[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
docus	5.14.0 → 5.15.0
nuxt-component-meta	0.18.0 → 0.19.0
pnpm (source)	12.11.2 → 12.14.0
react (source)	19.3.0 → 19.3.1
react-dom (source)	19.3.0 → 19.3.1
styled-components (source)	6.5.3 → 6.6.0

---

Release Notes

nuxt-content/docus (docus)

v5.15.0

Compare Source

Bug Fixes

• docs: un-indent code fences in components page (#​1465) (40b242a)
• layer: add accessible names to icon-only buttons + add missing translations (#​1451) (ce6d54b)
• layer: external link icon misplacement when truncated (#​1464) (ee912a6)
• layer: use header.logo.favicon for the site favicon (#​1468) (edb6a2b)
• og: keep commas in og image descriptions (#​1458) (502f479)

Performance Improvements

• assistant: load chat dependencies when the panel first opens (#​1453) (dcb54d3)
• layer: lazy load + lazily hydrate components (#​1460) (7a4967c)
• layer: only bundle the Nuxt UI locales in use (#​1459) (e83a018)
• layer: replace motion-v with CSS transitions (#​1452) (00603f4)
• layer: tree-shake schema.org composables from the client (#​1461) (ffe694d)

nuxt-content/nuxt-component-meta (nuxt-component-meta)

v0.19.0

Compare Source

🐞 Bug Fixes

• Tolerate unresolvable component paths and exclude built-ins by name - by @​danielroe in nuxtlabs#126 (a7cfe)
• Write meta with the vite environment api - by @​benjamincanac in nuxtlabs#128 (63afe)

Also upgrade dependencies.

View changes on GitHub

pnpm/pnpm (pnpm)

v12.14.0: pnpm 12.14.0

Compare Source

This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

Minor Changes

• Added the sideEffectsCache.exclude setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a remoteCache server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same name, @scope/*, and name@version patterns as minimumReleaseAgeExclude #​5271.

• pnpm login now prints the npm-notice response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.

Patch Changes

Installing packages

• pnpm install and pnpm add no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes #​16839.

• pnpm install, pnpm add and pnpm update now reuse pnpm-lock.yaml when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an overrides entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry #​16923.

• pnpm install now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With linkWorkspacePackages enabled, it used to run git ls-remote once per project #​16899.

• A filtered install, such as pnpm install --filter <pkg>, now keeps the pnpm-lock.yaml entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #​16931.

• pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install #​16901.

• An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #​16929.

Running commands and scripts

• pnpm no longer aborts with a core dump when the reader of its output has exited, as in pnpm list | head -1 or pnpm start 2>&1 | head -1. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 #​16904 pnpm/tasks#132.

• On Windows, pnpm exec, pnpm run, and commands such as pnpm nx now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited #​16930.

• Commands that do not write the project manifest now leave a missing package.json absent. This covers queries such as pnpm why and pnpm outdated, pnpm fetch, pnpm dedupe --check, and commands that exit with an error, such as pnpm rt ls. These commands used to create one from the initialization template. pnpm sbom run from a lockfile alone now reports the root component as unknown with version 0.0.0 #​16907.

• pnpm run now reports a failed script as a JSON record under --reporter=ndjson. It printed a plain [ELIFECYCLE] line to stderr.

• pnpm run no longer prints [ELIFECYCLE] Command failed with exit code N. to stderr when a script fails under --reporter=silent, --silent, or --loglevel=silent.

• pnpm pipeline --dry-run no longer writes a run report when no projects are selected. With --json it prints {"tasks": []} pnpm/tasks#126.

Packing and publishing

• pnpm pack and pnpm publish now ship the whole gitignored directory that main, browser, or bin points into, as npm does. Previously only the main and bin files themselves were packed, and a gitignored browser file was left out #​16908.

• pnpm pack and pnpm publish now honor a .npmignore or .gitignore inside a subdirectory when package.json has a files field. The package root's ignore files and those inherited from the workspace are still skipped #​16909.

Setting up pnpm and toolchains

• --registry, --https-proxy, --http-proxy, and --no-proxy now apply when pnpm resolves and downloads the pnpm version a project pins in packageManager. Before, these lookups went to https://registry.npmjs.org/, which a firewall that only allows a private registry blocks #​16911.

