fix(deps): update docs-site-runtime-tooling by renovate[bot] · Pull Request #143 · CMLPlatform/relab

renovate · 2026-04-24T10:44:42Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@astrojs/starlight (source)	`^0.38.3` → `^0.41.0`	dependencies	minor
caddy	`8344681` → `5f5c864`	final	digest
docker/dockerfile	→ `87999aa`	syntax	pinDigest
markdownlint-cli2	`^0.22.1` → `^0.23.0`	devDependencies	minor
node	`d8e448a` → `b31e7a4`	stage	digest
pnpm (source)	`10.33.0` → `10.34.4`	packageManager	minor

Release Notes

withastro/starlight (@astrojs/starlight)

`v0.41.3`

Compare Source

Patch Changes

#3911 1686ecc Thanks @timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

`v0.41.2`

Compare Source

Patch Changes

#4008 58a3520 Thanks @FrancoKaddour! - Fixes the table of contents overflowing the right edge of the viewport when a custom --sl-content-width value exceeds available space
#4015 bdbfffc Thanks @delucis! - Fixes an issue where aside icons were rendered incorrectly in projects where Astro’s MDX integration had optimization disabled

`v0.41.1`

Compare Source

Patch Changes

#3967 72e63dc Thanks @HiDeoo! - Adds 2 new icons: link and link-alt.
#3988 ac55cfa Thanks @delucis! - Fixes a dependency resolution issue introduced in Starlight v0.41
#3967 72e63dc Thanks @HiDeoo! - Optimizes the icons of Markdown asides.

`v0.41.0`

Compare Source

Minor Changes

#3951 1202dd4 Thanks @HiDeoo! - Adds support for Astro v7, drops support for Astro v6.

Upgrade Astro and dependencies

⚠️ BREAKING CHANGE: Astro v6 is no longer supported. Make sure you update Astro and any other official integrations at the same time as updating Starlight:

npx @&#8203;astrojs/upgrade

Community Starlight plugins and Astro integrations may also need to be manually updated to work with Astro v7. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 111 (released 07 March 2023) and Safari-based browsers prior to version 16.4 (released 27 March 2023). You can find a list of currently supported browsers and their versions using this browserslist query.

Patch Changes

#3953 a935d33 Thanks @HiDeoo! - Fixes Starlight Markdown processing being potentially applied to files that should not be processed.

`v0.40.0`

Compare Source

Minor Changes

#3923 edf2e6b Thanks @Princesseuh! - Adds support for Astro 6.4 and the new Sätteri Markdown processor.

It is now possible to opt into using Astro's 6.4 Sätteri Markdown processor by installing the @astrojs/markdown-satteri package and configuring it in your astro.config.mjs file:
```
// astro.config.mjs

import { defineConfig } from 'astro/config';
import { satteri } from '@&#8203;astrojs/markdown-satteri';

export default defineConfig({
  markdown: {
    processor: satteri(),
  },
});
```
⚠️ BREAKING CHANGE: The minimum supported version of Astro is now v6.4.5.

Please update Starlight and Astro together:
```
npx @&#8203;astrojs/upgrade
```
Community Starlight plugins and Astro integrations may also need to be manually updated to work with Sätteri. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

Patch Changes

#3923 edf2e6b Thanks @Princesseuh! - Updates Expressive Code to version 0.43.1.

`v0.39.3`

Compare Source

Patch Changes

#3910 dddf405 Thanks @andreialba! - Improves Romanian UI translations
#3924 02f2ce1 Thanks @BouRock! - Improves Turkish UI translations
#3928 11a7ed2 Thanks @delucis! - Updates Pagefind to v1.5 and adds support for Pagefind’s new diacriticSimilarity and metaWeights advanced ranking options
#3927 e944870 Thanks @HiDeoo! - Refactors internal file path handling for Starlight content collections.

