chore(deps): update all non-major dependencies#44
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
1a1d065 to
3e331c9
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
3e331c9 to
2150d56
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
24.12.4→24.13.124.13.2v6.0.2→v6.0.32.34.58→2.34.632.35.4(+5)2.70.4→2.70.52.8.1→2.8.22.8.329.5.2→29.5.3v4.0.1→v4.1.00.136.0→0.137.00.139.0(+1)11.5.1→11.5.211.6.0(+1)11.5.1→11.5.211.6.0(+1)54.7.1→54.9.154.13.0(+9)4.96.0→4.98.04.100.0(+1)Release Notes
actions/checkout (actions/checkout)
v6.0.3Compare Source
aws/aws-cli (awscli)
v2.34.63Compare Source
v2.34.62Compare Source
v2.34.61Compare Source
v2.34.60Compare Source
v2.34.59Compare Source
twpayne/chezmoi (chezmoi)
v2.70.5Compare Source
Changelog
Documentation
1c53abddocs: Add links to articles50af2d3docs: Add link to articledenoland/deno (deno)
v2.8.2Compare Source
(#34536)
(#34417)
(#34662)
deno compile(#34527)@latestindeno addfor JSR packages(#32859)
(#34575)
(#34558)
(#34473)
(#34458)
(#34511)
(#34469)
(#34679)
silicon (#34561)
(#34718)
rejects it (#34686)
(#34696)
(#34661)
DENODIR (#34497)
ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING (#34427)
INIT_CWD (#34700)
deno ci(#34459)(#34483)
moduleResolution: "bundler"for npm dir imports (#34643)typeof import(...)hovers (#34565)(#34693)
(#34728)
Windows (#34655)
bindingsnative addon error(#34666)
(#34467)
(#34491)
(#32854)
(#34437)
docker/cli (docker-cli)
v29.5.3Compare Source
jdx/mise-action (jdx/mise-action)
v4.1.0: : automatic --locked installsCompare Source
This release adds automatic locked installs when a
mise.lockis present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.Added
Automatic
--lockedinstall whenmise.lockexists (#495) by @zeitlingerWhen a repo contains
mise.lock, the action now automatically passes--lockedtomise install(on mise versions that support it). This removes the need to manually setinstall_args: --lockedand preventsmise installfrom silently mutating the lockfile in CI. Explicitinstall_argsand older mise versions are still respected.Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating
mise.lockmid-run — this surfaces lockfile drift rather than hiding it.Fixed
macos15,ubuntu24for GitHub-hosted runners;self-hostedotherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's~/.local/share/mise/installs/*, causing failures likedoes not have an executable named '…'or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.mise-shim.exemissing on Windows (#476) by @risu729 — the action now installsmise-shim.exealongsidemise.exeand repairs restored caches that lack the shim. Fixes #475.Changed
Full Changelog: jdx/mise-action@v4.0.1...v4.1.0
openai/codex (npm:@openai/codex)
v0.137.0pnpm/pnpm (pnpm)
v11.5.2Compare Source
Patch Changes
Peer dependency resolution now reuses the peer contexts already recorded in the lockfile when those providers are still present in the dependency graph and still satisfy the peer ranges. This avoids unnecessary peer-context rewrites during lockfile regeneration. Current manifest choices remain authoritative: a newly added, explicitly updated, or aliased direct provider, a changed nested provider, or a locked version that no longer satisfies the range still takes precedence.
The lockfile verifier now checks that a registry entry pinning an explicit
tarballURL points at the artifact the registry's own metadata lists for thatname@version. Previously a tampered lockfile could pair a trustedname@versionwith an attacker-chosen tarball URL (and a matching integrity for those bytes), so the install fetched the attacker's bytes. A mismatch — or any entry that can't be confirmed against the registry — is rejected withERR_PNPM_TARBALL_URL_MISMATCH. Non-registry resolutions (file:, git-hosted, etc.) and registry entries without an explicit tarball URL (the URL is reconstructed from name+version+registry, so it is inherently bound) are unaffected; non-standard registry tarball URLs (npm Enterprise, GitHub Packages) still pass because they match the metadata.Fix
pnpm update --recursive --lockfile-only <pkg>@​<version>crashing withInvalid Versionwhen the catalog entry for<pkg>is a version range (e.g.^21.2.10) andcatalogModeisstrictorprefer. The catalog–version comparison now skips the equality check when either side is a range rather than passing a range tosemver.eq(), so range specifiers fall through to the existing mismatch handling instead of throwing #11570.Avoided a Node.js crash when pnpm exits after network requests on Windows.
