chore(deps): patch and minor sweep

[kelsos]

Batch 3 of the renovate dashboard (#169): the patch and minor sweep. 30 catalog entries move to the newest release within their current major.

Targets were re-resolved from npm rather than taken from the dashboard, and filtered to releases older than the repo's 7 day minimumReleaseAge, so nothing here is a version pnpm would reject.

Notable jumps

Package	From	To
eslint	10.4.1	10.8.0
@nuxtjs/sitemap	8.0.15	8.3.0
@nuxt/content	3.14.0	3.15.2
vue-router	5.0.7	5.2.0
vue	3.5.34	3.5.40
stylelint	17.13.0	17.14.1
@playwright/test	1.60.0	1.62.0
@nuxtjs/robots	6.0.8	6.1.3
@nuxt/devtools	3.2.4	3.3.1
@nuxtjs/i18n	10.4.0	10.5.0

The rest are patches: vue-tsc, @vitejs/plugin-vue, vitest, @vitest/coverage-v8, @vue/test-utils, rollup, @rotki/eslint-plugin, autoprefixer, happy-dom, lint-staged, msw, npm-run-all2, plainfp, tsdown, @types/node, @fontsource/roboto, better-sqlite3, @nuxt/test-utils, @commitlint/cli, @commitlint/config-conventional.

Deliberately excluded

• satori and braintree-web get their own PRs. satori renders the OG images and wants a visual diff rather than green CI; braintree-web is on the payment path.
• nuxt / vite and their plugins, @rotki/ui-library, and the web3 stack are their own batches.
• @vueuse/* 14.4.0 was published 6 days ago, inside the 7 day minimumReleaseAge. Eligible tomorrow.
• typescript, @rotki/eslint-config, pinia, @unhead/vue, swiper, bumpp, better-sqlite3 13 are held-back majors.

Correction to an earlier claim

In #645 I said the leftover transitive postcss 8.5.15 would be cleared by bumping stylelint in this sweep. That turned out to be wrong, and it is not fixed here. stylelint 17.14.1 did move itself off (it requires ^8.5.16), but stylelint-order@8.1.1 declares its own postcss: ^8.5.8, 8.1.1 is the newest release, and pnpm will not re-resolve a range that is already satisfied. pnpm update -r --depth Infinity postcss does not budge it.

Clearing it needs a pnpm.overrides entry, which felt like the wrong thing to slip into a sweep. Still dev-only linting of first-party CSS, so the advisory's attacker-controlled sourceMappingURL precondition does not apply. Happy to add the override in a follow-up if you'd prefer it gone.

Verification

• typecheck clean.
• lint clean: 68 warnings, 0 errors, byte-identical to before despite eslint 10.4→10.8 and @rotki/eslint-plugin 1.4→1.5.
• 476 tests pass across the 3 test packages.
• generate builds 530 routes and 155 OG images (144 integration, 6 comparison, 5 feature), unchanged. Sitemap still emits 170 URLs across 181 pages. robots.txt is absent from the static output, but that is expected here rather than a regression from the @nuxtjs/robots bump: the Go backend serves it in production via robotsTxtHandler (backend/internal/api/routing/routes.go), and Nuxt only handles it in dev.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 28.42%. Comparing base (3130d45) to head (71ab53d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #648   +/-   ##
=======================================
  Coverage   28.42%   28.42%           
=======================================
  Files         390      390           
  Lines       12232    12232           
  Branches     1965     1965           
=======================================
  Hits         3477     3477           
  Misses       8656     8656           
  Partials       99       99           

Flag	Coverage Δ
backend	56.55% <ø> (ø)
frontend	19.17% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.