fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@apollo/server (source)	^5.4.0 → ^5.5.0			devDependencies	patch
@commitlint/cli (source)	^20.5.0 → ^20.5.3			devDependencies	patch
@commitlint/config-conventional (source)	^20.5.0 → ^20.5.3			devDependencies	patch
@favware/cliff-jumper	^6.0.0 → ^6.1.0			devDependencies	minor
@graphql-codegen/cli (source)	^6.2.1 → ^6.3.1			devDependencies	minor
@graphql-codegen/schema-ast (source)	^5.0.1 → ^5.0.2			devDependencies	patch
@swc/core (source)	1.15.18 → 1.15.32			devDependencies	patch
@types/koa (source)	^3.0.1 → ^3.0.2			devDependencies	patch
@vitest/coverage-v8 (source)	^4.1.0 → ^4.1.5			devDependencies	patch
docker/build-push-action	v7.0.0 → v7.1.0			action	minor
docker/login-action	v4.0.0 → v4.1.0			action	minor
graphql	16.13.1 → 16.13.2			dependencies	patch
koa (source)	^3.1.2 → ^3.2.0			devDependencies	minor
node (source)	24.14.0 → 24.15.0			volta	minor
prettier (source)	^3.8.1 → ^3.8.3			devDependencies	patch
vitest (source)	^4.1.0 → ^4.1.5			devDependencies	patch
yarn (source)	4.12.0 → 4.14.1			packageManager	minor

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.5.2

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

favware/cliff-jumper (@​favware/cliff-jumper)

v6.1.0

Compare Source

🐛 Bug Fixes

• deps: Update dependency smol-toml to ^1.6.1 (bc7a346) (#​303)
• deps: Update all non-major dependencies (dfce8f5) (#​296)
• deps: Update all non-major dependencies (d859ac9) (#​293)
• deps: Update all non-major dependencies (eaac1d2) (#​292)
• deps: Update all non-major dependencies (c929553) (#​291)
• deps: Update dependency smol-toml to ^1.6.0 (f9e7661) (#​287)
• deps: Update dependency git-cliff to ^2.11.0 (d7fa532) (#​286)
• deps: Update all non-major dependencies (236dc82) (#​283)
• deps: Update all non-major dependencies (e595c59) (#​280)
• deps: Update all non-major dependencies (fb55e53) (#​277)
• deps: Update all non-major dependencies (026d30a) (#​275)
• deps: Update all non-major dependencies (7f22325) (#​274)
• deps: Update all non-major dependencies (c216d79) (#​270)
• deps: Update all non-major dependencies (2ffd637) (#​269)
• deps: Update all non-major dependencies (5ad8486) (#​268)
• deps: Update all non-major dependencies (ad3837d) (#​260)
• deps: Update all non-major dependencies (b274e80) (#​259)
• deps: Update all non-major dependencies (b565a7b) (#​257)
• deps: Update all non-major dependencies (88192c5) (#​256)
• deps: Update all non-major dependencies (9ee2fe8) (#​255)
• deps: Update all non-major dependencies (31e2532) (#​251)
• deps: Update octokit monorepo (33182ae) (#​252)
• deps: Update dependency commander to v14 (fcab80c) (#​250)
• deps: Update all non-major dependencies (9ab2eb3) (#​249)
• deps: Update all non-major dependencies (fa29541) (#​247)
• deps: Update all non-major dependencies (91c8e32) (#​246)
• deps: Update all non-major dependencies (f483841) (#​242)
• deps: Update dependency conventional-recommended-bump to v11 (5958382) (#​238)
• deps: Update all non-major dependencies (be692db) (#​236)
• deps: Update all non-major dependencies (60d8186) (#​232)
• deps: Update all non-major dependencies (fbc3065) (#​231)
• deps: Update all non-major dependencies (7330784) (#​230)
• deps: Update dependency @​octokit/plugin-retry to ^7.1.3 (c582989) (#​227)

🚀 Features

• Add github-base-url option to publish to GHES and GHEC (51cbf49)

dotansimha/graphql-code-generator (@​graphql-codegen/cli)

v6.3.1

Compare Source

Patch Changes

• #​10737
  be85118
  Thanks @​eddeee888! - Fix issue where same SDL in different
  documents are ignored when handling documents vs externalDocuments

v6.3.0

Compare Source

Minor Changes

• #​10659
  e65d303
  Thanks @​ikusakov2! - Add support for externalDocuments

  externalDocuments declares GraphQL documents that will be read but will not have type files
  generated for them. These documents are available to plugins for type resolution (e.g. fragment
  types), but no output files will be generated based on them. Accepts the same formats as
  documents.

