fix(deps): update npm dependencies updates by renovate[bot] · Pull Request #191 · hackariens/vuejs

renovate · 2025-11-10T01:39:48Z

This PR contains the following updates:

Package	Change	Age	Confidence
create-vue	`3.18.` → `3.23.`
cypress (source)	`15.5.` → `15.19.`
dotenv	`17.2.` → `17.4.`
jscpd (source)	`4.0.` → `4.2.`
release-it	`19.0.` → `19.2.`

Release Notes

vuejs/create-vue (create-vue)

`v3.23.0`: 2026-07-21 (v3.23.0)

Compare Source

Notable Changes

fix: enable TypeScript with default flag by @cexbrayat in #1059
feat: detect nub package manager by @colinhacks in #1066
chore: update vscode settings by @btea in #1082
feat: replace Vue 3.6 beta option with RC by @haoqunjiang in #1083
chore(deps): update dependency pinia to v4 by @renovate[bot] in #1084

New Contributors

@colinhacks made their first contribution in #1066

Full Changelog: vuejs/create-vue@v3.22.4...v3.23.0

`v3.22.4`: 2026-06-17 (v3.22.4)

Compare Source

Notable Changes

Dependency updates
Dropped Node 20 support and advanced minor version requirements #1012
fix: quote glob in package script to fix bun/yarn issues on Windows by @clemyan in #1010
fix: add missing vue-eslint-parser dependency to avoid warnings by @clemyan in #1011
chore: add a missing trailing comma in Vite config template by @coder-xiaomo in #1021

New Contributors

@arpitjain099 made their first contribution in #1013
@clemyan made their first contribution in #1010

Full Changelog: vuejs/create-vue@v3.22.3...v3.22.4

`v3.22.3`: 2026-04-19 (v3.22.3)

Compare Source

What's Changed

chore: dependency updates
fix(cypress): remove workaround for TypeScript 6 by @haoqunjiang in #999

Full Changelog: vuejs/create-vue@v3.22.2...v3.22.3

`v3.22.2`: 2026-03-31 (v3.22.2)

Compare Source

Dependency updates.

Full Changelog: vuejs/create-vue@v3.22.1...v3.22.2

`v3.22.1`: 2026-03-11 (v3.22.1)

Compare Source

What's Changed

Dependency updates and minor bug fixes.
Drop nightwatch support by @haoqunjiang in #950

Full Changelog: vuejs/create-vue@v3.22.0...v3.22.1

`v3.22.0`: 2026-03-01 (v3.22.0)

Compare Source

Notable Changes

feat: generate TypeScript projects by default, closes #849 by @haoqunjiang in #945
chore: slight tsconfig adjustments; add comments on each options by @haoqunjiang in #944

Full Changelog: vuejs/create-vue@v3.21.2...v3.22.0

`v3.21.2`: 2026-02-25 (v3.21.2)

Compare Source

What's Changed

chore: remove compilerOptions.modules from the root tsconfig.json in Cypress projects by @haoqunjiang in #937
chore: dependency updates

Full Changelog: vuejs/create-vue@v3.21.1...v3.21.2

`v3.21.1`: 2026-02-16 (v3.21.1)

Compare Source

What's Changed

feat(oxlint): add vitest plugin by @cexbrayat in #921
fix: add missing oxfmt CLI flag by @cexbrayat in #923
feat: add typed-router nesting under tsconfig by @cexbrayat in #924
chore: update dependencies

Full Changelog: vuejs/create-vue@v3.21.0...v3.21.1

`v3.21.0`: 2026-02-02 (v3.21.0)

Compare Source

New Features

feat: add a new experimental option to try out Vue 3.6 beta by @haoqunjiang in #913
To try out the beta version in existing projects, run: npx install-vue@beta.

