chore(deps): update npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@nestjs/common (source)	11.1.6 -> 11.1.8
@nestjs/core (source)	11.1.6 -> 11.1.8
@nestjs/platform-express (source)	11.1.6 -> 11.1.8
@nestjs/testing (source)	11.1.6 -> 11.1.8
@types/node (source)	24.9.1 -> 24.10.1
@typescript-eslint/scope-manager (source)	8.46.2 -> 8.46.4
@typescript-eslint/visitor-keys (source)	8.46.2 -> 8.46.4
@vitest/browser (source)	4.0.6 -> 4.0.8
@vitest/browser-playwright (source)	4.0.6 -> 4.0.8
@vscode/vsce (source)	3.6.2 -> 3.7.0
alpinejs (source)	3.15.0 -> 3.15.1
antd (source)	5.27.5 -> 5.28.1
axios (source)	1.12.2 -> 1.13.2
dayjs (source)	1.11.18 -> 1.11.19
emnapi	1.6.0 -> 1.7.0
es-toolkit (source)	1.40.0 -> 1.41.0
esbuild	^0.25.0 -> ^0.27.0
eslint (source)	9.38.0 -> 9.39.1
happy-dom	20.0.7 -> 20.0.10
immer	10.1.3 -> 10.2.0
memfs	4.49.0 -> 4.51.0
pnpm (source)	10.20.0 -> 10.22.0
solid-js (source)	1.9.9 -> 1.9.10
terser (source)	5.44.0 -> 5.44.1
vitest (source)	4.0.1 -> 4.0.8
vitest (source)	4.0.6 -> 4.0.8
vue (source)	3.5.22 -> 3.5.24

---

Release Notes

nestjs/nest (@​nestjs/common)

v11.1.8

Compare Source

v11.1.7

Compare Source

nestjs/nest (@​nestjs/core)

v11.1.8

Compare Source

v11.1.7

Compare Source

nestjs/nest (@​nestjs/platform-express)

v11.1.8

Compare Source

v11.1.8 (2025-10-27)

Bug fixes

• core
  • #​15815 fix(core): ensure nested transient provider isolation (@​mag123c)
• platform-fastify
  • #​15831 fix(fastify): Migrate fastify top-level options to routerOptions (@​kim-sung-jee)

Committers: 2

• JaeHo Jang (@​mag123c)
• Seongjee Kim (@​kim-sung-jee)

v11.1.7

Compare Source

nestjs/nest (@​nestjs/testing)

v11.1.8

Compare Source

v11.1.7

Compare Source

typescript-eslint/typescript-eslint (@​typescript-eslint/scope-manager)

v8.46.4

Compare Source

This was a version bump only for scope-manager to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.46.3

Compare Source

This was a version bump only for scope-manager to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/visitor-keys)

v8.46.4

Compare Source

This was a version bump only for visitor-keys to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.46.3

Compare Source

This was a version bump only for visitor-keys to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

vitest-dev/vitest (@​vitest/browser)

v4.0.8

Compare Source

   🐞 Bug Fixes

• Workaround noExternal merging bug on Vite 6  -  by @​hi-ogawa in #​8950 (bcb13)
• Missed context.d.ts file  -  by @​termorey in #​8965 (9044d)
• Incorrect error message for non-awaited expect.element()  -  by @​StyleShit in #​8954 (9638d)
• browser: Cleanup frame-ancestors from CSP header at coverage middleware  -  by @​userquin in #​8941 (1f730)
• deps: Update all non-major dependencies  -  by @​sheremet-va in #​8636 (da8b9)
• forks: Do not fail with Windows Defender enabled  -  by @​sheremet-va in #​8967 (c79f4)
• runner: Properly encode Uint8Array body in annotations  -  by @​Livan-pro in #​8951 (997ca)
• spy: Copy static properties if spy is initialised with vi.fn(), fix types for vi.spyOn(obj, class)  -  by @​sheremet-va in #​8956 (75e7f)
• webdriverio: When no argument is passed to the .click interaction command, the webdriver command should also have no argument  -  by @​julienw in #​8937 (069e6)

    View changes on GitHub

v4.0.7

Compare Source

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in #​8916 (6240d)
• Create environment once per worker with isolate: false  -  by @​sheremet-va in #​8915 (c9078)
• Add Locator as a possible element type in toContainElement() matcher  -  by @​vitalybaev in #​8910 and #​8927 (35a27)
• browser: Inherit isolate option, deprecate browser.isolate/browser.fileParallelism  -  by @​sheremet-va in #​8890 (9d2b4)
• cli: Parse --execArgv as array  -  by @​AriPerkkio in #​8924 (751c3)
• jsdom: Support URL.createObjectURL, FormData.set(prop, blob)  -  by @​sheremet-va in #​8935 (a1b73)
• pool: Avoid --require argument when running in deno  -  by @​pi0 in #​8897 (d41fa)
• typecheck: Handle re-runs outside tsc  -  by @​AriPerkkio in #​8920 (fdb2e)

