fix: revert "chore(deps): update all non-major dependencies"

[gameroman]

Reverts #3107

Closes #3112

cc @ghostdevv

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ready	Preview	Aug 2, 2026 5:15pm
npmx.dev	Ready	Preview	Aug 2, 2026 5:15pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
npmx-lunaria	Ignored		Aug 2, 2026 5:15pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a31ae58-0763-4c8c-9009-fa4d76ee7f58

📥 Commits

Reviewing files that changed from the base of the PR and between a40f0ad and 4f19f34.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (14)

• .github/workflows/autofix.yml
• .github/workflows/chromatic.yml
• .github/workflows/ci.yml
• .github/workflows/dependency-diff.yml
• .github/workflows/deploy-canary.yml
• .github/workflows/lunaria.yml
• .github/workflows/mirror-tangled.yml
• .github/workflows/release-pr.yml
• .github/workflows/release-tag.yml
• .github/workflows/zizmor.yml
• cli/package.json
• docs/package.json
• package.json
• pnpm-workspace.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores

  • Updated development and build tooling versions across the CLI, documentation, and core project.
  • Adjusted package manager and workspace version pins for improved consistency across environments.
  • Refreshed automated workflow tooling and browser-test environment versions.

• Maintenance

  • Synchronised dependency versions and compatibility overrides across project packages.
  • No changes to end-user features or application behaviour.

Walkthrough

This PR changes pinned GitHub Actions revisions and package-manager dependency versions. It also changes the Playwright image, pnpm version, Vite Plus catalogue entry, and workspace overrides.

Changes

Dependency and workflow pin updates

Layer / File(s)	Summary
Workflow action and test-image pins .github/workflows/*.yml	Pinned actions/checkout revisions change from v7.0.1 to v7.0.0. Chromatic and zizmor action pins also change. The browser job uses Playwright v1.61.1.
Package and workspace resolution pins package.json, cli/package.json, docs/package.json, pnpm-workspace.yaml	Dependency versions are updated across the root, CLI, and documentation packages. The pnpm version, Vite Plus catalogue entry, and selected workspace overrides also change.

Possibly related PRs

• npmx-dev/npmx.dev#2990: Updates pnpm-workspace.yaml and includes the Vite Plus 0.2.2 version.
• npmx-dev/npmx.dev#3005: Updates overlapping h3-next and srvx versions in cli/package.json.
• npmx-dev/npmx.dev#2632: Modifies the same GitHub Actions workflow files and pinned action references.

Suggested reviewers: serhalp

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The dependency revert targets the reported redirect regression, but the required lockfile is excluded from review.	Review pnpm-lock.yaml to confirm that the dependency graph was fully reverted; it is excluded by the !**/pnpm-lock.yaml filter.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states that the dependency update is being reverted, which matches the main change.
Description check	✅ Passed	The description identifies the reverted pull request and linked issue about redirects stopping.
Out of Scope Changes check	✅ Passed	The workflow and dependency changes are consistent with reverting the referenced non-major dependency update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch revert-3107-renovate/all-minor-patch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	h3@​2.0.1-rc.26 ⏵ 2.0.1-rc.22
	devalue@​5.9.0 ⏵ 5.8.1	+1			+3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[github-actions]

⚠️ Package Trust Level Decreased

Caution

Decreased trust levels may indicate a higher risk of supply chain attacks. Please review these changes carefully.

📦 Package	🔒 Before	🔓 After
fast-check	stagedPublish	trustedPublisher
ultrahtml	trustedPublisher	none