Notable Changes

fix(oxlint): use buildFromOxlintConfigFile in eslint config by @cexbrayat in #915
fix(oxlint): do not add typescript plugin to js project by @cexbrayat in #914
chore(deps): update dependency vue-router to v5 by @renovate[bot] in #919

Full Changelog: vuejs/create-vue@v3.20.0...v3.21.0

`v3.20.0`: 2026-01-29 (v3.20.0)

Compare Source

Notable Changes

feat: always include Oxlint when ESLint is selected by @haoqunjiang in #869
feat: add vite temporarily config to gitignore by @btea in #892

Full Changelog: vuejs/create-vue@v3.19.0...v3.20.0

`v3.19.0`: 2026-01-22 (v3.19.0)

Compare Source

Notable Changes

fix: revert Prettier VS Code extension ID to esbenp.prettier-vscode #906
refactor: use eslint-config-prettier/flat directly, replacing @vue/eslint-config-prettier/skip-formatting #897
feat: add oxfmt option to experimental section #904

Full Changelog: vuejs/create-vue@v3.18.5...v3.19.0

`v3.18.5`: 2026-01-07 (v3.18.5)

Compare Source

What's Changed

fix: remove the extra space in the generated .oxlintrc.json file name (#883) by @ShanYi-Hui in #884
chore(deps): update dependencies
feat: use vite 8 beta instead of rolldown-vite package by @TheAlexLichter in #888

New Contributors

@ShanYi-Hui made their first contribution in #884

Full Changelog: vuejs/create-vue@v3.18.4...v3.18.5

`v3.18.4`: 2025-12-27 (v3.18.4)

Compare Source

What's Changed

chore: update dependency versions
feat: migrate vscode default formatter from esbenp.prettier-vscode to prettier.prettier-vscode by @coder-xiaomo in #863

New Contributors

@coder-xiaomo made their first contribution in #863

Full Changelog: vuejs/create-vue@v3.18.3...v3.18.4

`v3.18.3`: 2025-11-27 (v3.18.3)

Compare Source

Updated dependency versions. Most notably, replaced @tsconfig/node22 with @tsconfig/node24.

Full Changelog: vuejs/create-vue@v3.18.2...v3.18.3

cypress-io/cypress (cypress)

motdotla/dotenv (dotenv)

`v17.4.2`

Compare Source

Changed

Improved skill files - tightened up details (#1009)

`v17.4.1`

Compare Source

Changed

Change text injecting to injected (#1005)

`v17.4.0`

Compare Source

Added

Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

Tighten up logs: ◇ injecting env (14) from .env (#1003)

`v17.3.1`

Compare Source

Changed

Fix as2 example command in README and update spanish README

`v17.3.0`

Compare Source

Added

Add a new README section on dotenv’s approach to the agentic future.

Changed

Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

`v17.2.4`

Compare Source

Changed

Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

kucherenko/jscpd (jscpd)

`v4.2.5`

Compare Source

Bug Fixes

JSON reporter duplicate token counts — tokens was always reported as 0 in JSON output; now computed from token positions (end.position - start.position) (#801).
Gitignore parent-directory walk — .gitignore files in parent directories up to the repo root are now read and combined with scan-directory .gitignore files. Also reads .git/info/exclude and the global core.excludesFile for full parity with Git's ignore resolution (#741).
Commander v15 migration — CLI option parsing migrated from direct property access (cli.minTokens, etc.) to the cli.opts() API required by Commander v8+. The --no-gitignore / --gitignore flag handling was rewritten to use Commander's native negation support instead of rawArgs inspection.
Vitest 4.1.0 — bumped from 3.2.4 to address CVE-2026-47429.
Commander v15 — bumped from v5 to v15, enabling modern Node.js compatibility.
Pug 3.0.4, node-sarif-builder 4.1.0, nodemon 3.1.14 — dependency bumps for security and compatibility.

`v4.2.4`

Compare Source

`v4.2.3`

Compare Source

`v4.2.2`

Compare Source

`v4.2.1`

Compare Source

`v4.2.0`

Compare Source

Breaking Changes

Vue SFC tokenization — .vue files are no longer tokenized as markup. Each block is now dispatched to its own sub-format: <script> → javascript, <script lang="ts"> → typescript, <template> → markup, <style> → css, <style lang="scss"> → scss, <style lang="less"> → less. Clone reports for .vue files now appear under these resolved sub-format names. Any tooling or configuration that relied on .vue clones being reported under markup must be updated.
--formatsExts users — custom mappings that pointed .vue to markup (e.g. "formatsExts": { "markup": ["vue"] }) will no longer take effect because .vue is handled by the dedicated vue format processor. Remove or update such mappings.