  This config option is useful for monorepos where each project may want to generate types for its
  own documents, but some may need to read shared fragments from across projects.

Patch Changes

• Updated dependencies
  [9a66574,
  9a66574,
  9a66574,
  e65d303]:
  • @​graphql-codegen/client-preset@​5.3.0
  • @​graphql-codegen/core@​5.0.2
  • @​graphql-codegen/plugin-helpers@​6.3.0

dotansimha/graphql-code-generator (@​graphql-codegen/schema-ast)

v5.0.2

Compare Source

Patch Changes

• #​10103
  9a66574
  Thanks @​renovate! - dependencies updates:
  • Updated dependency tslib@^2.8.0 ↗︎ (from
    ~2.6.0, in dependencies)
• Updated dependencies
  [9a66574,
  e65d303]:
  • @​graphql-codegen/plugin-helpers@​6.3.0

swc-project/swc (@​swc/core)

v1.15.32

Compare Source

Bug Fixes

• (es/flow) Fix Flow type-only modules in script transforms (#​11817) (be38316)

• (es/flow) Avoid restoring module context when flow syntax is enabled (#​11819) (3ed7243)

• (es/minifier) Preserve frozen spread registry keys (#​11825) (347181c)

• (es/parser) Align Flow generic arrow JSX disambiguation (#​11821) (28a7fad)

Features

• (es) Add jsc.preserveSymlinks to swc::Options (#​11813) (fe38342)

v1.15.30

Compare Source

Bug Fixes

• (deploy) Fix musl binding test workflow (#​11804) (c30a522)

• (deploy) Build package ts before Linux GNU binding tests (#​11806) (a3d3ef3)

• (es/jsx) Preserve quoted JSX attribute newlines (#​11796) (9fe56c8)

• (es/minifier) Support full ES version parsing in minify (#​11800) (af1f08f)

• (es/module) Add opt-in symlink-preserving resolver (#​11801) (6028240)

• (es/parser) Allow return type annotation on Flow constructors (#​11790) (d66b29c)

• (es/parser) Support Flow anonymous keyof indexers (#​11792) (452c4e5)

• (es/parser) Add Flow strip RN and RNW regression corpus (#​11799) (23a9109)

Documentation

• Require PR template for pull requests (#​11793) (3a1084a)

Features

• (es/minify) Support extracting comments (#​11798) (5986411)

v1.15.26

Compare Source

v1.15.24

Compare Source

v1.15.21

Compare Source

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.5

Compare Source

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @​BartWaardenburg and @​AriPerkkio in #​10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @​felamaslen in #​10131 (9423d)
• Project color label on html reporter  -  by @​hi-ogawa in #​10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @​hi-ogawa in #​10163 (122c2)
• Alias agent reporter to minimal  -  by @​sheremet-va in #​10157 (663b9)
• Respect diff config options in soft assertions  -  by @​Copilot, sheremet-va and @​sheremet-va in #​8696 (9787d)
• Respect diff config options in soft assertions "  -  by @​sheremet-va in #​8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @​Yejneshwar in #​10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @​DaveT1991 and @​AriPerkkio in #​10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @​hi-ogawa and Codex in #​10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @​hi-ogawa in #​10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @​whitphx and Claude Opus 4.6 (1M context) in #​9927 and #​10124 (7ad7d)
• api: Make test-specification options writable  -  by @​sheremet-va in #​10154 (6abd5)

    View changes on GitHub

v4.1.4

Compare Source

   🚀 Features

• coverage:
  • Default to text reporter skipFull if agent detected  -  by @​hi-ogawa in #​10018 (53757)
• experimental:
  • Expose assertion as a public field  -  by @​sheremet-va in #​10095 (a120e)
  • Support aria snapshot  -  by @​hi-ogawa, Claude Opus 4.6 (1M context), @​AriPerkkio, Codex and @​sheremet-va in #​9668 (d4fbb)
• reporter:
  • Add filterMeta option to json reporter  -  by @​nami8824 and @​sheremet-va in #​10078 (b77de)

