This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@crxjs/vite-plugin](https://crxjs.dev/vite-plugin) ([source](https://redirect.github.com/crxjs/chrome-extension-tools/tree/HEAD/packages/vite-plugin)) | [`~2.4.0` → `~2.7.0`](https://renovatebot.com/diffs/npm/@crxjs%2fvite-plugin/2.4.0/2.7.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@crxjs%2fvite-plugin/2.7.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@crxjs%2fvite-plugin/2.4.0/2.7.0?slim=true) | dependencies | minor | | | [@jsverse/transloco](https://jsverse.gitbook.io/transloco/) ([source](https://redirect.github.com/jsverse/transloco)) | [`~8.3.0` → `~8.4.0`](https://renovatebot.com/diffs/npm/@jsverse%2ftransloco/8.3.0/8.4.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@jsverse%2ftransloco/8.4.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@jsverse%2ftransloco/8.3.0/8.4.0?slim=true) | devDependencies | minor | | | [@jsverse/transloco](https://jsverse.gitbook.io/transloco/) ([source](https://redirect.github.com/jsverse/transloco)) | [`~8.3.0` → `~8.4.0`](https://renovatebot.com/diffs/npm/@jsverse%2ftransloco/8.3.0/8.4.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@jsverse%2ftransloco/8.4.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@jsverse%2ftransloco/8.3.0/8.4.0?slim=true) | dependencies | minor | | | [@jsverse/transloco-messageformat](https://jsverse.gitbook.io/transloco/plugins/message-format) ([source](https://redirect.github.com/jsverse/transloco)) | [`~8.3.0` → `~8.4.0`](https://renovatebot.com/diffs/npm/@jsverse%2ftransloco-messageformat/8.3.0/8.4.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@jsverse%2ftransloco-messageformat/8.4.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@jsverse%2ftransloco-messageformat/8.3.0/8.4.0?slim=true) | devDependencies | minor | | | [@jsverse/transloco-messageformat](https://jsverse.gitbook.io/transloco/plugins/message-format) ([source](https://redirect.github.com/jsverse/transloco)) | [`~8.3.0` → `~8.4.0`](https://renovatebot.com/diffs/npm/@jsverse%2ftransloco-messageformat/8.3.0/8.4.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@jsverse%2ftransloco-messageformat/8.4.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@jsverse%2ftransloco-messageformat/8.3.0/8.4.0?slim=true) | dependencies | minor | | | [@openapitools/openapi-generator-cli](https://redirect.github.com/OpenAPITools/openapi-generator-cli) | [`~2.34.0` → `~2.38.0`](https://renovatebot.com/diffs/npm/@openapitools%2fopenapi-generator-cli/2.34.0/2.38.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@openapitools%2fopenapi-generator-cli/2.38.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@openapitools%2fopenapi-generator-cli/2.34.0/2.38.0?slim=true) | devDependencies | minor | `2.39.0` | | [@openapitools/openapi-generator-cli](https://redirect.github.com/OpenAPITools/openapi-generator-cli) | [`~2.34.0` → `~2.38.0`](https://renovatebot.com/diffs/npm/@openapitools%2fopenapi-generator-cli/2.34.0/2.38.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@openapitools%2fopenapi-generator-cli/2.38.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@openapitools%2fopenapi-generator-cli/2.34.0/2.38.0?slim=true) | dependencies | minor | `2.39.0` | | [@redocly/openapi-core](https://redirect.github.com/Redocly/redocly-cli) | [`~2.31.0` → `~2.34.0`](https://renovatebot.com/diffs/npm/@redocly%2fopenapi-core/2.31.6/2.34.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@redocly%2fopenapi-core/2.34.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@redocly%2fopenapi-core/2.31.6/2.34.0?slim=true) | devDependencies | minor | | | [@types/vscode](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/vscode) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/vscode)) | [`~1.120.0` → `~1.125.0`](https://renovatebot.com/diffs/npm/@types%2fvscode/1.120.0/1.125.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fvscode/1.125.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fvscode/1.120.0/1.125.0?slim=true) | devDependencies | minor | | | [@vercel/ncc](https://redirect.github.com/vercel/ncc) | [`~0.38.0` → `~0.44.0`](https://renovatebot.com/diffs/npm/@vercel%2fncc/0.38.4/0.44.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vercel%2fncc/0.44.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vercel%2fncc/0.38.4/0.44.0?slim=true) | devDependencies | minor | | | [actions/setup-java](https://redirect.github.com/actions/setup-java) | `v5.2.0` → `v5.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/actions%2fsetup-java/v5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/actions%2fsetup-java/v5.2.0/v5.3.0?slim=true) | action | minor | | | [lighthouse](https://redirect.github.com/GoogleChrome/lighthouse) | [`~13.3.0` → `~13.4.0`](https://renovatebot.com/diffs/npm/lighthouse/13.3.0/13.4.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lighthouse/13.4.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lighthouse/13.3.0/13.4.0?slim=true) | dependencies | minor | | | [lighthouse](https://redirect.github.com/GoogleChrome/lighthouse) | [`~13.3.0` → `~13.4.0`](https://renovatebot.com/diffs/npm/lighthouse/13.3.0/13.4.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lighthouse/13.4.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lighthouse/13.3.0/13.4.0?slim=true) | devDependencies | minor | | | [node](https://nodejs.org) ([source](https://redirect.github.com/nodejs/node)) | `24.16` → `24.17` | ![age](https://developer.mend.io/api/mc/badges/age/node-version/node/v24.17.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/node-version/node/v24.16.0/v24.17.0?slim=true) | | minor | | | [node](https://redirect.github.com/actions/node-versions) | `24.16` → `24.17` | ![age](https://developer.mend.io/api/mc/badges/age/github-releases/actions%2fnode-versions/24.17.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/actions%2fnode-versions/24.16.0/24.17.0?slim=true) | uses-with | minor | | | [sass](https://redirect.github.com/sass/dart-sass) | [`~1.100.0` → `~1.101.0`](https://renovatebot.com/diffs/npm/sass/1.100.0/1.101.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/sass/1.101.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass/1.100.0/1.101.0?slim=true) | devDependencies | minor | | | [sass](https://redirect.github.com/sass/dart-sass) | [`~1.100.0` → `~1.101.0`](https://renovatebot.com/diffs/npm/sass/1.100.0/1.101.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/sass/1.101.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass/1.100.0/1.101.0?slim=true) | dependencies | minor | | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/26) for more information. --- ### Release Notes

