Update npm non-major by renovate[bot] · Pull Request #19 · makewith/makewith.github.io

renovate · 2026-11-06T16:52:45Z

This PR contains the following updates:

Package	Change	Age	Confidence
@void/md (source)	`1.4.0` → `1.6.2`
@void/react (source)	`1.4.0` → `1.6.2`
hono (source)	`4.13.15` → `4.13.16`
vite (source)	`1.4.0` → `1.5.0`
vite-plus (source)	`1.4.0` → `1.5.0`
void (source)	`1.4.0` → `1.6.2`

Release Notes

voidzero-dev/void (@void/md)

`v1.6.2`

Compare Source

Added isVoidActionError() to recognize action errors at any status, including thrown 401, 403, and 5xx errors. Available from all four framework adapters.
Fixed overlapping routes choosing the wrong handler. Pages, API routes, and WebSocket routes now consistently prefer more specific paths.
Fixed c.redirect() unintentionally forwarding incoming query parameters to its destination.
Fixed unnecessary static page-data requests during development and for pages with prerender = false, avoiding 404s and extra round trips.
Fixed Solid's useParams() returning stale parameters after client-side navigation.
Fixed Better Auth OAuth state not being shared correctly in local development.
Fixed framework _headers files being dropped on native Cloudflare deployments that preserve existing secrets.
Fixed configuration errors and diagnostics referring to void.json in projects using void.config.ts.

Thanks to @0froq, @dvkam, @karthickeyan-dev, @morinokami, @niteshseram, @yangshun, and @yujiym for their contributions!

Recognizing Action Errors

Use isVoidActionError() in error handling to distinguish failed actions from other errors and read their status and message:

import { isVoidActionError } from '@void/react';

function describeError(error: unknown) {
  if (isVoidActionError(error)) {
    if (error.status === 401) return 'Please sign in again.';
    return error.message;
  }
  return 'Something went wrong.';
}

Action error handling

`v1.6.1`

Compare Source

Fixed void prepare failing in fresh projects with authentication when tsconfig.json extends .void/tsconfig.json.

`v1.6.0`

Compare Source

Added routing.typedRoutes to check URL strings in links, navigation, and rewrites. Enabled by default in new Pages apps.
Added automatic aria-current and data-void-active indicators to Link, with activeMatch="prefix" for nested pages.
Added data-void-pending to Link while its destination is loading.
Added prefetch.defaultStrategy to configure a default prefetch strategy for every Link.
Improved Link prefetching to skip external URLs, respect data saver and 2G connections, and wait 300 ms before prefetching visible links.
Added { resolveOn: 'data' } to React router.visit() and router.refresh() to avoid deadlocks when awaiting navigation inside Actions or transitions.
Added a threading option to sendEmail() so replies sent later can stay in the same conversation.
Added rotating refresh tokens for connected apps, allowing access to be renewed without hourly sign-in prompts.
Added --runtime-logs minimal for self-hosted platforms to omit request URLs and log and exception messages from runtime telemetry.
Improved native Cloudflare deploys to serve static files and prerendered pages without Worker invocations when no server processing is needed.
Fixed page middleware breaking loader and action responses and dropping validator types.
Fixed query-only and relative navigation URLs resolving against the site root instead of the current page.
Fixed Vue Link types rejecting standard attributes and listeners such as target, download, and @click.
Fixed Svelte useForm() clearing errors written directly in an input handler.
Fixed action errors showing a generic status instead of the message from a plain-text 4xx response.
Fixed forms and actions scrolling to the top after updating the current page in place.
Fixed custom response headers in local development and native deploys without overriding private authentication cache policy.
Fixed missing Sandbox and Container Durable Object bindings in the dev server.
Fixed Markdown client scripts missing from production builds when no .island. file was present.
Fixed invalid Markdown frontmatter stopping the dev server. Errors now identify the affected file, and other pages keep working.
Fixed platform setup requiring DNS Edit permission when using an existing compatible DNS record.
Fixed resumed platform installations ignoring replacement runtime tokens and leaving already deployed Workers with old credentials.

Thanks to @0froq, @Dazzanova, @dvkam, @iPLAYCAFE-dev, @karthickeyan-dev, @morinokami, @serkodev, @sglyon, @ubugeeei, and @yangshun for their contributions!

