fix(deps): update non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@typescript-eslint/eslint-plugin (source)	^8.61.1 → ^8.65.0			dependencies	minor
@typescript-eslint/parser (source)	^8.61.1 → ^8.65.0			dependencies	minor
@unocss/astro (source)	^66.7.2 → ^66.7.5			dependencies	patch
@vueuse/core (source)	14.3.0 → 14.4.0			dependencies	minor
axios (source)	^1.18.0 → ^1.19.0			dependencies	minor
dorny/paths-filter	v4.0.1 → v4.0.2			action	patch
fast-xml-parser	^5.9.3 → ^5.10.1			dependencies	minor
firebase (source, changelog)	^12.15.0 → ^12.17.0			dependencies	minor
firebase-functions	^7.2.5 → ^7.3.2			dependencies	minor
qs	^6.15.2 → ^6.15.3			dependencies	patch
semver	^7.8.4 → ^7.8.5			dependencies	patch
turbo (source)	^2.9.18 → ^2.10.7			devDependencies	minor	2.10.8
unocss (source)	^66.7.2 → ^66.7.5			dependencies	patch

---

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.65.0

Compare Source

🚀 Features

• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#​12578)
• add warning when TS 7 is detected (#​12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#​12527, #​19562, #​11889)

🩹 Fixes

• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#​12568)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#​12448)
• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#​12515)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

Compare Source

🚀 Features

• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#​12500)
• typescript-estree: throw for invalid definite assignment in class properties (#​12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#​12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

Compare Source

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#​12426)

🩹 Fixes

• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#​12492)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#​12491, #​12485)
• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#​12447, #​12446)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

Compare Source

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#​12443, #​12418)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#​12365)
• eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#​12328)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Patrick Aleite
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features

• remove redundant package.json "files" (#​12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.65.0

Compare Source

🚀 Features

• add warning when TS 7 is detected (#​12529)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#​12465)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features

• remove redundant package.json "files" (#​12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

unocss/unocss (@​unocss/astro)

v66.7.5

Compare Source

   🚀 Features

• preset-wind4: New rule for gap decorations  -  by @​zyyv in #​5241 (30fce)

   🐞 Bug Fixes

• transformer-compile-class: Update explicit shortcuts > Co-authored-by: LevDomasnih resolve #​4926, close #​5239  -  by @​zyyv in #​4926 and #​5239 (b5338)
• transformer-directive: Prehandle properties layer to skip apply css transform  -  by @​zyyv in #​5240 (67220)
• virtual-shared: Remove unnecessary envMode assignment in createContext close #​5243  -  by @​zyyv in #​5243 (d78d3)

    View changes on GitHub

v66.7.4

Compare Source

   🚀 Features

• Introduce @unocss/twoslash  -  by @​9romise and @​zyyv in #​5215 (e4a35)

   🐞 Bug Fixes

• astro: Skip wind3 reset injection when wind4 is detected  -  by @​zyyv in #​5236 (b48cc)

    View changes on GitHub

v66.7.3

Compare Source

   🚀 Features

• preset-wind4: Add scrollbar gutter utilities  -  by @​cyphercodes and cyphercodes in #​5224 (e41b2)

   🐞 Bug Fixes

• integration: Batch filesystem content extraction to avoid ENOMEM  -  by @​zyyv in #​5234 (23eea)

   🏎 Performance

• Batch token parsing  -  by @​TheAlexLichter, Anthony Fu and @​zyyv in #​5231 (edc53)
• core:
  • Skip redundant shortcut variant matching  -  by @​TheAlexLichter in #​5233 (1fd92)
  • Prefilter dynamic rules  -  by @​TheAlexLichter in #​5232 (6dc74)
• integration:
  • Reduce transformer dispatch overhead  -  by @​TheAlexLichter and @​zyyv in #​5230 (df33e)