crxjs/chrome-extension-tools (@crxjs/vite-plugin)

### [`v2.7.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#270) ##### Minor Changes - [`9f00943`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/9f00943): Add dev HMR support for manifest-declared MAIN world content scripts. ##### Patch Changes - [`a9cc89a`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/a9cc89a): Remove unused vite-plugin dependencies and update selected dependency versions. ### [`v2.6.1`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#261) ##### Patch Changes - [`2b88621`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/2b88621): Coalesce file writer readiness waits so large dev-server graph updates do not repeatedly recompute the same dependency traversal. This also fixes late HMR readiness waits that could miss the shared ready event and delay content script updates. ### [`v2.6.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#260) ##### Minor Changes - [`4f5d2ec`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4f5d2ec): feat: add IIFE content script bundling Content scripts named with `.iife.ts` extension are automatically bundled as self-contained IIFE files with all dependencies inlined. This is useful for MAIN world content scripts used with `chrome.scripting.executeScript` or `chrome.scripting.registerContentScripts`. ##### Patch Changes - [`5316e9c`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/5316e9c): Allow `chrome-extension://` and `moz-extension://` origins in Vite dev-server CORS automatically. This keeps extension pages able to fetch dev-server files on Vite releases with the stricter localhost-only CORS default, including Vite `4.5.6`, `5.4.12`, and `6.0.9+`, without requiring projects to configure `server.cors.origin` manually. - [`1aee9ad`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/1aee9ad): fix: dynamic content scripts failing in build --watch mode - [`2f8bab5`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/2f8bab5): Fix the dev-mode loading page so it waits for the requested extension HTML file, preserves the page URL query string, allows extension-origin readiness polling, and throttles automatic reloads to avoid rapid flicker. - [`1681511`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/1681511): Expand vite-plugin CI to run e2e tests against supported Vite versions and fix compatibility issues exposed by the matrix. - [`0593d58`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/0593d58): fix: publish ESM declarations for the Vite plugin entrypoint ### [`v2.5.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#250) ##### Minor Changes - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat: add HMR support for CSS declared in manifest content\_scripts - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): add: browser\_specific\_settings.gecko properties - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Fix "TypeError: plugins is not iterable" error when using rolldown-vite (Vite 7). In rolldown-vite, the buildStart hook doesn't receive options.plugins. This fix uses the configResolved hook to get plugins from the resolved config, with buildStart kept as a fallback for older Vite versions. - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Fixed [#852](https://redirect.github.com/crxjs/chrome-extension-tools/issues/852), the plugin now emits a correct URL in `service-worker-loader.js` when the Vite option `server.https` is enabled. - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: resolve TypeScript types correctly for ESM and CJS consumers - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat: add Vite 8 beta support ##### Patch Changes - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): ci: migrate release workflow to npm trusted publishers - [`570312a`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/570312a): fix: sanitize colons from output filenames on Windows - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: copy CSS files declared in manifest content\_scripts to output - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Replace cheerio with node-html-parser to fix npm deprecation warning