG.md#51060) [Compare Source](https://redirect.github.com/webpack/webpack/compare/v5.105.4...v5.106.0) ##### Minor Changes - Add `exportType: "style"` for CSS modules to inject styles into DOM via HTMLStyleElement, similar to style-loader functionality. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20579](https://redirect.github.com/webpack/webpack/pull/20579)) - Add `context` option support for VirtualUrlPlugin (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20449](https://redirect.github.com/webpack/webpack/pull/20449)) - The context for the virtual module. A string path. Defaults to 'auto', which will try to resolve the context from the module id. - Support custom context path for resolving relative imports in virtual modules - Add examples demonstrating context usage and filename customization - Generate different `CssModule` instances for different `exportType` values. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20590](https://redirect.github.com/webpack/webpack/pull/20590)) - Added the `localIdentHashFunction` option to configure the hash function to be used for hashing. (by [@alexander-akait](https://redirect.github.com/alexander-akait) in [#20694](https://redirect.github.com/webpack/webpack/pull/20694)) Additionally, the `localIdentName` option can now be a function. - Added support for destructuring assignment `require` in cjs, allowing for tree shaking. (by [@ahabhgk](https://redirect.github.com/ahabhgk) in [#20548](https://redirect.github.com/webpack/webpack/pull/20548)) - Added the `validate` option to enable/disable validation in webpack/plugins/loaders, also implemented API to make it inside plugins. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20275](https://redirect.github.com/webpack/webpack/pull/20275)) - Added `source` support for async WASM modules. (by [@magic-akari](https://redirect.github.com/magic-akari) in [#20364](https://redirect.github.com/webpack/webpack/pull/20364)) ##### Patch Changes - Add a static getSourceBasicTypes method to the Module class to prevent errors across multiple versions. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20614](https://redirect.github.com/webpack/webpack/pull/20614)) - Included fragment groups in the conflicting order warning for CSS. (by [@aryanraj45](https://redirect.github.com/aryanraj45) in [#20660](https://redirect.github.com/webpack/webpack/pull/20660)) - Avoid rendering unused top-level `__webpack_exports__` declaration when output ECMA module library. (by [@hai-x](https://redirect.github.com/hai-x) in [#20669](https://redirect.github.com/webpack/webpack/pull/20669)) - Fixed resolving in CSS modules. (by [@alexander-akait](https://redirect.github.com/alexander-akait) in [#20771](https://redirect.github.com/webpack/webpack/pull/20771)) - Allow external modules place in async chunks when output ECMA module. (by [@hai-x](https://redirect.github.com/hai-x) in [#20662](https://redirect.github.com/webpack/webpack/pull/20662)) - Implement `deprecate` flag in schema for better TypeScript support to show which options are already deprecated by the configuration (by [@bjohansebas](https://redirect.github.com/bjohansebas) in [#20432](https://redirect.github.com/webpack/webpack/pull/20432)) - Set `.name` to `"default"` for anonymous default export functions and classes per ES spec (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20773](https://redirect.github.com/webpack/webpack/pull/20773)) - Hash entry chunks after runtime chunks to prevent stale content hash references in watch mode (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20724](https://redirect.github.com/webpack/webpack/pull/20724)) - Fix multiple bugs and optimizations in CSS modules: correct third code point position in walkCssTokens number detection, fix multiline CSS comment regex, fix swapped :import/:export error message, fix comma callback incorrectly popping balanced stack, fix cache comparison missing array length check, fix match.index mutation side effect, move publicPathAutoRegex to module scope, precompute merged callbacks in consumeUntil, simplify redundant ternary in CssGenerator, fix typo GRID\_TEMPLATE\_ARES, remove duplicate grid-column-start, and merge duplicate getCompilationHooks calls. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20648](https://redirect.github.com/webpack/webpack/pull/20648)) - Correct url() path resolution and preserve source maps for non-link CSS export types (style, text, css-style-sheet) (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20717](https://redirect.github.com/webpack/webpack/pull/20717)) - Emit error when proxy server returns non-200 status code in HttpUriPlugin instead of silently failing. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20646](https://redirect.github.com/webpack/webpack/pull/20646)) - `import.meta` as standalone expression now returns a complete object with known properties (`url`, `webpack`, `main`, `env`) instead of an empty object `({})`, and hoists it as a module-level variable to ensure `import.meta === import.meta` identity. In `preserve-unknown` mode (ESM output), the hoisted object merges runtime `import.meta` properties via `Object.assign`. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20658](https://redirect.github.com/webpack/webpack/pull/20658)) - Fix incorrect condition in FileSystemInfo that always evaluated to false, preventing trailing slash removal from directory paths during build dependency resolution. (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20649](https://redirect.github.com/webpack/webpack/pull/20649)) - fix: VirtualUrlPlugin absolute path virtual module IDs getting concatenated with compiler context (by [@xiaoxiaojx](https://redirect.github.com/xiaoxiaojx) in [#20656](https://redirect.github.com/webpack/webpack/pull/20656)) When a virtual module ID is an absolute path (e.g. `virtual:C:/project/user.js`), the auto-derived context was incorrectly joined with `compiler.context`, producing a concatenated path like `C:\cwd\C:\project`. Now absolute-path contexts are used directly. - All deprecated methods and options now have `@deprecated` flag in types. (by [@alexander-akait](https://redirect.github.com/alexander-akait) in [#20707](https://redirect.github.com/webpack/webpack/pull/20707)) - Fix `CompatibilityPlugin` to correctly rename `__webpack_require__` when it appears as an arrow function parameter (e.g. `(__webpack_module, __webpack_exports, __webpack_require__) => { ... }`). (by [@hai-x](https://redirect.github.com/hai-x) in [#20661](https://redirect.github.com/webpack/webpack/pull/20661))

--- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/AmadeusITGroup/otter).