    View changes on GitHub

vueuse/vueuse (@​vueuse/core)

v14.4.0

Compare Source

   🚀 Features

• Update skills  -  by @​OrbisK in #​5491 (f4758)
• nuxt: Disable useColorMode auto import if @nuxtjs/color-mode is detected  -  by @​OrbisK in #​5476 (60687)
• nuxt: Generate nuxt module builder output layout  -  by @​userquin and @​43081j in #​5503 (40a1f)
• onStartTyping: Add more configurable options for onStartTyping  -  by @​LightQuanta and @​9romise in #​5395 (1f2b7)
• useDebounceFn: Add flush and isPending to filter system  -  by @​pcoterecollective, @​OrbisK and @​antfu in #​5259 (4aa18)
• useElementOverflow: New function  -  by @​inside5545, 苏俊言, @​antfu, @​ilyaliao, @​OrbisK, @​43081j and @​9romise in #​4094 (d49f5)
• useSpeechRecognition: Expose confidence of latest result  -  by @​SAY-5 in #​5398 (17dc9)
• useVirtualList: Add options behavior, block and inline to exposed scrollTo method  -  by @​laurens94, @​OrbisK, @​43081j and @​ilyaliao in #​4905 (01875)

   🐞 Bug Fixes

• Drop unnecessary PURE annotation to avoid Rollup warning  -  by @​serkodev and @​9romise in #​5388 (16933)
• Accept array template ref bound to v-for as observer target  -  by @​eldardada in #​5514 (bccb1)
• Reintroduce package normalisation to nuxt package  -  by @​43081j in #​5551 (c04c4)
• docs: Fix typo 'feedbacks' to 'feedback' in work-with-ai.md  -  by @​firstquarterlee in #​5447 (a4253)
• nuxt: Register formatTimeAgo variants for auto-import  -  by @​ilyaliao, @​cursoragent and Claude Opus 5 in #​5492 (8a908)
• skills: Correct broken relative links in generated function references  -  by @​lazerg and @​OrbisK in #​5549 (910db)
• tests: Deduplicate ci test runs  -  by @​Tofandel in #​5509 (5b272)
• useBrowserLocation: Skip write-back watching on 'load' state  -  by @​Tobias-Braun and @​9romise in #​5485 (fbdd2)
• useDraggable: End drag on pointercancel  -  by @​ShreeBohara and Claude Opus 5 in #​5550 (6aa9d)
• useElementSize: Prefill size based on box option  -  by @​meta-syntax in #​5524 (5fe49)
• useEventBus: Use tryOnScopeDispose to avoid operating Vue internal API  -  by @​liangmiQwQ in #​5548 (2cad7)
• useFetch: Ignore stale abort error after refetch succeeds  -  by @​lazerg in #​5525 (84426)
• useFuse: Trigger fuse ref after setCollection  -  by @​ilyaliao, Claude Opus 5 and @​cursoragent in #​5479 (3e10c)
• useGamepad: Keep updating remaining gamepads after one disconnects  -  by @​lazerg in #​5523 (65328)
• usePointerSwipe: Handle pointercancel event to reset state and trigger onSwipeEnd  -  by @​DORI2001, Dor Alagem and @​43081j in #​5379 (4c08a)
• useStyleTag: Avoid error when multiple components share the same id  -  by @​ben-lau in #​5473 (6d913)
• useVibrate: Make interval option optional  -  by @​Aluomolo in #​5490 (305ee)
• useVirtualList: Recompute range when item size changes  -  by @​Antreesy in #​5533 (0f6d5)
• useWebSocket: Sync status to 'CLOSED' after explicit close()  -  by @​WuMingDao and @​OrbisK in #​5471 (351bf)

    View changes on GitHub

axios/axios (axios)

v1.19.0

Compare Source

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

v1.18.1

Compare Source

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#​10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#​10917, #​10930, #​10942, #​10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#​10959, #​11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#​11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#​11007, #​11010, #​11023, #​11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#​11011, #​11012, #​11013, #​11014, #​11015, #​11016, #​11017, #​11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#​10913)
• @​sijie-Z (#​10993)
• @​bartlomieju (#​11023)
• @​JSap0914 (#​11019)

Full Changelog

dorny/paths-filter (dorny/paths-filter)

v4.0.2

Compare Source

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.10.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