• On Windows, pnpm install now installs the Rust toolchain for rustup's default host, so a machine set up with rustup set default-host x86_64-pc-windows-gnu gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain #​16854.

Platinum Sponsors

Gold Sponsors

v12.13.0: pnpm 12.13.0

Compare Source

This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.

Minor Changes

• Added the pnpm profile command to view and update registry user profile settings.

• Added pnpm token to list, create, and revoke authentication tokens on the registry.

• Added the storeIndexFormat setting. Set it to files to keep a store's package index as one file per package instead of the SQLite index.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt index.db.

• Added the nodePackageMap setting, which groups the package-map settings. nodePackageMap.mode: write-only writes node_modules/.package-map.json for other tools without making Node.js load it. mode: load also makes Node.js load the map, like nodeExperimentalPackageMap: true. nodePackageMap.type replaces nodePackageMapType. The old settings still work #​14937.

  nodePackageMap:
    mode: write-only
    type: loose

Patch Changes

Setting up pnpm

• pnpm setup now works when pnpm was installed with npm on macOS. It installed pnpm from npm's bin directory and left a $PNPM_HOME/bin/pnpm that could not run #​16855.

• pnpm runs again after pnpm setup when globalShims enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #​16874.

• A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that rust-toolchain.toml names. It used to install the MSVC toolchain.

Installing packages

• On macOS, pnpm install no longer fails with ERR_PNPM_LOCKFILE_WRITE_FILE when the project is on a virtiofs or SMB share. pnpm now falls back to a regular fsync when the file system rejects a full sync #​16846.

• On macOS, pnpm install, pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.

• pnpm install now puts the executables of a Python build backend's requirements on the PATH while the backend runs. Projects built with uv_build now install. Before, they failed with "uv-build was not properly installed".

• Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

• pnpm-lock.yaml no longer records the tarball URL of a package installed from a scoped registry, such as one set by @types:registry=, when pnpm can rebuild the URL from that registry #​16866.

Packing, auditing, and pipelines

• pnpm pack and pnpm publish now pack only package.json, the README, the license, and the files named in main and bin when files is an empty array. They used to pack every file in the package #​16889.

• pnpm audit and pnpm audit signatures no longer check runtimes installed through devEngines.runtime, such as node@runtime:24.21.0, against the npm package of the same name. pnpm audit signatures reported these runtimes as having an invalid registry signature #​16869.

• pnpm pipeline now runs the root's tasks when pnpm-workspace.yaml lists only the root in packages or omits packages, as pnpm -r run does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, pnpm pipeline now reports that no projects are selected #​16849.

Performance

• pnpm install resolves Python dependencies faster. With --lockfile-only, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.

• A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.

• pnpm install with enableModulesDir: false now verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.

Platinum Sponsors

Gold Sponsors

v12.12.1: pnpm 12.12.1

Compare Source

This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Patch Changes

• pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

• pnpm dist-tag add, rm, and ls now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.

• Added the tool: protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. pnpm add bun@tool:1.3.0, pnx node@tool:22, and pnx yarn@tool:4 work like the runtime: spelling, which stays supported as an alias. A lockfile written for runtime: stays up to date when package.json switches to tool:, and the other way around.

  A named registry can no longer be called tool.

Platinum Sponsors

Gold Sponsors

v12.12.0: pnpm 12.12.0

Compare Source

This release shares task results and dependency builds through a remote cache, adds the addMissingPeerTypes setting, and lets pnpm add --config and pnpm update manage configuration dependencies. It also fixes dangerouslyAllowAllBuilds running the build scripts of packages that allowBuilds denies.

Minor Changes

• pnpm pipeline can share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache.

  The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new remoteCache setting, which names the server and holds the signing keys. pnpm pipeline --report records the run under the organization remoteCache.org names.

• Added the addMissingPeerTypes setting, which links the @types package of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends on react gets the project's @types/react linked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on #​15689.

• pnpm add --config and pnpm update now handle configuration dependencies the way they handle other dependencies #​16814.

  pnpm add --config saves a version range in pnpm-workspace.yaml by the same rules as pnpm add, so pnpm add --config my-config@latest saves a range such as ^1.2.0. It also resolves the package again when pnpm-lock.yaml already locks an older version.

  pnpm update updates configuration dependencies within their ranges, and pnpm update --latest moves them to their latest version. A selector such as pnpm update my-config updates only the configuration dependencies it names.