for whatwg-encoding. Also adds explicit vite peerDependency declaration (^3.0.0 through ^7.0.0) to enable proper version resolution when used with different vite versions. - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): ci: run compat tests against stable Vite 8, make the vite8 available as a peer dependency - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: UnoCSS/TailwindCSS HMR issues with virtual CSS modules - [`8a99b4f`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/8a99b4f): made data\_collection\_permissions optional - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: respect user's build.manifest setting in Vite 4+ When users set `build.manifest: false` in their Vite config, the Vite manifest file (`.vite/manifest.json` in Vite 5+, or `manifest.json` in older versions) is now properly removed from the output bundle. CRXJS internally requires the Vite manifest to derive content script resources during build, so it forces `build.manifest: true`. Previously, this meant the Vite manifest was always included in the output even if the user explicitly disabled it. Now, CRXJS removes the manifest from the bundle after processing if the user didn't want it. Closes [#1077](https://redirect.github.com/crxjs/chrome-extension-tools/issues/1077) - [`d364bd8`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/d364bd8): chore: upgrade chokidar to 5.0.0 - [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat(client): Update the style and content of the development mode loading page

jsverse/transloco (@jsverse/transloco)

### [`v8.4.0`](https://redirect.github.com/jsverse/transloco/blob/HEAD/CHANGELOG.md#840-2026-06-13) [Compare Source](https://redirect.github.com/jsverse/transloco/compare/bd284ecd5e14ee6b5cbee0d84e3432a749e49d6a...b2b52b3bbcb4d958522e3ccee3e64e422555f8c5) ##### 🚀 Features - **transloco:** transpile function arguments in FunctionalTranspiler ##### 🩹 Fixes - translateSignal utility missing injector for toSignal - **transloco-scoped-libs:** multi-scope i18n with join strategy ##### ❤️ Thank You - Dafnik - f-aubert - Ilshat Khamitov

OpenAPITools/openapi-generator-cli (@openapitools/openapi-generator-cli)

### [`v2.38.0`](https://redirect.github.com/OpenAPITools/openapi-generator-cli/releases/tag/v2.38.0) [Compare Source](https://redirect.github.com/OpenAPITools/openapi-generator-cli/compare/v2.37.0...v2.38.0) ##### Features - **release:** trigger a release after upgrading concurrently to newer versions ([#1225](https://redirect.github.com/OpenAPITools/openapi-generator-cli/issues/1225)) ([a265046](https://redirect.github.com/OpenAPITools/openapi-generator-cli/commit/a265046fbaf12cf9e5b2ac12b8e186e04a808f8f)) ### [`v2.37.0`](https://redirect.github.com/OpenAPITools/openapi-generator-cli/releases/tag/v2.37.0) [Compare Source](https://redirect.github.com/OpenAPITools/openapi-generator-cli/compare/v2.36.0...v2.37.0) ##### Features - **release:** trigger a release after upgrading deps to newer versions ([#1223](https://redirect.github.com/OpenAPITools/openapi-generator-cli/issues/1223)) ([899c037](https://redirect.github.com/OpenAPITools/openapi-generator-cli/commit/899c037e7e9262bb4a56f8b8959b04fce45ed63d)) ### [`v2.36.0`](https://redirect.github.com/OpenAPITools/openapi-generator-cli/releases/tag/v2.36.0) [Compare Source](https://redirect.github.com/OpenAPITools/openapi-generator-cli/compare/v2.35.0...v2.36.0) ##### Features - **release:** trigger a release after upgrading to node 22.x ([#1217](https://redirect.github.com/OpenAPITools/openapi-generator-cli/issues/1217)) ([8f69e5a](https://redirect.github.com/OpenAPITools/openapi-generator-cli/commit/8f69e5a08113a3853cc3ebe092a8bddead9c7bf8)) ### [`v2.35.0`](https://redirect.github.com/OpenAPITools/openapi-generator-cli/releases/tag/v2.35.0) [Compare Source](https://redirect.github.com/OpenAPITools/openapi-generator-cli/compare/v2.34.0...v2.35.0) ##### Features - **release:** v7.23.0 release ([#1214](https://redirect.github.com/OpenAPITools/openapi-generator-cli/issues/1214)) ([47787b9](https://redirect.github.com/OpenAPITools/openapi-generator-cli/commit/47787b95a82cdbeb13b3f0af5b80d48509035d68))

