andras/fizika

Watch

Fork 0

Update all non-major dependencies #17

Open

andras wants to merge 1 commit from renovate/all into main

andras commented

2026-10-29 00:18:08 +00:00

Owner

This PR contains the following updates:

Package	Type	Update	Change
@plausible-analytics/tracker (source)	dependencies	patch	`0.4.5` → `0.4.7`
express (source)	dependencies	minor	`5.2.1` → `5.3.0`
helmet (source)	dependencies	minor	`8.2.0` → `8.3.0`
multer	dependencies	minor	`2.1.1` → `2.5.0`
prettier (source)	devDependencies	minor	`3.8.3` → `3.9.10`

Release Notes

plausible/analytics (@plausible-analytics/tracker)

`v0.4.6`

Compare Source

expressjs/express (express)

`v5.3.0`

Compare Source

=====

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305
Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements

Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
```
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
```
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
```
app.render('index', null, callback); // now works as expected
```
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
```
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
```
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
```
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html
```
Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @Mayvis in #7390

⚡ Performance

Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @bjohansebas in #6991

helmetjs/helmet (helmet)

`v8.3.0`

Compare Source

Changed

Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
Content-Security-Policy: improved error handling for invalid directive names

Fixed

Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

expressjs/multer (multer)

`v2.5.0`

Compare Source

Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)

`v2.4.0`

Compare Source

Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
Accept a function for limits, called with the request, to set limits per request (#1133)
Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
Allow multer.diskStorage() to be called without options (#1471)
Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
Files skipped by fileFilter no longer count towards maxCount (#1426)
Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
Remove the concat-stream dependency (#1356)
Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
Docs: add FormData upload examples (#896)
Docs: remove the translated READMEs (#1463)
Internal: run the test suite on macOS (#1464)

`v2.3.0`

Compare Source

Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)
Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)
Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)
Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)
Add MulterError codes INVALID_FIELD_NAME and STREAM_DESTROYED
Add opt-in limits.fieldArrayIndexLimit to bound numeric array indexes in field names (#1438)
Accept files whose size is exactly limits.fileSize (#1407)
Preserve the caller's async context (AsyncLocalStorage) when calling next() (#1124)
Decode WHATWG-escaped characters (%0A, %0D, %22) in file.originalname (#1421)
Do not crash when fileFilter invokes its callback more than once (#1427)
Use a fallback message for MulterError codes without a mapping (#1448)
Docs: clarify preservePath and parts, use crypto.randomBytes in the DiskStorage example (#1414, #1430, #1436)
Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README (#1431, #1354, #1462)
Internal: run the test suite on Windows (#1334)

`v2.2.0`

Compare Source

Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)
Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

prettier/prettier (prettier)

`v3.9.10`

Compare Source

diff

Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance (#20266 by @fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

`v3.9.9`

Compare Source

diff

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by @fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

`v3.9.8`

Compare Source

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.7 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a

{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.8 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

`v3.9.7`

Compare Source

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @Austin1serb, @giaBaoJS)

<!-- Input -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

<!-- Prettier 3.9.6 -->
- [x] short first line.

      second paragraph at six spaces that wraps
          onto another line here.

<!-- Prettier 3.9.7 -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

JavaScript: Fix embedded template literal idempotency (#19725 by @fisker)

// Input
const foo = html`
            <div>${getText({
            value,
            })}</div>
`;

// Prettier 3.9.6 (first format)
const foo = html`
  <div>
    ${getText({
              value,
            })}
  </div>
`;

// Prettier 3.9.6 (second format)
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

// Prettier 3.9.7
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

Markdown: Preserve Liquid blocks after Markdown tables (#19730 by @wanxiankai, @seiyab)

<!-- Input -->
| Argument | Type |
| -------- | ---- |
{% set default_params = {
    "model": ["str"],
} %}

<!-- Prettier 3.9.6 -->
| Argument                  | Type |
| ------------------------- | ---- |
| {% set default_params = { |

    "model": ["str"],

} %}

<!-- Prettier 3.9.7 -->
| Argument | Type |
| -------- | ---- |
{% set default_params = {
    "model": ["str"],
} %}

Markdown: Preserve single tildes in Markdown (#19739 by @lazerg)

Since 3.9.0, single-tilde spans like H~2~O were rewritten to double tildes, turning subscript syntax into strike-through. Only double tildes are treated that way now, matching GitHub.

<!-- Input -->
H~2~O

<!-- Prettier 3.9.6 -->
H~~2~~O

<!-- Prettier 3.9.7 -->
H~2~O

Markdown: Fix Markdown blockquote containing `>` characters (#19802 by @seiyab)

<!-- Input -->
> **test**\>

<!-- Prettier 3.9.6 -->
> **test**>\>

<!-- Prettier 3.9.7 -->
> **test**\>

Markdown: Strip blockquote markers from a setext heading's continuation lines (#19878 by @Kjubikstronk)

A setext heading spanning multiple lines inside a blockquote kept the > marker of its continuation lines as literal text.

<!-- Input -->
> Multi
> Line
> ===

<!-- Prettier 3.9.6 -->
> Multi > Line
> ===

<!-- Prettier 3.9.7 -->
> Multi
> Line
> ===

Markdown: Fix HTML block indentation drift in markdown list items (#19987 by @lazerg)

<!-- Input -->
1. Enable images:

    <p align="center">
      <img alt="example">
    </p>

<!-- Prettier 3.9.6 (--tab-width=4) -->
1. Enable images:

     <p align="center">
       <img alt="example">
     </p>

<!-- Prettier 3.9.7 (--tab-width=4) -->
1. Enable images:

    <p align="center">
      <img alt="example">
    </p>

Angular: Support `@boundary` error boundaries (#20014 by @Yahiro025)

<!-- Input -->
@boundary {
<complex-chart [data]="data"/>
}
@error (let err) {
<p>{{err.message}}</p>
}

<!-- Prettier 3.9.6 -->
SyntaxError: Unexpected character "EOF" (Do you have an unescaped "{" in your template? Use "{{ '{' }}") to escape it.) (6:1)

<!-- Prettier 3.9.7 -->
@boundary {
  <complex-chart [data]="data" />
} @error (let err) {
  <p>{{ err.message }}</p>
}

`v3.9.6`

Compare Source

diff

TypeScript: Preserve quotes for methods named `new` (#19621 by @kovsu)

// Input
interface Container {
  "new"(id: string): number;
}

// Prettier 3.9.5
interface Container {
  new(id: string): number;
}

// Prettier 3.9.6
interface Container {
  "new"(id: string): number;
}

TypeScript: Support `import defer` (#19624, #19675 by @fisker)

// Input
import defer * as foo from "foo";

// Prettier 3.9.5
import * as foo from "foo";

// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin `@prettier/plugin-yuku` (#19628, #19629 by @fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

Install the plugin:

yarn add --dev prettier @prettier/plugin-yuku

Add it to your .prettierrc:
```
plugins:
  - "@prettier/plugin-yuku"
```

Due to package size limitations, this plugin is not bundled with the main prettier package and must be installed separately.

