Skip to content

chore(deps): update all dependencies#124

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies
Open

chore(deps): update all dependencies#124
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies

Conversation

@renovate

@renovate renovate Bot commented Mar 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@codspeed/vitest-plugin (source) 5.4.0 → 5.5.0 age confidence pnpm.catalog.default minor
@types/node (source) 25.9.1 → 25.9.2 age confidence pnpm.catalog.default patch 25.9.3
@vitest/coverage-istanbul (source) 4.1.7 → 4.1.8 age confidence pnpm.catalog.default patch
CodSpeedHQ/action v4.15.1 → v4.17.0 age confidence action minor v4.17.5
actions/checkout v6.0.2 → v6.0.3 age confidence action patch
aqua:anchore/syft 1.44.0 → 1.45.1 age confidence minor
aqua:aquasecurity/trivy 0.70.0 → 0.71.0 age confidence minor 0.71.1
aqua:astral-sh/uv 0.11.16 → 0.11.19 age confidence patch 0.11.21 (+1)
aqua:cli/cli 2.92.0 → 2.93.0 age confidence minor 2.94.0
aqua:crate-ci/typos 1.46.3 → 1.47.2 age confidence minor
electron 42.2.0 → 42.3.3 age confidence pnpm.catalog.default minor 42.4.0
github/codeql-action v4.36.0 → v4.36.2 age confidence action patch
github:EmbarkStudios/cargo-deny 0.19.7 → 0.19.8 age confidence patch
github:nextest-rs/nextest 0.9.136 → 0.9.137 age confidence patch
jdx/mise v2026.5.15 → v2026.6.0 age confidence minor v2026.6.5 (+4)
jdx/mise-action v4.0.1 → v4.1.0 age confidence action minor
node (source) 24.15.0 → 24.16.0 age confidence minor
npm:pnpm (source) 11.2.2 → 11.5.2 age confidence minor 11.6.0 (+1)
oxfmt (source) 0.51.0 → 0.53.0 age confidence pnpm.catalog.default minor 0.54.0
oxlint (source) 1.66.0 → 1.68.0 age confidence pnpm.catalog.default minor 1.69.0
pnpm (source) 11.2.2+sha512.36e6621fad506178936455e70247b8808ef4ec25797a9f437a93281a020484e2607f6a469a22e982987c3dbb8866e3071514ab10a4a1749e06edcd1ec118436f → 11.5.2 age confidence packageManager minor 11.6.0 (+1)
quay.io/pypa/manylinux_2_28 65f13b3 → 8ee7337 final digest
ruff (source, changelog) ==0.15.14 → ==0.15.16 age confidence dependency-groups patch 0.15.17
rust (source, changelog) nightly-2026-05-24 → nightly-2026-06-06 age confidence toolchain patch nightly-2026-06-13 (+6)
rustlang/rust nightly-2026-05-24 → nightly-2026-06-05 age confidence minor nightly-2026-06-12 (+3)
tsx (source) 4.22.3 → 4.22.4 age confidence pnpm.catalog.default patch
vite (source) 8.0.14 → 8.0.16 age confidence pnpm.catalog.default patch
vite-plugin-dts (source) 5.0.1 → 5.0.2 age confidence pnpm.catalog.default patch
vitest (source) 4.1.7 → 4.1.8 age confidence pnpm.catalog.default patch

Release Notes

CodSpeedHQ/codspeed-node (@​codspeed/vitest-plugin)

v5.5.0

Compare Source

Highlights

We are introducing @codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.

Here's an example usage, but head to the docs for more information

import { bench, type Page } from "@​codspeed/playwright-plugin";
import electronExecutable from "electron";
import path from "node:path";
import { fileURLToPath } from "node:url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const appRoot = path.resolve(__dirname, "..");

async function waitUntilSettled(page: Page): Promise<void> {
  await page.waitForFunction(() => {
    const main = document.getElementById("main");
    return !!main && !main.classList.contains("loading");
  });
}

await bench(
  "inbox-search-archive-threads",
  async ({ page }) => {
    await page.fill("#search", "update");
    await waitUntilSettled(page);

    await page.click("#select-visible-btn");
    await page.click("#archive-btn");
    await waitUntilSettled(page);

    await page.click('#sidebar nav button[data-view="threads"]');
    await waitUntilSettled(page);
  },
  {
    target: {
      kind: "electron",
      appPath: path.join(appRoot, "out/main/index.js"),
      cwd: appRoot,
    },
    beforeRound: async ({ page }) => {
      page.setDefaultTimeout(180_000);
      await page.waitForSelector("#main");
      await waitUntilSettled(page);
    },
  },
);

Note: this plugin is only compatible with the walltime instrument.