New Features

Typed Routes

New Pages apps enable typed route URLs automatically. To enable them in an existing app:

// void.config.ts
import { defineConfig } from 'void/config';

export default defineConfig({
  routing: { typedRoutes: true },
});

TypeScript then checks URL strings passed to Link, router methods, and c.rewrite() against your app's routes.

Checked URL strings

Active and Pending Links

Style the current page and a navigation in progress with CSS:

a[data-void-active] {
  font-weight: 600;
}

a[data-void-pending] {
  opacity: 0.6;
  transition: opacity 0.15s 0.1s;
}

Use activeMatch="prefix" to keep a section's link active on nested pages:

<Link href="/users" activeMatch="prefix">Users</Link>

Active links · Pending links

Prefetch Defaults

Configure prefetching once in your framework adapter:

voidReact({ prefetch: { defaultStrategy: 'hover' } });

The same option works with voidVue, voidSvelte, and voidSolid. Individual links can override it:

<Link href="/reports" prefetch="visible">Reports</Link>
<Link href="/exports" prefetch={false}>Exports</Link>

Visible links wait 300 ms before prefetching. Automatic prefetching skips when the browser reports data saver or a 2G connection.

Prefetching

Awaiting Navigation in React Actions

Pass resolveOn: 'data' when awaiting navigation inside a React Action or transition:

startTransition(async () => {
  await saveUser();
  await router.refresh({ resolveOn: 'data' });
});

This lets the Action finish once page data is ready, allowing React to commit the update.

React navigation completion

Email Threading

Save an incoming message's ID and use it when sending a reply later, such as from a queue job:

await sendEmail({
  to: ticket.from,
  subject: `Re: ${ticket.subject}`,
  text: 'We fixed it.',
  threading: { inReplyTo: ticket.messageId },
});

Reply later

Connected-App Refresh Tokens

Connected apps can renew access by posting grant_type=refresh_token and their refresh token to /oauth/token, using HTTP Basic client authentication.

Connected apps

Minimal Runtime Logs

Choose minimal logging when installing or upgrading a self-hosted platform:

void platform install --runtime-logs minimal
void platform upgrade --runtime-logs minimal

Runtime logs

Upgrade Guide

Form types are stricter in this release:

Form status fields are read-only, and form.data and form.errors cannot be replaced. In React and Solid, update fields through the form methods. Vue and Svelte continue to support editing data and errors in place.
Island form errors are now typed as string | undefined. Check that an error exists before using it.
Svelte useIslandForm() now infers field types from its defaults. Annotate defaults that need a wider type, such as null as File | null.

`v1.5.0`

Compare Source

Added routeUrl() from void/routes to build URLs with autocomplete and type checking for route patterns and required parameters.
Added typed destination objects to router.visit(), router.prefetch(), router.flush(), and c.rewrite().
Added logger.child(fields) to attach shared fields to log entries, with support for nested child loggers and per-call overrides.
Improved Pages navigation by loading page components and layouts in parallel with page data.
Upgraded to Cloudflare Vite plugin 2.0 beta and updated Cloudflare tooling.
Fixed React action() hanging when awaited inside a transition, useActionState, or a form action.
Fixed islands imported only by Markdown pages failing to hydrate in React and Vue.
Fixed withValidator({ query }) dropping repeated query parameters. Repeated values are now preserved as arrays.
Fixed queue handler errors being swallowed instead of logged.
Fixed void secret sync --platform cloudflare reporting success without storing secrets.
Added --yes to void secret sync for scripts and CI. Cancelled secret commands now exit with a non-zero status.
Improved Cloudflare deployment error reporting.

Thanks to @0froq, @Dazzanova, @morinokami, and @yangshun for their contributions!

Upgrade Guide

Please run void migrate to add the .cloudflare build folder to your .gitignore. If you are using void secret sync on CI, please add the --yes flag.

honojs/hono (hono)

`v4.13.16`

Compare Source

Security fixes

This release includes fixes for the following security issues:

`mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

`validator('form')` skips validation for `multipart/form-data` requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

`css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

`csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in #5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

voidzero-dev/vite-plus (vite)

`v1.5.0`: vite-plus v1.5.0

Compare Source

Vite+ 1.5 adds an official Homebrew tap, runs TypeScript through Node.js with node --import vite-plus/register, and lets vp migrate move oxnode and transpile-only ts-node scripts to vpx.