New Features

Custom tokenizer backend — replaced the prismjs npm package with a self-contained reprism-based grammar engine. ~11.5% faster tokenization on real projects (avg 1126 ms → 997 ms on a 548-file, 223-format scan).
Cross-format detection — Vue SFC (.vue), Svelte (.svelte), Astro (.astro), and Markdown files are now tokenized per-block/per-section. A <script> block in a .vue file can match a .ts file; a fenced code block in Markdown can match a .py file.
223 supported formats — Apex, CFML/ColdFusion, GDScript, Svelte, Astro, and 70+ additional languages added (up from 152). See FORMATS.md.
Shebang detection — extensionless executable scripts (e.g. /usr/bin/env python3) are auto-detected by their #! shebang line and tokenized in the correct language.
--store-path — configure a custom directory for the LevelDB cache, eliminating collisions when multiple jscpd processes run in parallel on the same machine.
--skipComments — shorthand flag for --mode weak, which strips comments before detection.
--formats-names — map specific filenames (e.g. Makefile, Dockerfile) to a detection format.

Bug Fixes

Entire-file duplicates silently dropped (@jscpd/core #728) — RabinKarp flushed the pending clone on a store hit at end-of-file instead of on a miss. Files that are complete copies of each other were undetected. Fixed.
ReDoS hang on Lisp/Elisp files (@jscpd/tokenizer #737) — the Lisp string regex /"(?:[^"\\]*|\\.)*"/ could catastrophically backtrack (O(2ⁿ)) on unterminated strings. Replaced with a linear /"(?:[^"\\]|\\[\s\S])*"/ pattern.
Process crash on malformed package.json (#739) — readJSONSync threw an unhandled SyntaxError when package.json contained invalid JSON, killing the process. Now emits a warning and continues with an empty config.
Vue SFC cross-file detection broken — the detector used the file-level format (vue) as the store namespace for all SFC blocks, preventing a <script> block in one .vue file from ever matching a <script> block in another. The namespace now reflects each block's resolved sub-format.
Vue SFC incorrect column numbers — tokens on the first line of a block carried block-relative column 1 instead of file-absolute column numbers. Fixed in @jscpd/tokenizer.
50 dependency security vulnerabilities remediated across the monorepo (Dependabot batches).

Known Limitations

Malformed SFC blocks (e.g. unclosed tags, invalid attributes) are silently skipped and do not contribute tokens.

`v4.1.1`

Compare Source

`v4.1.0`

Compare Source

New Features

AI Reporter — new ai reporter that produces compact, token-efficient clone output specifically designed for feeding results into language models and AI tooling. Use --reporters ai to activate it.
MCP Server enhancements — the Model Context Protocol server now exposes a jscpd://statistics resource and supports a recheck endpoint so AI agents can trigger a rescan without restarting the process.
Apex & CFML language support — jscpd can now detect duplicate code in Salesforce Apex and ColdFusion Markup Language (CFML) files (closes #83, #619).
GDScript support — detect copy-paste duplication in Godot Engine GDScript files.
HTML reporter footer — the HTML report now displays a branded footer with the jscpd version and a sponsor link.
--noTips flag — suppress the usage-tip messages that appear after a detection run.
CI: Node.js 22.x / 24.x — continuous integration updated to test against the latest Node.js LTS and current releases.

Performance

Tokenizer — grammars are now loaded lazily, hot paths are O(n), and the spark-md5 dependency has been removed in favour of a lighter built-in implementation. Startup time and memory usage are noticeably reduced on large codebases.
Replaced the vendored reprism syntax library with the official prismjs npm package, shrinking the installed footprint.

Bug Fixes

Restored the correct start.line expectation for weak-mode clone detection.