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0

vitest-dev/vitest (@​vitest/coverage-istanbul)

v4.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
CodSpeedHQ/action (CodSpeedHQ/action)

v4.17.0

Compare Source

Release Notes

🚀 Features
🐛 Bug Fixes
💼 Other
🏗️ Refactor
🧪 Testing
⚙️ Internals

Install codspeed-runner 4.17.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.17.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.17.0

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.15.1...v4.17.0

actions/checkout (actions/checkout)

v6.0.3

Compare Source

anchore/syft (aqua:anchore/syft)

v1.45.1

Compare Source

Bug Fixes

(Full Changelog)

v1.45.0

Compare Source

Added Features
Bug Fixes
Additional Changes

(Full Changelog)

aquasecurity/trivy (aqua:aquasecurity/trivy)

v0.71.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10767

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0710-2026-06-01

astral-sh/uv (aqua:astral-sh/uv)

v0.11.19

Compare Source

Released on 2026-06-03.

Python
Enhancements
  • Always compute SHA256 for remote distributions (#​19662)
  • Add PyEmscripten platform (PEP 783) (#​19629)
  • Add Pyodide 2025 target triple (#​19653)
Preview features
  • Make preview features for commands have names that aren't ambiguous with the command (#​19645)
  • Respect --isolated in uv check (#​19666)
Bug fixes
  • Continue tool uninstall after dangling receipts (#​19623)
  • Skip Unix-specific installation steps when cross-installing Windows Python distributions (#​19424)

v0.11.18

Compare Source

Released on 2026-06-01.

Performance
  • Fix performance regression in unzip of local wheels (#​19637)
Preview
Bug fixes
  • Update activation scripts with upstream fixes (#​19628)
Other changes

v0.11.17

Compare Source

Released on 2026-05-28.

Enhancements
  • Add a diagnostic for uv add with standard library modules (#​19572)
  • Expose uv workspace and its list subcommand in help output (#​19533)
  • Improve the "403 forbidden" hint to suggest ignore-error-codes when applicable (#​19521)
  • Skip direct URL lock freshness checks while offline (#​19596)
  • Add import-names and import-namespaces support to uv-build (PEP 794) (#​19380)
  • Add a --no-editable-package flag to various commands (#​19584)
  • Infer Python version requests from source trees in uv tool invocations (#​19577)
Preview features
  • Add module owners to uv workspace metadata (#​19122)
  • Do not allow uv venv --clear to remove non-virtual environments (#​19595)
Bug fixes
  • Improve the performance of large entries in tool.uv.conflicts (#​19538)
  • Avoid modifying the parent process' env with --env-file in uv run (#​19567)
  • Fix script environment creation for scripts with long filenames (#​19539)
  • Fix transitive Git archive dependencies in lockfiles (#​19589)
  • Preserve Git repository URLs in direct URL metadata (#​19590)
  • Support redirects in --check-url (#​19594)
  • Accept case-insensitive HTML tags in --find-links parsing (#​19537)
  • Reject duplicate script metadata blocks (#​19544)
  • Ban names like "python3" as script entry points (#​19535, #​19536)
  • Validate Git LFS artifacts for Git archives (#​19592)
  • Use a relative path when creating symlinks in cache to improve relocatability (#​19033)
Documentation
  • Fix malformed positional anchors in the CLI reference (#​19575)
cli/cli (aqua:cli/cli)

v2.93.0: GitHub CLI 2.93.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands.

Users are advised to update gh to version v2.93.0 as soon as possible.

For more information see: GHSA-8xvp-7hj6-mcj9

Support agents in gh secret command set

The gh secret command set can now set agent secrets. For more information, see "Configuring secrets and variables for Copilot cloud agent".

