fix(deps): update all non-major dependencies with stable versions (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@evilmartians/lefthook	^2.1.2 → ^2.1.4
@types/node (source)	^24.11.2 → ^24.12.0
@vue/compiler-core (source)	^3.5.29 → ^3.5.31
diff@<8.0.3	>=8.0.3 → >=8.0.4
eslint (source)	^9.39.3 → ^9.39.4
h3@<1.15.9 (source)	>=1.15.9 → >=1.15.10
h3@<=1.15.4 (source)	>=1.15.9 → >=1.15.10
minimatch@<3.1.3	>=10.2.4 → >=10.2.5
minimatch@>=10.0.0 <10.2.4	[>=10.2.4 → >=10.2.5](https://renovatebot.com/diffs/npm/minimatch@>=10.0.0 <10.2.4/10.2.4/10.2.5)
minimatch@>=5.0.0 <5.1.7	[>=10.2.4 → >=10.2.5](https://renovatebot.com/diffs/npm/minimatch@>=5.0.0 <5.1.7/10.2.4/10.2.5)
minimatch@>=9.0.0 <9.0.6	[>=10.2.4 → >=10.2.5](https://renovatebot.com/diffs/npm/minimatch@>=9.0.0 <9.0.6/10.2.4/10.2.5)
nanoid	^5.1.6 → ^5.1.7
seroval@<1.4.1 (source)	>=1.5.0 → >=1.5.1
seroval@<=1.4.0 (source)	>=1.5.0 → >=1.5.1
systeminformation@<5.30.8 (source)	>=5.31.3 → >=5.31.5
systeminformation@<=5.30.7 (source)	>=5.31.3 → >=5.31.5
tar@<7.5.7	>=7.5.11 → >=7.5.13
undici@<7.24.0 (source)	>=7.24.0 → >=7.24.6
vue (source)	^3.5.29 → ^3.5.31
vue-tsc (source)	^3.2.5 → ^3.2.6

---

Release Notes

evilmartians/lefthook (@​evilmartians/lefthook)

v2.1.4

Compare Source

• pkg: fix scripts (#​1348) by @​mrexox
• fix: bring back {lefthook_job_name} template (#​1347) by @​mrexox
• pkg: refactor packaging (2) (#​1346) by @​mrexox
• fix: separate more commands' non-option args with -- (#​1339) by @​scop
• docs: change logo to point to landing page instead of itself (#​1343) by @​igas
• pkg: make it easier to read (#​1340) by @​mrexox
• pkg: refactor packaging scripts (#​1308) by @​mrexox

vuejs/core (@​vue/compiler-core)

v3.5.31

Compare Source

Bug Fixes

• compiler-sfc: allow Node.js subpath imports patterns in asset urls (#​13045) (95c3356), closes #​9919
• compiler-sfc: support template literal as defineModel name (#​14622) (bd7eef0), closes #​14621
• reactivity: normalize toRef property keys before dep lookup + improve types (#​14625) (1bb28d0), closes #​12427 #​12431
• runtime-core: invalidate detached v-for memo vnodes after unmount (#​14624) (560def4), closes #​12708 #​12710
• runtime-core: preserve nullish event handlers in mergeProps (#​14550) (5725222)
• runtime-core: prevent merging model listener when value is null or undefined (#​14629) (b39e032)
• runtime-dom: defer teleport mount/update until suspense resolves (#​8619) (88ed045), closes #​8603
• runtime-dom: handle activeElement check in Shadow DOM for v-model (#​14196) (959ded2)
• server-renderer: cleanup component effect scopes after SSR render (#​14548) (862f11e)
• suspense: avoid unmount activeBranch twice if wrapped in transition (#​9392) (908c6ad), closes #​7966
• suspense: update suspense vnode's el during branch self-update (#​12922) (a2c1700), closes #​12920
• transition: skip enter guard while hmr updating (#​14611) (be0a2f1), closes #​14608
• types: prevent shallowReactive marker from leaking into value unions (#​14493) (3b561db), closes #​14490

v3.5.30

Compare Source

Bug Fixes

• compat: add entities to @​vue/compat deps to fix CJS edge cases (#​12514) (e725a67), closes #​10609
• custom-element: ensure child component styles are injected in correct order before parent styles (#​13374) (1398bf8), closes #​13029
• custom-element: properly locate parent when slotted in shadow dom (#​12480) (f06c81a), closes #​12479
• custom-element: should properly patch as props for vue custom elements (#​12409) (740983e), closes #​12408
• reactivity: avoid duplicate raw/proxy entries in Set.add (#​14545) (d943612)
• reactivity: fix reduce on reactive arrays to preserve reactivity (#​12737) (16ef165), closes #​12735
• reactivity: handle Set with initial reactive values edge case (#​12393) (5dc27ca), closes #​8647
• runtime-core: warn about negative number in v-for (#​12308) (9438cc5)
• ssr: prevent watch from firing after async setup await (#​14547) (6cda71d), closes #​14546
• types: make generics with runtime props in defineComponent work (fix #​11374) (#​13119) (cea3cf7), closes #​13763
• types: narrow useAttrs class/style typing for TSX (#​14492) (bbb8977), closes #​14489

kpdecker/jsdiff (diff@<8.0.3)

v8.0.4

Compare Source

• #​667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

eslint/eslint (eslint)

v9.39.4

Compare Source

Bug Fixes

• f18f6c8 fix: update dependency minimatch to ^3.1.5 (#​20564) (Milos Djermanovic)
• a3c868f fix: update dependency @​eslint/eslintrc to ^3.3.4 (#​20554) (Milos Djermanovic)
• 234d005 fix: minimatch security vulnerability patch for v9.x (#​20549) (Andrej Beles)
• b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#​20538) (루밀LuMir)