For more information, check the package homepage.

Big thanks to @arshad-yaseen for his excellent work.

`v3.9.5`

Compare Source

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text

1234567890123456789012) text

<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text

1234567890123456789012) text

<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text

1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](<> "title")

<!-- Prettier 3.9.4 -->
[link]( "title")

<!-- Prettier 3.9.5 -->
[link](<> "title")

Less: Remove extra spaces after `[` in map lookups (#19503 by @kovsu)

// Input
.foo {
  color: #theme[ primary];
  color: #theme[@name];
  color: #theme[@@name];
}

// Prettier 3.9.4
.foo {
  color: #theme[ primary];
  color: #theme[ @name];
  color: #theme[ @@name];
}

// Prettier 3.9.5
.foo {
  color: #theme[primary];
  color: #theme[@name];
  color: #theme[@@name];
}

CSS: Prevent addition space in `type()` with `+` (#19516 by @bigandy)

This fixes the addition space before + in CSS type() declaration. For example type(<number>+) was being converted into type(<number> +) which is invalid CSS and does not work.

/* Input */
div {
  border-radius: attr(br type(<length>+));
}

/* Prettier 3.9.4 */
div {
  border-radius: attr(br type(<length> +));
}

/* Prettier 3.9.5 */
div {
  border-radius: attr(br type(<length>+));
}

Less: Remove spaces between merge markers and colons (#19517 by @kovsu)

// Input
a {
  box-shadow  +  : 0 0 1px #&#8203;000;
}

// Prettier 3.9.4
a {
  box-shadow+  : 0 0 1px #&#8203;000;
}

// Prettier 3.9.5
a {
  box-shadow+: 0 0 1px #&#8203;000;
}

Markdown: Preserve wiki links with aliases (#19527 by @kovsu)

<!-- Input -->
[[Foo:Bar]]

<!-- Prettier 3.9.4 -->
[[Foo]]

<!-- Prettier 3.9.5 -->
[[Foo:Bar]]

TypeScript: Fix comments being dropped on shorthand `type` import/export specifiers (#19565 by @kirkwaiblinger)

// Input
export { type /* comment */ T } from "foo";
import { type /* comment */ T } from "foo";

// Prettier 3.9.4
Error: Comment "comment" was not printed. Please report this error!

// Prettier 3.9.5
export { type /* comment */ T } from "foo";
import { type /* comment */ T } from "foo";

Miscellaneous: Preserving comments' `placement` property (#19567 by @Janther)

Prettier@3.9.0 deleted an undocumented property on comments, which was already used by plugins, comment.placement is now available again after comment attach.

Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)

// Input
declare module "foo" {}

// Prettier 3.9.4
declare module "foo" {
}

// Prettier 3.9.5
declare module "foo" {}

Angular: Support expression for exhaustive typechecking (#19571 by @fisker)

<!-- Input -->
@switch (state.mode) {
  @default never(state);
}

<!-- Prettier 3.9.4 -->
@switch (state.mode) {
  @default never;
}

<!-- Prettier 3.9.5 -->
@switch (state.mode) {
  @default never(state);
}

TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)

// Input
foo<{
  // comment
  [key in keyof Foo]: number
}>();

// Prettier 3.9.4
foo<
  {
    // comment
    [key in keyof Foo]: number;
  }
>();

// Prettier 3.9.5
foo<{
  // comment
  [key in keyof Foo]: number;
}>();

Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)

// Input
/* a *//* b */
/* a */* {
  color: red;
}

// Prettier 3.9.4
/* a */
/* b */
/* a * {
  color: red;
}

// Prettier 3.9.5
/* a */ /* b */
/* a */
* {
  color: red;
}

JavaScript: Handle dangling comments in `SwitchStatement` (#19581 by @fisker)

// Input
switch (foo) {
 // comment
}

// Prettier 3.9.4
switch (
  foo
  // comment
) {
}

// Prettier 3.9.5
switch (foo) {
  // comment
}

TypeScript: Remove space in comment-only object type (#19583 by @fisker)

// Input
var foo = {
  /* comment */
};
type Foo = {
  /* comment */
};

// Prettier 3.9.4
var foo = {/* comment */};
type Foo = { /* comment */ };

// Prettier 3.9.5
var foo = {/* comment */};
type Foo = {/* comment */};

`v3.9.4`

Compare Source

diff

Angular: Format `@content(name)` -> `@content (name)` to align with other block syntax (#19499 by @fisker)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>

<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
  @content(icon) {
    <span>Icon!</span>
  }
  @content(description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>

<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>

`v3.9.3`

Compare Source

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @seiyab)

// Input
<!-- Input -->
{{ page.title
}} text

<!-- Prettier 3.9.1 -->
{{ page.title
 text

<!-- Prettier 3.9.3 -->
{{ page.title
}} text

TypeScript: Allow decorators to be used with declare on class fields (#19492 by @evoactivity)

Extensively used within the Ember ecosystem, decorators with declare on class fields will ignore the babel parser error and allow Prettier to format the code without breaking it.

// Input
export default class ProjectStatusComponent extends Component<ProjectStatusSig> {
  @service declare server: ServerService;
}

// Prettier 3.9.1
// SyntaxError: Decorators can't be used with a declare field. (2:3)
//  1 | export default class ProjectStatusComponent extends Component<ProjectStatusSig> {
//> 2 |   @service declare server: ServerService;
//    |   ^
//  3 | }

// Prettier 3.9.3
export default class ProjectStatusComponent extends Component<ProjectStatusSig> {
  @service declare server: ServerService;
}

`v3.9.2`

Compare Source

`v3.9.1`

Compare Source

diff

Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance (#20266 by @fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

`v3.9.0`

Compare Source

diff

🔗 Release Notes

`v3.8.5`

Compare Source

diff

Flow: Support `readonly` as a variance annotation (#19022 by @marcoww6)

Flow now accepts readonly as a property variance annotation, equivalent to + (covariant/read-only).

