chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	10.28.0 → 10.28.2
prettier (source)	^3.8.0 → ^3.8.1
tsdown (source)	^0.19.0 → ^0.20.1
vitest (source)	^4.0.17 → ^4.0.18

---

Release Notes

pnpm/pnpm (pnpm)

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Gold Sponsors

v10.28.1

Compare Source

rolldown/tsdown (tsdown)

v0.20.1

Compare Source

   🚀 Features

• inline-only: Show warnings if bundled deps  -  by @​sxzz (1e0e7)

    View changes on GitHub

v0.20.0

Compare Source

   🚨 Breaking Changes

• Upgrade dts plugin, remove dts.resolve option  -  by @​sxzz (16655)

   🚀 Features

• Add option to disable legacy CJS warning  -  by @​sxzz (9fada)
• Apply inlineOnly option for dts files  -  by @​sxzz (7d89d)
• Upgrade rolldown to 1.0.0-beta.60  -  by @​sxzz (bb3ee)
• Upgrade rolldown to rc 1  -  by @​sxzz (1959f)
• entry: Support mixed array and object entries  -  by @​sxzz (a8083)

   🐞 Bug Fixes

• Optional parseEnv  -  by @​sxzz (be1b6)
• Reload config on restart  -  by @​sxzz (1756b)
• Config extensions typo  -  by @​aryaemami59 in #​722 (d2bb7)
• windows: Normalize path separators in build output  -  by @​ryuapp in #​719 (c4525)

   🏎 Performance

• Native filter for external plugin  -  by @​sxzz (8764e)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}