Features

Install vp from the official Homebrew tap on macOS and glibc Linux (docs) (#2740), by @fengmk2:

brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp

node --import vite-plus/register runs TypeScript with the same loader as vpx, so tools that start Node.js themselves, such as the Node.js test runner, AVA, or a NODE_OPTIONS setting, can run TypeScript files (docs) (#3208), by @fengmk2.
vp migrate moves oxnode commands and transpile-only ts-node commands to vpx, and moves their Node.js preloads and literal NODE_OPTIONS values to vite-plus/register. ts-node commands that type-check stay unchanged with a warning, and the ts-node dependency is removed only when nothing still uses it. A project already on Vite+ gets this migration with vp migrate --full (docs) (#3209, #3210), by @fengmk2.
vp migrate warns when it finds Rollup, Rolldown, or Jest dependencies with matching configuration, and explains how to move them to Vite, tsdown, or Vitest. The warnings show during the first migration, or with vp migrate --full in a project already on Vite+ (#3275), by @KTrain5169 and @fengmk2.
vite-plus exports resolveConfigFromFile(configFile, options?), which resolves a config relative to the config file's directory instead of process.cwd(), so editor plugins with several workspace folders load the files of the right project (#3249), by @leaysgur and @fengmk2.
Security: the CLI ships minimatch@11.0.4, which fixes a denial of service through glob pattern amplification (GHSA-g3hv-75wg-m249, medium), and zstd@0.13.4, which fixes RUSTSEC-2026-0391, RUSTSEC-2026-0398, and RUSTSEC-2026-0403 (#3328, #3331), by @renovate[bot] and @wan9chi.
Upgrade the bundled tools (#3205, #3236, #3261, #3206, #3330, #3338), by @voidzero-guard[bot] and @fengmk2:
- rolldown@1.2.15 to rolldown@1.2.16, with experimentalInlineCommonChunks in dev mode and no crash when the working directory was deleted.
- tsdown@0.23.1 to tsdown@0.23.4: vp pack --env-file can be repeated to load several env files, the config has a JSON schema, and ?inline CSS imported from dependencies is inlined.
- vitest@5.0.5 to vitest@5.1.0, with --last-failed and --since-last-run, fake timers for node:timers, and interactive review of failed snapshots. Browser mode now uses port 23315 by default.
- oxlint@1.89.0 to oxlint@1.91.0 and oxlint-tsgolint@7.0.2004 to oxlint-tsgolint@7.0.2005, with the new type-aware rule typescript/no-unsafe-enum-assignment, wider checks in rules such as array-callback-return, no-useless-concat, and no-control-regex, and two rules moved into the suspicious category.
- oxfmt@0.74.0 to oxfmt@0.76.0, with a new HTML formatter and JavaScript and TypeScript fixes for parentheses, array layout, and line width with wide characters.
- The new oxlint and oxfmt versions can flag code that passed before. If your CI runs vp check, run vp fmt after upgrading.
- Known issue: oxlint@1.91.0 can report react/immutability for a let declared inside an effect and reassigned by a closure in that effect (oxc#28401).
- vpx and vite-plus/register run on oxc-node@1.0.1, which resolves a .jsx specifier to its .tsx or .ts source.