`v0.39.2`

Compare Source

Patch Changes

#3890 2d05e18 Thanks @tats-u! - Fixes CSS selector for text-autospace styles in Chromium browsers

`v0.39.1`

Compare Source

Patch Changes

#3885 010eed1 Thanks @ArmandPhilippot! - Fixes the version mentioned in an error message related to autogenerated sidebar groups support.
#3887 b3c6990 Thanks @delucis! - Adds 13 new icons: clock, desktop, mobile-android, window, database, server, code-branch, notes, question, question-circle, analytics, padlock, and solidjs.

`v0.39.0`

Compare Source

Minor Changes

#3618 dcf6d09 Thanks @HiDeoo! - ⚠️ BREAKING CHANGE: This release changes how autogenerated links work in Starlight’s sidebar configuration.

If you have sidebar groups using the autogenerate key, you must now wrap that configuration in an items array:
```
{
    label: 'My group',
-   autogenerate: { directory: 'some-dir' },
+   items: [{ autogenerate: { directory: 'some-dir' } }],
}
```
This change unlocks the possibility to mix autogenerated links and other links in a single group, for example:
```
{
  label: 'Mixed group',
  items: [
    'example-page',
    { autogenerate: { directory: 'examples' } },
    { label: 'More examples', link: 'https://example.com' },
  ],
}
```
This release also updates the shape of autogenerated sidebar entries in route data. Autogenerated links and groups in Astro.locals.starlightRoute.sidebar now include an autogenerate object with the configured directory value:
```
{
  type: 'link',
  label: 'Example',
  href: '/examples/example/',
  isCurrent: false,
  autogenerate: { directory: 'examples' }
}
```
#3618 dcf6d09 Thanks @HiDeoo! - ⚠️ BREAKING CHANGE: This release changes the default collapsed state of autogenerated sidebar subgroups.

Autogenerated subgroups no longer inherit the collapsed value from their parent group. They are now expanded by default unless explicitly configured with autogenerate.collapsed.

If your sidebar configuration relies on a collapsed parent group to also collapse its autogenerated subgroups, update your configuration to set autogenerate.collapsed to true:
```
{
  label: 'Reference',
  collapsed: true,
  items: [
-   { autogenerate: { directory: 'reference' } },
+   { autogenerate: { directory: 'reference', collapsed: true } },
  ],
}
```
#3845 4d755f5 Thanks @delucis! - Adds a <link rel="alternate" hreflang="x-default" href="..."> tag pointing to the default locale in multilingual sites. The x-default alternate is used as a signal of which language to fall back to if no other is available. Learn more in Google’s SEO localization docs.
#3862 ec70630 Thanks @itrew! - Makes spacing of items in nested lists more consistent
#3872 417a66c Thanks @tats-u! - Enables the CSS property text-autospace in Chinese and Japanese documents.

If you would prefer to disable autospacing in Chinese and Japanese pages, you can add the following custom CSS to your site:
```
[lang]:where(:lang(zh, ja)) {
  text-autospace: initial;
}
```
#3797 9764ebd Thanks @delucis! - Avoids the risk of layout shift when users expand and collapse sidebar groups

This release can introduce additional padding to the site sidebar on certain devices to reserve space for scrollbars. You may wish to inspect your site sidebar visually when upgrading.

If you would prefer to keep the previous styling, you can add the following custom CSS to your site:
```
.sidebar-pane {
  scrollbar-gutter: auto;
}
```
#3858 6672c35 Thanks @delucis! - Updates i18next, used for Starlight’s localization APIs, from v23 to v26

There should not be any user-facing changes from this update

`v0.38.5`

Compare Source

Patch Changes

#3854 ccf6000, #3877 47451bc Thanks @delucis! - Updates internal dependencies

`v0.38.4`

Compare Source

Patch Changes

#3828 342038b Thanks @MangelMaxime! - Fixes aside styling when used without any content
#3853 563e11b Thanks @delucis! - Fixes a type-checking issue for users on newer versions of TypeScript

DavidAnson/markdownlint-cli2 (markdownlint-cli2)

`v0.23.0`

Compare Source

Add overrides configuration option
Improve options/configuration file handling
Update dependencies (including markdownlint)
Remove support for end-of-life Node 20

pnpm/pnpm (pnpm)

`v10.34.4`: pnpm 10.34.4

Compare Source

Patch Changes

352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.

