chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
deno (source)	2.6.6 → 2.6.8
jiti	^2 → ^2.6.1
pnpm (source)	10.28.2 → 10.29.2
rollup (source)	^4.57.0 → ^4.57.1

---

Release Notes

denoland/deno (deno)

v2.6.8

Compare Source

• feat(npm): support jsr: scheme in package.json (#​31938)
• feat: Windows on ARM builds (#​31917)
• fix(ext/node): enable defensive option on DatabaseSync (#​32004)
• fix(ext/node): error formatting compatibility (#​31970)
• fix(ext/node): implement sqlite' SQLTagStore (#​31945)
• fix(ext/node): use primordials in _fs_fchown.ts (#​32007)
• fix(flags): correct zsh completions for script arg (#​31994)
• fix(install): clean up associated config and lock files during uninstall
  (#​31984)
• fix(types): correct types for Worker events (#​31981)
• fix: Reload the CronHandlerImpl if necessary when the control socket
  receives new envs (#​31996)
• fix: upgrade deno_core to 0.383.0 (#​32014)

v2.6.7

Compare Source

• feat(ext/node): implement mock API for node:test module (#​31954)
• feat(node): implement FileHandle.readv() method (#​31943)
• feat(npm): use JSR for @jsr scope (#​31925)
• feat: External Socket-Based Cron Implementation (#​31952)
• feat: V8 14.5 (#​31873)
• feat: add --inspect-publish-uid flag for VSCode debugging (#​31927)
• fix(ext/http): use serve address override only once (#​31935)
• fix(ext/net): remove socket file when dropping unix listener (#​31947)
• fix(ext/node): sqlite's StatementSync compatibility (#​31941)
• fix(ext/node): align assert throws/rejects signatures (#​31934)
• fix(ext/node): fix usage of new V8 string APIs (#​31963)
• fix(ext/node): implement sqlite's missing options (#​31919)
• fix(ext/node): pass test-child-process-bad-stdio node compat test (#​31851)
• fix(ext/node): read NODE_OPTIONS for --require and --inspect-publish-uid
  (#​31949)
• fix(ext/node): retry stale keepAlive connections in http client (#​31932)
• fix(ext/node): support setImmediate promisify.custom (#​31920)
• fix(ext/node): use primordials in _fs_ftruncate.ts (#​31944)
• fix(ext/node): use primordials in ext/node/polyfills/tls.ts (#​31816)
• fix(ext/web): support object in DOMException second argument for Node.js
  compat (#​31939)
• fix(node): throw ERR_INVALID_ARG_TYPE for invalid fs.readFile path (#​31918)
• fix(unstable): lint ast comments from first file showing in others (#​31956)
• fix(x): use local npm package even if npm specifier is used, forward unstable
  flags (#​31942)
• fix: allow reading /dev/tty without requiring --allow-all (#​31105)
• fix: enable edns for Deno.resolveDns (#​31951)
• fix: graceful server shutdown with open, un-upgraded connections (#​31959)
• fix: use locked-tripwire to prevent unlocked cargo installs (#​31973)

unjs/jiti (jiti)

v2.6.1

Compare Source

compare changes

🩹 Fixes

• interop: Only passthrough default if it is not a promise (#​408)

📦 Build

• Revert to terser-webpack-plugin (#​407)

🏡 Chore

• Update bench (037c646)
• Update deps (974ca40)
• Remove unused code (8b41497)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)

v2.6.0

Compare Source

compare changes

🔥 Performance

• Lazy load babel transform (#​405)

🩹 Fixes

• cjs-interop: Handle function default exports (#​396)
• Always use native for node: specifiers (#​392)

📦 Build

• Migrate to rspack (#​404)

🏡 Chore

• Update deps (5123334)

✅ Tests

• Update deno and bun native test ignores (df844f8)
• New bench script (6404427)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Volodymyr Kolesnykov (@​sjinks)
• Jungwoo LEE <jungwoo3490@​naver.com>

v2.5.1

Compare Source

compare changes

🩹 Fixes

• interop: Passthrough module if it is a promise (#​389)

❤️ Contributors

• Pooya Parsa pyapar@gmail.com

v2.5.0

Compare Source

compare changes

🚀 Enhancements

• Use sha256 for cache entries in fips mode (#​375)
• rebuildFsCache ( JITI_REBUILD_FS_CACHE) (#​379)

🩹 Fixes

• Interop modules with nil default export (#​377)
• register: Handle require(<json>) (#​374)

🏡 Chore

• Update ci (6b7fe8b)
• Update deps (fb2b903)
• Add defaults in JSDocs (#​365)
• Update deps (35a6a61)
• Lint (dde7c82)
• Update snapshot (c567a37)

✅ Tests

• Update snapshot (c7cfeed)
• Only include src for coverage report (#​372)

❤️ Contributors

• Kricsleo (@​kricsleo)
• Pooya Parsa (@​pi0)
• Kanon (@​ysknsid25)
• Arya Emami (@​aryaemami59)

v2.4.2

Compare Source

compare changes

🩹 Fixes

• cache: Add +map suffix to fs entries when sourceMaps enabled (#​352)
• Use native require cache of loaded entries only (#​348)

🏡 Chore

• Update deps (7b7ffef)

✅ Tests

• Simplify snapshot tests (#​351)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.4.1

Compare Source

compare changes

🩹 Fixes

• Interop modules with primitive default export (#​343)

🏡 Chore

• Update deps (58d3f5f)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.4.0

Compare Source

compare changes

🚀 Enhancements

• Support generic type for jiti.import<T> (#​331)

🩹 Fixes

• Try to resolve .ts files with .js extension from js files (#​337)

🏡 Chore

• Update renovate.json (86f11b3)
• Update deps and lockfile (5dfb0ec)
• Add nvmrc (899a782)

🤖 CI

• Deno v2 compat (f4d0062)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Lars Kappert (@​webpro)
• Alexander a.hywax@gmail.com

v2.3.3

Compare Source

compare changes

🩹 Fixes

• eval: Return fallback value (#​326)

💅 Refactors

• Remove some unused exports (#​327)

❤️ Contributors

• Lars Kappert (@​webpro)

v2.3.2

Compare Source

compare changes

🩹 Fixes

• eval: Fallback in async mode (#​325)

🏡 Chore

• Update lockfile (3627a56)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.3.1

Compare Source

compare changes

🩹 Fixes

• Conditional access to mod.default (8c30a94)

🏡 Chore

• Update note (f67ed60)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.3.0

Compare Source

compare changes

🚀 Enhancements

• Support jiti.import(id, {default: true}) (#​323)

🩹 Fixes

• interopDefault: Avoid in operator for primitive inputs (#​321)

💅 Refactors

• interopDefault: Simplify logic for default export checks (#​322)

📖 Documentation

• Fix format (#​320)
• Update interopDefault description and reference (61891a0)
• Add note about interop default (537fa39)

🏡 Chore

• Update lockfile (c1325e9)

❤️ Contributors

• Pooya Parsa (@​pi0)
• @​beer (@​iiio2)

v2.2.1

Compare Source

compare changes

🩹 Fixes

• Bump cache version (3acd097)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.2.0

Compare Source

compare changes

🚀 Enhancements

• Use smarter proxy for interopDefault (#​318)

💅 Refactors

• Inline interopDefault from mlly (8826047)

🤖 CI

• Run nightly release once (4f9d67d)
• Correct condition (1384010)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.1.2

Compare Source

compare changes

🌊 Types

• Use local NodeModule type (718bea2)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.1.1

Compare Source

compare changes

🩹 Fixes

• types: Add standalone types for node require (#​316)

🏡 Chore

• Updarte deps (5998e3c)

✅ Tests

• Add dependency tests (1d86ca3)
• Ignore deps for node native register (e7ffe04)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.1.0

Compare Source

compare changes

🚀 Enhancements

• Enable interopDefault by default (#​310)
• Support import.meta.dirname and import.meta.filename (#​308)

🔥 Performance

• cli: Enable node 22 compile cache (#​312)

🩹 Fixes

• Make TransformOptions type strict to allow auto-complete (#​305)
• Properly handle tsx (#​311)

💅 Refactors

• Deprecate commonjs api (#​313)

📦 Build

• Fix /register and /native subpath types for Node10 module resolution (#​304)

🏡 Chore

• Remove ext for consistency (e4a9bae)
• Add jsx field (6a4e13a)
• Update dependencies (ee90eca)
• Lint (85d7c41)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Arya Emami (@​aryaemami59)

pnpm/pnpm (pnpm)

v10.29.2

Compare Source

v10.29.1: pnpm 10.29.1

Compare Source

Minor Changes

• The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
• Support configuring auditLevel in the pnpm-workspace.yaml file #​10540.
• Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #​10436.

Patch Changes

• Fixed pnpm list --json returning incorrect paths when using global virtual store #​10187.

• Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #​10290.

• Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #​10497.

• Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #​10176.

• Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #​10281.

• Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #​10460.

• Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #​10540.

• update tar to version 7.5.7 to fix security issue

  Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842

• Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #​10325.

• Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #​10271.

• pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #​10561.

• Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #​10457.

Platinum Sponsors

Gold Sponsors

rollup/rollup (rollup)

v4.57.1

Compare Source

2026-01-30

Bug Fixes

• Fix heap corruption issue in Windows (#​6251)
• Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)

Pull Requests

• #​6251: fix: Isolate and cache process.report.getReport() calls in a child process for robust environment detection (@​alan-agius4, @​lukastaegert)
• #​6252: chore(deps): update dependency lru-cache to v11 (@​renovate[bot])
• #​6253: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)
• #​6254: Fully include dynamic imports in a try-catch (@​lukastaegert)
• #​6255: chore(deps): lock file maintenance (@​renovate[bot])

---

Configuration

📅 Schedule: Branch creation - "after 2am and before 3am" (UTC), Automerge - "after 1am and before 2am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nitro.build	Ready	Preview, Comment	Feb 9, 2026 10:17am

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitrojs/nitro@4008

commit: e2ec275