chore(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@semantic-release/git	11.0.0 → 11.0.1
globals	17.7.0 → 17.9.0
lint-staged	17.1.1 → 17.3.0
mocha (source)	11.7.6 → 11.8.0
nx (source)	23.1.0 → 23.1.1
semantic-release	25.0.8 → 25.0.9
yjs (source)	13.6.31 → 13.6.32

---

Release Notes

semantic-release/git (@​semantic-release/git)

v11.0.1

Compare Source

Bug Fixes

• deps: update dependency execa to v10 (#​564) (b39d5c6)

sindresorhus/globals (globals)

v17.9.0

Compare Source

v17.8.0

Compare Source

• Update globals (2026-07-01) (#​347) 7394811

---

lint-staged/lint-staged (lint-staged)

v17.3.0

Compare Source

Minor Changes

• #​1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #​1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Compare Source

Minor Changes

• #​1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

  Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

  Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.js": {
      title: "Log staged JS files to console",
      task: async (files) => {
        console.log("Staged JS files:", files);
      },
    },
  };

mochajs/mocha (mocha)

v11.8.0

Compare Source

nrwl/nx (nx)

v23.1.1

Compare Source

23.1.1 (2026-07-30)

🚀 Features

• core: derive stable repo key from normalized remote and relative path (#​36439)
• repo: add react + vite + vitest + playwright example (#​35921)