`v4.0.9`

Compare Source

`v4.0.8`

Compare Source

`v4.0.7`

Compare Source

New Features

jscpd-server — a new jscpd-server package ships a RESTful HTTP API for code-duplication detection. Ideal for CI pipelines, IDE plugins, and services that need on-demand analysis without spinning up a CLI process.
GitHub Actions example — an example_github_action.yml starter workflow is included in the repository.

Bug Fixes

Ignore patterns defined in configuration files are now applied correctly (the path-matching bug in resolveIgnorePattern has been fixed).
Importing jscpd as a Node.js module no longer auto-executes the CLI entry point.
Fixed an invalid documentation link.

`v4.0.6`

Compare Source

Bug Fixes

Dependency and lock-file updates to address security advisories.

release-it/release-it (release-it)

`v19.2.4`

Compare Source

chore: update dependencies to resolve security vulnerabilities (#1273) (b45dd1a) - thanks @Yeom-JinHo!
Update a few dev deps (cd8acdc)

`v19.2.3`

Compare Source

Reuse generated changelog (316dbfa)
Remove obsolete eslint compat packages/config (f6cc8f3)
Update remark-preset-webpro and fix broken links (6e6dd4b)

`v19.2.2`

Compare Source

Improve getChangelog method (7a56364)

`v19.2.1`

Compare Source

Improve commit prompt (b7aca7c)
Remedy potential edge case in template helper (5c0a6ee)

`v19.2.0`

Compare Source

Add option to exit gracefully (e1f825d)
Update dependencies (424c9f6)
Auto-format docs (06f41bb)
fix: add shell mode for npm commands on windows (#1266) (382e346) - thanks @julienbenac!
Feat: Add publishPackageManager config option in NPM plugin to allow using different package manager for publishing (e.g. Bun) (#1169) (0dafc0b) - thanks @chrispader!
Only use --workspaces=false with npm (12bb89c)
Fix up docs/types a bit (05a5986)
Format (c9d6ebf)

`v19.1.0`

Compare Source

Ignore .npmrc (8ccd060)
Update lockfile (c4cd2ba)
Support interactive shell in non-CI mode for 2FA flow (resolve #1263) (a10b20d)
Add --workspaces=false to get rid of the null/matches error (14a4907)
Remove npm config env var warnings (b8c1247)
doc(readme): add release-it-beautiful-changelog plugin to list of plugins (#1261) (1b68c21)
Add 403 to consider resource alive (7969849)

`v19.0.6`

Compare Source

Update list of projects using release-it (92b49d3)
Bump github/codeql-action from 2 to 4 (#1253) (21309d3) - thanks @dependabot[bot]!
Bump actions/setup-node from 5 to 6 (#1255) (3fbaab1) - thanks @dependabot[bot]!
Test in node 24 (7a12b12)
Upgrade c12 (resolve #1254) (1f48d03)

Configuration

📅 Schedule: (in timezone Europe/Paris)

Branch creation
- "before 8am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 2 times, most recently from 06772d6 to b013096 Compare November 20, 2025 02:09

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 2 times, most recently from bff1436 to eca5979 Compare December 3, 2025 03:01

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 2 times, most recently from 9ed24f2 to b787001 Compare December 17, 2025 02:10

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 3 times, most recently from 9382116 to 89736f8 Compare December 24, 2025 09:03

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 3 times, most recently from 645a522 to 23543d7 Compare December 31, 2025 12:47

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 4 times, most recently from 670593e to 3c4363b Compare January 11, 2026 09:22

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 3 times, most recently from 331bc31 to 05b8e6f Compare January 20, 2026 21:03

renovate Bot force-pushed the renovate/npm-dependencies-updates branch from 05b8e6f to 258ea6c Compare January 22, 2026 16:26

renovate Bot changed the title ~~chore(deps): update npm dependencies updates~~ fix(deps): update npm dependencies updates Jan 22, 2026

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 4 times, most recently from 063f671 to 3cf1b90 Compare February 4, 2026 00:58

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 2 times, most recently from cd50c9c to 2260a4a Compare February 12, 2026 12:02

