Skip to content

chore(deps): update all non-major dependencies #2661

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update all non-major dependencies #2661

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 26, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update
@types/node (source) 24.10.9 → 24.10.13 age confidence devDependencies patch
github.com/alecthomas/chroma/v2 v2.23.0 → v2.23.1 age confidence require patch
github.com/puzpuzpuz/xsync/v4 v4.3.0 → v4.4.0 age confidence require minor
github.com/zeebo/xxh3 v1.0.2 → v1.1.0 age confidence require minor
go (source) 1.25.6 → 1.26.0 age confidence toolchain minor
go 1.25.x → 1.26.x age confidence uses-with minor
go.yaml.in/yaml/v4 v4.0.0-rc.3 → v4.0.0-rc.4 age confidence require patch
golang.org/x/term v0.39.0 → v0.40.0 age confidence require minor
golangci/golangci-lint v2.8.0 → v2.9.0 age confidence minor
netlify-cli 23.13.4 → 23.15.1 age confidence devDependencies minor
pnpm (source) 10.28.1+sha512.7d7dbbca9e99447b7c3bf7a73286afaaf6be99251eb9498baefa7d406892f67b879adb3a1d7e687fc4ccc1a388c7175fbaae567a26ab44d1067b54fcb0d6a316 → 10.29.3 age confidence packageManager minor
prettier (source) 3.8.0 → 3.8.1 age confidence devDependencies patch
vitepress-plugin-llms 1.10.0 → 1.11.0 age confidence devDependencies minor
vue (source) 3.5.27 → 3.5.28 age confidence devDependencies patch

Release Notes

alecthomas/chroma (github.com/alecthomas/chroma/v2)

v2.23.1

Compare Source

Changelog

puzpuzpuz/xsync (github.com/puzpuzpuz/xsync/v4)

v4.4.0

Compare Source

  • Micro-optimize Map for integer keys #​185
  • Add Map.RangeRelaxed method for faster map iteration #​187
  • Add Map.DeleteMatching method for batch entry deletion #​186

Read-heavy operations on Map with integer keys are now 24-29% faster due to a more efficient hash function, as well as a number of micro-optimizations.

RangeRelaxed is a much faster (~11x), lock-free alternative to Range. The downside is that the same key may be visited by RangeRelaxed more than once if it is concurrently deleted and re-inserted during the iteration. RangeRelaxed should be preferred over Range in all cases when weaker consistency is acceptable.

m := xsync.NewMap[string, int]()
m.Store("alice", 10)
m.Store("bob", 20)
m.Store("carol", 30)
m.Store("dave", 40)

// Iterate map entries and calculate sum of all values.
sum := 0
m.RangeRelaxed(func(key string, value int) bool {
	sum += value
	return true // continue iteration
})

DeleteMatching deletes all entries for which the delete return value of the input function is true. If the cancel return value is true, the iteration stops immediately. The function returns the number of deleted entries. The call locks a hash table bucket for the duration of evaluating the function for all entries in the bucket and performing deletions. It performs up to 20% faster than Range + Delete, yet if the percentage of the entries to-be-deleted is low, RangeRelaxed + Delete combination should be more efficient.

// Delete entries with value greater than 25.
deleted := m.DeleteMatching(func(key string, value int) (delete, cancel bool) {
	return value > 25, false
})
zeebo/xxh3 (github.com/zeebo/xxh3)

v1.1.0

Compare Source

golang/go (go)

v1.26.0

v1.25.7

actions/go-versions (go)

v1.26.0: 1.26.0

Compare Source

Go 1.26.0

yaml/go-yaml (go.yaml.in/yaml/v4)

v4.0.0-rc.4

Compare Source

golangci/golangci-lint (golangci/golangci-lint)

v2.9.0

Compare Source

Released on 2026-02-10

  1. Enhancements
    • 🎉 go1.26 support
  2. Linters new features or changes
    • arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)
    • ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)
    • golines: from 0.14.0 to 0.15.0
    • misspell: from 0.7.0 to 0.8.0
    • unqueryvet: from 1.4.0 to 1.5.3 (new options: check-n1, check-sql-injection, check-tx-leaks, allow, custom-rules)
    • wsl: from 5.3.0 to 5.6.0 (new rule: after-block)
  3. Linters bug fixes
    • modernize: from 0.41.0 to 0.42.0
    • prealloc: from 1.0.1 to 1.0.2
    • protogetter: from 0.3.18 to 0.3.20
  4. Misc.
    • Log information about files when configuration verification
    • Emit an error when no linters enabled
    • Do not collect VCS information when loading code
netlify/cli (netlify-cli)

v23.15.1

Compare Source

Bug Fixes

v23.15.0

Compare Source

Features
  • use site caps for AIG gating, add support to dev-exec and serve (#​7904) (f33a839)
Bug Fixes

v23.14.0

Compare Source

Features
Bug Fixes

v23.13.5

Compare Source

Bug Fixes
pnpm/pnpm (pnpm)

v10.29.3

Compare Source

v10.29.2

Compare Source

v10.29.1: pnpm 10.29.1

Compare Source

Minor Changes

  • The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
  • Support configuring auditLevel in the pnpm-workspace.yaml file #​10540.
  • Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #​10436.

Patch Changes

  • Fixed pnpm list --json returning incorrect paths when using global virtual store #​10187.

  • Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #​10290.

  • Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #​10497.

  • Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #​10176.

  • Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #​10281.

  • Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #​10460.

  • Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #​10540.

  • update tar to version 7.5.7 to fix security issue

    Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842

  • Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #​10325.

  • Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #​10271.

  • pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #​10561.

  • Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #​10457.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

  • Security fix: prevent path traversal in directories.bin field.

  • When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

    This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

    Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

  • Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite
prettier/prettier (prettier)

v3.8.1

Compare Source

okineadev/vitepress-plugin-llms (vitepress-plugin-llms)

v1.11.0

Compare Source

    🩹 Fixes
   💖 Contributors
     View changes on GitHub
vuejs/core (vue)

v3.5.28

Compare Source

Bug Fixes

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added area: dependencies Changes related to dependency files. lang: go Pull requests that update Go code. lang: javascript Pull requests that update Javascript code. labels Jan 26, 2026
@renovate
Copy link
Contributor Author

renovate bot commented Jan 26, 2026 •
edited
Loading

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/klauspost/cpuid/v2 v2.2.7 -> v2.2.10
golang.org/x/sys v0.40.0 -> v0.41.0

@renovate renovate bot added area: dependencies Changes related to dependency files. lang: go Pull requests that update Go code. lang: javascript Pull requests that update Javascript code. labels Jan 26, 2026
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from d26684c to a49a9fa Compare January 26, 2026 16:38
@andreynering
Copy link
Member

andreynering commented Jan 28, 2026

go.yaml.in/yaml/v4 has breaking changes. We need to figure it out how to adjust or if this is a bug on the package.

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 0769b7f to a3b9ece Compare February 5, 2026 00:44
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from 6fafee6 to 4ed7a13 Compare February 11, 2026 05:44
@renovate renovate bot added the area: github actions Pull requests that update GitHub Actions code label Feb 11, 2026
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 4ed7a13 to ba61686 Compare February 11, 2026 17:32
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from ba61686 to bf5a075 Compare February 12, 2026 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area: dependencies Changes related to dependency files. area: github actions Pull requests that update GitHub Actions code lang: go Pull requests that update Go code. lang: javascript Pull requests that update Javascript code.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@andreynering