chore(deps): update all non-major dependencies

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@iconify/json](https://iconify.design/icon-sets/) ([source](https://redirect.github.com/iconify/icon-sets)) | [`^2.2.458` → `^2.2.468`](https://renovatebot.com/diffs/npm/@iconify%2fjson/2.2.458/2.2.468) |  |  | | [@types/three](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/three) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/three)) | [`^0.183.1` → `^0.184.0`](https://renovatebot.com/diffs/npm/@types%2fthree/0.183.1/0.184.0) |  |  | | [axios](https://axios-http.com) ([source](https://redirect.github.com/axios/axios)) | [`^1.14.0` → `^1.15.2`](https://renovatebot.com/diffs/npm/axios/1.15.0/1.15.2) |  |  | | [defu](https://redirect.github.com/unjs/defu) | [`^6.1.4` → `^6.1.7`](https://renovatebot.com/diffs/npm/defu/6.1.5/6.1.7) |  |  | | [gsap](https://gsap.com) ([source](https://redirect.github.com/greensock/GSAP)) | [`^3.14.2` → `^3.15.0`](https://renovatebot.com/diffs/npm/gsap/3.14.2/3.15.0) |  |  | | [lodash-es](https://lodash.com/custom-builds) ([source](https://redirect.github.com/lodash/lodash)) | [`^4.17.23` → `^4.18.1`](https://renovatebot.com/diffs/npm/lodash-es/4.18.1/4.18.1) |  |  | | [nanoid](https://redirect.github.com/ai/nanoid) | [`^5.1.7` → `^5.1.11`](https://renovatebot.com/diffs/npm/nanoid/5.1.7/5.1.11) |  |  | | [three](https://threejs.org/) ([source](https://redirect.github.com/mrdoob/three.js)) | [`^0.183.2` → `^0.184.0`](https://renovatebot.com/diffs/npm/three/0.183.2/0.184.0) |  |  | | [vue-component-type-helpers](https://redirect.github.com/vuejs/language-tools) ([source](https://redirect.github.com/vuejs/language-tools/tree/HEAD/packages/component-type-helpers)) | [`^3.2.6` → `^3.2.7`](https://renovatebot.com/diffs/npm/vue-component-type-helpers/3.2.6/3.2.7) |  |  | --- ### Release Notes <details> <summary>iconify/icon-sets (@&#8203;iconify/json)</summary> ### [`v2.2.468`](https://redirect.github.com/iconify/icon-sets/compare/2.2.467...65ab95d3f1682147677959e473756373757c1046) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.467...2.2.468) ### [`v2.2.467`](https://redirect.github.com/iconify/icon-sets/compare/2.2.466...2.2.467) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.466...2.2.467) ### [`v2.2.466`](https://redirect.github.com/iconify/icon-sets/compare/2.2.465...2.2.466) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.465...2.2.466) ### [`v2.2.465`](https://redirect.github.com/iconify/icon-sets/compare/2.2.464...2.2.465) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.464...2.2.465) ### [`v2.2.464`](https://redirect.github.com/iconify/icon-sets/compare/2.2.463...2.2.464) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.463...2.2.464) ### [`v2.2.463`](https://redirect.github.com/iconify/icon-sets/compare/2.2.462...2.2.463) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.462...2.2.463) ### [`v2.2.462`](https://redirect.github.com/iconify/icon-sets/compare/2.2.461...2.2.462) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.461...2.2.462) ### [`v2.2.461`](https://redirect.github.com/iconify/icon-sets/compare/2.2.460...2.2.461) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.460...2.2.461) ### [`v2.2.460`](https://redirect.github.com/iconify/icon-sets/compare/2.2.459...2.2.460) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.459...2.2.460) ### [`v2.2.459`](https://redirect.github.com/iconify/icon-sets/compare/2.2.458...2.2.459) [Compare Source](https://redirect.github.com/iconify/icon-sets/compare/2.2.458...2.2.459) </details> <details> <summary>axios/axios (axios)</summary> ### [`v1.15.2`](https://redirect.github.com/axios/axios/releases/tag/v1.15.2) [Compare Source](https://redirect.github.com/axios/axios/compare/v1.15.1...v1.15.2) This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in `allowedSocketPaths` allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs. #### 🔒 Security Fixes - **Prototype Pollution Hardening (HTTP Adapter):** Hardened the Node HTTP adapter and `resolveConfig`/`mergeConfig`/validator paths to read only own properties and use null-prototype config objects, preventing polluted `auth`, `baseURL`, `socketPath`, `beforeRedirect`, and `insecureHTTPParser` from influencing requests. (**[#&#8203;10779](https://redirect.github.com/axios/axios/issues/10779)**) - **SSRF via `socketPath`:** Rejects non-string `socketPath` values and adds an opt-in `allowedSocketPaths` config option to restrict permitted Unix domain socket paths, returning `AxiosError` `ERR_BAD_OPTION_VALUE` on mismatch. (**[#&#8203;10777](https://redirect.github.com/axios/axios/issues/10777)**) - **Supply-chain Hardening:** Added `.npmrc` with `ignore-scripts=true`, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded `SECURITY.md`/`THREATMODEL.md` with provenance