Compare Source

What's Changed

• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​849
• Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in #​848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

firebase/firebase-js-sdk (firebase)

v12.17.0

Compare Source

v12.16.0

Compare Source

firebase/firebase-functions (firebase-functions)

v7.3.2

Compare Source

• chore: update dependencies to close CVEs (#​1936)
• Fix an issue with npm labeling in the deployment pipeline. (#​1937)
• chore: improve release script (#​1932)

v7.3.0

Compare Source

• Bringing in lifecycle triggers into docgen. (#​1931)
• fix: Remove false warning when using Expression in cors option (#​1802)
• feat: Add requiresRole developer API for declarative security support and automatic Manifest extraction (#​1908)
• Validate literal timeoutSeconds values per v2 trigger type (0-540s for events, 0-3600s for HTTPS/callable, 0-1800s for task queues, 0-7s for identity functions) so misconfigured values fail at function-definition or manifest-extraction time instead of at deploy time. (#​1877)
• feat: Add requiresAPI function to allow declaring Google Cloud API dependencies in code. (#​1900)
• fix(v1): Call onInit for schedule.onRun functions (#​1801)
• feat: Add support to declare lifecycle hooks in functions. (#​1915)
• fix(cors): Fix issue using Params to set CORS allowed hosts (#​1903)
• fix(v2): Fix event data unpacking for auth event triggers (#​1923)
• feat: Add "v2/lifecycle" and "lifecycle" import paths for lifecycle hooks (#​1926)
• chore: revamp deploy pipeline to be stateless. Changes must now include relnotes (#​1929)
• chore: move the last encrypted keys into Google Cloud Secrets Manager (#​1929)

ljharb/qs (qs)

v6.15.3

Compare Source

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#​559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#​558)

npm/node-semver (semver)

v7.8.5

Compare Source

Bug Fixes

• 9c8692a #​878 include prereleases in tilde range lower bound with includePrerelease (#​878) (@​chatman-media)

vercel/turborepo (turbo)

v2.10.7: Turborepo v2.10.7

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.6 by @​github-actions[bot] in #​13431
• chore: Refine bug report template help section by @​anthonyshew in #​13433
• fix: Verify version after attempting codemod upgrade by @​anthonyshew in #​13446
• test: Characterize JavaScript package discovery by @​anthonyshew in #​13440
• refactor: Separate package graph node assembly by @​anthonyshew in #​13441
• fix: Upgrade @​vercel/connect by @​anthonyshew in #​13450
• refactor: Add authoritative package knowledge by @​anthonyshew in #​13442
• feat: Select runnable task entrypoints by @​anthonyshew in #​13452
• refactor: Add workspace root contribution contract by @​anthonyshew in #​13447
• refactor: Use package knowledge for scope selection by @​anthonyshew in #​13443
• fix: Prevent mobile homepage overflow by @​anthonyshew in #​13453
• docs: Document service readiness probes by @​anthonyshew in #​13472
• fix: Preserve pnpm root dependencies during prune by @​anthonyshew in #​13476
• fix: Preserve pnpm aliased dependencies during prune by @​anthonyshew in #​13477
• release(turborepo): 2.10.7-canary.1 by @​github-actions[bot] in #​13478
• test: Add Terminal UI sanity tests by @​anthonyshew in #​13475
• chore: Upgrade Next.js by @​anthonyshew in #​13482
• chore: Upgrade brace-expansion by @​anthonyshew in #​13483
• fix: Support multiple macOS file watch roots by @​anthonyshew in #​13484