Fixes & Enhancements

vp create into a target path that is a symbolic link removes only the link after confirmation, instead of deleting the contents of the linked directory, and the overwrite prompt names symbolic links and files (#2418), by @leslieeilsel and @fengmk2.
vp implode removes only directories and shims that it can verify as Vite+ installations, and refuses the home directory, its parents, and filesystem roots even with --yes, so a VP_HOME that points at another directory cannot delete unrelated files (#3228), by @jong-kyung.
vp run starts faster in workspaces whose tasks share cache input and output patterns, because each pattern is parsed once. In a 138-package workspace this saves about 2 seconds of CPU on every run (vite-task#887, vite-task#890), by @jasonkuhrt and @wan9chi.
vp run and package-manager commands in npm projects start about 110 ms sooner, because vp reads the npm version from npm's package.json instead of running npm --version (#3259), by @magurotuna.
vp migrate checks Vitest prerequisites faster in workspaces, because it parses each lockfile once (#3212), by @jong-kyung.
The installer and vp upgrade install the global CLI's dependencies with the Node.js version that the release pins (24.22.2 for this release), instead of the latest LTS (docs) (#3269), by @fengmk2.
The Node.js latest alias in vp env use, vp env default, vp env pin, vp env install, and .nvmrc resolves to the newest stable release instead of a 27.0.0-alpha build, and vp env list-remote marks that stable release as latest (#3335), by @voidzero-bot[bot] and @fengmk2.
VP_NODE_VERSION=22 and other partial versions work for project commands such as vp build, vp run, and vp list, instead of failing with a 404 download error (#3341), by @jong-kyung.
Two vp install -g commands that run at the same time no longer delete each other's active package, and a command that starts while a package manager is being installed no longer runs its shim before the shim is executable (#3185, #3248), by @jong-kyung.
vp config waits and retries when another linked git worktree holds the shared git config lock, so a prepare script no longer fails when two worktrees install at the same time (#3199), by @naokihaba.
vp env doctor reports Node.js resolution failures, unreadable config, a failing system node, and missing shims as errors and exits with code 1. When it finds only warnings, the summary says Some warnings found instead of All checks passed (#3215, #3222), by @liangmiQwQ.
Nushell completions for vp and vpr use the named completer input, so Nushell 0.116 shows no deprecation warning, and they fall back to file completion when fish is not installed. Run vp env setup --refresh to regenerate env.nu (#3267, #3276), by @naokihaba.
vp migrate removes the tsx dependency even when a comment still contains a tsx command or code fence, and keeps it for JSDoc type imports that need it (#3299), by @voidzero-bot[bot] and @fengmk2.
The prefer-vite-plus-imports lint rule and its autofix leave the vite and vitest imports that vp migrate keeps, such as vitest imports in a package that lists vitest in peerDependencies, so vp lint --fix no longer breaks the package for its plain Vitest users (#3192), by @Dunqing.
Generated Zed settings no longer force typeAware and unusedDisableDirectives, so editor diagnostics follow the lint.options in vite.config.ts. Existing editor settings stay unchanged (#2357), by @pweyck.
vp dlx with npm runs the right executable for scoped packages such as @angular/cli (#3229), by @jong-kyung.
vp outdated -r in npm projects checks the workspaces instead of transitive dependencies, and requires npm 7.14.0 or later (#3240), by @jong-kyung.
Dependency filters such as --prod and --dev work with npm 6, and filters that npm 6 cannot apply are rejected instead of passed through (#3251), by @jong-kyung.
Package-manager commands that the selected version does not have, such as vp pm stage before npm 11.15.0, are skipped with a warning. Unsupported pnpm dlx and pnpm pack options, and project-only flags on managed global commands such as vp install -g, are rejected instead of silently ignored (#3286, #3285), by @jong-kyung.
vp toolchain -g is short for vp toolchain --global (#3189), by @jong-kyung.
On Linux and macOS, programs in tasks with automatic file-access tracking no longer abort when they call exec with an empty path or execl with 32 or more arguments (vite-task#896, vite-task#865), by @wan9chi and @tlq5l.

Refactor

Remove the test-only package download wrapper (#3224), by @jong-kyung.

Docs

Explain that vp check stops at formatting failures, and that vp check flags go before file paths (#3262), by @SaKaNa-Y.
Show how to align an existing vite dependency with its override during a manual npm installation, to avoid EOVERRIDE (#3157), by @SaKaNa-Y.
Explain how environment variable prefixes such as FOO=bar command work in task commands on every platform (#3161), by @tartelettie.
Restore the /vp-setup redirect and the redirects for moved guide pages (#3271), by @fengmk2.
Align the labels of "See [...]" section links with their target titles (#3231), by @yamaurakazuto.

