chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@rocicorp/zero (source)	^0.25.1 → ^0.26.0			dependencies	minor
@types/node (source)	24.11.0 → 24.12.0			devDependencies	minor
actions/setup-node	v6.2.0 → v6.3.0			action	minor
jose	6.1.3 → 6.2.1			dependencies	minor
pnpm (source)	10.30.3 → 10.32.1			packageManager	minor
vue-tsc (source)	3.2.5 → 3.2.6			devDependencies	patch

---

Release Notes

rocicorp/mono (@​rocicorp/zero)

v0.26.1

Compare Source

v0.26.0

Compare Source

actions/setup-node (actions/setup-node)

v6.3.0

Compare Source

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in #​1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @​gowridurgad in #​1491
• Replace uuid with crypto.randomUUID() by @​trivikr in #​1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @​marco-ippolito in #​1467
• Scope test lockfiles by package manager and update cache tests by @​gowridurgad in #​1495

New Contributors

• @​susnux made their first contribution in #​1283

Full Changelog: actions/setup-node@v6...v6.3.0

panva/jose (jose)

v6.2.1

Compare Source

Refactor

• reorganize internals, less files, smaller footprint (d4231f9)

v6.2.0

Compare Source

Features

• re-introduce JWE "zip" (Compression Algorithm) Header Parameter support (b13b446)

Documentation

• clarify return of general jws and jwe (56682b4)

pnpm/pnpm (pnpm)

v10.32.1: pnpm 10.32.1

Compare Source

Patch Changes

• Fix a regression where pnpm-workspace.yaml without a packages field caused all directories to be treated as workspace projects. This broke projects that use pnpm-workspace.yaml only for settings (e.g. minimumReleaseAge) without defining workspace packages #​10909.

Platinum Sponsors

Gold Sponsors

v10.32.0: pnpm 10.32

Compare Source

Minor Changes

• Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #​10136.

Patch Changes

• Reverted change related to setting explicitly the npm config file path, which caused regressions.
• Reverted fix related to lockfile-include-tarball-url. Fixes #​10915.

Platinum Sponsors

Gold Sponsors

v10.31.0

Compare Source

vuejs/language-tools (vue-tsc)

v3.2.6

Compare Source

language-core

• fix: generate $slots type in template correctly with defineSlots (#​5984) - Thanks to @​KazariEX!
• fix: infer only readonly component of arrays in v-for (#​5987) - Thanks to @​ascott18!
• fix: avoid false positives for destructured props detection on binding property names (#​5994) - Thanks to @​KazariEX!

vscode

• fix: use regex for TS extension patching to support VS Code 1.110+ (#​5983) - Thanks to @​ebiryu!

---

Configuration

📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​rocicorp/​zero@​0.25.13 ⏵ 0.26.1	-4		+1
	@​vitest/​coverage-v8@​4.0.18 ⏵ 4.1.0			+11	+1
	@​types/​node@​24.11.0 ⏵ 24.12.0	+1		+1
	bumpp@​10.4.1 ⏵ 11.0.1	+4		+1	+1
	eslint@​10.0.2 ⏵ 10.0.3	+1
	jose@​6.1.3 ⏵ 6.2.1
	knip@​5.85.0 ⏵ 5.88.0			+1	+1
	@​antfu/​eslint-config@​7.6.1 ⏵ 7.7.3	+4

View full report