Skip to content

chore(deps): update all dependencies#124

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies
Open

chore(deps): update all dependencies#124
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 21, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@codspeed/vitest-plugin (source) 5.4.05.5.0 age confidence pnpm.catalog.default minor
CodSpeedHQ/action v4.15.1v4.17.0 age confidence action minor
aqua:astral-sh/uv 0.11.160.11.17 age confidence patch 0.11.19 (+1)
aqua:cli/cli 2.92.02.93.0 age confidence minor
aqua:crate-ci/typos 1.46.31.47.0 age confidence minor 1.47.2 (+1)
electron 42.2.042.3.0 age confidence pnpm.catalog.default minor 42.3.3
github:EmbarkStudios/cargo-deny 0.19.70.19.8 age confidence patch
github:nextest-rs/nextest 0.9.1360.9.137 age confidence patch
jdx/mise v2026.5.15v2026.5.16 age confidence patch v2026.6.0 (+2)
node (source) 24.15.024.16.0 age confidence minor
npm:pnpm (source) 11.2.211.5.0 age confidence minor 11.5.2 (+1)
oxfmt (source) 0.51.00.52.0 age confidence pnpm.catalog.default minor 0.53.0
oxlint (source) 1.66.01.67.0 age confidence pnpm.catalog.default minor 1.68.0
pnpm (source) 11.2.2+sha512.36e6621fad506178936455e70247b8808ef4ec25797a9f437a93281a020484e2607f6a469a22e982987c3dbb8866e3071514ab10a4a1749e06edcd1ec118436f11.5.0 age confidence packageManager minor 11.5.2 (+1)
quay.io/pypa/manylinux_2_28 65f13b3102e1ad final digest
ruff (source, changelog) ==0.15.14==0.15.15 age confidence dependency-groups patch 0.15.16
rust (source, changelog) nightly-2026-05-24nightly-2026-05-30 age confidence toolchain patch nightly-2026-06-06 (+6)
rustlang/rust nightly-2026-05-24nightly-2026-05-30 age confidence patch nightly-2026-06-06 (+6)

Release Notes

CodSpeedHQ/codspeed-node (@​codspeed/vitest-plugin)

v5.5.0

Compare Source

Highlights

We are introducing @codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.

Here's an example usage, but head to the docs for more information

import { bench, type Page } from "@​codspeed/playwright-plugin";
import electronExecutable from "electron";
import path from "node:path";
import { fileURLToPath } from "node:url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const appRoot = path.resolve(__dirname, "..");

async function waitUntilSettled(page: Page): Promise<void> {
  await page.waitForFunction(() => {
    const main = document.getElementById("main");
    return !!main && !main.classList.contains("loading");
  });
}

await bench(
  "inbox-search-archive-threads",
  async ({ page }) => {
    await page.fill("#search", "update");
    await waitUntilSettled(page);

    await page.click("#select-visible-btn");
    await page.click("#archive-btn");
    await waitUntilSettled(page);

    await page.click('#sidebar nav button[data-view="threads"]');
    await waitUntilSettled(page);
  },
  {
    target: {
      kind: "electron",
      appPath: path.join(appRoot, "out/main/index.js"),
      cwd: appRoot,
    },
    beforeRound: async ({ page }) => {
      page.setDefaultTimeout(180_000);
      await page.waitForSelector("#main");
      await waitUntilSettled(page);
    },
  },
);

Note: this plugin is only compatible with the walltime instrument.

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0

CodSpeedHQ/action (CodSpeedHQ/action)

v4.17.0

Compare Source

Release Notes

🚀 Features
🐛 Bug Fixes
💼 Other
🏗️ Refactor
🧪 Testing
⚙️ Internals

Install codspeed-runner 4.17.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.17.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.17.0

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.15.1...v4.17.0

astral-sh/uv (aqua:astral-sh/uv)

v0.11.17

Compare Source

Released on 2026-05-28.