// Input
type T = {
  readonly foo: string,
};

// Prettier 3.8.4
SyntaxError

// Prettier 3.8.5
type T = {
  readonly foo: string,
};

`v3.8.4`

Compare Source

diff

Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)

Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.

<!-- Input -->
- a

  - b

- c

  - d

<!-- Prettier 3.8.3 -->
- a
  - b
- c
  - d

<!-- Prettier 3.8.4 -->
- a

  - b

- c

  - d

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@plausible-analytics/tracker](https://plausible.io) ([source](https://github.com/plausible/analytics)) | dependencies | patch | [`0.4.5` → `0.4.7`](https://renovatebot.com/diffs/npm/@plausible-analytics%2ftracker/0.4.5/0.4.7) | | [express](https://expressjs.com/) ([source](https://github.com/expressjs/express)) | dependencies | minor | [`5.2.1` → `5.3.0`](https://renovatebot.com/diffs/npm/express/5.2.1/5.3.0) | | [helmet](https://helmet.js.org/) ([source](https://github.com/helmetjs/helmet)) | dependencies | minor | [`8.2.0` → `8.3.0`](https://renovatebot.com/diffs/npm/helmet/8.2.0/8.3.0) | | [multer](https://github.com/expressjs/multer) | dependencies | minor | [`2.1.1` → `2.5.0`](https://renovatebot.com/diffs/npm/multer/2.1.1/2.5.0) | | [prettier](https://prettier.io) ([source](https://github.com/prettier/prettier)) | devDependencies | minor | [`3.8.3` → `3.9.10`](https://renovatebot.com/diffs/npm/prettier/3.8.3/3.9.10) | --- ### Release Notes <details> <summary>plausible/analytics (@plausible-analytics/tracker)</summary> ### [`v0.4.7`](https://github.com/plausible/analytics/compare/607f3c733fd068ed58fc7bed3385a47c755adb06...6c062a1c6da21f85d2394568c043035a1723750f) [Compare Source](https://github.com/plausible/analytics/compare/607f3c733fd068ed58fc7bed3385a47c755adb06...6c062a1c6da21f85d2394568c043035a1723750f) ### [`v0.4.6`](https://github.com/plausible/analytics/compare/49448f5b16a5923ce06b200833a04de0e037b5e9...607f3c733fd068ed58fc7bed3385a47c755adb06) [Compare Source](https://github.com/plausible/analytics/compare/49448f5b16a5923ce06b200833a04de0e037b5e9...607f3c733fd068ed58fc7bed3385a47c755adb06) </details> <details> <summary>expressjs/express (express)</summary> ### [`v5.3.0`](https://github.com/expressjs/express/blob/HEAD/History.md#530) [Compare Source](https://github.com/expressjs/express/compare/v5.2.1...v5.3.0) \===== #### 🐞 Bug fixes - Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@YuryShkoda](https://github.com/YuryShkoda) in [#4893](https://github.com/expressjs/express/pull/4893) Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a `Transfer-Encoding` header - by [@cuishuang](https://github.com/cuishuang) in [#7459](https://github.com/expressjs/express/pull/7459) * Upgrade `qs` to `^6.16.0`, which fixes [CVE-2026-2391](https://www.cve.org/CVERecord?id=CVE-2026-2391) ([GHSA-w7fw-mjwx-w883](https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883)), [CVE-2026-82417](https://www.cve.org/CVERecord?id=CVE-2026-82417) ([GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g)) and [CVE-2026-82562](https://www.cve.org/CVERecord?id=CVE-2026-82562) ([GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)): `arrayLimit` bypasses in comma parsing and a denial of service via an attacker-controlled `isBuffer` - by [@davetashner](https://github.com/davetashner) in [#7057](https://github.com/expressjs/express/pull/7057) and [#7478](https://github.com/expressjs/express/pull/7478), and [@cyphercodes](https://github.com/cyphercodes) in [#7305](https://github.com/expressjs/express/pull/7305) * Upgrade `proxy-addr` to `^2.0.8`, which fixes [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) - by [@lazerg](https://github.com/lazerg) in [#7474](https://github.com/expressjs/express/pull/7474) #### 🚀 Improvements - Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@Cherry](https://github.com/Cherry) in [#7366](https://github.com/expressjs/express/pull/7366) ```js // QUERY /reports with If-None-Match: "12345" app.query('/reports', (req, res) => { res.set('ETag', '"12345"'); res.send(results); // now responds 304 Not Modified }); ``` - Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@Bernice55231](https://github.com/Bernice55231) in [#5167](https://github.com/expressjs/express/pull/5167) - When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#6903](https://github.com/expressjs/express/pull/6903) ```js app.render('index', null, callback); // now works as expected ``` - Upgrade `content-type` to `^2.0.0`, bringing a faster parser (\~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse. `type-is` is upgraded to `^2.1.0` as part of the same change - by [@blakeembrey](https://github.com/blakeembrey) in [#7234](https://github.com/expressjs/express/pull/7234) ```js res.set('Content-Type', 'text/plain; foo=bar').send('hey'); // -> Content-Type: text/plain; foo=bar; charset=utf-8 ``` - The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#6464](https://github.com/expressjs/express/pull/6464) - Upgrade `content-disposition` to `^2.0.1`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@blakeembrey](https://github.com/blakeembrey) in [#7233](https://github.com/expressjs/express/pull/7233) ```js res.attachment('user.html'); // before -> Content-Disposition: attachment; filename="user.html" // after -> Content-Disposition: attachment; filename=user.html ``` - Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored - by [@Mayvis](https://github.com/Mayvis) in [#7390](https://github.com/expressjs/express/pull/7390) #### ⚡ Performance - Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](https://github.com/expressjs/express/pull/6991) </details> <details> <summary>helmetjs/helmet (helmet)</summary> ### [`v8.3.0`](https://github.com/helmetjs/helmet/blob/HEAD/CHANGELOG.md#830---2026-07-11) [Compare Source](https://github.com/helmetjs/helmet/compare/v8.2.0...v8.3.0) ##### Changed - `Content-Security-Policy`: improved performance by \~7% when there are no dynamic directives - `Content-Security-Policy`: improved error handling for invalid directive names ##### Fixed - `Content-Security-Policy`: `useDefaults: false` with no directives is no longer valid, both at runtime and the type level - `Content-Security-Policy`: dynamically-computed directive values would `throw`, not call `next`, when invalid - `Content-Security-Policy`: dynamically-computed directive value entries would `throw`, not call `next`, when function threw </details> <details> <summary>expressjs/multer (multer)</summary> ### [`v2.5.