Redocly/redocly-cli (@redocly/openapi-core)

### [`v2.34.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.34.0) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.33.2...@redocly/openapi-core@2.34.0) ##### Minor Changes - Improved CLI install speed by bundling the CLI into a dependency-free package. **Warning:** The published package no longer ships runtime dependencies in `node_modules`. Plugins that relied on importing packages hoisted from the CLI (such as `@redocly/openapi-core`) must now declare those packages as their own dependencies. ### [`v2.33.2`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.33.2) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.33.1...@redocly/openapi-core@2.33.2) ##### Patch Changes - Fixed a path traversal in the `split` command that might have written files outside the chosen `--outDir`. - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.33.2. ### [`v2.33.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.33.1) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.33.0...@redocly/openapi-core@2.33.1) ##### Patch Changes - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.33.1. ### [`v2.33.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.33.0) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.32.2...@redocly/openapi-core@2.33.0) ##### Minor Changes - Added the `--component-names-strategy` option to the `bundle` command. This option allows a choice of how inline Schema components are named: `basename` (default) or `title` (from each schema's `title` field). ##### Patch Changes - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.33.0. ### [`v2.32.2`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.32.2) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.32.1...@redocly/openapi-core@2.32.2) ##### Patch Changes - Updated [@redocly/respect-core](https://redirect.github.com/redocly/respect-core) to v2.32.2. ### [`v2.32.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.32.1) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.32.0...@redocly/openapi-core@2.32.1) ##### Patch Changes - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.32.1. ### [`v2.32.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.32.0) [Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.31.6...@redocly/openapi-core@2.32.0) ##### Minor Changes - Added support for `junit` output in the `lint` command. ##### Patch Changes - Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.32.0.

vercel/ncc (@vercel/ncc)

### [`v0.44.0`](https://redirect.github.com/vercel/ncc/releases/tag/0.44.0) [Compare Source](https://redirect.github.com/vercel/ncc/compare/0.43.0...0.44.0) ##### Features - read permissions pr.yml ([#1323](https://redirect.github.com/vercel/ncc/issues/1323)) ([5ea625e](https://redirect.github.com/vercel/ncc/commit/5ea625ef32c0daf332fc1523f7e72be5d1dd7b24)) ### [`v0.43.0`](https://redirect.github.com/vercel/ncc/releases/tag/0.43.0) [Compare Source](https://redirect.github.com/vercel/ncc/compare/0.38.4...0.43.0) ##### Changes - BREAKING CHANGE: add Node 24 and 26 support, remove 20 ([#1318](https://redirect.github.com/vercel/ncc/issues/1318)) ([#1305](https://redirect.github.com/vercel/ncc/issues/1305)) - switch npm releases to trusted publishing (OIDC) ([#1325](https://redirect.github.com/vercel/ncc/issues/1325)) ([#1327](https://redirect.github.com/vercel/ncc/issues/1327)) ([#1328](https://redirect.github.com/vercel/ncc/issues/1328)) ([#1329](https://redirect.github.com/vercel/ncc/issues/1329)) ([#1330](https://redirect.github.com/vercel/ncc/issues/1330)) ([#1331](https://redirect.github.com/vercel/ncc/issues/1331)) ([#1332](https://redirect.github.com/vercel/ncc/issues/1332)) - switch package management to pnpm ([#1321](https://redirect.github.com/vercel/ncc/issues/1321)) - fix predictable global cache directory in /tmp enables symlink/hijack risks ([#1314](https://redirect.github.com/vercel/ncc/issues/1314)) - reorder extension resolution to prioritise TypeScript over JSON ([#1315](https://redirect.github.com/vercel/ncc/issues/1315)) - support TypeScript 6 transpile builds ([#1316](https://redirect.github.com/vercel/ncc/issues/1316))

actions/setup-java (actions/setup-java)