Fixed packages being materialized into the virtual store without their root-level files (
package.json,LICENSE, README, root entrypoints) when multiplepnpm installprocesses ran against the same store/workspace concurrently. The fast import path used to destructively empty the shared target directory, so a concurrent importer could wipe files another importer had already written; if the surviving files included thepackage.jsoncompletion marker, every later install treated the broken directory as complete and never repaired it. The fast path now imports directly only when it can create the target directory exclusively, and otherwise builds the package in a private temp directory and atomically renames it into place #12197.Fix dependency build scripts not running under the global virtual store (
enableGlobalVirtualStore).In a workspace install, dependency build scripts are deferred to a single
rebuildpass (buildProjects). That pass resolved each package's location from the classicnode_modules/.pnpm/<depPathToFilename>layout, which does not exist under the global virtual store — so native dependencies (e.g. packages usingnode-gyp/prebuild-install) were never built and failed to load at runtime (Cannot find module .../build/Release/*.node).buildProjectsnow resolves the global-virtual-store projection directory (<storeDir>/links/<hash>, computed with the same graph hash the installer uses) whenenableGlobalVirtualStoreis set, and serializes concurrent builds of the same shared projection so parallel workspace projects don't race on the same directory.Don't promote a
runtime:dependency (such as the Node.js version fromdevEngines.runtimeorpnpm runtime set) into a catalog whencatalogModeisstrictorprefer. Aruntime:dependency round-trips todevEngines.runtime, which only recognizes theruntime:protocol; cataloging it rewrote the manifest entry tocatalog:, which broke that round-trip, stranded it indevDependencies, and leftdevEngines.runtimeuntouched.Skip lockfile
minimumReleaseAge/trustPolicyverification for non-registry tarball protocols (for examplefile:), so local tarball dependencies are not incorrectly checked against npm registry metadata.vercel/vercel (vercel)
v54.9.1Compare Source
Patch Changes
f5ab607: [evals] Shrink eval result uploads and fix run discoveryThe eval ingest transform (
transform-agent-eval-to-canonical.js) now excludes raw transcripts (transcript-raw.jsonl) from the--upload-artifacts allpath, roughly halving each ingest payload. The parsedtranscript.jsonis still uploaded and still read forresolvedModelsmetadata.It also normalizes provider-prefixed model paths before upload. Models that resolve to
provider/model(e.g.openai/gpt-5.5-pro) write results one directory deeper, pushing the timestamp past theexperiment/model/timestampshape the ingest endpoint discovers runs from, which previously failed withCould not discover any experiment/model/timestamp runs. The model is now collapsed to a single segment (openai-gpt-5.5-pro) so discovery succeeds.2b31813: Fixvc build --standalonefailing to zip Lambdas when run from a monoreposubdirectory. When dependencies are hoisted to the monorepo root (e.g. pnpm's
node_modules/.pnpm/...), the recorded function file paths could escape thefunction root (
../../node_modules/...), which later caused zipping to failwith
invalid relative path: ../../node_modules/.... These paths are nowre-anchored inside the function so the standalone output is self-contained.
252c6eb: [cli] Showclaiminvercel integration resource --helpThe
claimsubcommand was missing fromresourceSubcommand.subcommands, sovercel integration resource --helponly listedconnect,disconnect,remove, andcreate-threshold. The legacyvercel integration-resource --helpand the dispatcher's runtime resolution both already includedclaim— this was purely a help/discoverability gap on the canonical nested path. AddsclaimSubcommandto the subcommand list and updates the parent description accordingly.0a170fd: [services] wireexperimentalServicesV2intofs-detectors.Updated dependencies [
aeb5bfa]Updated dependencies [
0a170fd]v54.9.0Compare Source
Minor Changes
fb4fb2d: Add support for claiming sandbox marketplace resources (Stripe, Shopify) from the CLI.integration listshows a newClaimcolumn,integration-resource claim <name>opens the provider claim URL in the browser and polls until completion, andintegration addoffers to claim sandbox resources after provisioning with new--claim/--no-claimflags.Patch Changes
338cc35: Add isPackageInstalled util for detecting dependencies during build.Fix Vercel Flags dependency detection for emitting datafiles during builds with OIDC tokens.