Patch Changes

• A package set to false in allowBuilds no longer runs its build scripts when dangerouslyAllowAllBuilds is true. The two settings together now allow every build except the denied ones. Previously, dangerouslyAllowAllBuilds ignored the denials.

• pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an .npmrc file, or _auth, or a pnpm-workspace.yaml it could not parse, stopped every command, pnpm --version included.

• pnpm update and pnpm why accept --depth Infinity again. They failed with invalid value 'Infinity' for '--depth <DEPTH>' #​16817.

• pnpm deploy without injectWorkspacePackages now binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed with ERR_PNPM_DEPLOY_AMBIGUOUS_PEER whenever other packages in the deployed graph depended on different versions of that peer #​16807.

• pnpm deploy --legacy no longer fails with ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER when a workspace dependency of the deployed project declares a workspace: peer dependency that the project does not depend on itself. pnpm now copies that peer from the workspace into the deploy directory.

  An auto-installed peer declared with workspace: now always resolves to the workspace project. Previously, workspace:* and workspace:^1.0.0 peers could be installed from the registry #​16806.

• Repeat installs no longer resolve again when an injected workspace package lists a dependency also as a peer dependency.

• Sped up frozen installs of unchanged injected workspace packages that use hardlinks.

• Sped up workspace discovery with subtree exclusions such as !generated/**.

• A key under a registry URL in the _auth setting that does not start with @ is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds an authToken object but lacks its @, such as org for @org, is still an error.

Platinum Sponsors

Gold Sponsors

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

styled-components/styled-components (styled-components)

v6.6.0

Compare Source

Minor Changes

• 7ce6aea: Added a StyledComponent<Target, Props> type for annotating explicitly-typed styled component exports.

  Packages that emit their own declaration files, including any project using isolatedDeclarations, must annotate every exported styled component, and there was no public type for it: consumers reached into internal paths or hand-assembled one that dropped members like a wrapped component's hoisted statics.

  StyledComponent is exported from the web and native entries. Name the target and props as you passed them to styled:

  import styled, { type StyledComponent } from 'styled-components';
  
  export const Card: StyledComponent<'div', { $active?: boolean }> = styled.div<{
    $active?: boolean;
  }>`...`;
  export const CloseButton: StyledComponent<typeof IconButton> = styled(IconButton)`...`;

  It resolves to the exact type styled(Target)<Props> produces, so the annotation is not lossy.

Patch Changes

• 7afbd11: Fixed attrs no longer applying its value when a prop was explicitly passed as undefined (the 6.3.12 to 6.5.x behavior). styled.button.attrs(({ type = 'button', ...rest }) => ({ type, ...rest })) rendered without type="button" when the caller passed type={undefined}, and an object-form default such as .attrs({ type: 'button' }) was lost the same way, including through a wrapper component that spreads its own props over the styled component. attrs now always wins for the keys it returns, matching every other case where a prop is passed alongside attrs.

  Also fixed: a prop passed explicitly as undefined (and not overridden by attrs) is now forwarded to a wrapped component so that component can fall back to its own default, the pattern MUI's ButtonBase relies on (for example <Root role="button" {...props} />). Wrapped components have dropped this prop entirely since v6.0, so a component that checks 'role' in props or merges {...defaults, ...props} to detect an explicitly-passed prop may see and behave differently now that the key is present again. This only applies when wrapping another component; a DOM tag such as styled.div still drops the undefined prop entirely, since browsers have no notion of an "undefined" attribute.

  If you were relying on an explicit undefined to clear an attrs default, use the function form and check for the prop's presence instead:

  styled.a.attrs(props => ('rel' in props ? {} : { rel: 'noopener' }))``;

  Passing rel={undefined} now renders no rel attribute, and omitting the prop renders rel="noopener".

  React Native already forwarded an explicit undefined prop to a wrapped component; it now also matches web in never forwarding an undefined that attrs itself produced.

• 209317c: Rendering styled-components on the server with the edge runtime (for example export const runtime = 'edge' in a Next.js route) now fails with a clear message that names the fix: use the Node.js runtime for routes that render styled-components. Previously the same setup ended in an obscure crash, either at next build or on the first request.

• 3de03c2: Type-checking is faster when you annotate exported styled components with an explicit type, the pattern that packages emitting their own declaration files (including any project using isolatedDeclarations) rely on. The improvement is largest in codebases that annotate many components built on intrinsic tags such as styled.div, styled.span, and styled.button, and wrappers over polymorphic components whose props are a union.