🩹 Fixes

• angular-rspack: speed up builds and align behavior with the esbuild application builder (#​36268, #​34936)
• bundling: support TypeScript esbuildConfig files in the esbuild executor (#​36352, #​36349)
• bundling: acknowledge @​swc/core build scripts when configuring rollup (#​36412)
• core: speed up npm lockfile parsing (#​36216)
• core: speed up lockfile parsing and catalog resolution (#​36223)
• core: show performance report recommendations only when actionable (#​36344)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#​36280)
• core: prevent shell injection in nx import (#​36348)
• core: correct the 22.6.0 gitignore and analytics migration wiring (#​36356)
• core: support npm 12 and pnpm in the package provenance check (#​36354, #​36338)
• core: honor pnpm minimumReleaseAge config on pnpm 11 (#​36335, #​36330)
• core: support pnpm 11 patched dependency hashes (#​36360)
• core: resolve name refs copied into pattern-matched target arrays (#​36359)
• core: resolve source-loaded plugin transitive workspace imports (#​36296)
• core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#​36302)
• core: include continuous and default-config dependencies in show target (#​36374)
• core: make unit tests pass locally regardless of invoking package manager (#​35994)
• core: respect --aiAgents none to skip AI agent file generation (#​34944, #​34692)
• core: use --config.frozen-lockfile=false for pnpm add during migrate (#​36337)
• core: run selected projects with --exclude-task-dependencies (#​35562)
• core: stop passing git revisions through a shell in affected commands (#​36379)
• core: collect trickling watcher bursts fully on daemon force-flush (#​36391)
• core: report tasks running in another Nx process in the inline TUI (#​36341)
• core: stop ratatui cursor queries from racing the TUI event stream (#​36318)
• core: render critical-path tasks as a nested list in the job summary (#​36394)
• core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#​36411)
• core: support multiple brace groups in workspace glob matching (#​36395)
• core: handle CRLF line endings in pnpm multi-document lockfiles (#​36419, #​35828, #​35840)
• core: correct glob pattern expansion for ZeroOrOne groups (#​31857)
• core: stop re-querying confirmed cache misses in task orchestrator (#​36301, #​35632)
• core: sample project graph perf span telemetry per session at 10% (#​36420)
• core: strip terminal query sequences when replaying task output (#​36432)
• core: preserve FORCE_COLOR=0 intent for forked child tasks (#​35293)
• core: handle colons in target name when resolving inputs to generate graph (#​36429, #​33710)
• core: merge default plugins through the source-map-aware merge path (#​36257)
• core: keep nx migrate on the requested version when release-age gates interfere (#​36444)
• core: avoid bogus duplicate project name errors when generating nested apps (#​36458)
• core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#​36497)
• core: bump pinned axios and brace-expansion past vulnerable versions (#​36507, #​36474)
• core: parse pnpm lockfiles that omit the packages block (#​36512)
• core: keep real dependencies when omitting peers from npm temp installs (#​36518)
• devkit: resolve ensurePackage against the workspace (#​36496)
• docker: run release pipeline docker commands without a shell (#​36505)
• js: support private methods and static blocks in babel preset (#​36218, #​36205)
• js: parse pnpm/npm publish JSON containing braces in file paths (#​36241, #​36236)
• js: resolve the verdaccio bin through its package.json (#​36479)
• js: resolve package and extension-less tsconfig extends read from the tree (#​36271)
• linter: keep override parser when convert-to-flat-config uses FlatCompat (#​36363)
• linter: use projectService for typed linting in flat configs (#​35727)
• misc: resolve CSS url() assets on Windows in postcss-cli-resources (#​36353, #​36336)
• misc: suppress outdated disclaimer for unsupported AI agents with AGENTS.md (#​36324, #​36264)
• misc: bump ci-workflow generator to node 24 and current action majors (#​36364)
• misc: preserve package alias keys in generated package.json (#​35207)
• misc: prevent crash when opening browser in Podman+WSL container (#​34639)
• module-federation: do not cache static remote assets in the dev-server plugin (#​36279, #​36278)
• module-federation: strip version suffix from npm dependency names for bun compatibility (#​34960)
• react-native: include migration docs in the built package (#​36378)
• release: only extract body issue references linked via closing keywords (#​36326, #​123)
• release: align VersionDataEntry dependency types with VersionActions to allow null values (#​35932, #​35913)
• repo: bump decompress to safe version (#​36333)
• repo: drop stale e2e dependsOn overrides that omit the local registry (#​36482)
• repo: serialize cypress installs and skip the binary when unused (#​36493)
• rspack: lazy-load @​rspack/core in create-compiler to avoid eager ESM resolution (#​36476)
• storybook: update configuration generator nx.json (#​34880, #​34879)
• testing: add @​swc/core when configuring jest with the swc compiler (#​36409)
• vite: prevent watch false leaking into dev server config (#​36080, #​36078)
• vitest: honor watch config and keep --ui open in the test executor (#​36237, #​30263)
• vitest: generate root vitest.config.ts instead of deprecated vitest.workspace (#​36316, #​36311)
• vitest: prevent out-of-memory crash during atomized test graph creation (#​36339, #​36315)
• webpack: disable extractComments on the swc terser minimizer (#​36238, #​36233)
• webpack: bundle non-buildable library subpaths with fallback-array exports (#​36313, #​36309)
• webpack: propagate watch option from executor to webpack config (#​34927, #​22945)

❤️ Thank You

• Aaron Thomas @​ATKasem
• AgentEnder @​AgentEnder
• Amp
• Charlie Croom
• Claude
• Claude Fable 5
• Claude Sonnet 5
• Cogi @​dbwodlf3
• Copilot @​Copilot
• Craigory Coppola @​AgentEnder
• David Johnson @​djohnson-aperture
• duckot13
• FrozenPandaz @​FrozenPandaz
• ilan weissberg @​ilanwei1
• Jack Hsu @​jaysoo
• Jaeil Yu
• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez
• Louis DeScioli
• Martijn van der Meij @​Squixx
• Miroslav Jonas @​meeroslav
• Miroslav Jonaš @​meeroslav
• Prafful S @​prafful1234
• Richard Roozenboom @​Roozenboom
• Thees Hengstermann @​theescodes
• Tushar Khadde @​Tusharkhadde

semantic-release/semantic-release (semantic-release)

v25.0.9

Compare Source

yjs/yjs (yjs)

v13.6.32

Compare Source

• fix #​797 - undomanager clears destroy handler 95e890d

---

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: package-lock.json

npm --before could not be enforced because existing locked packages were published after the minimumReleaseAge cutoff. This will resolve after the next lock file maintenance run.

[github-actions]

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