338cc35]v54.8.0Compare Source
Minor Changes
fddeb55: Add configurable credentials storage handling across the CLI auth stack. Storage of credentials can be configured by the newcredStoragekey in globalconfig.jsonor the newVERCEL_TOKEN_STORAGEenvironment variable. The environment variable takes precedence over the configuration key. Accepted values arefile(store credentials inauth.json),keyring(store credentials in system keyring, e.g macOS Keychain or Secrets Service on Linux), andauto(try storing in keyring if available, fall back tofileif keyring is not available).@vercel/oidcsupports keyring-stored authentication credentials by delegating the OIDC minting to the CLI executable via@vercel/cli-exec.Patch Changes
a869874: [connect] Rename user-facing "client" references to "connector"Updates the
vercel connectCLI commands to use the official "connector" terminology in all user-facing surfaces: help text argument names (remove/attach/detach), usage strings in error messages, and the--format=jsonoutput key (clients→connectors) forvercel connect list.200aa3b: [connect] Forward--scopesand--installation-idinto the authorize/install recovery URLWhen
vercel connect tokenhits an action-required error (user_authorization_requiredorclient_installation_required), the CLI builds an authorize/install URL for the user to complete consent in the browser. Previously this URL carried onlyteamIdandrequest_code, dropping the--scopesand--installation-idthe user supplied. As a result the consent flow fell back to provider defaults (e.g. Slack'susers.profile:read), and the post-authorization token retry mismatched the requested scopes. The CLI now forwardsscopes(comma-joined) andinstallationIdas query params, which the authorize and install endpoints already accept.3019788: [services] Remove theservicesfield fromvercel.jsonand theVERCEL_USE_SERVICESgate.fe893ec: [services] AddexperimentalServicesV2field tovercel.jsonimplementing the new schema for services.d22d812: [cli] Nestintegration-resourceunderintegration resourceand addintegration resource connectThe marketplace resource subcommands (
disconnect,remove,create-threshold) are now discoverable undervercel integration resource <sub>. The standalonevercel integration-resourceandvc irforms still work as hidden aliases — no scripts or tests break.Adds a new
vercel integration resource connect <resource> [project]command (the inverse ofdisconnect). Accepts--environment(repeatable, defaults to all three),--prefixfor env var namespacing,--yes, and--format=json. Defaults to the project linked in the current directory when<project>is omitted.Tightens
disconnectto error (exit 1) when the specified project is not connected to the resource, instead of exiting 0 with a "not found" message.Both commands emit a structured
outputAgentErrorpayload withreason: confirmation_requiredand anext: [{command}]retry hint when run in non-interactive / agent mode without--yes. Whenconnectfails because an env var with the same name already exists on the target project, the error names the conflicting variable and suggests--prefixorvercel env rmas remediation.Updated dependencies [
3019788]Updated dependencies [
fe893ec]Updated dependencies [
fddeb55]cloudflare/workers-sdk (wrangler)
v4.98.0Compare Source
Minor Changes
#14089
c6c61b5Thanks @alsuren! - Addmigrations_patternto D1 database bindingsThe D1 binding now accepts an optional
migrations_patternfield, allowing you to pointwrangler d1 migrations applyandwrangler d1 migrations listat migration files in nested layouts (e.g. ORM-generated folders likemigrations/0000_init/migration.sql).migrations_patternis a glob (relative to the wrangler config file) and defaults to${migrations_dir}/*.sql, which preserves today's behaviour. Files that do not match the pattern are not executed.{ "d1_databases": [ { "binding": "DB", "database_name": "my-db", "database_id": "...", "migrations_dir": "migrations", "migrations_pattern": "migrations/*/migration.sql" } ] }When no migrations match the configured pattern but files matching the common
migrations/*/migration.sql(drizzle-style) layout do exist, Wrangler logs a hint suggestingmigrations_patternas an opt-in.wrangler d1 migrations createnow returns an actionable error if the generated migration filename would not match the configured pattern.#14153
7a6b1a4Thanks @dario-piotrowicz! - Generalizewrangler deployandwrangler versions uploadpositional argument from[script]to[path]Both
wrangler deployandwrangler versions uploadnow accept a generic[path]positional argument that can point to either a Worker entry-point file or a directory of static assets. The type is auto-detected. For example:wrangler deploy ./src/index.tsdeploys a Worker (same as before)wrangler deploy ./publicdeploys a static assets site (no interactive confirmation prompt)The
--scriptnamed option is now hidden and deprecated for both commands. It continues to work for backwards compatibility but only accepts file paths. Passing a directory to--scriptnow produces a clear error message suggesting the positionalpathargument or--assetsflag instead.#13863
3b8b80aThanks @aslakhellesoy! -getPlatformProxy()now passes through workflow bindings that have ascript_nameWorkflows without a
script_nameare still stripped (and warned about) because the engine for an internal workflow can't run inside the empty proxy worker that backsgetPlatformProxy(). Workflows with ascript_nameare handed to miniflare unchanged; miniflare reroutes the engine'sUSER_WORKFLOWbinding through the dev-registry-proxy when the target worker is running in another Miniflare instance — the same mechanism Durable Objects already use.This means SvelteKit/Remix (and similar split-process setups) can call
platform.env.MY_WORKFLOW.create({ ... })directly from their server-side request handlers in dev, as long as the workflow class is exposed by another worker registered in the dev registry.Closes #7459.
#14164
b502d54Thanks @G4brym! - Rename theweb_searchbinding kind towebsearchPre-launch rename of the public binding type from
web_searchtowebsearchso the on-the-wire shape matches the product name (Web Search). The wrangler config key, the binding-type string sent to the Cloudflare API, and the miniflare option key all move fromweb_search/webSearchtowebsearch.Update your wrangler config:
The runtime
WebSearchtype exposed onenv.WEBSEARCHis unchanged.Patch Changes
#14089
c6c61b5Thanks @alsuren! - Restore the D1executeSqllogger level via try/finallywrangler d1 execute --jsonand the internalexecuteSqlhelper temporarily lower the global logger to"error"to keep human-readable output out of the JSON payload. Previously the level was restored only on the happy path, so any early return or thrown error left the singleton logger muted, silencing laterlogger.warn/logger.logoutput (notably from migration helpers that wrapexecuteSqland are commonly mocked in tests).The level swap is now wrapped in
try/finallyso it is always restored.#14175
a3eea27Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
[#14121](htt
Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.