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.92.0...v2.93.0

crate-ci/typos (aqua:crate-ci/typos)

v1.47.2

Compare Source

Fixes
  • Don't correct inferrable
  • Correct unused inferible variant

v1.47.1

Compare Source

Fixes
  • Don't correct requestors

v1.47.0

Compare Source

Features
  • Updated the dictionary with the May 2026 changes
electron/electron (electron)

v42.3.3: electron v42.3.3

Compare Source

Release Notes for v42.3.3

Fixes

  • Fixed a crash when calling node:wasi functions with fast API calls enabled. #​51867
  • Improved external resize band positioning and scaling for frameless windows on Windows. #​51561 (Also in 41, 43)

Other Changes

  • Fixed silent data truncation in Buffer/TextEncoder APIs and a crash in fs.writeFileSync with non-ASCII strings on Apple Silicon. #​51849 (Also in 41, 43)
  • Improved app startup performance — the main process now boots from an embedded Node.js startup snapshot, framework bundles and preload scripts are cached as compiled V8 bytecode, and sandboxed renderer startup data is pushed ahead of navigation instead of fetched via blocking IPC. Preload stack traces now show the correct file path and line number. #​51831 (Also in 43)

v42.3.2: electron v42.3.2

Compare Source

Release Notes for v42.3.2

  • Fixed a crash in simdutf when processing strings in the main process

v42.3.1: electron v42.3.1

Compare Source

Release Notes for v42.3.1

Fixes

  • Fixed a desktopCapturer crash when sharing a window on Windows. #​51787

Other Changes

  • Enabled ThinLTO on macOS builds. #​51823 (Also in 43)
  • Improved performance of Linux and Windows release builds by enabling ThinLTO link-time optimization for the main Electron binary. #​51821 (Also in 43)
  • Improved performance of app.isDefaultProtocolClient() and app.setAsDefaultProtocolClient() on Linux. #​51627
  • Improved runtime performance. #​51828
  • Updated Chromium to 148.0.7778.218. #​51790

v42.3.0: electron v42.3.0

Compare Source

Release Notes for v42.3.0

Features

  • Added Linux support for app.getApplicationInfoForProtocol(). #​51680
  • Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. #​51691 (Also in 43)
  • Added session support to net module requests from utility process. #​51698

Fixes

  • Fixed an issue where process and other Node globals were undefined in ESM preload scripts when contextIsolation was disabled. #​51726 (Also in 43)
  • Fixed native addon compilation failure with undefined msvc intrinsic from v8 headers. #​51706 (Also in 43)

Other Changes

  • Updated Chromium to 148.0.7778.180. #​51600
github/codeql-action (github/codeql-action)

v4.36.2

Compare Source

v4.36.1

Compare Source

EmbarkStudios/cargo-deny (github:EmbarkStudios/cargo-deny)

v0.19.8

Compare Source

Fixed
  • PR#864 fixed matching of ^ and ~ with on prerelease versions for when checking if a crate is affected by an advisory. As of the time of the PR, this literally affected none of published versions of any crate with an advisory, but this just ensures such a case will be handled in the future.
nextest-rs/nextest (github:nextest-rs/nextest)

v0.9.137: cargo-nextest 0.9.137

Compare Source

Changed
  • CLI --help descriptions, configuration-reference docs, and JSON schema descriptions now use consistent language and voice. (#​3366)
Fixed
  • Filterset expressions like not(test(foo)), all()and(test(foo)), and all()or(test(foo)), where not, and, or or is immediately followed by an opening parenthesis, now parse correctly. Previously, a separating space was required. (#​3367)
jdx/mise (jdx/mise)

v2026.6.0: : Corepack-managed npm and aqua Windows parity

Compare Source

A focused release that wires npm into Corepack when requested, brings aqua's Windows extension handling in line with upstream, and fixes task include ordering plus a Git Bash cygdrive regression.

Added

  • (npm) Ensure npm itself is managed by Corepack when node.corepack=true and node.npm_shim=false, so the Corepack-managed npm shim is enabled alongside yarn/pnpm (#​10196 by @​roele).
  • (cli) New mise sponsors subcommand and a sponsor block on the docs site that lists sponsors fetche

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Mar 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package.json
Command failed: corepack use pnpm@11.5.2

@greptile-apps

greptile-apps Bot commented Mar 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Greptile Summary

This is a routine automated dependency update PR from Renovate Bot, bumping a wide range of dependencies across the stack: GitHub Actions (setup-node v6.3.0, mise-action v3.6.3, zizmor-action v0.5.2, codeql-action v4.32.6), Node.js packages (pnpm 10.32.1, vitest/vite 4.1.0/8.0.0 stable releases from beta, oxfmt, oxlint, undici, electron, node-addon-slsa), Rust crates (tempfile 3.27.0), Python tools (ruff, semgrep, pyrefly, zizmor), and various aqua-managed CLI tools (uv, gh, gitleaks, shfmt, nextest). All GitHub Action references continue to be pinned by full commit SHA, which is good practice for this repository.

