You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands.
Users are advised to update gh to version v2.93.0 as soon as possible.
PR#864 fixed matching of ^ and ~ with on prerelease versions for when checking if a crate is affected by an advisory. As of the time of the PR, this literally affected none of published versions of any crate with an advisory, but this just ensures such a case will be handled in the future.
CLI --help descriptions, configuration-reference docs, and JSON schema descriptions now use consistent language and voice. (#3366)
Fixed
Filterset expressions like not(test(foo)), all()and(test(foo)), and all()or(test(foo)), where not, and, or or is immediately followed by an opening parenthesis, now parse correctly. Previously, a separating space was required. (#3367)
jdx/mise (jdx/mise)
v2026.5.16: : versions-host metadata, fork-bomb fixes, and friendlier upgrades
(github) Use the shared mise-versions host for release metadata and artifact attestations before falling back to api.github.com, dramatically cutting anonymous GitHub API usage in CI/Docker (#10127 by @jdx).
(node) New node.npm_shim setting (MISE_NODE_NPM_SHIM) to opt out of the bundled npm wrapper, letting corepack manage bin/npm cleanly (#10082 by @jjb).
(npm) New allow_builds tool option for npm-backend installs that expands to --allow-build=<pkg> for aube and pnpm, accepting a string, array, or true for all builds (#10116 by @jdx).
Fixed
(backend) Strip the system shims dir from dependency_env PATH to prevent npm/go shim re-entry fork-bombs in devcontainer/Docker setups using mise install --system (#10019 by @andrewjamesbrown).
(backend) Improve libc detection on musl distros so installing gcompat on Alpine no longer flips mise to glibc binaries (#10020 by @thespags).
(aqua) Skip in-place link creation when src and dst alias the same inode (fixes godot install on macOS/APFS) (#10012 by @tvararu).
(aqua) Lock github_content packages using raw GitHub content URLs instead of archive URLs (#10102 by @risu729).
(toolset)hook-env and other prefer-offline flows no longer fetch remote versions to resolve concrete/latest/prefix:* specs, speeding up shells with many fuzzy tools (#10098 by @jdx).
(upgrade) Preserve installed versions still pinned by other tracked project lockfiles during upgrade cleanup (#10114 by @jdx).
(upgrade) Improve current version detection so prefix requests like go = "1.25" show the best matching installed version in summaries (#9973 by @jdx).
(lock) Allow mise lock and mise upgrade to refresh mise.lock even when locked = true is set (#10111 by @jdx).
(install) Reject install requests whose resolved backend is in disable_backends, including explicit syntax like ubi:owner/repo (#9905 by @risu729).
(use) Reject tool version strings that start with - (e.g. mise use dummy@--version) (#10113 by @jdx).
(en) Preserve MISE_ENV / -E profile when an activated subshell sources mise activate (#10124 by @jdx).
(unset) Respect MISE_GLOBAL_CONFIG_FILE when running mise unset from $HOME, matching mise set/use (#10105 by @jdx).
(task) Set config_root on tasks loaded from global config so {{config_root}} renders correctly (#10106 by @jdx).
(task) Render templates and expand ~/ in sandbox allow_read / allow_write paths (#10112 by @jdx).
(shim) Skip dot-prefixed (hidden) executables when generating shims (#10123 by @jdx).
(pipx) Combine --pip-args=VALUE into a single argv element so pipx's argparse accepts values starting with -- (#10120 by @iloveitaly).
(security) Apply url_replacements to the GitHub attestations API base URL (#9971 by @SlaterByte).
Show the mise version in friendly error output (#10109 by @jdx).
Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: package.json
Command failed: corepack use pnpm@11.5.0
File name: mise.lock
mise ERROR error parsing config file: /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml
mise ERROR Config files in /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml are not trusted.
Trust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.
mise ERROR Version: 2026.6.0 linux-x64 (2026-06-03)
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information
Command failed: mise lock aqua:astral-sh/uv aqua:cli/cli aqua:crate-ci/typos github:EmbarkStudios/cargo-deny github:EmbarkStudios/cargo-deny github:nextest-rs/nextest node npm:pnpm rustlang/rust
mise ERROR error parsing config file: /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml
mise ERROR Config files in /tmp/renovate/repos/github/vadimpiven/node_reqwest/mise.toml are not trusted.