### [`v5.3.0`](https://redirect.github.com/actions/setup-java/releases/tag/v5.3.0) [Compare Source](https://redirect.github.com/actions/setup-java/compare/v5.2.0...v5.3.0) ##### What's Changed - chore: update Java version to 25 in setup examples by [@alaahong](https://redirect.github.com/alaahong) in [#969](https://redirect.github.com/actions/setup-java/pull/969) - Bump minimatch from 3.1.2 to 3.1.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#984](https://redirect.github.com/actions/setup-java/pull/984) - Refactor error handling and improve test logging for installers by [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#989](https://redirect.github.com/actions/setup-java/pull/989) - chore: upgrade dependencies ([@actions/core](https://redirect.github.com/actions/core), cache, glob, http-client, tool-cache, xmlbuilder2) by [@Copilot](https://redirect.github.com/Copilot) in [#999](https://redirect.github.com/actions/setup-java/pull/999) - Add Oracle JDK 17 licensing limitation note by [@mahabaleshwars](https://redirect.github.com/mahabaleshwars) in [#1001](https://redirect.github.com/actions/setup-java/pull/1001) - Update readme for ubuntu sudo java\_home behavior by [@mahabaleshwars](https://redirect.github.com/mahabaleshwars) in [#1013](https://redirect.github.com/actions/setup-java/pull/1013) - temurin: add support for Alpine Linux by [@gdams](https://redirect.github.com/gdams) in [#674](https://redirect.github.com/actions/setup-java/pull/674) - fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by [@gdams](https://redirect.github.com/gdams) in [#1015](https://redirect.github.com/actions/setup-java/pull/1015) - Bump [@typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) from 8.35.1 to 8.48.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#952](https://redirect.github.com/actions/setup-java/pull/952) - Bump eslint-config-prettier from 8.10.0 to 10.1.8 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#881](https://redirect.github.com/actions/setup-java/pull/881) - Bump picomatch, [@types/jest](https://redirect.github.com/types/jest), jest, jest-circus and ts-jest by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1016](https://redirect.github.com/actions/setup-java/pull/1016) - Bump [@types/node](https://redirect.github.com/types/node) from 24.1.0 to 25.9.3 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#950](https://redirect.github.com/actions/setup-java/pull/950) - Implement pagination with link headers for Adoptium based apis by [@johnoliver](https://redirect.github.com/johnoliver) in [#1014](https://redirect.github.com/actions/setup-java/pull/1014) - Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by [@johnoliver](https://redirect.github.com/johnoliver) in [#522](https://redirect.github.com/actions/setup-java/pull/522) - Bump [@vercel/ncc](https://redirect.github.com/vercel/ncc) from 0.38.1 to 0.44.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#1018](https://redirect.github.com/actions/setup-java/pull/1018) ##### New Contributors - [@alaahong](https://redirect.github.com/alaahong) made their first contribution in [#969](https://redirect.github.com/actions/setup-java/pull/969) - [@Copilot](https://redirect.github.com/Copilot) made their first contribution in [#999](https://redirect.github.com/actions/setup-java/pull/999) - [@johnoliver](https://redirect.github.com/johnoliver) made their first contribution in [#1014](https://redirect.github.com/actions/setup-java/pull/1014) **Full Changelog**:

GoogleChrome/lighthouse (lighthouse)