  Nothing about the styled component's type changes for your code: props, defaultProps, propTypes, ref forwarding, and as polymorphism all behave exactly as before. This is purely a type-check speedup.

• 7afbd11: Fixed a typo in the useTheme error message's example code (a misspelled component name in error 18), so the copy-pasted example compiles as written.

• 7afbd11: Fixed global styles from createGlobalStyle disappearing in React Server Components: a global style rendered in a loading state (a React <Suspense> fallback) and again once the real content streamed in could vanish entirely once the fallback was replaced. The same loss could happen across a client-side navigation when a global style was rendered by both a layout and one of its pages, and the layout's copy never re-rendered.

  Each server-rendered instance of a global style now carries its own styles, so a global style shown in more than one place in a request always survives, whether the page reveals streamed content or the user navigates to a sibling route.

• 52c5f6e: Fixed a crash ("Rendered fewer hooks than expected") and a related stale-style bug for components that call a React hook, or read any value outside their props and theme, from inside a style interpolation. This affected @mui/styled-engine-sc with MUI X DataGrid, which calls hooks within an interpolation, and was a regression introduced in 6.4.0.

  Style interpolations now run on every render, so a hook called inside one runs consistently and a value read inside one always reflects its current state.

  If a component re-renders often with unchanged props and its interpolations are expensive, wrap it in React.memo to skip those re-renders. That is the right place to bail out, because only the calling code knows the full set of inputs its styles depend on.

• 7afbd11: Fixed // JavaScript-style line comments in React Native style declarations. Only /* */ block comments were recognized before; a // comment left in a template literal was parsed as part of the surrounding CSS, which could drop or corrupt the styles that followed it on the same line. Line comments are now stripped the same way block comments already were, while a URL used as a raw value (for example url(http://example.com/image.png) or an unquoted https:// value in a custom property) is left untouched.

• 1c0e309: Fixed styles disappearing from a server-rendered component when it is revealed from behind a React <Suspense> boundary, such as a streaming Next.js route (including cacheComponents). A component shown first in a Suspense fallback and then in the resolved content kept its class name but lost its CSS, because the rule had been emitted only inside the fallback that React discards on reveal.

  Each server-rendered instance now carries its own inline <style>, so its styles always travel with it and survive the boundary. The data React sends for server components includes each distinct style once on React 19, however many instances repeat it. In the HTML, nearby duplicates compress away almost for free under gzip, but gzip can only look back about 32 KB, so once repeats are farther apart on the page each one costs roughly its own compressed size; brotli's much larger window keeps it cheap regardless of distance. Only a very large repeated list (thousands of instances of one component on a single page) is worth restyling from a single parent element, and a development-only warning points that out if it happens.

• 7afbd11: styled-components now installs the stylis type declarations its own published types rely on.

  The shipped declarations reference types from stylis (the stylisPlugins option and stylisPluginRSC), and stylis ships no types of its own. With skipLibCheck turned off, a project that had not installed @types/stylis itself could fail to type-check with an error inside styled-components' declarations. Nothing changes at runtime.

• 7afbd11: Fixed the shipped types failing to compile, with skipLibCheck turned off, against @types/react 16, 17, and 18.2.6 through 18.2.11. Those versions don't declare the <search> HTML element, and styled-components' types assumed they did. The published types now compile on every supported @types/react.

  styled.search is present in the types on every version, and accepts the same props it did before, so no existing code stops compiling.

• 7afbd11: Fixed an error inside styled-components' own type declarations, with skipLibCheck turned off, for projects using React 16 or 17 type packages or without @types/react-dom installed. The ServerStyleSheet streaming API's types referenced a type that only @types/react-dom 18 and later provide. interleaveWithNodeStream still accepts the result of renderToPipeableStream and Node readable streams exactly as before.

• 7afbd11: Added a development-only warning for when the server and the browser are running different versions of styled-

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for nuxt-sanity-module ready!

Name	Link
🔨 Latest commit	beeccf2
🔍 Latest deploy log	https://app.netlify.com/projects/nuxt-sanity-module/deploys/6ad5842368781494ca12afe2
😎 Deploy Preview	https://deploy-preview-1585--nuxt-sanity-module.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/sanity@1585

commit: beeccf2