fix(deps): update non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	^20.4.0 → ^20.4.1
@commitlint/config-conventional (source)	^20.4.0 → ^20.4.1
@commitlint/rules (source)	^20.4.0 → ^20.4.1
@types/node (source)	^20.19.30 → ^20.19.32
@types/react (source)	^18.3.27 → ^18.3.28
@vueuse/core (source)	14.1.0 → 14.2.0
dotenv	^17.2.3 → ^17.2.4
eslint-plugin-vue (source)	^9.32.0 → ^9.33.0
firebase-admin (source)	^13.6.0 → ^13.6.1
semver	^7.7.3 → ^7.7.4
turbo (source)	^2.8.0 → ^2.8.3

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.4.1

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.4.1

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

conventional-changelog/commitlint (@​commitlint/rules)

v20.4.1

Compare Source

Reverts

• replace all lodash string methods with kasi #​4602 (#​4621) (5326ab9), closes #​4620 #​4620

vueuse/vueuse (@​vueuse/core)

v14.2.0

Compare Source

   🚀 Features

• Support configurable scheduler for timed composables  -  by @​9romise in #​5129 (66aad)
• Allow vue-router 5 as peer deps  -  by @​Ericlm in #​5269 (7c94a)
• useCssSupports: Add useCssSupports  -  by @​OrbisK in #​5266 (c1282)
• useDraggable: Auto-scroll with restricted dragging within the container  -  by @​Gazoon007, Alfarish Fizikri, Robin and @​OrbisK in #​4472 (a8a85)
• useElementVisibility: Inherit rootMargin from useIntersectionObserver  -  by @​9romise in #​5207 (46682)
• useIntersectionObserver: Make rootMargin reactive  -  by @​doyuli, @​ilyaliao and @​9romise in #​4934 (53abe)
• useSortable: Add watchElement option for auto-reinitialize on element change  -  by @​Mini-ghost and @​ilyaliao in #​5189 (17ea2)

   🐞 Bug Fixes

• nuxt: Ensure excludes disabledFunctions' alias  -  by @​jinyongp and @​9romise in #​5240 (76829)
• refManualReset: Add explicit return type annotation  -  by @​batuhan-bas in #​5246 (13bbb)
• useAsyncState: Ensure execute return the actual data  -  by @​9romise in #​5167 (0c346)
• useDocumentVisibility: Fix type inference from string to Documen…  -  by @​webfanzc and cowhorse in #​5248 (e8be8)
• useFocusTrap: Update focus-trap range to ^7  -  by ** ^8 (#​5270)** ()
• useInfiniteScroll: Improve promise handling and add flush post to watch  -  by @​nhquyss and @​9romise in #​5122 (abcea)
• useMagicKeys: Handle undefined key in keyboard events  -  by @​LouisLau-art, LouisLau-art and @​OrbisK in #​5225 (65e25)

    View changes on GitHub

motdotla/dotenv (dotenv)

v17.2.4

Compare Source

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

firebase/firebase-admin-node (firebase-admin)

v13.6.1: Firebase Admin Node.js SDK v13.6.1

Compare Source

Bug Fixes

• fix: Refactor isURL() to use Built-in URL Constructor (#​3061)
• fix(data-connect): correctly serialize strings with special characters (#​3056)

Miscellaneous

• [chore] Release 13.6.1 (#​3063)
• build(deps): bump jws (#​3029)
• chore: Update release workflows for push triggers (#​3062)
• build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#​3057)
• build(deps-dev): bump mocha from 11.7.1 to 11.7.5 (#​3012)
• chore: Update github actions workflows and integration test resources (#​3052)
• chore: Rename default branch to (#​3033)
• build(deps): bump node-forge from 1.3.1 to 1.3.2 (#​3024)
• build(deps): bump glob from 10.4.5 to 10.5.0 (#​3019)
• build(deps-dev): bump bcrypt and @​types/bcrypt (#​3015)
• fix validate unit tests (#​3009)

npm/node-semver (semver)

v7.7.4

Compare Source

Bug Fixes

• a29faa5 #​835 cli: pass options to semver.valid() for loose version validation (#​835) (@​mldangelo)

Documentation

• 1d28d5e #​836 fix typos and update -n CLI option documentation (#​836) (@​mldangelo)

Dependencies

• 120968b #​840 @npmcli/template-oss@4.29.0 (#​840)

Chores

• 44d7130 #​824 bump @​npmcli/eslint-config from 5.1.0 to 6.0.0 (#​824) (@​dependabot[bot])
• 7073576 #​820 reorder parameters in invalid-versions.js test (#​820) (@​reggi)
• 5816d4c #​829 bump @​npmcli/template-oss from 4.28.0 to 4.28.1 (#​829) (@​dependabot[bot], @​npm-cli-bot)

vercel/turborepo (turbo)

v2.8.3: Turborepo v2.8.3

Compare Source

What's Changed

Changelog

• fix: Upgrade capnp to 0.24 by @​anthonyshew in #​11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @​anthonyshew in #​11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @​anthonyshew in #​11657
• chore: Remove abandoned turbo clone command by @​anthonyshew in #​11673
• fix: Upgrade rustls and ring by @​anthonyshew in #​11659
• fix: Upgrade openssl to 0.10.75 by @​anthonyshew in #​11660
• fix: Replace unmaintained adler with adler2 by @​anthonyshew in #​11661

Full Changelog: vercel/turborepo@v2.8.2...v2.8.3

v2.8.2: Turborepo v2.8.2

Compare Source

What's Changed

Docs

• fix: Upgrade next to fix HTTP deserialization DoS by @​anthonyshew in #​11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @​anthonyshew in #​11611
• fix: Upgrade recharts to fix lodash vulnerability by @​anthonyshew in #​11606
• chore: Move applications to apps/ directory by @​anthonyshew in #​11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @​anthonyshew in #​11616

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @​anthonyshew in #​11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @​anthonyshew in #​11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @​anthonyshew in #​11623
• feat: Migrate from tsup to tsdown by @​anthonyshew in #​11649

@​turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @​anthonyshew in #​11599
• fix: Replace axios with native fetch in turbo-codemod by @​anthonyshew in #​11600
• fix: Upgrade diff to fix DoS vulnerabilities by @​anthonyshew in #​11621

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @​anthonyshew in #​11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @​anthonyshew in #​11615

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11591
• fix: escaping for link titles in LinksService by @​odaysec in #​11632

Changelog

• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @​ddmoney420 in #​11579
• chore: Eliminate ts-rs serde attribute parse warnings by @​anthonyshew in #​11589
• fix: Extract git argument validation into reusable helper by @​anthonyshew in #​11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @​anthonyshew in #​11598
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11596
• fix: Upgrade tar to fix security vulnerabilities by @​anthonyshew in #​11602
• fix: Upgrade @​actions/github to fix @​octokit vulnerabilities by @​anthonyshew in #​11607
• fix: Upgrade @​vercel/blob and @​actions packages to fix undici vulnerability by @​anthonyshew in #​11608
• docs: Running Root Tasks by @​Netail in #​11630
• Update README.md title and remove features section by @​anthonyshew in #​11651
• docs: Update using-environment-variables.mdx by @​anthonyshew in #​11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @​alexmkio in #​11650
• fix: Remove smooth scrolling from docs by @​anthonyshew in #​11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @​anthonyshew in #​11655

New Contributors

• @​ddmoney420 made their first contribution in #​11579
• @​i5d6 made their first contribution in #​11591
• @​Netail made their first contribution in #​11630
• @​alexmkio made their first contribution in #​11650

Full Changelog: vercel/turborepo@v2.8.1...v2.8.2

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.