   🐞 Bug Fixes

• Use "black" foreground for labeled terminal message to ensure contrast  -  by @​hi-ogawa in #​10076 (203f0)
• Make expect(..., message) consistent as error message prefix  -  by @​hi-ogawa and Codex in #​10068 (a1b5f)
• Do not hoist imports whose names match class properties .  -  by @​SunsetFi in #​10093 and #​10094 (0fc4b)
• browser: Spread user server options into browser Vite server in project  -  by @​GoldStrikeArch in #​10049 (65c9d)

    View changes on GitHub

v4.1.3

Compare Source

   🚀 Experimental Features

• Add experimental.preParse flag  -  by @​sheremet-va in #​10070 (78273)
• Support browser.locators.exact option  -  by @​sheremet-va in #​10013 (48799)
• Add TestAttachment.bodyEncoding  -  by @​hi-ogawa in #​9969 (89ca0)
• Support custom snapshot matcher  -  by @​hi-ogawa, Claude Sonnet 4.6 and Codex in #​9973 (59b0e)

   🐞 Bug Fixes

• Advance fake timers with expect.poll interval  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​10022 (3f5bf)
• Add @vitest/coverage-v8 and @vitest/coverage-istanbul as optional dependency  -  by @​alan-agius4 in #​10025 (146d4)
• Fix defineHelper for webkit async stack trace + update playwright 1.59.0  -  by @​hi-ogawa in #​10036 (5a5fa)
• Fix suite hook throwing errors for unused auto test-scoped fixture  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​10035 (39865)
• expect:
  • Remove JestExtendError.context from verbose error reporting  -  by @​hi-ogawa in #​9983 (66751)
  • Don't leak "runner" types  -  by @​sheremet-va in #​10004 (ec204)
• snapshot:
  • Fix flagging obsolete snapshots for snapshot properties mismatch  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​9986 (6b869)
  • Export custom snapshot matcher helper from vitest  -  by @​hi-ogawa and Codex in #​10042 (691d3)
• ui:
  • Don't leak vite types  -  by @​sheremet-va in #​10005 (fdff1)
• vm:
  • Fix external module resolve error with deps optimizer query  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​10024 (9dbf4)

    View changes on GitHub

v4.1.2

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#​9975).

   🐞 Bug Fixes

• Don't resolve setupFiles from parent directory  -  by @​hi-ogawa in #​9960 (7aa93)
• Ensure sequential mock/unmock resolution  -  by @​hi-ogawa and Claude Opus 4.6 in #​9830 (7c065)
• browser: Take failure screenshot if toMatchScreenshot can't capture a stable screenshot  -  by @​macarie in #​9847 (faace)
• coverage: Correct coverageConfigDefaults values and types  -  by @​Arthie in #​9940 (b3c99)
• pretty-format: Fix output limit over counting  -  by @​hi-ogawa in #​9965 (d3b7a)
• Disable colors if agent is detected  -  by @​sheremet-va and @​AriPerkkio in #​9851 (6f97b)

    View changes on GitHub

v4.1.1

Compare Source

   🚀 Features

• experimental:
  • Expose matchesTagsFilter to test if the current filter matches tags  -  by @​sheremet-va in #​9913 (eec53)
  • Introduce experimental.vcsProvider  -  by @​sheremet-va in #​9928 (56115)

   🐞 Bug Fixes

• Mark TestProject.testFilesList internal properly  -  by @​sapphi-red in #​9867 (54f26)
• Detect fixture that returns without calling use  -  by @​oilater in #​9831 and #​9861 (633ae)
• Drop vite 8.beta support  -  by @​AriPerkkio in #​9862 (b78f5)
• Type regression in vi.mocked() static class methods  -  by @​purepear and @​hi-ogawa in #​9857 (90926)
• Properly re-evaluate actual modules of mocked external  -  by @​hi-ogawa in #​9898 (ae5ec)
• Preserve coverage report when html reporter overlaps  -  by @​hi-ogawa in #​9889 (2d81a)
• Provide vi.advanceTimers to the preview provider  -  by @​sheremet-va in #​9891 (1bc3e)
• Don't leak event listener in playwright provider  -  by @​sheremet-va in #​9910 (d9355)
• Open browser in --standalone mode without running tests  -  by @​sheremet-va in #​9911 (e78ad)
• Guard disposable and optional body  -  by @​sheremet-va in #​9912 (6fdb2)
• Resolve retry.condition RegExp serialization issue  -  by @​nstepien and @​hi-ogawa in #​9942 (7b605)
• collect:
  • Don't treat extra props on test return as tests  -  by @​sheremet-va in #​9871 (141e7)
• coverage:
  • Simplify provider types  -  by @​AriPerkkio in #​9931 (aaf9f)
  • Load built-in provider without module runner  -  by @​AriPerkkio in #​9939 (bf892)
• expect:
  • Soft assertions continue after .resolves/.rejects promise errors  -  by @​mixelburg, Maks Pikov, Claude Opus 4.6 (1M context) and @​hi-ogawa in #​9843 (6d74b)
  • Fix sinon-chai style API  -  by @​hi-ogawa in #​9943 (0f08d)
• pretty-format:
  • Limit output for large object  -  by @​hi-ogawa and Claude Opus 4.6 (1M context) in #​9949 (0d5f9)

    View changes on GitHub

docker/build-push-action (docker/build-push-action)

v7.1.0

Compare Source

• Git context query format support by @​crazy-max in #​1505
• Bump @​docker/actions-toolkit from 0.79.0 to 0.87.0 by @​crazy-max in #​1505
• Bump brace-expansion from 1.1.12 to 1.1.13 in #​1500
• Bump fast-xml-parser from 5.4.2 to 5.5.7 in #​1489
• Bump flatted from 3.3.3 to 3.4.2 in #​1491
• Bump glob from 10.3.12 to 10.5.0 in #​1490
• Bump handlebars from 4.7.8 to 4.7.9 in #​1497
• Bump lodash from 4.17.23 to 4.18.1 in #​1510
• Bump picomatch from 4.0.3 to 4.0.4 in #​1496
• Bump undici from 6.23.0 to 6.24.1 in #​1486
• Bump vite from 7.3.1 to 7.3.2 in #​1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

docker/login-action (docker/login-action)

v4.1.0

Compare Source

• Fix scoped Docker Hub cleanup path when registry is omitted by @​crazy-max in #​945
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1020.0 in #​930
• Bump @​docker/actions-toolkit from 0.77.0 to 0.86.0 in #​932 #​936
• Bump brace-expansion from 1.1.12 to 1.1.13 in #​952
• Bump fast-xml-parser from 5.3.4 to 5.3.6 in #​942
• Bump flatted from 3.3.3 to 3.4.2 in #​944
• Bump glob from 10.3.12 to 10.5.0 in #​940
• Bump handlebars from 4.7.8 to 4.7.9 in #​949
• Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #​937
• Bump lodash from 4.17.23 to 4.18.1 in #​958
• Bump minimatch from 3.1.2 to 3.1.5 in #​941
• Bump picomatch from 4.0.3 to 4.0.4 in #​948
• Bump undici from 6.23.0 to 6.24.1 in #​938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

graphql/graphql-js (graphql)

v16.13.2

Compare Source

koajs/koa (koa)

v3.2.0

Compare Source

What's Changed

• docs: remove dead Job Board links by @​Jerry-CodeHub in #​1926
• build(deps-dev): bump qs from 6.14.1 to 6.14.2 by @​dependabot[bot] in #​1927
• chore: Add workflow_dispatch trigger to npm-publish workflow by @​Copilot in #​1930
• feat: defer AsyncLocalStorage creation for v8 startup snapshots by @​killagu in #​1946

New Contributors

• @​Jerry-CodeHub made their first contribution in #​1926
• @​killagu made their first contribution in #​1946

Full Changelog: koajs/koa@v3.1.2...v3.2.0

nodejs/node (node)

v24.15.0

Compare Source

v24.14.1

Compare Source

prettier/prettier (prettier)

v3.8.3

Compare Source

v3.8.2

Compare Source

yarnpkg/berry (yarn)

v4.14.1

Compare Source

v4.14.0

Compare Source

v4.13.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 12pm on Sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.