   🏎 Performance

• pool:
  • Sort test files by project by default  -  by @​AriPerkkio in #​8914 (680a6)
• reporters:
  • Optimize getting the tests stats  -  by @​Connormiha in #​8908 (06d62)
  • Remove unnecessary Array.from call  -  by @​Connormiha in #​8907 (b6014)

    View changes on GitHub

Microsoft/vsce (@​vscode/vsce)

v3.7.0

Compare Source

Changes:

• #​1219: Remove invalid validation for extension dependencies
• #​1212: Validate extension dependencies use lowercase letters and warn about deprecated github.copilot
• #​1209: Bump validator from 13.9.0 to 13.15.20
• #​1200: Bump tar-fs from 2.1.3 to 2.1.4

This list of changes was auto generated.

alpinejs/alpine (alpinejs)

v3.15.1

Compare Source

Changed

• x-sort improvements
• CSP build allowGlobals now defaults to false instead of true

ant-design/ant-design (antd)

v5.28.1

Compare Source

• Carousel
  • 🐞 Fix Carousel style issue in vertical mode. #​55615 @​wanpan11
  • 🐞 Fix Carousel dots animation missing when first render. #​55589 @​wanpan11
• 🐞 Fix Descriptions where content style wrongly used labelStyle. #​55572 @​li-jia-nan
• 💄 Adjust the height of the Select component to 32px when variant="underlined". #​55607 @​ustcfury
• 💄 When the underlined property is enabled for the Input component, the border color changes on mouse hover. #​55609 @​ustcfury
• 🛠 Flex gap prop support number type. #​55591 @​ayangweb
• 🌐 Add missing TimePicker translations for locales: ar_EG, en_GB, gl_ES, bg_BG, ca_ES, cs_CZ, el_GR, es_ES, eu_ES, fi_FI, he_IL, hu_HU, is_IS, kn_IN, kmr_IQ, lv_LV, mk_MK, mn_MN, ms_MY, pl_PL, pt_BR, pt_PT, ro_RO, sk_SK, sl_SI, sv_SE, ta_IN, th_TH, zh_TW, et_EE. #​55656 @​li-jia-nan

---

• Carousel
  • 🐞 修复 Carousel 组件纵向样式问题。#​55615 @​wanpan11
  • 🐞 修复 Carousel 首次渲染时指示点动画丢失。#​55589 @​wanpan11
• 🐞 修复 Popconfirm 在 actionFn 出错时未重置 ref 的问题。#​55519 @​Taoister39
• 🐞 修复 Descriptions 组件内容样式错误使用 labelStyle 的问题。#​55572 @​li-jia-nan
• 💄 修正 underlined 变体的 Select 组件高度为 32px。#​55607 @​ustcfury
• 💄 为 underlined 变体的 Input 组件补全 hover 边框颜色样式。#​55609 @​ustcfury
• 🛠 Flex gap 属性支持 number 类型。#​55591 @​ayangweb
• 🌐 补充 TimePicker 多语言翻译，覆盖以下语言：ar_EG、en_GB、gl_ES、bg_BG、ca_ES、cs_CZ、el_GR、es_ES、eu_ES、fi_FI、he_IL、hu_HU、is_IS、kn_IN、kmr_IQ、lv_LV、mk_MK、mn_MN、ms_MY、pl_PL、pt_BR、pt_PT、ro_RO、sk_SK、sl_SI、sv_SE、ta_IN、th_TH、zh_TW、et_EE。#​55656 @​li-jia-nan

v5.28.0

Compare Source

v5.27.6

Compare Source

• Table
  • 🐞 Fix Table pagination.align is not working. #​55316
  • 🛠 Add Table missing useMemo capability to spinProps. #​55344
• 🛠 Refactor Modal useMemo of ConfirmDialog to resolve useMemo invalid where Object.values ​​generates a new array. #​55376
• TypeScript
  • 🤖 Add ConfigProvider the Window type definition in getTargetContainer of . #​55313
  • 🤖 Add ConfigProvider the ShadowRoot type definition in getTargetContainer and getPopupContainer. #​55278 @​leshalv
  • 🤖 Improve Modal type definition. #​55371

---

• Table
  • 🐞 修复 Table pagination.align 属性失效的问题。#​55316
  • 🛠 补充 Table 中 spinProps 的 useMemo 缺失能力。#​55344
• 🛠 重构 Modal 中 ConfirmDialog 的 useMemo，以解决 Object.values 生成新数组导致 useMemo 失效的问题。#​55376
• TypeScript
  • 🤖 补充 ConfigProvider getTargetContainer 中 Window 类型定义。#​55313
  • 🤖 补充 ConfigProvider 的 getTargetContainer 和 getPopupContainer 中 ShadowRoot 类型定义。#​55278 @​leshalv
  • 🤖 优化 Modal 中类型定义。#​55371

axios/axios (axios)

v1.13.2

Compare Source

Bug Fixes

• http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#​7206) (8d37233)
• http: use default export for http2 module to support stubs; (#​7196) (0588880)