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#250) [Compare Source](https://github.com/expressjs/multer/compare/v2.4.0...v2.5.0) - Fix [CVE-2026-113872](https://www.cve.org/CVERecord?id=CVE-2026-113872) ([GHSA-q7qp-rjg7-q26m](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m)) - Accept a field value of exactly `limits.fieldSize` bytes, so `LIMIT_FIELD_VALUE` fires only when the limit is exceeded. This also covers the default `fieldSize` of 1MB, so a [`1048576`](https://github.com/expressjs/multer/commit/1048576) byte value is no longer rejected when you set no limits. If you set `fieldSize` one higher to work around this, you can drop the extra one ([#1481](https://github.com/expressjs/multer/pull/1481)) - Do not add a file to the abort cleanup list when its storage engine reports an error after a `LIMIT_FILE_SIZE` abort; `DiskStorage` no longer tries to unlink an undefined path ([#1489](https://github.com/expressjs/multer/pull/1489)) ### [`v2.4.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#240) [Compare Source](https://github.com/expressjs/multer/compare/v2.3.0...v2.4.0) - Fix [CVE-2026-88932](https://www.cve.org/CVERecord?id=CVE-2026-88932) ([GHSA-3pph-fpjx-jg34](https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34)) - Add `filename` to `LIMIT_FILE_SIZE` and `LIMIT_UNEXPECTED_FILE` errors ([#1416](https://github.com/expressjs/multer/pull/1416)) - Accept a function for `limits`, called with the request, to set limits per request ([#1133](https://github.com/expressjs/multer/pull/1133)) - Add opt-in `flush` option to `DiskStorage` to fsync files before the callback runs ([#1458](https://github.com/expressjs/multer/pull/1458)) - Expose busboy's `defCharset`, `highWaterMark` and `fileHwm` options ([#1465](https://github.com/expressjs/multer/pull/1465)) - Add `streamHandler` option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) ([#1466](https://github.com/expressjs/multer/pull/1466)) - Allow `multer.diskStorage()` to be called without options ([#1471](https://github.com/expressjs/multer/pull/1471)) - Decode WHATWG-escaped characters (`%0A`, `%0D`, `%22`) in field names, matching `file.originalname` since 2.3.0: `req.body` keys, `file.fieldname` and `err.field` now carry the real name. If you matched the escaped spelling as a workaround, use the real name now ([#1473](https://github.com/expressjs/multer/pull/1473)) - Report the decoded filename in `err.filename` on `LIMIT_FILE_SIZE` errors, matching `file.originalname` ([#1478](https://github.com/expressjs/multer/pull/1478)) - Reject non-integer or negative `limits` values at construction time; a float limit silently disabled the check ([#1395](https://github.com/expressjs/multer/pull/1395), [#1335](https://github.com/expressjs/multer/pull/1335)) - Accept requests with exactly `limits.parts` parts; `LIMIT_PART_COUNT` now fires only when the limit is exceeded. If you set `parts` one higher to work around this, you can drop the extra one ([#1446](https://github.com/expressjs/multer/pull/1446)) - Files skipped by `fileFilter` no longer count towards `maxCount` ([#1426](https://github.com/expressjs/multer/pull/1426)) - Change the `LIMIT_UNEXPECTED_FILE` message to "Unexpected file field" ([#426](https://github.com/expressjs/multer/pull/426)) - Remove the `concat-stream` dependency ([#1356](https://github.com/expressjs/multer/pull/1356)) - Docs: add JSDoc to the public API and document the storage engine stream contract ([#1467](https://github.com/expressjs/multer/pull/1467), [#1468](https://github.com/expressjs/multer/pull/1468)) - Docs: add FormData upload examples ([#896](https://github.com/expressjs/multer/pull/896)) - Docs: remove the translated READMEs ([#1463](https://github.com/expressjs/multer/pull/1463)) - Internal: run the test suite on macOS ([#1464](https://github.com/expressjs/multer/pull/1464)) ### [`v2.3.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#230) [Compare Source](https://github.com/expressjs/multer/compare/v2.2.0...v2.3.0) - Fix [CVE-2026-77078](https://www.cve.org/CVERecord?id=CVE-2026-77078) ([GHSA-wc9g-mqfw-jrwm](https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm)) - Fix [CVE-2026-77037](https://www.cve.org/CVERecord?id=CVE-2026-77037) ([GHSA-qfvm-cv95-jqjf](https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf)) - Fix [CVE-2026-77063](https://www.cve.org/CVERecord?id=CVE-2026-77063) ([GHSA-qvfw-j98x-7q72](https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72)) - Fix [CVE-2026-82333](https://www.cve.org/CVERecord?id=CVE-2026-82333) ([GHSA-535w-7cp7-47q4](https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4)) - Add `MulterError` codes `INVALID_FIELD_NAME` and `STREAM_DESTROYED` - Add opt-in `limits.fieldArrayIndexLimit` to bound numeric array indexes in field names ([#1438](https://github.com/expressjs/multer/pull/1438)) - Accept files whose size is exactly `limits.fileSize` ([#1407](https://github.com/expressjs/multer/pull/1407)) - Preserve the caller's async context (`AsyncLocalStorage`) when calling `next()` ([#1124](https://github.com/expressjs/multer/pull/1124)) - Decode WHATWG-escaped characters (`%0A`, `%0D`, `%22`) in `file.originalname` ([#1421](https://github.com/expressjs/multer/pull/1421)) - Do not crash when `fileFilter` invokes its callback more than once ([#1427](https://github.com/expressjs/multer/pull/1427)) - Use a fallback message for `MulterError` codes without a mapping ([#1448](https://github.com/expressjs/multer/pull/1448)) - Docs: clarify `preservePath` and `parts`, use `crypto.randomBytes` in the `DiskStorage` example ([#1414](https://github.com/expressjs/multer/pull/1414), [#1430](https://github.com/expressjs/multer/pull/1430), [#1436](https://github.com/expressjs/multer/pull/1436)) - Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README ([#1431](https://github.com/expressjs/multer/pull/1431), [#1354](https://github.com/expressjs/multer/pull/1354), [#1462](https://github.com/expressjs/multer/pull/1462)) - Internal: run the test suite on Windows ([#1334](https://github.com/expressjs/multer/pull/1334)) ### [`v2.2.