verification (`npm audit signatures`), 60-day resolution policy, and maintainer incident-response runbook. (**[#&#8203;10776](https://redirect.github.com/axios/axios/issues/10776)**) #### 🚀 New Features - **`allowedSocketPaths` Config Option:** New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (**[#&#8203;10777](https://redirect.github.com/axios/axios/issues/10777)**) #### 🐛 Bug Fixes - **Keep-alive Socket Memory Leak:** Installs a single per-socket `error` listener tracking the active request via `kAxiosSocketListener`/`kAxiosCurrentReq`, eliminating per-request listener accumulation, `MaxListenersExceededWarning`, and linear heap growth under concurrent or long-running keep-alive workloads (fixes [#&#8203;10780](https://redirect.github.com/axios/axios/issues/10780)). (**[#&#8203;10788](https://redirect.github.com/axios/axios/issues/10788)**) #### 🔧 Maintenance & Chores - **Changelog:** Updated `CHANGELOG.md` with v1.15.1 release notes. (**[#&#8203;10781](https://redirect.github.com/axios/axios/issues/10781)**) [Full Changelog](https://redirect.github.com/axios/axios/compare/v1.15.1...v1.15.2) ### [`v1.15.1`](https://redirect.github.com/axios/axios/compare/v1.15.0...ac42446be51300fe214ba3c6e40cc95f34fd6871) [Compare Source](https://redirect.github.com/axios/axios/compare/v1.15.0...v1.15.1) </details> <details> <summary>unjs/defu (defu)</summary> ### [`v6.1.7`](https://redirect.github.com/unjs/defu/blob/HEAD/CHANGELOG.md#v617) [Compare Source](https://redirect.github.com/unjs/defu/compare/v6.1.6...v6.1.7) [compare changes](https://redirect.github.com/unjs/defu/compare/v6.1.6...v6.1.7) ##### 🩹 Fixes - **defu.d.cts:** Export Defu types ([#&#8203;157](https://redirect.github.com/unjs/defu/pull/157)) ##### 📦 Build - Correct the `types` export entry ([#&#8203;160](https://redirect.github.com/unjs/defu/pull/160)) ##### ❤️ Contributors - Jakub Michálek ([@&#8203;J-Michalek](https://redirect.github.com/J-Michalek)) - Kricsleo ([@&#8203;kricsleo](https://redirect.github.com/kricsleo)) ### [`v6.1.6`](https://redirect.github.com/unjs/defu/blob/HEAD/CHANGELOG.md#v616) [Compare Source](https://redirect.github.com/unjs/defu/compare/v6.1.5...v6.1.6) [compare changes](https://redirect.github.com/unjs/defu/compare/v6.1.5...v6.1.6) ##### 📦 Build - Fix mixed types ([407b516](https://redirect.github.com/unjs/defu/commit/407b516)) ##### ❤️ Contributors - Pooya Parsa ([@&#8203;pi0](https://redirect.github.com/pi0)) </details> <details> <summary>greensock/GSAP (gsap)</summary> ### [`v3.15.0`](https://redirect.github.com/greensock/GSAP/compare/3.14.2...3.15.0) [Compare Source](https://redirect.github.com/greensock/GSAP/compare/3.14.2...3.15.0) </details> <details> <summary>ai/nanoid (nanoid)</summary> ### [`v5.1.11`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5111) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5db09ee173cb187e616337148da5bd892d396aa7...5423cf56499c1ea33ea4bd9fbaab1723083cb659) - Fixed breaking Nano ID by requesting big ID. ### [`v5.1.10`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5110) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.9...5.1.10) - Fixed breaking nanoid by requesting big ID (by [@&#8203;alanzabihi](https://redirect.github.com/alanzabihi)). ### [`v5.1.9`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#519) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.8...5.1.9) - Fixed npm package size regression. ### [`v5.1.8`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#518) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.7...5.1.8) - Made `cusatomAlphabet` 75% faster (by [@&#8203;saripovdenis](https://redirect.github.com/saripovdenis)). </details> <details> <summary>mrdoob/three.js (three)</summary> ### [`v0.184.0`](https://redirect.github.com/mrdoob/three.js/compare/1939c35f2d92a4c870568da011aab54dabdfdd30...d3b629c0c2097cec664ad16369bb6eae3b10e335) [Compare Source](https://redirect.github.com/mrdoob/three.js/compare/1939c35f2d92a4c870568da011aab54dabdfdd30...d3b629c0c2097cec664ad16369bb6eae3b10e335) </details> <details> <summary>vuejs/language-tools (vue-component-type-helpers)</summary> ### [`v3.2.7`](https://redirect.github.com/vuejs/language-tools/blob/HEAD/CHANGELOG.md#327-2026-04-19) [Compare Source](https://redirect.github.com/vuejs/language-tools/compare/v3.2.6...v3.2.7) ##### component-meta - **fix:** preserve non-ASCII characters in prop default values ([#&#8203;6012](https://redirect.github.com/vuejs/language-tools/issues/6012)) - Thanks to [@&#8203;ef81sp](https://redirect.github.com/ef81sp)! ##### workspace - **chore:** bump typescript to 6.0.3 ([#&#8203;6017](https://redirect.github.com/vuejs/language-tools/issues/6017)) - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/MoomFE/mixte). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoiZGV2IiwibGFiZWxzIjpbXX0=-->