Platinum Sponsors

Gold Sponsors

`v10.34.3`: pnpm 10.34.3

Compare Source

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:

the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
registry URLs in pnpm-workspace.yaml.

This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).

Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.

If your authentication broke after upgrading, move the token out of the committed .npmrc:

# Writes to your user/global config, not the repository:
pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"

Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.

See https://pnpm.io/npmrc for full migration details.

Patch Changes

Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.

Platinum Sponsors

Gold Sponsors

`v10.34.2`: pnpm 10.34.2

Compare Source

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:

the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
registry URLs in pnpm-workspace.yaml.

This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).

Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.

If your authentication broke after upgrading, move the token out of the committed .npmrc:

# Writes to your user/global config, not the repository:
pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"

Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.

See https://pnpm.io/npmrc for full migration details.

Patch Changes

Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.

Platinum Sponsors

Gold Sponsors

`v10.34.1`: pnpm 10.34.1

Compare Source

Patch Changes

Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Gold Sponsors

`v10.34.0`: pnpm 10.34

Compare Source

Minor Changes

Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.

pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.

The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.

--force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.

Patch Changes

Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml were not loaded when pnpm was invoked from outside <dir> #11535.
Reject dependency aliases that contain path-traversal segments (such as @x/../../../../../.git/hooks) when reading them from a package manifest or symlinking them into node_modules. A malicious registry package could otherwise use a transitive dependency key to make pnpm install create symlinks at attacker-chosen paths outside the intended node_modules directory.

Platinum Sponsors

Gold Sponsors

`v10.33.4`: pnpm 10.33.4

Compare Source

Patch Changes

Pin the integrity of git-hosted tarballs (codeload.github.com, gi

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added dependencies renovate containers runtime-risk labels Apr 24, 2026

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch from 1b76816 to 2837847 Compare April 25, 2026 12:51

renovate Bot added the automerge label Apr 25, 2026

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch from 2837847 to f2804cb Compare April 26, 2026 13:18

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch 5 times, most recently from c9358b4 to 96eb568 Compare May 10, 2026 13:34

renovate Bot changed the title ~~chore(deps): pin dependencies~~ fix(deps): update docs-site-runtime-tooling May 10, 2026

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch 3 times, most recently from e72f4d9 to c579a0a Compare May 14, 2026 09:55

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch 5 times, most recently from c46078a to 799d3fa Compare May 21, 2026 22:39

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch 5 times, most recently from 9f6e5c4 to 5967a00 Compare June 4, 2026 09:43

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch 4 times, most recently from 6b7348f to d0b76c8 Compare June 14, 2026 17:09

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch 7 times, most recently from 4f89b76 to 3076632 Compare June 25, 2026 02:01

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch from 3076632 to e45764c Compare June 26, 2026 23:55

fix(deps): update docs-site-runtime-tooling

d2fd878

renovate Bot force-pushed the renovate/docs-site-runtime-tooling branch from e45764c to d2fd878 Compare July 4, 2026 09:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update docs-site-runtime-tooling#143

fix(deps): update docs-site-runtime-tooling#143
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/docs-site-runtime-tooling

renovate Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Upgrade Astro and dependencies

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

v10.34.4: pnpm 10.34.4

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.3: pnpm 10.34.3

⚠️ Security fix — environment variables in a project .npmrc (action may be required)

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.2: pnpm 10.34.2

⚠️ Security fix — environment variables in a project .npmrc (action may be required)

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.1: pnpm 10.34.1

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.0: pnpm 10.34

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.33.4: pnpm 10.33.4

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 24, 2026 •

edited

Loading

`v10.34.4`: pnpm 10.34.4

`v10.34.3`: pnpm 10.34.3

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

`v10.34.2`: pnpm 10.34.2

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

`v10.34.1`: pnpm 10.34.1

`v10.34.0`: pnpm 10.34

`v10.33.4`: pnpm 10.33.4