Enhancements
  • Add a diagnostic for uv add with standard library modules (#​19572)
  • Expose uv workspace and its list subcommand in help output (#​19533)
  • Improve the "403 forbidden" hint to suggest ignore-error-codes when applicable (#​19521)
  • Skip direct URL lock freshness checks while offline (#​19596)
  • Add import-names and import-namespaces support to uv-build (PEP 794) (#​19380)
  • Add a --no-editable-package flag to various commands (#​19584)
  • Infer Python version requests from source trees in uv tool invocations (#​19577)
Preview features
  • Add module owners to uv workspace metadata (#​19122)
  • Do not allow uv venv --clear to remove non-virtual environments (#​19595)
Bug fixes
  • Improve the performance of large entries in tool.uv.conflicts (#​19538)
  • Avoid modifying the parent process' env with --env-file in uv run (#​19567)
  • Fix script environment creation for scripts with long filenames (#​19539)
  • Fix transitive Git archive dependencies in lockfiles (#​19589)
  • Preserve Git repository URLs in direct URL metadata (#​19590)
  • Support redirects in --check-url (#​19594)
  • Accept case-insensitive HTML tags in --find-links parsing (#​19537)
  • Reject duplicate script metadata blocks (#​19544)
  • Ban names like "python3" as script entry points (#​19535, #​19536)
  • Validate Git LFS artifacts for Git archives (#​19592)
  • Use a relative path when creating symlinks in cache to improve relocatability (#​19033)
Documentation
  • Fix malformed positional anchors in the CLI reference (#​19575)
cli/cli (aqua:cli/cli)

v2.93.0: GitHub CLI 2.93.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands.

Users are advised to update gh to version v2.93.0 as soon as possible.

For more information see: GHSA-8xvp-7hj6-mcj9

Support agents in gh secret command set

The gh secret command set can now set agent secrets. For more information, see "Configuring secrets and variables for Copilot cloud agent".

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.92.0...v2.93.0

crate-ci/typos (aqua:crate-ci/typos)

v1.47.0

Compare Source

Features
  • Updated the dictionary with the May 2026 changes
electron/electron (electron)

v42.3.0: electron v42.3.0

Compare Source

Release Notes for v42.3.0

Features

  • Added Linux support for app.getApplicationInfoForProtocol(). #​51680
  • Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. #​51691 (Also in 43)
  • Added session support to net module requests from utility process. #​51698

Fixes

  • Fixed an issue where process and other Node globals were undefined in ESM preload scripts when contextIsolation was disabled. #​51726 (Also in 43)
  • Fixed native addon compilation failure with undefined msvc intrinsic from v8 headers. #​51706 (Also in 43)

Other Changes

  • Updated Chromium to 148.0.7778.180. #​51600
EmbarkStudios/cargo-deny (github:EmbarkStudios/cargo-deny)

v0.19.8

Compare Source

Fixed
  • PR#864 fixed matching of ^ and ~ with on prerelease versions for when checking if a crate is affected by an advisory. As of the time of the PR, this literally affected none of published versions of any crate with an advisory, but this just ensures such a case will be handled in the future.
nextest-rs/nextest (github:nextest-rs/nextest)

v0.9.137: cargo-nextest 0.9.137

Compare Source

Changed
  • CLI --help descriptions, configuration-reference docs, and JSON schema descriptions now use consistent language and voice. (#​3366)
Fixed
  • Filterset expressions like not(test(foo)), all()and(test(foo)), and all()or(test(foo)), where not, and, or or is immediately followed by an opening parenthesis, now parse correctly. Previously, a separating space was required. (#​3367)
jdx/mise (jdx/mise)

v2026.5.16: : versions-host metadata, fork-bomb fixes, and friendlier upgrades

Compare Source

Added
  • (github) Use the shared mise-versions host for release metadata and artifact attestations before falling back to api.github.com, dramatically cutting anonymous GitHub API usage in CI/Docker (#​10127 by @​jdx).
  • (node) New node.npm_shim setting (MISE_NODE_NPM_SHIM) to opt out of the bundled npm wrapper, letting corepack manage bin/npm cleanly (#​10082 by @​jjb).
  • (npm) New allow_builds tool option for npm-backend installs that expands to --allow-build=<pkg> for aube and pnpm, accepting a string, array, or true for all builds (#​10116 by @​jdx).
Fixed
  • (backend) Strip the system shims dir from dependency_env PATH to prevent npm/go shim re-entry fork-bombs in devcontainer/Docker setups using mise install --system (#​10019 by @​andrewjamesbrown).
  • (backend) Improve libc detection on musl distros so installing gcompat on Alpine no longer flips mise to glibc binaries (#​10020 by @​thespags).
  • (aqua) Skip in-place link creation when src and dst alias the same inode (fixes godot install on macOS/APFS) (#​10012 by @​tvararu).
  • (aqua) Lock github_content packages using raw GitHub content URLs instead of archive URLs (#​10102 by @​risu729).
  • (toolset) hook-env and other prefer-offline flows no longer fetch remote versions to resolve concrete/latest/prefix:* specs, speeding up shells with many fuzzy tools (#​10098 by @​jdx).
  • (upgrade) Preserve installed versions still pinned by other tracked project lockfiles during upgrade cleanup (#​10114 by @​jdx).
  • (upgrade) Improve current version detection so prefix requests like go = "1.25" show the best matching installed version in summaries (#​9973 by @​jdx).
  • (lock) Allow mise lock and mise upgrade to refresh mise.lock even when locked = true is set (#​10111 by @​jdx).
  • (install) Reject install requests whose resolved backend is in disable_backends, including explicit syntax like ubi:owner/repo (#​9905 by @​risu729).
  • (use) Reject tool version strings that start with - (e.g. mise use dummy@--version) (#​10113 by @​jdx).
  • (en) Preserve MISE_ENV / -E profile when an activated subshell sources mise activate (#​10124 by @​jdx).
  • (unset) Respect MISE_GLOBAL_CONFIG_FILE when running mise unset from $HOME, matching mise set/use (#​10105 by @​jdx).
  • (task) Set config_root on tasks loaded from global config so {{config_root}} renders correctly (#​10106 by @​jdx).
  • (task) Render templates and expand ~/ in sandbox allow_read / allow_write paths (#​10112 by @​jdx).
  • (shim) Skip dot-prefixed (hidden) executables when generating shims (#​10123 by @​jdx).
  • (pipx) Combine --pip-args=VALUE into a single argv element so pipx's argparse accepts values starting with -- (#​10120 by @​iloveitaly).
  • (security) Apply url_replacements to the GitHub attestations API base URL (#​9971 by @​SlaterByte).
  • Show the mise version in friendly error output (#​10109 by @​jdx).
  • (copr) Increase build timeout (#​10071 by @​jdx).
Performance
  • Cache repeated successful path canonicalization across hot PATH/shim/activation lookups (#​10068 by @​jdx).
Changed
Documentation
💚 Sponsor mise

mise is built by @​jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

nodejs/node (node)

v24.16.0: 2026-05-21, Version 24.16.0 'Krypton' (LTS), @​aduh95

Compare Source

Notable Changes
  • [b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #​62553
  • [ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #​62713
  • [9705f628d9] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #​57775
  • [40ccfdecf9] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #​62277
  • [d7188af5c9] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #​63082
  • [aa1d8a9afc] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #​62541
  • [6f37f7e240] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #​61098
  • [d14029be7f] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #​61747
  • [d142c584cd] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #​62820
  • [01a9552585] - (SEMVER-MINOR) test_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #​60751
  • [00705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #​61556
Commits

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Mar 21, 2026

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package.json
Command failed: corepack use pnpm@11.5.0

File name: mise.lock

mise ERROR error parsing config file: /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml
mise ERROR Config files in /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml are not trusted.
Trust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.
mise ERROR Version: 2026.6.0 linux-x64 (2026-06-03)
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

Command failed: mise lock aqua:astral-sh/uv aqua:cli/cli aqua:crate-ci/typos github:EmbarkStudios/cargo-deny github:EmbarkStudios/cargo-deny github:nextest-rs/nextest node npm:pnpm rustlang/rust
mise ERROR error parsing config file: /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml
mise ERROR Config files in /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml are not trusted.
Trust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.
mise ERROR Version: 2026.6.0 linux-x64 (2026-06-03)
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

@greptile-apps
Copy link
Copy Markdown

greptile-apps Bot commented Mar 21, 2026

Greptile Summary

This is a routine automated dependency update PR from Renovate Bot, bumping a wide range of dependencies across the stack: GitHub Actions (setup-node v6.3.0, mise-action v3.6.3, zizmor-action v0.5.2, codeql-action v4.32.6), Node.js packages (pnpm 10.32.1, vitest/vite 4.1.0/8.0.0 stable releases from beta, oxfmt, oxlint, undici, electron, node-addon-slsa), Rust crates (tempfile 3.27.0), Python tools (ruff, semgrep, pyrefly, zizmor), and various aqua-managed CLI tools (uv, gh, gitleaks, shfmt, nextest). All GitHub Action references continue to be pinned by full commit SHA, which is good practice for this repository.

  • Most changes are straightforward version bumps with no behavioral impact on the codebase itself.
  • Several beta versions (vitest, vite) graduate to stable releases — a positive change.
  • The packageManager field in package.json was updated to pnpm@10.32.1 but the SHA512 integrity hash that was present in the old value was dropped, removing Corepack's ability to verify the pnpm binary on download.

Confidence Score: 4/5

  • This PR is safe to merge; the only notable finding is a non-critical omission of the Corepack integrity hash for pnpm.
  • All changes are automated dependency bumps. GitHub Actions remain SHA-pinned, Dockerfile images are digest-pinned, and lock files are fully regenerated. The one notable point is the missing SHA512 hash in the packageManager field, which is a best-practice/supply-chain hygiene issue rather than an active vulnerability. Everything else is routine.
  • package.json — missing SHA512 hash in the packageManager field.

Important Files Changed

Filename Overview
package.json Updated pnpm to 10.32.1 but dropped the SHA512 integrity hash from the packageManager field, removing Corepack's ability to verify the binary's integrity on download.
Dockerfile Updated docker/dockerfile syntax to 1.22 and manylinux_2_28 base image to a new digest. Both references are pinned by SHA256. No issues found.
Cargo.lock Updated tempfile from 3.26.0 to 3.27.0 which pulls in getrandom 0.3.4 instead of 0.4.2, and resolves different windows-sys versions for various crates. Standard lock file update.
mise.toml Updated gitleaks, uv, gh CLI, nextest, and mvdan/sh (shfmt) to newer patch/minor versions. No issues found.
pyproject.toml Updated pyrefly, ruff, semgrep, and zizmor to newer versions. No issues found.
pnpm-workspace.yaml Updated catalog versions for @vitest/coverage-istanbul, electron, oxfmt, oxlint, undici, vite, and vitest from beta/older versions to stable releases. No issues found.

Comments Outside Diff (1)

  1. package.json, line 202 (link)

    P2 Missing Corepack integrity hash for pnpm

    The previous packageManager value included a +sha512 integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

    You can restore supply-chain integrity by running:

    corepack use pnpm@10.32.1

    This will update package.json with the correct hash for 10.32.1, e.g.:

    Consider asking Renovate to preserve the hash when bumping the packageManager field (the pinDigests option may help, or a custom packageRules entry targeting packageManager).

    Prompt To Fix With AI
    This is a comment left during a code review.
    Path: package.json
    Line: 202
    
    Comment:
    **Missing Corepack integrity hash for pnpm**
    
    The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.
    
    You can restore supply-chain integrity by running:
    
    ```bash
    corepack use pnpm@10.32.1
    ```
    
    This will update `package.json` with the correct hash for 10.32.1, e.g.:
    
    
    
    Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).
    
    How can I resolve this? If you propose a fix, please make it concise.
Prompt To Fix All With AI
This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:

```suggestion
  "packageManager": "pnpm@10.32.1+sha512.<hash-for-10.32.1>",
```

Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

Last reviewed commit: "Update all dependenc..."

@renovate renovate Bot force-pushed the renovate/all-dependencies branch 4 times, most recently from 1c2d5e5 to 40653e4 Compare March 22, 2026 02:03
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch from 40653e4 to 757f335 Compare March 22, 2026 04:59
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch from 757f335 to a2c2755 Compare March 22, 2026 21:02
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch from a2c2755 to 4501313 Compare March 23, 2026 01:45
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch 17 times, most recently from c433c4d to 7fe5e47 Compare March 27, 2026 13:13
@renovate renovate Bot force-pushed the renovate/all-dependencies branch from 57dabdb to b7f6851 Compare April 19, 2026 09:14
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch 9 times, most recently from 5bce89e to 366fde0 Compare April 20, 2026 21:11
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 20, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@renovate renovate Bot force-pushed the renovate/all-dependencies branch 9 times, most recently from e033171 to c00b714 Compare April 27, 2026 22:59
@renovate renovate Bot force-pushed the renovate/all-dependencies branch 6 times, most recently from 48dd3a8 to 5e27d67 Compare April 30, 2026 15:12
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented May 18, 2026

Merging this PR will not alter performance

✅ 15 untouched benchmarks


Comparing renovate/all-dependencies (4ff023f) with main (32fd41a)

Open in CodSpeed

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Jun 5, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​oxfmt@​0.52.0891008996100
Addednpm/​oxlint@​1.67.0991009196100
Addednpm/​@​codspeed/​vitest-plugin@​5.5.0971009896100
Addednpm/​electron@​42.3.010010010098100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant