chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	10.34.4 → 10.34.5
simple-statistics	7.9.1 → 7.9.3
typedoc (source)	0.28.19 → 0.28.20

---

Release Notes

pnpm/pnpm (pnpm)

v10.34.5: pnpm 10.34.5

Compare Source

Patch Changes

• 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
• 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
• 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
• 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Gold Sponsors

simple-statistics/simple-statistics (simple-statistics)

v7.9.3

Compare Source

Patch Changes

• 2a98671: Mark the package as "type": "module" and rename the CommonJS bundle to dist/simple-statistics.cjs. Consumers resolve through the exports map, so both import "simple-statistics" and require("simple-statistics") keep working unchanged — only the internal CJS bundle path moved. (Code that hard-coded the deep path simple-statistics/dist/simple-statistics.js, bypassing the package entry points, should switch to the package name or the .cjs path.)

v7.9.2

Compare Source

Patch Changes

• d571a60: Fix quantile() bug when an array was provided as the second argument

  Thanks Alexander Kireyev for the identification
  and fix.

TypeStrong/TypeDoc (typedoc)

v0.28.20

Compare Source

Features

• Group/category section headings (<h2>) in the default theme now include an id attribute so they can be linked to via fragment identifiers (e.g. modules.html#classes), #​3029.
• Added a @reexport modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, #​3096.
• API: Introduced generateOutputsBegin and generateOutputsEnd events on Application for plugin use.

Bug Fixes

• When --emit none is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, #​3078.
• Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, #​3103.
• A @hidden tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, #​3111.
• Custom @group and @category titles with the same sort weight are now ordered consistently with the alphabetical reflection sort, #​3120.

Thanks!

• @​greymoth-jp
• @​jonathanhefner
• @​kcastellino
• @​Metbcy
• @​StoneCypher
• @​wotan-allfather

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.