Full Changelog: vercel/turborepo@v2.10.6...v2.10.7

v2.10.6: Turborepo v2.10.6

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.5 by @​github-actions[bot] in #​13368
• fix: Disable unresolved Cargo artifact caching by @​anthonyshew in #​13362
• fix: Surface create-turbo Git failures by @​anthonyshew in #​13371
• fix: Resolve exact cargo profile outputs by @​anthonyshew in #​13366
• fix: Prune Bun production workspace dev dependencies by @​anthonyshew in #​13369
• fix: Resolve Cargo target output layouts by @​anthonyshew in #​13370
• release(turborepo): 2.10.6-canary.1 by @​github-actions[bot] in #​13374
• fix: Preserve Yarn Babel extension during pruning by @​anthonyshew in #​13373
• feat: Support Cargo-only repos by @​anthonyshew in #​13378
• fix: Preserve colors in TUI output by @​anthonyshew in #​13381
• feat: Infer Cargo workspace tasks by @​anthonyshew in #​13380
• fix: Retain shutdown signals for force exit by @​anthonyshew in #​13382
• release(turborepo): 2.10.6-canary.2 by @​github-actions[bot] in #​13383
• fix: Resolve weekly security audit vulnerabilities by @​cursor[bot] in #​13358
• chore: Update to Rust 1.97.0 by @​ognevny in #​13322
• fix: Pin VS Code extension macOS runners by @​anthonyshew in #​13391
• release(turborepo): 2.10.6-canary.3 by @​github-actions[bot] in #​13392
• docs: Add Experimental Rust Guide by @​anthonyshew in #​13375
• ci: Use affected filtering for JS tests by @​anthonyshew in #​13386
• ci: Fold docs checks into quality by @​anthonyshew in #​13385
• ci: Verify schemas through Turborepo by @​anthonyshew in #​13387
• chore: Avoid duplicate N-API Cargo build by @​anthonyshew in #​13388
• chore: Hash embedded frameworks data in Rust builds by @​anthonyshew in #​13389
• ci: Include VS Code extension type checks by @​anthonyshew in #​13390
• refactor: Run releaser bundle directly by @​anthonyshew in #​13393
• refactor: Move release publishing into releaser by @​anthonyshew in #​13394
• refactor: Consolidate release orchestration by @​anthonyshew in #​13395
• feat: Add crate-scoped Cargo verification tasks by @​anthonyshew in #​13398
• ci: Fetch release commit parent by @​anthonyshew in #​13400
• docs: Update Geistdocs to 1.13.0 by @​molebox in #​13412
• release(turborepo): 2.10.6-canary.4 by @​github-actions[bot] in #​13401
• fix: Preserve pnpm node@runtime: lockfile entries by @​anthonyshew in #​13408
• chore: Fix typos in with-solid example and globwatch comment by @​tajo in #​13416
• refactor: Remove unused public APIs found by Hawk by @​anthonyshew in #​13420
• fix: Check dynamic imports in boundaries by @​anthonyshew in #​13418
• refactor: Use regex! for static pattern compilation by @​anthonyshew in #​13419
• fix: Refactor turbo watch by @​anthonyshew in #​13423
• release(turborepo): 2.10.6-canary.5 by @​github-actions[bot] in #​13424
• chore: Upgrade brace-expansion by @​anthonyshew in #​13429
• chore: Update tar to 7.5.18 by @​anthonyshew in #​13428
• chore: Upgrade js-yaml by @​anthonyshew in #​13427
• fix: Match JIT inputs for affected tasks by @​anthonyshew in #​13426
• fix: Preserve project Yarn package extensions by @​anthonyshew in #​13425

New Contributors

• @​tajo made their first contribution in #​13416

Full Changelog: vercel/turborepo@v2.10.5...v2.10.6

v2.10.5: Turborepo v2.10.5

Compare Source

What's Changed

Changelog

• perf: Evaluate simple include globs without wax compilation by @​anthonyshew in #​13285
• chore: Dogfood native Cargo support in this repository by @​anthonyshew in #​13283
• release(turborepo): 2.10.4 by @​github-actions[bot] in #​13286
• ci: Remove dead sccache configuration by @​anthonyshew in #​13289
• feat: Serve the Remote Cache as an sccache backend for Cargo tasks by @​anthonyshew in #​13288
• fix: Reject output path traversal by @​anthonyshew in #​13290
• fix: Disable the sccache proxy when remote cache use is off by @​anthonyshew in #​13291
• feat: Embed sccache so the Cargo compile cache ne

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.