chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	^24.13.4 → ^24.13.6
@vue/test-utils	^2.5.0 → ^2.5.1
devalue	^5.9.2 → ^5.9.4
eslint (source)	^10.10.0 → ^10.11.0
html-validate (source)	^11.15.0 → ^11.16.0
magic-string	^1.3.1 → ^1.4.1
oxc-parser (source)	^0.149.0 → ^0.151.0
prettier (source)	^3.9.6 → ^3.9.8
unplugin (source)	^3.3.0 → ^3.4.0
vue (source)	^3.5.42 → ^3.5.43

---

Release Notes

vuejs/test-utils (@​vue/test-utils)

v2.5.1

Compare Source

What's Changed

• fix: generic SFC findComponent types by @​simonyang08 in #​2934
• fix: share config across builds by @​cexbrayat in #​2937

New Contributors

• @​simonyang08 made their first contribution in #​2934

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

sveltejs/devalue (devalue)

v5.9.4

Compare Source

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Compare Source

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

eslint/eslint (eslint)

v10.11.0

Compare Source

html-validate/html-validate (html-validate)

v11.16.0

Compare Source

Features

• api: unified HtmlValidate.autofix() and deprecate all other variants (40c67f0)
• rules: add minSectioningRootInitialRank option to heading-level (7b9629f)

Bug Fixes

• deps: update dependency ignore to v7.0.9 (0337345)

Rich-Harris/magic-string (magic-string)

v1.4.1

Compare Source

Bug Fixes

• flush the shared encoder buffer at the end of every drain (#​356) (f682ccf)

v1.4.0

Compare Source

Bug Fixes

• don't resurrect removed content in replace/replaceAll (#​352) (c847b0e)

Features

• add affinity option to move() (#​351) (f849b39)
• bundle: add toMagicString() to flatten a Bundle into a MagicString (#​353) (3a7c7b0)

Performance Improvements

• encode mappings incrementally in generateMap to cut peak memory (#​350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

• carry trimStart and trimEnd into the outro and intro (#​348) (07d2fcb)
• preserve inserts anchored to the edges of a removed range (#​282) (#​349) (bd7ee85)
• return an empty slice when the end index resolves to zero (#​346) (5531971)
• treat moving a range to where it already sits as a no-op (#​347) (22ed11b)

1.3.1 (2026-09-10)

v1.3.2

Compare Source

Bug Fixes

• don't resurrect removed content in replace/replaceAll (#​352) (c847b0e)

Features

• add affinity option to move() (#​351) (f849b39)
• bundle: add toMagicString() to flatten a Bundle into a MagicString (#​353) (3a7c7b0)

Performance Improvements

• encode mappings incrementally in generateMap to cut peak memory (#​350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

• carry trimStart and trimEnd into the outro and intro (#​348) (07d2fcb)
• preserve inserts anchored to the edges of a removed range (#​282) (#​349) (bd7ee85)
• return an empty slice when the end index resolves to zero (#​346) (5531971)
• treat moving a range to where it already sits as a no-op (#​347) (22ed11b)

1.3.1 (2026-09-10)

oxc-project/oxc (oxc-parser)

v0.151.0

🚀 Features

• 1fac655 coverage: Support new TypeScript fixture layout (#​26226) (camc314)

prettier/prettier (prettier)

v3.9.8

Compare Source

v3.9.7

Compare Source

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

unjs/unplugin (unplugin)

v3.4.0

Compare Source

   🐞 Bug Fixes

• Add missing optional peer deps  -  by @​sxzz (e499d)
• Disallow string filters for resolveId  -  by @​sxzz (b7b5f)

    View changes on GitHub

vuejs/core (vue)

v3.5.43

Compare Source

Bug Fixes

• compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#​15548) (2fde323)
• compiler-sfc: prepend semicolon for await in switch case (#​15498) (9a1df69), closes #​15495
• compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #​15465
• compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #​15478) (#​15480) (d6febaa)
• hydration: run leave hooks for hydration placeholders (#​15431) (5dda192)
• reactivity: preserve readonly wrappers in array copy methods (#​15469) (599f35b)
• runtime-core: unmount v-once children after parent rerenders (#​15435) (d720338)
• shared: handle circular references in looseEqual (#​15499) (718f782), closes #​15496
• shared: preserve comment-like text in style values (#​15471) (b9456cb)
• suspense: don't drop nested suspense patches during hydration (#​15429) (76d42dc)
• suspense: keep the boundary pending while its branch is patched (#​15411) (bfcfe9e), closes #​7506
• suspense: patch a hydrating boundary's pending branch in place (#​15432) (2cde6f7)
• suspense: unmount the DOM an interrupted async component claimed (#​15430) (fb9b45c)
• types: keep optional props when a runtime prop uses a generic PropType (#​15523) (243aabc), closes #​9546

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​24.13.4 ⏵ 24.13.6				+1
	unplugin@​3.3.0 ⏵ 3.4.0			+1
	oxc-parser@​0.149.0 ⏵ 0.151.0			+1	-1
	@​vue/​test-utils@​2.5.0 ⏵ 2.5.1	+1		+1	+2
	magic-string@​1.3.1 ⏵ 1.4.1	+1		+1	-1
	devalue@​5.9.2 ⏵ 5.9.4	+1		+1
	html-validate@​11.15.0 ⏵ 11.16.0	+1		+1
	eslint@​10.10.0 ⏵ 10.11.0	+1
	prettier@​3.9.6 ⏵ 3.9.8			+1	+1

View full report