Skip to content

chore(deps): update dependencies - #39256

Open
GiteaBot wants to merge 1 commit into
mainfrom
renovate/dependencies
Open

chore(deps): update dependencies#39256
GiteaBot wants to merge 1 commit into
mainfrom
renovate/dependencies

Conversation

@GiteaBot

@GiteaBot GiteaBot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@​codemirror/search 6.7.1 → 6.7.2 age confidence dependencies patch
@​codemirror/state 6.7.1 → 6.7.2 age confidence dependencies patch 6.7.4 (+1)
@​codemirror/view 6.43.9 → 6.43.10 age confidence dependencies patch 6.43.11
@eslint/json 2.0.1 → 2.1.0 age confidence devDependencies minor
@types/node (source) 26.3.0 → 26.4.1 age confidence devDependencies minor
@typescript-eslint/parser (source) 8.68.0 → 8.69.0 age confidence devDependencies minor
crowdin/github-action v2.17.1 → v3.0.1 age confidence action major v3.0.2
docker/setup-qemu-action v4.2.0 → v4.3.0 age confidence action minor
eslint-plugin-unicorn 73.0.0 → 74.0.0 age confidence devDependencies major
github.com/PuerkitoBio/goquery v1.12.0 → v1.13.0 age confidence require minor
github.com/aws/aws-sdk-go-v2/credentials v1.19.38 → v1.20.2 age confidence require minor v1.20.3
github.com/aws/aws-sdk-go-v2/service/codecommit v1.38.3 → v1.41.0 age confidence require minor v1.42.0
github.com/getkin/kin-openapi v0.147.0 → v0.149.0 age confidence require minor
github.com/go-webauthn/webauthn v0.17.4 → v0.18.0 age confidence require minor
github.com/golangci/golangci-lint/v2 v2.13.1 → v2.13.2 age confidence patch
github.com/google/go-github/v89 v89.0.0 → v90.0.0 age confidence require major v91.0.0
github.com/yuin/goldmark v1.8.5 → v2.0.0 age confidence require major v2.0.1
gitlab.com/gitlab-org/api/client-go/v2 v2.59.1 → v2.61.0 age confidence require minor v2.64.0 (+2)
globals 17.11.0 → 17.12.0 age confidence devDependencies minor
js-yaml 5.4.0 → 5.4.1 age confidence dependencies patch
katex (source) 0.18.4 → 0.18.5 age confidence dependencies patch 0.18.7 (+1)
linguist-languages 9.4.0 → 9.5.0 age confidence devDependencies minor
modernc.org/sqlite v1.57.0 → v1.58.0 age confidence require minor
pnpm (source) 11.24.0 → 12.2.1 age confidence packageManager major 12.3.4 (+4)
renovatebot/github-action v46.2.4 → v46.2.5 age confidence action patch v46.2.6
spectral-cli-bundle 1.0.11 → 1.0.12 age confidence devDependencies patch
typescript-eslint (source) 8.68.0 → 8.69.0 age confidence devDependencies minor
vue (source) 3.5.41 → 3.5.42 age confidence dependencies patch
zizmor (source) ==1.29.0 → ==1.30.0 age confidence dependency-groups minor

Release Notes

eslint/json (@​eslint/json)

v2.1.0

Compare Source

Features
  • treat hexadecimal literals as integers in no-unsafe-values (#​267) (8d76ca7)
Bug Fixes
  • allow additional properties in JSONLanguageOptions (#​271) (7046bd8)
  • type compatibility issue between JSON v2 and ESLint v9 (#​248) (b9643c5)
typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.69.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

crowdin/github-action (crowdin/github-action)

v3.0.1

Compare Source

What's Changed

Full Changelog: crowdin/github-action@v3.0.0...v3.0.1

v3.0.0

Compare Source

Crowdin GitHub Action v3 runs on Crowdin CLI 5 🚀 - a complete rewrite that starts instantly and no longer requires Java. Your workflows, crowdin.yml configuration, and exit codes stay the same, so most setups upgrade with a one-line change:

-uses: crowdin/github-action@v2
+uses: crowdin/github-action@v3

Breaking changes

Only relevant if you pass custom CLI arguments via the command, command_args, or other *_args inputs:

  • pre-translate is now auto-translate (no alias); --translate-untranslated-only was removed - use --scope.
  • --plain was removed - use --output plain.
  • Redundant negatable flags were removed (e.g. --auto-update; --no-auto-update stays) - defaults are unchanged, simply drop them.

v3

Compare Source

docker/setup-qemu-action (docker/setup-qemu-action)

v4.3.0

Compare Source

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

sindresorhus/eslint-plugin-unicorn (eslint-plugin-unicorn)

v74.0.0

Compare Source

Improvements

PuerkitoBio/goquery (github.com/PuerkitoBio/goquery)

v1.13.0

Compare Source

Performance improvements and new top-level goquery.Text function to extract text from a selection with more control than the sel.Text jquery-like method.

getkin/kin-openapi (github.com/getkin/kin-openapi)

v0.149.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.148.0...v0.149.0

v0.148.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.147.0...v0.148.0

go-webauthn/webauthn (github.com/go-webauthn/webauthn)

v0.18.0

Compare Source

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has
added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum
Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int MIGRATION.md as they are substantial between
ths version and prior versions.

Bug Fixes
Features
BREAKING CHANGES
  • protocol: A credential response whose id and rawId disagree, or which omits rawId, is rejected. Registration previously accepted both, since the credential record is built from the attested credential id and nothing read the client's value.
  • An IP address configured as a relying party id is
    rejected, so a Config carrying one now fails validation.
  • HasherFromCOSEAlg returns (hash.Hash, bool) and no
    longer substitutes SHA-256 for an unregistered algorithm. Callers must
    handle the second value.
  • webauthncose: A stored credential whose OKP key names an algorithm
    other than -8 or -19 no longer parses, failing the assertion rather than
    verifying with Ed25519.
  • The rpOpaqueOrigins parameter has been added to protocol.CollectedClientData.Verify, protocol.ParsedCredentialCreationData.Verify and protocol.ParsedCredentialAssertionData.Verify, immediately after the existing rpOrigins parameter; callers which accept no opaque origins should pass nil. The webauthn.ConfigProvider interface has also gained a GetOpaqueOrigins method which implementations outside this module must provide.
  • RegistrationOption and LoginOption now return an error, so any option implemented outside this module must be adjusted, and WithExtensions and WithAssertionExtensions accept extension options in place of a map. protocol.AuthenticationExtensions and protocol.AuthenticationExtensionsClientOutputs are structs rather than map[string]any, protocol.Extensions is removed, and ParsedPublicKeyCredential.GetAppID takes a protocol.SessionExtensions. SessionData.Extensions changes both its type and its encoded representation, so a session persisted by an earlier version cannot be decoded by this one, and a client extension output the Relying Party did not request now fails the ceremony unless Config.ExtensionsUnsolicitedOutputPolicy says otherwise.
  • protocol: ConfigProvider requires GetSignaturePolicy. AttestationObject.Verify, AttestationObject.VerifyAttestation, ParsedCredentialAssertionData.Verify, ParsedCredentialCreationData.Verify, Credential.Verify, Credential.VerifyAttestationType and the attestation format validation handler registered by RegisterAttestationFormat take a SignaturePolicy. AttestationPolicy no longer carries a Signature member and webauthncose.SetExperimentalInsecureAllowBERIntegers is removed.
  • protocol: AttestationObject.Verify and AttestationObject.VerifyAttestation take an AttestationPolicy, and ConfigProvider requires GetAttestationPolicy.
  • metadata: Statement.CredentialExportProtocolConfigURL and its JSON counterpart are now named CredentialExchangeConfigURL, matching the credential exchange terminology the specification uses.
  • metadata: the desired statuses given to ValidateStatusReports are now a
    set of acceptable current statuses rather than a set which must all appear
    somewhere in the report history.
  • metadata: StatusReport.EffectiveDate and BiometricStatusReport.EffectiveDate are now *time.Time so an absent date is distinguishable from a zero value.
golangci/golangci-lint (github.com/golangci/golangci-lint/v2)

v2.13.2

Compare Source

Released on 2026-08-28

  1. Bug fixes
    • Decrease cache entropy
  2. Linters bug fixes
    • iface: from 1.5.0 to 1.5.1
    • staticcheck: from 0.8.0 to 0.8.1
    • unparam: from 3f964bc to 2fa3d84
    • canonicalheader: from v1.1.2 to a temporary fork
google/go-github (github.com/google/go-github/v89)

v90.0.0

Compare Source

This release contains the following breaking API changes:

  • refactor!: Pass UpdateConnectedExternalGroup request body by value via new UpdateConnectedExternalGroupRequest (#​4425)
    BREAKING CHANGE: TeamsService.UpdateConnectedExternalGroup now takes UpdateConnectedExternalGroupRequest (with non-pointer GroupID) by value.
  • refactor!: Rename PullRequestReviewDismissalRequest to PullRequestDismissReviewRequest, add PullRequestSubmitReviewRequest, and pass review request bodies by value (#​4406)
    BREAKING CHANGE: PullRequestReviewDismissalRequest is now PullRequestDismissReviewRequest with non-pointer Message and PullRequestsService.DismissReview takes it by value; PullRequestsService.SubmitReview now takes a new PullRequestSubmitReviewRequest.
  • refactor!: Split CreateOrUpdateCustomRepoRoleOptions into CreateCustomRepoRoleRequest and UpdateCustomRepoRoleRequest and pass by value (#​4401)
    BREAKING CHANGE: CreateOrUpdateCustomRepoRoleOptions is split into CreateCustomRepoRoleRequest (with non-pointer Name and BaseRole) and UpdateCustomRepoRoleRequest; OrganizationsService.CreateCustomRepoRole and UpdateCustomRepoRole now take these request types by value.
  • refactor!: Rename EditLabel to UpdateLabel, Split Label into CreateLabelRequest & UpdateLabelRequest and pass by value (#​4400)
    BREAKING CHANGE: IssuesService.CreateLabel now takes CreateLabelRequest by value (with required non-pointer Name); IssuesService.EditLabel renamed to UpdateLabel, taking an UpdateLabelRequest by value.
  • refactor!: Rename AutolinkOptions to CreateAutolinkRequest, AddAutolink to CreateAutolink, and pass the body by value (#​4399)
    BREAKING CHANGE: AutolinkOptions is now CreateAutolinkRequest with non-pointer KeyPrefix and URLTemplate; RepositoriesService.AddAutolink is now CreateAutolink and passes body by value.
  • refactor!: Split IssueRequest into CreateIssueRequest & UpdateIssueRequest and pass by value (#​4396)
    BREAKING CHANGE: IssueService.Edit is renamed to IssueService.Update.
  • refactor!: Rename NewPullRequest to CreatePullRequest and pass it by value (#​4395)
    BREAKING CHANGE: NewPullRequest is renamed to CreatePullRequest, PullRequests.Create now takes it by value, and CreatePullRequest.Head and CreatePullRequest.Base are now string.
  • refactor!: Pass SarifAnalysis by value (#​4394)
    BREAKING CHANGE: CodeScanningService.UploadSarif now takes body by value and its required fields are no longer pointers.
  • refactor!: Pass CreateDeploymentBranchPolicyRequest and UpdateDeploymentBranchPolicyRequest by value (#​4382)
    BREAKING CHANGE: RepositoriesService.CreateDeploymentBranchPolicy and UpdateDeploymentBranchPolicy now take body by value and the required Name field is of type string.
  • refactor!: Pass TemplateRepoRequest by value in Repositories.CreateFromTemplate (#​4378)
    BREAKING CHANGE: RepositoriesService.CreateFromTemplate now passes body by value and Name is now required and passed by value.
  • refactor!: Pass RepositoryMergeRequest and RepoMergeUpstreamRequest by value (#​4372)
    BREAKING CHANGE: RepositoriesService.Merge and RepositoriesService.MergeUpstream now pass body by value and required struct fields are now values.
  • feat!: Refactor dependabot secrets to pass request by value (#​4348)
    BREAKING CHANGE: DependabotService methods involving secrets have new params and return values.

...and the following additional changes:

  • chore: Bump version of go-github to v90.0.0 (#​4428)
  • docs: Clarify assisted contribution expectations (#​4427)
  • feat: Add org level secret scanning custom patterns support (#​4426)
  • feat: Add MetaService.ListAPIVersions (#​4422)
  • feat: Add DeleteCodeQLDatabase for code scanning (#​4421)
  • feat: Add Stack field to PullRequest for stacked pull requests (#​4423)
  • build: Bump GitHub workflow action versions (#​4424)
  • feat: Add search_type support to issue search (#​4414)
  • chore: Update SecurityAdvisory structs with new fields (#​4413)
  • chore: Consolidate Dependabot PRs (#​4418)
  • feat: Support OIDC custom property claims for Actions (#​4411)
  • feat: Add repo-level secret scanning custom patterns support (#​4397)
  • chore: Update openapi_operations.yaml (#​4412)
  • chore: Fix comment typo (#​4410)
  • chore: Update dependabot changes (#​4405)
  • chore: Update openapi_operations.yaml (#​4398)
  • feat: Add remaining Projects v2 endpoints (#​4319)
  • chore: Update Dependabot-driven dependencies (#​4393)
  • chore: Bump /example dependencies (#​4380)
  • chore: Fix flaky tests with deterministic runs (#​4377)
  • build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0 in /tools (#​4376)
  • chore: Fix flaky unit test (#​4374)
  • fix: Enable submitting empty allowlist for actions permissions patterns (#​4371)
  • feat: Add GitHub App Enterprise perm scope (#​4343)
  • chore: Bump go-github from v88 to v89 in /scrape (#​4370)
yuin/goldmark (github.com/yuin/goldmark)

v2.0.0

Compare Source

  • initial official release of v2

v1.8.6

Compare Source

gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)

v2.61.0

Compare Source

2.61.0

🚀 Features
  • feat: add Dependency Firewall ecosystems (composer, conan, golang, nuget, cargo, swift, pub) (!3016) by Michael Eddington
🔄 Other Changes

2.61.0 (2026-08-31)

Bug Fixes
  • satisfy golangci-lint 2.13.1 (6ed574d)
Features
  • add Dependency Firewall ecosystems (composer, conan, golang, nuget, cargo, swift, pub) (7cd7b90)

v2.60.0

Compare Source

2.60.0

🚀 Features

2.60.0 (2026-08-26)

Features
  • add Dependency Firewall package evaluation endpoint (b76c955)
sindresorhus/globals (globals)

v17.12.0

Compare Source

nodeca/js-yaml (js-yaml)

v5.4.1

Compare Source

Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
    CPU usage, #​797.
KaTeX/KaTeX (katex)

v0.18.5

Compare Source

Bug Fixes
ikatyang-collab/linguist-languages (linguist-languages)

v9.5.0: Release 9.5.0

Compare Source

cznic/sqlite (modernc.org/sqlite)

v1.58.0

Compare Source

pnpm/pnpm (pnpm)

v12.2.1: pnpm 12.2.1

Compare Source

Patch Changes

  • Restored the pnpm executable target without a file extension so pnpm 12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems.

Platinum Sponsors

Bit OpenAI Notion

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx Latitude

v12.2.0: pnpm 12.2

Compare Source

Minor Changes

  • Catalogs can now resolve workspace dependencies through the workspace: protocol.

Patch Changes

  • Fixed pnpm audit --fix failing with ERR_PNPM_INVALID_FIX_OPTION when used without a value, including when another flag follows it, as in pnpm audit --fix --json #​13261. Fixed pnpm audit --fix=override ignoring the saveExact and savePrefix settings when writing vulnerability overrides #​11523.

  • Authenticate Node.js runtime downloads from nodeDownloadMirrors with URL-scoped npm registry credentials, including bearer token

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@GiteaBot GiteaBot added dependencies lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Sep 7, 2026
@GiteaBot

GiteaBot commented Sep 7, 2026

Copy link
Copy Markdown
Collaborator Author

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Error: ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS

  × The following settings in pnpm-workspace.yaml are not recognized by this
  │ version of pnpm: "confirmModulesPurge" (a pnpm v11 setting).
  help: The project pins pnpm to a version the running pnpm satisfies, so
        these settings cannot be meant for a different pnpm version. Remove
        them from pnpm-workspace.yaml or fix their spelling.
File name: undefined
Command failed: make svg
Error: ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE

  × resolve package manager dependencies
  ╰─▶ Cannot update packageManagerDependencies with "frozen-lockfile" because
      the lockfile is not up to date

make: *** [Makefile:593: node_modules] Error 1
File name: undefined
Command failed: make generate-codemirror-languages
Error: ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE

  × resolve package manager dependencies
  ╰─▶ Cannot update packageManagerDependencies with "frozen-lockfile" because
      the lockfile is not up to date

make: *** [Makefile:593: node_modules] Error 1

@github-actions github-actions Bot added the skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features. label Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@GiteaBot