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#220) [Compare Source](https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0) - Fix [CVE-2026-5038](https://www.cve.org/CVERecord?id=CVE-2026-5038) ([GHSA-3p4h-7m6x-2hcm](https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm)) - Fix [CVE-2026-5079](https://www.cve.org/CVERecord?id=CVE-2026-5079) ([GHSA-72gw-mp4g-v24j](https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j)) </details> <details> <summary>prettier/prettier (prettier)</summary> ### [`v3.9.10`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#3910) [Compare Source](https://github.com/prettier/prettier/compare/3.9.9...3.9.10) [diff](https://github.com/prettier/prettier/compare/3.9.9...3.9.10) ##### Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance ([#20266](https://github.com/prettier/prettier/pull/20266) by [@fisker](https://github.com/fisker)) See [micromark/micromark-extension-gfm-table@`4f43ead`](https://github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267) for details. ### [`v3.9.9`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#399) [Compare Source](https://github.com/prettier/prettier/compare/3.9.8...3.9.9) [diff](https://github.com/prettier/prettier/compare/3.9.8...3.9.9) ##### Markdown: Fix text with `$` been incorrectly parsed as math syntax ([#20140](https://github.com/prettier/prettier/pull/20140) by [@fisker](https://github.com/fisker))  ```md  **Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.  **Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.  **Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here. ``` ### [`v3.9.8`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#398) [Compare Source](https://github.com/prettier/prettier/compare/3.9.7...3.9.8) [diff](https://github.com/prettier/prettier/compare/3.9.7...3.9.8) ##### Markdown: Don't let Liquid objects interrupt paragraphs ([#20087](https://github.com/prettier/prettier/pull/20087) by [@seiyab](https://github.com/seiyab))  ```markdown  If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a {{jsxref("TypeError")}} is thrown.  If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a {{jsxref("TypeError")}} is thrown.  If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a {{jsxref("TypeError")}} is thrown. ``` ### [`v3.9.7`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#397) [Compare Source](https://github.com/prettier/prettier/compare/3.9.6...3.9.7) [diff](https://github.com/prettier/prettier/compare/3.9.6...3.9.7) ##### Markdown: Prevent indentation drift in list-item code blocks ([#19647](https://github.com/prettier/prettier/pull/19647), [#19990](https://github.com/prettier/prettier/pull/19990) by [@Austin1serb](https://github.com/Austin1serb), [@giaBaoJS](https://github.com/giaBaoJS))  ```markdown  - [x] short first line. second paragraph at six spaces that wraps onto another line here.  - [x] short first line. second paragraph at six spaces that wraps onto another line here.  - [x] short first line. second paragraph at six spaces that wraps onto another line here. ``` ##### JavaScript: Fix embedded template literal idempotency ([#19725](https://github.com/prettier/prettier/pull/19725) by [@fisker](https://github.com/fisker))  ```jsx // Input const foo = html` <div>${getText({ value, })}</div> `; // Prettier 3.9.6 (first format) const foo = html` <div> ${getText({ value, })} </div> `; // Prettier 3.9.6 (second format) const foo = html` <div> ${getText({ value, })} </div> `; // Prettier 3.9.7 const foo = html` <div> ${getText({ value, })} </div> `; ``` ##### Markdown: Preserve Liquid blocks after Markdown tables ([#19730](https://github.com/prettier/prettier/pull/19730) by [@wanxiankai](https://github.com/wanxiankai), [@seiyab](https://github.com/seiyab))  ```markdown  | Argument | Type | | -------- | ---- | {% set default_params = { "model": ["str"], } %}  | Argument | Type | | ------------------------- | ---- | | {% set default_params = { | "model": ["str"], } %}  | Argument | Type | | -------- | ---- | {% set default_params = { "model": ["str"], } %} ``` ##### Markdown: Preserve single tildes in Markdown ([#19739](https://github.com/prettier/prettier/pull/19739) by [@lazerg](https://github.com/lazerg)) Since 3.9.0, single-tilde spans like `H~2~O` were rewritten to double tildes, turning subscript syntax into strike-through. Only double tildes are treated that way now, matching GitHub.  ```markdown  H~2~O  H~~2~~O  H~2~O ``` ##### Markdown: Fix Markdown blockquote containing `>` characters ([#19802](https://github.com/prettier/prettier/pull/19802) by [@seiyab](https://github.com/seiyab))  ```md  > **test**\>  > **test**>\>  > **test**\> ``` ##### Markdown: Strip blockquote markers from a setext heading's continuation lines ([#19878](https://github.com/prettier/prettier/pull/19878) by [@Kjubikstronk](https://github.com/Kjubikstronk)) A setext heading spanning multiple lines inside a blockquote kept the `>` marker of its continuation lines as literal text.  ```md  > Multi > Line > ===  > Multi > Line > ===  > Multi > Line > === ``` ##### Markdown: Fix HTML block indentation drift in markdown list items ([#19987](https://github.com/prettier/prettier/pull/19987) by [@lazerg](https://github.com/lazerg))  ```markdown  1. Enable images: <p align="center"> <img alt="example"> </p>  1. Enable images: <p align="center"> <img alt="example"> </p>  1. Enable images: <p align="center"> <img alt="example"> </p> ``` ##### Angular: Support `@boundary` error boundaries ([#20014](https://github.com/prettier/prettier/pull/20014) by [@Yahiro025](https://github.com/Yahiro025))  ```html  @boundary { <complex-chart [data]="data"/> } @error (let err) { <p>{{err.message}}</p> }  SyntaxError: Unexpected character "EOF" (Do you have an unescaped "{" in your template? Use "{{ '{' }}") to escape it.) (6:1)  @boundary { <complex-chart [data]="data" /> } @error (let err) { <p>{{ err.message }}</p> } ``` ### [`v3.9.6`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#396) [Compare Source](https://github.com/prettier/prettier/compare/3.9.5...3.9.6) [diff](https://github.com/prettier/prettier/compare/3.9.5...3.9.6) ##### TypeScript: Preserve quotes for methods named `new` ([#19621](https://github.com/prettier/prettier/pull/19621) by [@kovsu](https://github.com/kovsu))  ```tsx // Input interface Container { "new"(id: string): number; } // Prettier 3.9.5 interface Container { new(id: string): number; } // Prettier 3.9.6 interface Container { "new"(id: string): number; } ``` ##### TypeScript: Support `import defer` ([#19624](https://github.com/prettier/prettier/pull/19624), [#19675](https://github.com/prettier/prettier/pull/19675) by [@fisker](https://github.com/fisker))  ```tsx // Input import defer * as foo from "foo"; // Prettier 3.9.5 import * as foo from "foo"; // Prettier 3.9.6 import defer * as foo from "foo"; ``` ##### JavaScript: Added a new official plugin `@prettier/plugin-yuku` ([#19628](https://github.com/prettier/prettier/pull/19628), [#19629](https://github.com/prettier/prettier/pull/19629) by [@fisker](https://github.com/fisker)) `@prettier/plugin-yuku` is powered by [Yuku](https://yuku.fyi/) (A high-performance JavaScript/TypeScript compiler toolchain written in Zig). This plugin includes two new parsers: `yuku` (JavaScript syntax) and `yuku-ts` (TypeScript syntax). **To use this plugin:** 1. Install the plugin: ```bash yarn add --dev prettier @prettier/plugin-yuku ``` 2. Add it to your `.prettierrc`: ```yaml plugins: - "@prettier/plugin-yuku" ``` Due to package size limitations, this plugin is not bundled with the main prettier package and must be installed separately. For more information, check [the package homepage](https://github.com/prettier/prettier/tree/main/packages/plugin-yuku). Big thanks to [@arshad-yaseen](https://github.com/arshad-yaseen) for his excellent work. ### [`v3.9.5`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#395) [Compare Source](https://github.com/prettier/prettier/compare/3.9.4...3.9.5) [diff](https://github.com/prettier/prettier/compare/3.9.4...3.9.5) ##### Markdown: Cap ordered list mark at 999,999,999 ([#19351](https://github.com/prettier/prettier/pull/19351) by [@tats-u](https://github.com/tats-u)) CommonMark parsers only support ordered list item numbers up to 999,999,999. With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:  ```markdown  999999998. text 999999998. text 999999998. text 999999998. text 1234567890123456789012) text  999999998. text 999999999. text 1000000000. text 1000000001. text 1234567890123456789012) text  999999998. text 999999999. text 999999999. text 999999999. text 1234567890123456789012) text ``` ##### Markdown: Avoid corrupting empty link with title ([#19487](https://github.com/prettier/prettier/pull/19487) by [@andersk](https://github.com/andersk)) Do not remove `<>` from an inline link or image with an empty URL and a title, as this removal would change its interpretation.  ```md  [link](<> "title")  [link]( "title")  [link](<> "title") ``` ##### Less: Remove extra spaces after `[` in map lookups ([#19503](https://github.com/prettier/prettier/pull/19503) by [@kovsu](https://github.com/kovsu))  ```less // Input .foo { color: #theme[ primary]; color: #theme[@name]; color: #theme[@@name]; } // Prettier 3.9.4 .foo { color: #theme[ primary]; color: #theme[ @name]; color: #theme[ @@name]; } // Prettier 3.9.5 .foo { color: #theme[primary]; color: #theme[@name]; color: #theme[@@name]; } ``` ##### CSS: Prevent addition space in `type()` with `+` ([#19516](https://github.com/prettier/prettier/pull/19516) by [@bigandy](https://github.com/bigandy)) This fixes the addition space before `+` in CSS `type()` declaration. For example `type(<number>+)` was being converted into `type(<number> +)` which is invalid CSS and does not work.  ```css /* Input */ div { border-radius: attr(br type(<length>+)); } /* Prettier 3.9.4 */ div { border-radius: attr(br type(<length> +)); } /* Prettier 3.9.5 */ div { border-radius: attr(br type(<length>+)); } ``` ##### Less: Remove spaces between merge markers and colons ([#19517](https://github.com/prettier/prettier/pull/19517) by [@kovsu](https://github.com/kovsu))  ```less // Input a { box-shadow + : 0 0 1px #000; } // Prettier 3.9.4 a { box-shadow+ : 0 0 1px #000; } // Prettier 3.9.5 a { box-shadow+: 0 0 1px #000; } ``` ##### Markdown: Preserve wiki links with aliases ([#19527](https://github.com/prettier/prettier/pull/19527) by [@kovsu](https://github.com/kovsu))  ```markdown  [[Foo:Bar]]  [[Foo]]  [[Foo:Bar]] ``` ##### TypeScript: Fix comments being dropped on shorthand `type` import/export specifiers ([#19565](https://github.com/prettier/prettier/pull/19565) by [@kirkwaiblinger](https://github.com/kirkwaiblinger))  ```tsx // Input export { type /* comment */ T } from "foo"; import { type /* comment */ T } from "foo"; // Prettier 3.9.4 Error: Comment "comment" was not printed. Please report this error! // Prettier 3.9.5 export { type /* comment */ T } from "foo"; import { type /* comment */ T } from "foo"; ``` ##### Miscellaneous: Preserving comments' `placement` property ([#19567](https://github.com/prettier/prettier/pull/19567) by [@Janther](https://github.com/Janther)) Prettier\@3.9.0 deleted an undocumented property on comments, which was already used by plugins, `comment.placement` is now available again after comment attach. ##### Flow: Stop enforcing empty module declaration to break ([#19568](https://github.com/prettier/prettier/pull/19568) by [@fisker](https://github.com/fisker))  ```flow // Input declare module "foo" {} // Prettier 3.9.4 declare module "foo" { } // Prettier 3.9.5 declare module "foo" {} ``` ##### Angular: Support expression for exhaustive typechecking ([#19571](https://github.com/prettier/prettier/pull/19571) by [@fisker](https://github.com/fisker))  ```html  @switch (state.mode) { @default never(state); }  @switch (state.mode) { @default never; }  @switch (state.mode) { @default never(state); } ``` ##### TypeScript: Ignore comments inside mapped type when checking type parameter comments ([#19572](https://github.com/prettier/prettier/pull/19572) by [@fisker](https://github.com/fisker))  ```tsx // Input foo<{ // comment [key in keyof Foo]: number }>(); // Prettier 3.9.4 foo< { // comment [key in keyof Foo]: number; } >(); // Prettier 3.9.5 foo<{ // comment [key in keyof Foo]: number; }>(); ``` ##### Less: Fix adjacent block comments being corrupted ([#19574](https://github.com/prettier/prettier/pull/19574) by [@kovsu](https://github.com/kovsu))  ```less // Input /* a *//* b */ /* a */* { color: red; } // Prettier 3.9.4 /* a */ /* b */ /* a * { color: red; } // Prettier 3.9.5 /* a */ /* b */ /* a */ * { color: red; } ``` ##### JavaScript: Handle dangling comments in `SwitchStatement` ([#19581](https://github.com/prettier/prettier/pull/19581) by [@fisker](https://github.com/fisker))  ```jsx // Input switch (foo) { // comment } // Prettier 3.9.4 switch ( foo // comment ) { } // Prettier 3.9.5 switch (foo) { // comment } ``` ##### TypeScript: Remove space in comment-only object type ([#19583](https://github.com/prettier/prettier/pull/19583) by [@fisker](https://github.com/fisker))  ```tsx // Input var foo = { /* comment */ }; type Foo = { /* comment */ }; // Prettier 3.9.4 var foo = {/* comment */}; type Foo = { /* comment */ }; // Prettier 3.9.5 var foo = {/* comment */}; type Foo = {/* comment */}; ``` ### [`v3.9.4`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#394) [Compare Source](https://github.com/prettier/prettier/compare/3.9.3...3.9.4) [diff](https://github.com/prettier/prettier/compare/3.9.3...3.9.4) ##### Angular: Format `@content(name)` -> `@content (name)` to align with other block syntax ([#19499](https://github.com/prettier/prettier/pull/19499) by [@fisker](https://github.com/fisker))  ```html  <FancyButton [label]="title"> @content (icon) { <span>Icon!</span> } @content (description) { <span>Description text</span> } <span>Other children</span> </FancyButton>  <FancyButton [label]="title"> @content(icon) { <span>Icon!</span> } @content(description) { <span>Description text</span> } <span>Other children</span> </FancyButton>  <FancyButton [label]="title"> @content (icon) { <span>Icon!</span> } @content (description) { <span>Description text</span> } <span>Other children</span> </FancyButton> ``` ### [`v3.9.3`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#393) [Compare Source](https://github.com/prettier/prettier/compare/3.9.2...3.9.3) [diff](https://github.com/prettier/prettier/compare/3.9.1...3.9.3) ##### Markdown: Fix unexpected removal of characters in liquid syntax ([#19489](https://github.com/prettier/prettier/pull/19489) by [@seiyab](https://github.com/seiyab))  ```md // Input  {{ page.title }} text  {{ page.title text  {{ page.title }} text ``` ##### TypeScript: Allow decorators to be used with declare on class fields ([#19492](https://github.com/prettier/prettier/pull/19492) by [@evoactivity](https://github.com/evoactivity)) Extensively used within the Ember ecosystem, decorators with `declare` on class fields will ignore the babel parser error and allow Prettier to format the code without breaking it.  ```ts // Input export default class ProjectStatusComponent extends Component<ProjectStatusSig> { @service declare server: ServerService; } // Prettier 3.9.1 // SyntaxError: Decorators can't be used with a declare field. (2:3) // 1 | export default class ProjectStatusComponent extends Component<ProjectStatusSig> { //> 2 | @service declare server: ServerService; // | ^ // 3 | } // Prettier 3.9.3 export default class ProjectStatusComponent extends Component<ProjectStatusSig> { @service declare server: ServerService; } ``` ### [`v3.9.2`](https://github.com/prettier/prettier/compare/3.9.1...3.9.2) [Compare Source](https://github.com/prettier/prettier/compare/3.9.1...3.9.2) ### [`v3.9.1`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#3910) [Compare Source](https://github.com/prettier/prettier/compare/3.9.0...3.9.1) [diff](https://github.com/prettier/prettier/compare/3.9.9...3.9.10) ##### Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance ([#20266](https://github.com/prettier/prettier/pull/20266) by [@fisker](https://github.com/fisker)) See [micromark/micromark-extension-gfm-table@`4f43ead`](https://github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267) for details. ### [`v3.9.0`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#390) [Compare Source](https://github.com/prettier/prettier/compare/3.8.5...3.9.0) [diff](https://github.com/prettier/prettier/compare/3.8.5...3.9.0) 🔗 [Release Notes](https://prettier.io/blog/2026/06/27/3.9.0) ### [`v3.8.5`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#385) [Compare Source](https://github.com/prettier/prettier/compare/3.8.4...3.8.5) [diff](https://github.com/prettier/prettier/compare/3.8.4...3.8.5) ##### Flow: Support `readonly` as a variance annotation ([#19022](https://github.com/prettier/prettier/pull/19022) by [@marcoww6](https://github.com/marcoww6)) Flow now accepts `readonly` as a property variance annotation, equivalent to `+` (covariant/read-only).  ```jsx // Input type T = { readonly foo: string, }; // Prettier 3.8.4 SyntaxError // Prettier 3.8.5 type T = { readonly foo: string, }; ``` ### [`v3.8.4`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#384) [Compare Source](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) [diff](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) ##### Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX ([#17746](https://github.com/prettier/prettier/pull/17746) by [@byplayer](https://github.com/byplayer)) Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.  ```markdown  - a - b - c - d  - a - b - c - d  - a - b - c - d ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