  • Most changes are straightforward version bumps with no behavioral impact on the codebase itself.
  • Several beta versions (vitest, vite) graduate to stable releases — a positive change.
  • The packageManager field in package.json was updated to pnpm@10.32.1 but the SHA512 integrity hash that was present in the old value was dropped, removing Corepack's ability to verify the pnpm binary on download.

Confidence Score: 4/5

  • This PR is safe to merge; the only notable finding is a non-critical omission of the Corepack integrity hash for pnpm.
  • All changes are automated dependency bumps. GitHub Actions remain SHA-pinned, Dockerfile images are digest-pinned, and lock files are fully regenerated. The one notable point is the missing SHA512 hash in the packageManager field, which is a best-practice/supply-chain hygiene issue rather than an active vulnerability. Everything else is routine.
  • package.json — missing SHA512 hash in the packageManager field.

Important Files Changed

Filename Overview
package.json Updated pnpm to 10.32.1 but dropped the SHA512 integrity hash from the packageManager field, removing Corepack's ability to verify the binary's integrity on download.
Dockerfile Updated docker/dockerfile syntax to 1.22 and manylinux_2_28 base image to a new digest. Both references are pinned by SHA256. No issues found.
Cargo.lock Updated tempfile from 3.26.0 to 3.27.0 which pulls in getrandom 0.3.4 instead of 0.4.2, and resolves different windows-sys versions for various crates. Standard lock file update.
mise.toml Updated gitleaks, uv, gh CLI, nextest, and mvdan/sh (shfmt) to newer patch/minor versions. No issues found.
pyproject.toml Updated pyrefly, ruff, semgrep, and zizmor to newer versions. No issues found.
pnpm-workspace.yaml Updated catalog versions for @vitest/coverage-istanbul, electron, oxfmt, oxlint, undici, vite, and vitest from beta/older versions to stable releases. No issues found.

Comments Outside Diff (1)

  1. package.json, line 202 (link)

    P2 Missing Corepack integrity hash for pnpm

    The previous packageManager value included a +sha512 integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

    You can restore supply-chain integrity by running:

    corepack use pnpm@10.32.1

    This will update package.json with the correct hash for 10.32.1, e.g.:

    Consider asking Renovate to preserve the hash when bumping the packageManager field (the pinDigests option may help, or a custom packageRules entry targeting packageManager).

    Prompt To Fix With AI 
    This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:



Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.
Prompt To Fix All With AI 
This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:

```suggestion
  "packageManager": "pnpm@10.32.1+sha512.<hash-for-10.32.1>",
```

Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

Last reviewed commit: "Update all dependenc..."

@renovate renovate Bot force-pushed the renovate/all-dependencies branch 4 times, most recently from 1c2d5e5 to 40653e4 Compare March 22, 2026 02:03
github-advanced-security[bot]
github-advanced-security AI found potential problems Mar 22, 2026
View reviewed changes
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch from 40653e4 to 757f335 Compare March 22, 2026 04:59
github-advanced-security[bot]
github-advanced-security AI found potential problems Mar 22, 2026
View reviewed changes
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch from 757f335 to a2c2755 Compare March 22, 2026 21:02
github-advanced-security[bot]
github-advanced-security AI found potential problems Mar 22, 2026
View reviewed changes
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch from a2c2755 to 4501313 Compare March 23, 2026 01:45
github-advanced-security[bot]
github-advanced-security AI found potential problems Mar 23, 2026
View reviewed changes
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch 17 times, most recently from c433c4d to 7fe5e47 Compare March 27, 2026 13:13
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 19, 2026
View reviewed changes
Comment thread .github/workflows/release.yaml Fixed
Comment thread .github/workflows/release.yaml Fixed
@renovate renovate Bot force-pushed the renovate/all-dependencies branch 9 times, most recently from 5bce89e to 366fde0 Compare April 20, 2026 21:11
@codecov

codecov Bot commented Apr 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@renovate renovate Bot force-pushed the renovate/all-dependencies branch 9 times, most recently from e033171 to c00b714 Compare April 27, 2026 22:59
@renovate renovate Bot force-pushed the renovate/all-dependencies branch 6 times, most recently from 48dd3a8 to 5e27d67 Compare April 30, 2026 15:12
@codspeed-hq

codspeed-hq Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 15 untouched benchmarks

Comparing renovate/all-dependencies (a483481) with main (32fd41a)

Open in CodSpeed

@socket-security

socket-security Bot commented Jun 7, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@socket-security

socket-security Bot commented Jun 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​ruff@​0.15.14 ⏵ 0.15.16100100100100100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@github-advanced-security