### [`v13.4.0`](https://redirect.github.com/GoogleChrome/lighthouse/blob/HEAD/changelog.md#1340-2026-06-09) [Compare Source](https://redirect.github.com/GoogleChrome/lighthouse/compare/v13.3.0...v13.4.0) [Full Changelog](https://redirect.github.com/GoogleChrome/lighthouse/compare/v13.3.0...v13.4.0) We expect this release to ship in the DevTools of [Chrome 151](https://chromiumdash.appspot.com/schedule), and to PageSpeed Insights within 2 weeks. #### New contributors Thanks to our new contributors 👽🐷🐰🐯🐻! - Thomas Steiner [@tomayac](https://redirect.github.com/tomayac) - KS Nithin [@Nithin0620](https://redirect.github.com/Nithin0620) - Emanuele [@emazack](https://redirect.github.com/emazack) - Kirtikumar Anandrao Ramchandani [@KirtiRamchandani](https://redirect.github.com/KirtiRamchandani) - Rin [@RinZ27](https://redirect.github.com/RinZ27) - Michael Hablich [@natorion](https://redirect.github.com/natorion) #### Core - canonical: improve validation for invalid URLs ([#16765](https://redirect.github.com/GoogleChrome/lighthouse/pull/16765)) - llms-txt: allow leading whitespace for header check ([#17057](https://redirect.github.com/GoogleChrome/lighthouse/pull/17057)) - geolocation-on-start: mention `geolocation` element ([#16835](https://redirect.github.com/GoogleChrome/lighthouse/pull/16835)) - add public Lighthouse types entrypoint ([#17028](https://redirect.github.com/GoogleChrome/lighthouse/pull/17028)) - match scripts to network requests using frameId ([#16774](https://redirect.github.com/GoogleChrome/lighthouse/pull/16774)) - config: import LH types ([#17048](https://redirect.github.com/GoogleChrome/lighthouse/pull/17048)) - driver: add ExecutionContext.evaluateOnObject ([#17050](https://redirect.github.com/GoogleChrome/lighthouse/pull/17050)) - driver: check if usage data exists before using ([#17033](https://redirect.github.com/GoogleChrome/lighthouse/pull/17033)) #### Report - fix performance gauge label, improve load animation ([#17045](https://redirect.github.com/GoogleChrome/lighthouse/pull/17045)) - decouple link creation from link details rendering ([#17049](https://redirect.github.com/GoogleChrome/lighthouse/pull/17049)) - viewer: persist dark mode when when changing langauge ([#17063](https://redirect.github.com/GoogleChrome/lighthouse/pull/17063)) #### Deps - upgrade deps ([#17070](https://redirect.github.com/GoogleChrome/lighthouse/pull/17070)) - upgrade typescript to 6.0.3 ([#17060](https://redirect.github.com/GoogleChrome/lighthouse/pull/17060)) - upgrade terser to 5.48.0 ([#17059](https://redirect.github.com/GoogleChrome/lighthouse/pull/17059)) - upgrade esbuild to 0.28.0 ([#17058](https://redirect.github.com/GoogleChrome/lighthouse/pull/17058)) - upgrade trace\_engine to 0.0.65 ([#17046](https://redirect.github.com/GoogleChrome/lighthouse/pull/17046)) - upgrade puppeteer to 25.0.2 ([#17019](https://redirect.github.com/GoogleChrome/lighthouse/pull/17019)) #### Clients - viewer: prevent toast showing on load ([#17069](https://redirect.github.com/GoogleChrome/lighthouse/pull/17069)) - viewer: clear github auth token on 401 error ([#17064](https://redirect.github.com/GoogleChrome/lighthouse/pull/17064)) - viewer: disable agentic-browsing in PSI api call ([#17041](https://redirect.github.com/GoogleChrome/lighthouse/pull/17041)) #### I18n - import ([#17071](https://redirect.github.com/GoogleChrome/lighthouse/pull/17071)) #### Docs - add agentic web issue template ([#17020](https://redirect.github.com/GoogleChrome/lighthouse/pull/17020)) #### Tests - exclude origin-isolation-coop-present smoke test ([#17072](https://redirect.github.com/GoogleChrome/lighthouse/pull/17072)) - remove accidental .only ([#17042](https://redirect.github.com/GoogleChrome/lighthouse/pull/17042)) - remove unused c8 ([#16845](https://redirect.github.com/GoogleChrome/lighthouse/pull/16845)) - llms-txt: add coverage for network failure and heading edge cases ([#17040](https://redirect.github.com/GoogleChrome/lighthouse/pull/17040)) - viewer: update psi key ([#17037](https://redirect.github.com/GoogleChrome/lighthouse/pull/17037)) #### Misc - migrate typescript moduleResolution to bundler ([#17061](https://redirect.github.com/GoogleChrome/lighthouse/pull/17061)) - build: generate subset of web-features data ([#17047](https://redirect.github.com/GoogleChrome/lighthouse/pull/17047)) - ci: add Node 26 to unit matrix ([#17062](https://redirect.github.com/GoogleChrome/lighthouse/pull/17062)) - ci: bump actions/upload-artifact from 4 to 7 ([#16938](https://redirect.github.com/GoogleChrome/lighthouse/pull/16938))

nodejs/node (node)