Chore

Bump vite-task to 40cb9ca; its user-facing changes are listed above (#3246, #3280), by @wan9chi.
Keep CI working on the Node.js 26 LTS and Ubuntu 24.04, cap job runtimes, reduce Node.js downloads, avoid upgrade build and snapshot download timeouts, pin Nushell, and restore Namespace Linux runners (#3198, #3258, #3266, #3268, #3303, #3309, #3320, #3332), by @fengmk2 and @wan9chi.
Add automated issue triage (#3253, #3260), by @Boshen and @fengmk2.
Run the upstream dependency upgrade with Kimi K3.1 Pro and report its timeouts (#3314, #3304), by @Brooooooklyn and @wan9chi.
Stabilize and trim tests: rerun ESLint and Prettier migration fixtures with --full, stabilize pnpm setup and Bun snapshots, update the tiptap ecosystem pin, use a recorded package in the install shortcut case, and remove duplicate devEngines parse tests (#3193, #3196, #3242, #3305, #3301), by @liangmiQwQ, @fengmk2, @wan9chi, and @Brooooooklyn.
Update Rust crates, synchronize workspace dependency requirements, and stop installing dprint and taplo in just init (#3234, #3310, #3250), by @renovate[bot], @leaysgur, and @fengmk2.
Refine contributor guidance: the release-manager skill, isolated CLI bootstrap checks in AGENTS.md, and the Rolldown exports in the CLI bundling notes (#3207, #3238, #3316), by @fengmk2 and @liangmiQwQ.

Bundled Versions

Tool	Version	Source	Changelog
vite	`8.3.5`	`981f07f`	unchanged
rolldown	`1.2.16`	`de6facf`	1.2.16
oxc-node	`1.0.1`	`7ff14c3`	1.0.1
tsdown	`0.23.4`	npm	0.23.2, 0.23.3, 0.23.4
vitest	`5.1.0`	npm	5.1.0
oxlint	`1.91.0`	npm	1.90.0, 1.91.0
oxlint-tsgolint	`7.0.2005`	npm	7.0.2005
oxfmt	`0.76.0`	npm	0.75.0, 0.76.0

Upgrade

vp upgrade

New Contributors

@yamaurakazuto, @tartelettie, @pweyck, @jasonkuhrt

Full Changelog: voidzero-dev/vite-plus@v1.4.0...v1.5.0

Published Packages

@voidzero-dev/vite-plus-core@1.5.0
vite-plus@1.5.0
create-vite-plus@1.5.0

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Homebrew (macOS/Linux):

brew tap voidzero-dev/vite-plus https://github.com/voidzero-dev/vite-plus
brew install voidzero-dev/vite-plus/vp

See the Homebrew guide to switch from the script installer or the Homebrew Core vite-plus formula.

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.5.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

Branch creation
- Between 12:00 AM and 11:59 AM, only on Saturday (* 0-11 * * 6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update npm non-major

e8fcbdb

honbin merged commit 804c96d into main Nov 7, 2026
2 checks passed

honbin deleted the renovate/npm-non-major branch November 7, 2026 00:37

Navigation Menu

Repository navigation

Update npm non-major - #19

Update npm non-major#19
honbin merged 1 commit into
mainfrom
renovate/npm-non-major

renovate Bot commented Nov 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Nov 6, 2026

Release Notes

v1.6.2

Recognizing Action Errors

v1.6.1

v1.6.0

New Features

Typed Routes

Active and Pending Links

Prefetch Defaults

Awaiting Navigation in React Actions

Email Threading

Connected-App Refresh Tokens

Minimal Runtime Logs

Upgrade Guide

v1.5.0

Upgrade Guide

v4.13.16

Security fixes

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

validator('form') skips validation for multipart/form-data requests with extra parameters

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

csrf() does not check requests sent by hyperlink auditing (text/ping)

What's Changed

v1.5.0: vite-plus v1.5.0

Features

Fixes & Enhancements

Refactor

Docs

Chore

Bundled Versions

Upgrade

New Contributors

Published Packages

Installation

Create a New App

Configuration

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v1.6.2`

`v1.6.1`

`v1.6.0`

`v1.5.0`

`v4.13.16`

`mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

`validator('form')` skips validation for `multipart/form-data` requests with extra parameters

`css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

`csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

`v1.5.0`: vite-plus v1.5.0