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 3 times, most recently from a3250c9 to ff4a68b Compare February 17, 2026 20:07

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 3 times, most recently from 2dcc2ba to 7bfec92 Compare April 12, 2026 17:27

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 3 times, most recently from fb4941f to 3d3dad4 Compare April 21, 2026 18:38

renovate Bot force-pushed the renovate/npm-dependencies-updates branch from 3d3dad4 to 9e72cec Compare April 29, 2026 22:03

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 6 times, most recently from 308b0fc to f0b7640 Compare May 15, 2026 21:04

renovate Bot force-pushed the renovate/npm-dependencies-updates branch from f0b7640 to a5b7916 Compare May 17, 2026 12:42

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 3 times, most recently from 3bb3311 to fb22c40 Compare May 28, 2026 18:32

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 2 times, most recently from 20046b0 to 296aa75 Compare June 7, 2026 21:27

renovate Bot force-pushed the renovate/npm-dependencies-updates branch from 296aa75 to 741e8e0 Compare June 9, 2026 20:38

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 2 times, most recently from bf60820 to 78539e7 Compare June 23, 2026 20:57

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 2 times, most recently from bb8ddf8 to 7fd8aa8 Compare July 12, 2026 16:08

renovate Bot force-pushed the renovate/npm-dependencies-updates branch 4 times, most recently from a62ffad to befb428 Compare July 21, 2026 18:32

fix(deps): update npm dependencies updates

ca44a82

renovate Bot force-pushed the renovate/npm-dependencies-updates branch from befb428 to ca44a82 Compare July 24, 2026 18:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update npm dependencies updates - #191

fix(deps): update npm dependencies updates#191
renovate[bot] wants to merge 1 commit into
developfrom
renovate/npm-dependencies-updates

renovate Bot commented Nov 10, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.23.0: 2026-07-21 (v3.23.0)

Notable Changes

New Contributors

v3.22.4: 2026-06-17 (v3.22.4)

Notable Changes

New Contributors

v3.22.3: 2026-04-19 (v3.22.3)

What's Changed

v3.22.2: 2026-03-31 (v3.22.2)

v3.22.1: 2026-03-11 (v3.22.1)

What's Changed

v3.22.0: 2026-03-01 (v3.22.0)

Notable Changes

v3.21.2: 2026-02-25 (v3.21.2)

What's Changed

v3.21.1: 2026-02-16 (v3.21.1)

What's Changed

v3.21.0: 2026-02-02 (v3.21.0)

New Features

Notable Changes

v3.20.0: 2026-01-29 (v3.20.0)

Notable Changes

v3.19.0: 2026-01-22 (v3.19.0)

Notable Changes

v3.18.5: 2026-01-07 (v3.18.5)

What's Changed

New Contributors

v3.18.4: 2025-12-27 (v3.18.4)

What's Changed

New Contributors

v3.18.3: 2025-11-27 (v3.18.3)

Changed

Changed

Added

Changed

Changed

Added

Changed

Changed

Bug Fixes

Breaking Changes

New Features

Bug Fixes

Known Limitations

New Features

Performance

Bug Fixes

New Features

Bug Fixes

Bug Fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 10, 2025 •

edited

Loading

`v3.23.0`: 2026-07-21 (v3.23.0)

`v3.22.4`: 2026-06-17 (v3.22.4)

`v3.22.3`: 2026-04-19 (v3.22.3)

`v3.22.2`: 2026-03-31 (v3.22.2)

`v3.22.1`: 2026-03-11 (v3.22.1)

`v3.22.0`: 2026-03-01 (v3.22.0)

`v3.21.2`: 2026-02-25 (v3.21.2)

`v3.21.1`: 2026-02-16 (v3.21.1)

`v3.21.0`: 2026-02-02 (v3.21.0)

`v3.20.0`: 2026-01-29 (v3.20.0)

`v3.19.0`: 2026-01-22 (v3.19.0)

`v3.18.5`: 2026-01-07 (v3.18.5)

`v3.18.4`: 2025-12-27 (v3.18.4)

`v3.18.3`: 2025-11-27 (v3.18.3)