### [`v24.17.0`](https://redirect.github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95 [Compare Source](https://redirect.github.com/nodejs/node/compare/v24.16.0...v24.17.0) This is a security release. ##### Notable Changes - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low ##### Commits - \[[`9e4dfc7bba`](https://redirect.github.com/nodejs/node/commit/9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://redirect.github.com/nodejs-private/node-private/pull/878) - \[[`cb2aed980c`](https://redirect.github.com/nodejs/node/commit/cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://redirect.github.com/nodejs-private/node-private/pull/890) - \[[`a8a0d12875`](https://redirect.github.com/nodejs/node/commit/a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#62891](https://redirect.github.com/nodejs/node/pull/62891) - \[[`66e6203c1c`](https://redirect.github.com/nodejs/node/commit/66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#62891](https://redirect.github.com/nodejs/node/pull/62891) - \[[`dd627ced27`](https://redirect.github.com/nodejs/node/commit/dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://redirect.github.com/nodejs/node/pull/63820) - \[[`684bae568f`](https://redirect.github.com/nodejs/node/commit/684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://redirect.github.com/nodejs/node/pull/63820) - \[[`3a631e7f83`](https://redirect.github.com/nodejs/node/commit/3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#62656](https://redirect.github.com/nodejs/node/pull/62656) - \[[`cf44df3996`](https://redirect.github.com/nodejs/node/commit/cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#63703](https://redirect.github.com/nodejs/node/pull/63703) - \[[`138c70294b`](https://redirect.github.com/nodejs/node/commit/138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://redirect.github.com/nodejs-private/node-private/pull/868) - \[[`be7e719c3f`](https://redirect.github.com/nodejs/node/commit/be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://redirect.github.com/nodejs-private/node-private/pull/846) - \[[`cc7c11b4d1`](https://redirect.github.com/nodejs/node/commit/cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://redirect.github.com/nodejs-private/node-private/pull/855) - \[[`9224427b92`](https://redirect.github.com/nodejs/node/commit/9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://redirect.github.com/nodejs-private/node-private/pull/867) - \[[`cf85d54839`](https://redirect.github.com/nodejs/node/commit/cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://redirect.github.com/nodejs-private/node-private/pull/873) - \[[`a1bbc24f96`](https://redirect.github.com/nodejs/node/commit/a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://redirect.github.com/nodejs-private/node-private/pull/870) - \[[`e3723ff2d6`](https://redirect.github.com/nodejs/node/commit/e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854) - \[[`a77af4867b`](https://redirect.github.com/nodejs/node/commit/a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854) - \[[`31beb4f707`](https://redirect.github.com/nodejs/node/commit/31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://redirect.github.com/nodejs-private/node-private/pull/857) - \[[`8e75c73f91`](https://redirect.github.com/nodejs/node/commit/8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://redirect.github.com/nodejs-private/node-private/pull/869)

actions/node-versions (node)

### [`v24.17.0`](https://redirect.github.com/actions/node-versions/releases/tag/24.17.0-27765711116): 24.17.0 [Compare Source](https://redirect.github.com/actions/node-versions/compare/24.16.0-26265092718...24.17.0-27765711116) Node.js 24.17.0

sass/dart-sass (sass)

### [`v1.101.0`](https://redirect.github.com/sass/dart-sass/blob/HEAD/CHANGELOG.md#11010) [Compare Source](https://redirect.github.com/sass/dart-sass/compare/1.100.0...1.101.0) - **Potentially breaking bug fix:** The Node package importer now properly supports resolving import-only variants of Sass files declared in the `exports`, `sass`, and `style` fields of `package.json`. Previously, these files were ignored even when loaded via `@import`, so any code relying on loading module-system-only files this way may break.

--- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/AmadeusITGroup/otter).