Performance Improvements

• http: fix early loop exit; (#​7202) (12c314b)

Contributors to this release

• Dmitriy Mozgovoy
• Kasper Isager Dalsgarð

v1.13.1

Compare Source

Bug Fixes

• http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#​7193) (bcd5581)

Contributors to this release

• Anchal Singh
• Dmitriy Mozgovoy

v1.13.0

Compare Source

Bug Fixes

• fetch: prevent TypeError when config.env is undefined (#​7155) (015faec)
• resolve issue #​7131 (added spacing in mergeConfig.js) (#​7133) (9b9ec98)

Features

• http: add HTTP2 support; (#​7150) (d676df7)

Contributors to this release

• Dmitriy Mozgovoy
• Noritaka Kobayashi
• Aviraj2929
• prasoon patel
• Samyak Dandge
• Anchal Singh
• Rahul Kumar
• Amit Verma
• Abhishek3880
• Dhvani Maktuporia
• Usama Ayoub
• ikuy1203
• Nikhil Simon Toppo
• Jane Wangari
• Supakorn Ieamgomol
• Kian-Meng Ang
• UTSUMI Keiji

1.12.2 (2025-09-14)

Bug Fixes

• fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#​7030) (cf78825)

Contributors to this release

• Dmitriy Mozgovoy
• Noritaka Kobayashi

1.12.1 (2025-09-12)

Bug Fixes

• types: fixed env config types; (#​7020) (b5f26b7)

Contributors to this release

• Dmitriy Mozgovoy

iamkun/dayjs (dayjs)

v1.11.19

Compare Source

Bug Fixes

• added usage warnings for diff + updated unit tests (#​2948) (269a7a9)
• dont instantiate regexes within ar locale functions to avoid performance overhead (#​2898) (af5e9f0)
• replace italian locale "un' ora fa" with "un'ora fa", add tests for it (#​2930) (9e9f76c)
• Updated Belarusian locale with relative time (#​2656) (1d8746c)

toyobayashi/emnapi (emnapi)

v1.7.0

Compare Source

What's Changed

• feat: add napi_create_object_with_properties method by @​toyobayashi in #​181

Full Changelog: toyobayashi/emnapi@v1.6.0...v1.7.0

toss/es-toolkit (es-toolkit)

v1.41.0

Compare Source

Released on October 24th, 2025.

• Enhanced throttle to preserve this context when called as a method.
• Added type guard support for partition function.
• Fixed omit to support runtime-determined key arrays with proper overloads.
• Fixed defaults in compatibility layer to properly handle undefined and null sources.
• Fixed toSnakeCaseKeys and toCamelCaseKeys to correctly return types for non-plain objects.
• Fixed toMerged and mergeWith to properly handle shared objects in merge logic.
• Fixed compat/union to support array-like objects.
• Fixed compat/updateWith to use get for value retrieval in updater function.
• Fixed circular import between isMatch and isMatchWith.
• Fixed find and findLast by simplifying logic and removing unnecessary checks.
• Fixed takeRight by improving test coverage and removing redundant checks.
• Fixed curry and curryRight by removing unnecessary type assertions.
• Fixed isEqualWith and mapKeys by removing unnecessary type assertions.
• Improved performance for meanBy by removing intermediate array creation.
• Updated build system to use UMD format instead of IIFE for browser builds.
• Fixed numerous documentation examples across compat modules.
• Improved test coverage with additional test cases for edge cases and compatibility.

We sincerely thank @​the5thbeatle, @​wo-o29, @​hwibaski, @​manudeli, @​raon0211, @​dayongkr, @​D-Sketon, @​yoouungyoung, @​Dohun-choi, @​sukvvon, @​zoulou00, and @​sen2y for their contributions. We appreciate your great efforts!

evanw/esbuild (esbuild)

v0.27.0

Compare Source

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

• Use Uint8Array.fromBase64 if available (#​4286)

  With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.

• Update the Go compiler from v1.23.12 to v1.25.4 (#​4208, #​4311)

  This raises the operating system requirements for running esbuild:

  • Linux: now requires a kernel version of 3.2 or later
  • macOS: now requires macOS 12 (Monterey) or later

v0.26.0

Compare Source

• Enable trusted publishing (#​4281)

  GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

  Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

eslint/eslint (eslint)

v9.39.1

Compare Source

v9.39.0

Compare Source

capricorn86/happy-dom (happy-dom)

v20.0.10

Compare Source

v20.0.9

Compare Source

v20.0.8

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where previousSibling() and nextSibling() didn't work in HTMLSelectElement and HTMLFormElement - By @​capricorn86 in task #​1939
• Fixes issue where parsing an item without a permitted parent (e.g. <tr>) should be valid inside a <template> element - By @​capricorn86 in task #​1939

immerjs/immer (immer)

[v10.2.0](https://redirect.github.com/immerjs/

---

Configuration

📅 Schedule: Branch creation - "before 10am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[graphite-app]

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• 0-merge - adds this PR to the back of the merge queue
• hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.