andras added 1 commit

2026-10-29 00:18:08 +00:00

Update all dependencies

Deploy to Pages / deploy (pull_request) Successful in 4s

Details

Build and Publish Docker Image / build-and-push (pull_request) Successful in 27s

Details

Test / test (pull_request) Failing after 7s

Details

720462e241

andras force-pushed renovate/all from 720462e241

Deploy to Pages / deploy (pull_request) Successful in 4s

Details

Build and Publish Docker Image / build-and-push (pull_request) Successful in 27s

Details

Test / test (pull_request) Failing after 7s

Details

to 63e11d0197

Deploy to Pages / deploy (pull_request) Successful in 3s

Details

Test / test (pull_request) Failing after 7s

Details

Build and Publish Docker Image / build-and-push (pull_request) Successful in 19s

Details

2026-10-30 17:46:28 +00:00

Compare

andras changed title from ~~Update all dependencies~~ to Update all non-major dependencies

2026-10-30 17:46:28 +00:00

Deploy to Pages / deploy (pull_request) Successful in 3s

Details

Test / test (pull_request) Failing after 7s

Details

Build and Publish Docker Image / build-and-push (pull_request) Successful in 19s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin "renovate/all:renovate/all"

git switch "renovate/all"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "main"

git merge --no-ff "renovate/all"

git switch "renovate/all"

git rebase "main"

git switch "main"

git merge --ff-only "renovate/all"

git switch "renovate/all"

git rebase "main"

git switch "main"

git merge --no-ff "renovate/all"

git switch "main"

git merge --squash "renovate/all"

git switch "main"

git merge --ff-only "renovate/all"

git switch "main"

git merge "renovate/all"

git push origin "main"

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

andras/fizika!17

No description provided.

Rows
Columns

Update all non-major dependencies #17

Release Notes

🐞 Bug fixes

🚀 Improvements

⚡ Performance

Changed

Fixed

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

Markdown: Don't let Liquid objects interrupt paragraphs (#​20087 by @​seiyab)

Markdown: Prevent indentation drift in list-item code blocks (#​19647, #​19990 by @​Austin1serb, @​giaBaoJS)

JavaScript: Fix embedded template literal idempotency (#​19725 by @​fisker)

Markdown: Preserve Liquid blocks after Markdown tables (#​19730 by @​wanxiankai, @​seiyab)

Markdown: Preserve single tildes in Markdown (#​19739 by @​lazerg)

Markdown: Fix Markdown blockquote containing > characters (#​19802 by @​seiyab)

Markdown: Strip blockquote markers from a setext heading's continuation lines (#​19878 by @​Kjubikstronk)

Markdown: Fix HTML block indentation drift in markdown list items (#​19987 by @​lazerg)

Angular: Support @boundary error boundaries (#​20014 by @​Yahiro025)

TypeScript: Preserve quotes for methods named new (#​19621 by @​kovsu)

TypeScript: Support import defer (#​19624, #​19675 by @​fisker)

JavaScript: Added a new official plugin @prettier/plugin-yuku (#​19628, #​19629 by @​fisker)

Markdown: Cap ordered list mark at 999,999,999 (#​19351 by @​tats-u)

Markdown: Avoid corrupting empty link with title (#​19487 by @​andersk)

Less: Remove extra spaces after [ in map lookups (#​19503 by @​kovsu)

CSS: Prevent addition space in type() with + (#​19516 by @​bigandy)

Less: Remove spaces between merge markers and colons (#​19517 by @​kovsu)

Markdown: Preserve wiki links with aliases (#​19527 by @​kovsu)

TypeScript: Fix comments being dropped on shorthand type import/export specifiers (#​19565 by @​kirkwaiblinger)

Miscellaneous: Preserving comments' placement property (#​19567 by @​Janther)

Flow: Stop enforcing empty module declaration to break (#​19568 by @​fisker)

Angular: Support expression for exhaustive typechecking (#​19571 by @​fisker)

TypeScript: Ignore comments inside mapped type when checking type parameter comments (#​19572 by @​fisker)

Less: Fix adjacent block comments being corrupted (#​19574 by @​kovsu)

JavaScript: Handle dangling comments in SwitchStatement (#​19581 by @​fisker)

TypeScript: Remove space in comment-only object type (#​19583 by @​fisker)

Angular: Format @content(name) -> @content (name) to align with other block syntax (#​19499 by @​fisker)

Markdown: Fix unexpected removal of characters in liquid syntax (#​19489 by @​seiyab)

TypeScript: Allow decorators to be used with declare on class fields (#​19492 by @​evoactivity)

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

Flow: Support readonly as a variance annotation (#​19022 by @​marcoww6)

Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#​17746 by @​byplayer)

Configuration

Checkout

Merge

Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance (#20266 by @fisker)

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by @fisker)

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @Austin1serb, @giaBaoJS)

JavaScript: Fix embedded template literal idempotency (#19725 by @fisker)

Markdown: Preserve Liquid blocks after Markdown tables (#19730 by @wanxiankai, @seiyab)

Markdown: Preserve single tildes in Markdown (#19739 by @lazerg)

Markdown: Fix Markdown blockquote containing `>` characters (#19802 by @seiyab)

Markdown: Strip blockquote markers from a setext heading's continuation lines (#19878 by @Kjubikstronk)

Markdown: Fix HTML block indentation drift in markdown list items (#19987 by @lazerg)

Angular: Support `@boundary` error boundaries (#20014 by @Yahiro025)

TypeScript: Preserve quotes for methods named `new` (#19621 by @kovsu)

TypeScript: Support `import defer` (#19624, #19675 by @fisker)

JavaScript: Added a new official plugin `@prettier/plugin-yuku` (#19628, #19629 by @fisker)

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)

Markdown: Avoid corrupting empty link with title (#19487 by @andersk)

Less: Remove extra spaces after `[` in map lookups (#19503 by @kovsu)

CSS: Prevent addition space in `type()` with `+` (#19516 by @bigandy)

Less: Remove spaces between merge markers and colons (#19517 by @kovsu)

Markdown: Preserve wiki links with aliases (#19527 by @kovsu)

TypeScript: Fix comments being dropped on shorthand `type` import/export specifiers (#19565 by @kirkwaiblinger)

Miscellaneous: Preserving comments' `placement` property (#19567 by @Janther)

Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)

Angular: Support expression for exhaustive typechecking (#19571 by @fisker)

TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)

Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)

JavaScript: Handle dangling comments in `SwitchStatement` (#19581 by @fisker)

TypeScript: Remove space in comment-only object type (#19583 by @fisker)

Angular: Format `@content(name)` -> `@content (name)` to align with other block syntax (#19499 by @fisker)

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @seiyab)

TypeScript: Allow decorators to be used with declare on class fields (#19492 by @evoactivity)

Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance (#20266 by @fisker)

Flow: Support `readonly` as a variance annotation (#19022 by @marcoww6)

Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)