Documentation

• 4675152 docs: add deprecation notice partial (#​20520) (Milos Djermanovic)

Chores

• b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#​20596) (Francesco Trotta)
• 71b2f6b chore: package.json update for @​eslint/js release (Jenkins)
• 1d16c2f ci: pin Node.js 25.6.1 (#​20563) (Milos Djermanovic)

h3js/h3 (h3@​<1.15.9)

v1.15.10

Compare Source

compare changes

🩹 Fixes

• Preserve percent-encoded req.url in app event handler (#​1355)

❤️ Contributors

• Sergio Azócar (@​sergioazoc)

isaacs/minimatch (minimatch@<3.1.3)

v10.2.5

Compare Source

ai/nanoid (nanoid)

v5.1.7

Compare Source

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

sebhildebrandt/systeminformation (systeminformation@<5.30.8)

v5.31.5

Compare Source

Full Changelog: sebhildebrandt/systeminformation@v5.31.4...v5.31.5

v5.31.4

Compare Source

Full Changelog: sebhildebrandt/systeminformation@v5.31.3...v5.31.4

isaacs/node-tar (tar@<7.5.7)

v7.5.13

Compare Source

v7.5.12

Compare Source

nodejs/undici (undici@<7.24.0)

v7.24.6

Compare Source

What's Changed

• fix(test): client wasm compatible with clang 22 by @​rozzilla in #​4909
• fix(mock): improve error message when intercepts are exhausted by @​travisbreaks in #​4912
• fix(websocket): support open diagnostics over h2 by @​mcollina in #​4921
• fix: assume http/https scheme for scheme-less proxy env vars by @​travisbreaks in #​4914
• fix(cache): check Authorization on request headers per RFC 9111 §3.5 by @​metalix2 in #​4911
• fix: wrap kConnector call in try/catch to prevent client hang by @​veeceey in #​4834
• docs: clarify fetch and FormData pairing by @​mcollina in #​4922
• fix: support Connection header with connection-specific header names per RFC 7230 by @​mcollina in #​4775
• fix: avoid prototype collisions in parseHeaders by @​mcollina in #​4923
• build(deps-dev): bump typescript from 5.9.3 to 6.0.2 by @​dependabot[bot] in #​4926
• test: auto-init WPT submodule by @​mcollina in #​4930

New Contributors

• @​rozzilla made their first contribution in #​4909
• @​veeceey made their first contribution in #​4834

Full Changelog: nodejs/undici@v7.24.5...v7.24.6

v7.24.5

Compare Source

What's Changed

• Formdata tests by @​KhafraDev in #​4902
• test: add unexpected disconnect guards to more client test files by @​samayer12 in #​4844
• fix(cache): only apply 1-year deleteAt for immutable responses by @​metalix2 in #​4913

New Contributors

• @​metalix2 made their first contribution in #​4913

Full Changelog: nodejs/undici@v7.24.4...v7.24.5

v7.24.4

Compare Source

What's Changed

• fix(fetch): handle URL credentials in dispatch path extraction by @​mcollina in #​4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

Compare Source

What's Changed

• fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @​hxinhan in #​4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

Compare Source

What's Changed

• fix fetch path logic by @​KhafraDev in #​4890
• remove maxDecompressedMessageSize by @​KhafraDev in #​4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

Compare Source

vuejs/language-tools (vue-tsc)

v3.2.6

Compare Source

language-core

• fix: generate $slots type in template correctly with defineSlots (#​5984) - Thanks to @​KazariEX!
• fix: infer only readonly component of arrays in v-for (#​5987) - Thanks to @​ascott18!
• fix: avoid false positives for destructured props detection on binding property names (#​5994) - Thanks to @​KazariEX!

vscode

• fix: use regex for TS extension patching to support VS Code 1.110+ (#​5983) - Thanks to @​ebiryu!

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) in timezone America/New_York, Automerge - Monday through Friday ( * * * * 1-5 ) in timezone America/New_York.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

❌ Deploy Preview for kongponents-sandbox failed.

Name	Link
🔨 Latest commit	c5f5615
🔍 Latest deploy log	https://app.netlify.com/projects/kongponents-sandbox/deploys/69cf64f1d29bf100088160bc

[netlify]

✅ Deploy Preview for kongponents ready!

Name	Link
🔨 Latest commit	891e62f
🔍 Latest deploy log	https://app.netlify.com/projects/kongponents/deploys/69cb6b2fcf7ae00008c20342
😎 Deploy Preview	https://deploy-preview-3128--kongponents.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
 ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 3.5.32 (released 76 minutes ago) of @vue/compiler-core does not meet the minimumReleaseAge constraint

This error happened while installing a direct dependency of /tmp/renovate/repos/github/Kong/kongponents

The latest release of @vue/compiler-core is "3.5.32". Published at 4/3/2026 5:41:04 AM

Other releases are:
  * rc: 3.5.0-rc.1 published at 8/29/2024
  * alpha: 3.6.0-alpha.7 published at 12/12/2025
  * beta: 3.6.0-beta.9 published at 3/26/2026

If you need the full list of all 273 published versions run "pnpm view @vue/compiler-core versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude