Skip to content

ci: synced file(s) with EWA-Services/EWA-Actions - #1

Merged
jai merged 1 commit into
mainfrom
sync_workflow_files/default
Aug 11, 2026
Merged

ci: synced file(s) with EWA-Services/EWA-Actions#1
jai merged 1 commit into
mainfrom
sync_workflow_files/default

Conversation

@finn-devops

@finn-devops finn-devops commented Aug 11, 2026

Copy link
Copy Markdown

synced local file(s) with EWA-Services/EWA-Actions.

Checklist

  • I have provided a clear description of the work in this PR (what and why)

Description

Sync shared workflow files from EWA-Actions to keep downstream repositories aligned with approved CI/CD standards.

AI Assistance

Why not AI-assisted

This sync PR is generated by EWA-Actions automation without AI assistance.

This PR was created automatically by the repo-file-sync-action workflow run #31474731088

@finn-devops finn-devops added automerge Allow Bulldozer to auto merge this PR not-ai-assisted labels Aug 11, 2026
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

PR Description Validation Report

👤 Author: finn-devops

🤖 Account Type: Automation

Layout Requirement:
🤖 Strict layout check skipped for automation account

Checkbox Requirement:
✅ Checkbox requirement met (Found: 1/1 required)

🤖 Linear ticket check skipped for automation account

✅ All validation checks passed!

@jai
jai merged commit ad367a0 into main Aug 11, 2026
18 checks passed
@jai
jai deleted the sync_workflow_files/default branch August 11, 2026 08:58
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@jemiahw @bhargavms
perf(relay): index channel-id lookups and skip trace-only reads (bloc…
27a07ff 
…k#4647)

## Problem

`SELECT id, community_id FROM channels WHERE id = ANY($1) AND deleted_at
IS NULL` is the top **Load by waits (AAS)** on the Buzz Postgres writer.
Two independent causes compound, and both are fixed here.

### 1. No index can serve it

`channels` is `PRIMARY KEY (community_id, id)`, and every secondary
index leads with `community_id`:

| Index | Columns |
|---|---|
| *(primary key)* | `(community_id, id)` |
| `idx_channels_nip29_group` | `(community_id, nip29_group_id)` |
| `idx_channels_dm_hash` | `(community_id, participant_hash)` |
| `idx_channels_community_type` | `(community_id, channel_type)` |
| `idx_channels_community_visibility` | `(community_id, visibility)` |
| `idx_channels_created_by` | `(community_id, created_by)` |
| `idx_channels_ttl_expiry` | `(ttl_deadline)` *(partial)* |

The two tenant-independent lookups carry **no `community_id` predicate**
— deliberately:

- `Db::communities_of_channels` — `WHERE id = ANY($1) AND deleted_at IS
NULL`
- `Db::community_of_channel` — `WHERE id = $1 AND deleted_at IS NULL`

That independence is load-bearing, not an oversight: projecting a row's
*true* owning community regardless of the fetch query's `WHERE` clause
is what makes `Inv_NonInterference` non-vacuous. If the fetch ever
dropped its tenant scoping, this lookup would still report the real
label and the checker would catch the mismatch.

But a composite btree is only usable when its leading column is
constrained, so neither query can use the primary key, and nothing else
leads with `id`. **Both sequentially scan `channels` on every call.**

### 2. In production the result is discarded

Both call sites feed `record_read_message_rows` /
`record_read_by_id_rows`, which call `tracer.record(...)`. Production
binds `NoopTracer` (`crates/buzz-relay/src/state.rs`), whose `record`
body is empty.

The existing guard tests `trace_state`, which is `Some` for every
well-formed request — it only goes `None` on malformed pubkey bytes. So
the scan ran on the hot read path and its output was dropped. This is
the classic eager-argument bug: `log.debug("..." + expensiveCall())`
with no `isDebugEnabled()` check.

### 3. Multiplied per filter

The non-search call site sits **inside the phase-3 per-filter loop**, so
a `REQ` carrying N filters performed N sequential scans of `channels`
before responding.