Trust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.
mise ERROR Version: 2026.6.0 linux-x64 (2026-06-03)
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information
This is a routine automated dependency update PR from Renovate Bot, bumping a wide range of dependencies across the stack: GitHub Actions (setup-node v6.3.0, mise-action v3.6.3, zizmor-action v0.5.2, codeql-action v4.32.6), Node.js packages (pnpm 10.32.1, vitest/vite 4.1.0/8.0.0 stable releases from beta, oxfmt, oxlint, undici, electron, node-addon-slsa), Rust crates (tempfile 3.27.0), Python tools (ruff, semgrep, pyrefly, zizmor), and various aqua-managed CLI tools (uv, gh, gitleaks, shfmt, nextest). All GitHub Action references continue to be pinned by full commit SHA, which is good practice for this repository.
Most changes are straightforward version bumps with no behavioral impact on the codebase itself.
Several beta versions (vitest, vite) graduate to stable releases — a positive change.
The packageManager field in package.json was updated to pnpm@10.32.1 but the SHA512 integrity hash that was present in the old value was dropped, removing Corepack's ability to verify the pnpm binary on download.
Confidence Score: 4/5
This PR is safe to merge; the only notable finding is a non-critical omission of the Corepack integrity hash for pnpm.
All changes are automated dependency bumps. GitHub Actions remain SHA-pinned, Dockerfile images are digest-pinned, and lock files are fully regenerated. The one notable point is the missing SHA512 hash in the packageManager field, which is a best-practice/supply-chain hygiene issue rather than an active vulnerability. Everything else is routine.
package.json — missing SHA512 hash in the packageManager field.
Important Files Changed
Filename
Overview
package.json
Updated pnpm to 10.32.1 but dropped the SHA512 integrity hash from the packageManager field, removing Corepack's ability to verify the binary's integrity on download.
Dockerfile
Updated docker/dockerfile syntax to 1.22 and manylinux_2_28 base image to a new digest. Both references are pinned by SHA256. No issues found.
Cargo.lock
Updated tempfile from 3.26.0 to 3.27.0 which pulls in getrandom 0.3.4 instead of 0.4.2, and resolves different windows-sys versions for various crates. Standard lock file update.
mise.toml
Updated gitleaks, uv, gh CLI, nextest, and mvdan/sh (shfmt) to newer patch/minor versions. No issues found.
pyproject.toml
Updated pyrefly, ruff, semgrep, and zizmor to newer versions. No issues found.
pnpm-workspace.yaml
Updated catalog versions for @vitest/coverage-istanbul, electron, oxfmt, oxlint, undici, vite, and vitest from beta/older versions to stable releases. No issues found.
The previous packageManager value included a +sha512 integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.
You can restore supply-chain integrity by running:
corepack use pnpm@10.32.1
This will update package.json with the correct hash for 10.32.1, e.g.:
Consider asking Renovate to preserve the hash when bumping the packageManager field (the pinDigests option may help, or a custom packageRules entry targeting packageManager).
Prompt To Fix With AI
This is a comment left during a code review.
Path: package.json
Line: 202
Comment:
**Missing Corepack integrity hash for pnpm**
The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.
You can restore supply-chain integrity by running:
```bash
corepack use pnpm@10.32.1
```
This will update `package.json` with the correct hash for 10.32.1, e.g.:
Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).
How can I resolve this? If you propose a fix, please make it concise.
Prompt To Fix All With AI
This is a comment left during a code review.
Path: package.json
Line: 202
Comment:
**Missing Corepack integrity hash for pnpm**
The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.
You can restore supply-chain integrity by running:
```bash
corepack use pnpm@10.32.1
```
This will update `package.json` with the correct hash for 10.32.1, e.g.:
```suggestion "packageManager": "pnpm@10.32.1+sha512.<hash-for-10.32.1>",```
Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).
How can I resolve this? If you propose a fix, please make it concise.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.4.0→5.5.0v4.15.1→v4.17.00.11.16→0.11.170.11.19(+1)2.92.0→2.93.01.46.3→1.47.01.47.2(+1)42.2.0→42.3.042.3.30.19.7→0.19.80.9.136→0.9.137v2026.5.15→v2026.5.16v2026.6.0(+2)24.15.0→24.16.011.2.2→11.5.011.5.2(+1)0.51.0→0.52.00.53.01.66.0→1.67.01.68.011.2.2+sha512.36e6621fad506178936455e70247b8808ef4ec25797a9f437a93281a020484e2607f6a469a22e982987c3dbb8866e3071514ab10a4a1749e06edcd1ec118436f→11.5.011.5.2(+1)65f13b3→102e1ad==0.15.14→==0.15.150.15.16nightly-2026-05-24→nightly-2026-05-30nightly-2026-06-06(+6)nightly-2026-05-24→nightly-2026-05-30nightly-2026-06-06(+6)Release Notes
CodSpeedHQ/codspeed-node (@codspeed/vitest-plugin)
v5.5.0Compare Source
Highlights
We are introducing
@codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.Here's an example usage, but head to the docs for more information
Note: this plugin is only compatible with the walltime instrument.
What's Changed
Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0
CodSpeedHQ/action (CodSpeedHQ/action)
v4.17.0Compare Source
Release Notes
🚀 Features
🐛 Bug Fixes
💼 Other
🏗️ Refactor
🧪 Testing
⚙️ Internals
Install codspeed-runner 4.17.0
Install prebuilt binaries via shell script
Download codspeed-runner 4.17.0
Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md
Full Changelog: CodSpeedHQ/action@v4.15.1...v4.17.0
astral-sh/uv (aqua:astral-sh/uv)
v0.11.17Compare Source
Released on 2026-05-28.
Enhancements
uv addwith standard library modules (#19572)uv workspaceand itslistsubcommand in help output (#19533)ignore-error-codeswhen applicable (#19521)import-namesandimport-namespacessupport touv-build(PEP 794) (#19380)--no-editable-packageflag to various commands (#19584)uv toolinvocations (#19577)Preview features
uv workspace metadata(#19122)uv venv --clearto remove non-virtual environments (#19595)Bug fixes
tool.uv.conflicts(#19538)--env-fileinuv run(#19567)--check-url(#19594)--find-linksparsing (#19537)Documentation
cli/cli (aqua:cli/cli)
v2.93.0: GitHub CLI 2.93.0Compare Source
Security
A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via
gh attestation,gh release verify, andgh release verify-assetcommands.Users are advised to update
ghto versionv2.93.0as soon as possible.For more information see: GHSA-8xvp-7hj6-mcj9
Support agents in
gh secretcommand setThe
gh secretcommand set can now set agent secrets. For more information, see "Configuring secrets and variables for Copilot cloud agent".What's Changed
✨ Features
🐛 Fixes
gh auth refreshfor 401 returns by @333fred in #13068📚 Docs & Chores
gh copilottelemetry sampling to 100% by @williammartin in #13362New Contributors
Full Changelog: cli/cli@v2.92.0...v2.93.0
crate-ci/typos (aqua:crate-ci/typos)
v1.47.0Compare Source
Features
electron/electron (electron)
v42.3.0: electron v42.3.0Compare Source
Release Notes for v42.3.0
Features
app.getApplicationInfoForProtocol(). #51680Fixes
processand other Node globals were undefined in ESM preload scripts whencontextIsolationwas disabled. #51726 (Also in 43)Other Changes
EmbarkStudios/cargo-deny (github:EmbarkStudios/cargo-deny)
v0.19.8Compare Source
Fixed
^and~with on prerelease versions for when checking if a crate is affected by an advisory. As of the time of the PR, this literally affected none of published versions of any crate with an advisory, but this just ensures such a case will be handled in the future.nextest-rs/nextest (github:nextest-rs/nextest)
v0.9.137: cargo-nextest 0.9.137Compare Source
Changed
--helpdescriptions, configuration-reference docs, and JSON schema descriptions now use consistent language and voice. (#3366)Fixed
not(test(foo)),all()and(test(foo)), andall()or(test(foo)), wherenot,and, ororis immediately followed by an opening parenthesis, now parse correctly. Previously, a separating space was required. (#3367)jdx/mise (jdx/mise)
v2026.5.16: : versions-host metadata, fork-bomb fixes, and friendlier upgradesCompare Source
Added
mise-versionshost for release metadata and artifact attestations before falling back toapi.github.com, dramatically cutting anonymous GitHub API usage in CI/Docker (#10127 by @jdx).node.npm_shimsetting (MISE_NODE_NPM_SHIM) to opt out of the bundled npm wrapper, lettingcorepackmanagebin/npmcleanly (#10082 by @jjb).allow_buildstool option for npm-backend installs that expands to--allow-build=<pkg>for aube and pnpm, accepting a string, array, ortruefor all builds (#10116 by @jdx).Fixed
dependency_envPATH to prevent npm/go shim re-entry fork-bombs in devcontainer/Docker setups usingmise install --system(#10019 by @andrewjamesbrown).gcompaton Alpine no longer flips mise to glibc binaries (#10020 by @thespags).github_contentpackages using raw GitHub content URLs instead of archive URLs (#10102 by @risu729).hook-envand other prefer-offline flows no longer fetch remote versions to resolve concrete/latest/prefix:*specs, speeding up shells with many fuzzy tools (#10098 by @jdx).go = "1.25"show the best matching installed version in summaries (#9973 by @jdx).mise lockandmise upgradeto refreshmise.lockeven whenlocked = trueis set (#10111 by @jdx).disable_backends, including explicit syntax likeubi:owner/repo(#9905 by @risu729).-(e.g.mise use dummy@--version) (#10113 by @jdx).MISE_ENV/-Eprofile when an activated subshell sourcesmise activate(#10124 by @jdx).MISE_GLOBAL_CONFIG_FILEwhen runningmise unsetfrom$HOME, matchingmise set/use(#10105 by @jdx).config_rooton tasks loaded from global config so{{config_root}}renders correctly (#10106 by @jdx).~/in sandboxallow_read/allow_writepaths (#10112 by @jdx).--pip-args=VALUEinto a single argv element so pipx's argparse accepts values starting with--(#10120 by @iloveitaly).url_replacementsto the GitHub attestations API base URL (#9971 by @SlaterByte).Performance
Changed
npmon Windows (aqua's standalonenpm/clitarball is broken on Windows) (#10101 by @risu729).wrangler,gemini-cli,vercel,codebuff,jules,orval,serverless), and drop npm fallbacks forast-grep,lefthook,claude,code(#9916 by @risu729).modem-dev/hunk(#10051 by @naoki-mizuno),wacli(#10043 by @dovocoder),liquibasevia the github backend (#10052 by @benberryallwood),longbridge-terminal(#10073 by @hogan-yuan), and makeaubemore resilient (#10092 by @bgeron, #10110).Documentation
main.tfreference (#10099 by @risu729).💚 Sponsor mise
mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.
nodejs/node (node)
v24.16.0: 2026-05-21, Version 24.16.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
b267f6bca3] - (SEMVER-MINOR) crypto: implementrandomUUIDv7()(nabeel378) #62553ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #627139705f628d9] - (SEMVER-MINOR) fs: add signal option tofs.stat()(Mert Can Altin) #5777540ccfdecf9] - (SEMVER-MINOR) fs: exposefrsizefield instatfs(Jinho Jang) #62277d7188af5c9] - (SEMVER-MINOR) http: hardenClientRequestoptions merge (Matteo Collina) #63082aa1d8a9afc] - (SEMVER-MINOR) http: addreq.signaltoIncomingMessage(Akshat) #625416f37f7e240] - (SEMVER-MINOR) stream: propagate destruction induplexPair(Ahmed Elhor) #61098d14029be7f] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747d142c584cd] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #6282001a9552585] - (SEMVER-MINOR) test_runner: add mock-timers support forAbortSignal.timeout(DeveloperViraj) #6075100705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556Commits
dd72df060d] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509add94f4bc3] - build: track PDL files as inputs in inspector GN build (Robo) #628881b1eb9e334] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #626678752b604ec] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902341947e7fd] - crypto: reject unintended raw key format string input (Filip Skokan) #6297428a78747fc] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #6286316e8c2b54d] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839eeae754a87] - crypto: reject inherited key type names (Jonathan Lopes) #628759dd5540325] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #625537597d204c1] - crypto: add support forEd25519context parameter (Filip Skokan) #624744bf85845da] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #6271383e98f77b7] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375ec8c6b939a] - deps: V8: cherry-pick657d8de(Guy Bedford) #62784722c0c3274] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #611875304db93d3] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046e073b3811d] - deps: update nghttp3 to 1.11.0 (James M Snell) #592491d00313fb2] - deps: update ngtcp2 to 1.14.0 (James M Snell) #592498b3a4fc18f] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #6309062fe0cfcd1] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045137e09c8e9] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #6281014a4cb8fbc] - deps: update timezone to 2026b (Node.js GitHub Bot) #629623e1036583a] - deps: upgrade npm to 11.13.0 (npm team) #6289801dfe5961c] - deps: cherry-pick libuv/libuv@439a54b(skooch) #628816cd368b10c] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699f218a4f553] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698b47688524a] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629d202e2d343] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #626292faba66341] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594fa46c90c5d] - deps: update googletest tod72f9c8(Node.js GitHub Bot) #62593099ded5713] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #625927ce95afe96] - deps: libuv: cherry-pickaabb765(Santiago Gimeno) #6256157ef845623] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324493ac40e12] - deps: update libuv to 1.52.1 (Node.js GitHub Bot) #61829b39508b368] - deps: update undici to 7.25.0 (Node.js GitHub Bot) #63011cb67a925e9] - deps: use npm undici@seven tag inupdate-undici.sh(Matteo Collina) #62739aa1e0bc28b] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828f2a1735ed9] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917b6378e215c](https://redirect.github.com/nodejs/Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.