## Changes

**`Tracer::enabled()`** — a capability check on the trait (the
`isDebugEnabled()` of this seam), defaulting to `true`. `NoopTracer`
overrides it to `false`, and both emitters in `req.rs` now gate on it,
skipping the trace-only DB read entirely in production.

**`migrations/0027_channels_id_lookup_index.sql`**

```sql
CREATE INDEX IF NOT EXISTS idx_channels_id_live
    ON channels (id) INCLUDE (community_id)
    WHERE deleted_at IS NULL;
```

- `INCLUDE (community_id)` — both queries select exactly `(id,
community_id)`, so this is covering and can be served index-only.
- Partial on `deleted_at IS NULL` — matches both predicates exactly,
excludes soft-deleted history, and lets Postgres skip the recheck.
- **Not `UNIQUE`.** `id` alone is *not* unique in this table —
`command_executor.rs` documents that `community_of_channel(channel_id)`
is ambiguous because the same channel id can appear under more than one
community. A unique index would encode a false constraint and fail to
build on any database already holding such a pair.

Worth keeping the index even though fix #1 removes the production
caller: it still runs under conformance, and `community_of_channel` has
the same problem on its own paths.

**`schema/schema.sql`** — mirrored, since a test asserts desired-state
parity.

## Conformance is unchanged

This is the part worth reviewing closely. Under a real tracer
`enabled()` returns `true` and **every emit happens exactly as before**
— the gate only skips *building* emit inputs when nothing observes them,
never an emit that would otherwise have been made. The coverage-breach
guard stays non-vacuous.

`CountingTracer` forwards `enabled()` to its inner tracer rather than
inheriting the `true` default. Both directions matter and both fail
silently:

- inheriting `true` over a `NoopTracer` would keep the overhead this PR
removes;
- hardcoding `false` over a live tracer would suppress the emits whose
absence `EmitGuard` reports as `ImplBug` — masking real breaches behind
expected ones.

Covered by a new regression test,
`counting_tracer_delegates_enabled_to_inner`, which asserts delegation
in both directions.

## Verification

- `cargo check -p buzz-conformance -p buzz-relay` — clean
- `cargo clippy --all-targets` — clean, zero warnings
- `cargo test -p buzz-conformance` — 6/6
- `cargo test -p buzz-relay --lib conformance` — 11/11
- `cargo test -p buzz-db --lib migration` — 7/7
- `just test-unit` (pre-push) — green

Migration-count assertions in `crates/buzz-db/src/migration.rs` were
bumped 26 → 27, with content assertions for 0027 following the existing
per-migration pattern (including a guard that it never becomes
`UNIQUE`).

## Open questions for reviewers

1. **Lock strategy.** Built *without* `CONCURRENTLY`, following
migration 0004's precedent, because sqlx runs each migration inside a
transaction and `CREATE INDEX CONCURRENTLY` cannot run in one. This
takes a brief `SHARE` lock on `channels` (blocks writes, not reads) —
small relative to `events`, but an operator preferring zero
write-blocking can pre-build it by hand and `IF NOT EXISTS` makes the
migration a no-op. I could not confirm whether sqlx 0.9 supports a `--
no-transaction` directive; if it does, that may be preferable.

2. **Diagnosis is static.** This comes from reading the source, not from
`EXPLAIN` against the live database. Worth confirming with `EXPLAIN
(ANALYZE, BUFFERS)` on the writer before/after — that also sizes the win
by revealing the real table size and row counts.

3. **Expected impact** scales with average filters-per-`REQ`, which I
did not measure. `pg_stat_statements` ordered by `total_exec_time` would
confirm this query drops off the top and show whether anything else is
scanning the same way.

Signed-off-by: Jemiah Westerman <jemiah@squareup.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update rust crate clap to v4.6.6 (block#4465)
78a76eb 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [clap](https://github.com/clap-rs/clap) | dependencies |
patch | `4.6.1` → `4.6.6` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>clap-rs/clap (clap)</summary>

###
[`v4.6.6`](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.5...clap_complete-v4.6.6)

[Compare
Source](https://github.com/clap-rs/clap/compare/v4.6.5...v4.6.6)

###
[`v4.6.5`](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.4...clap_complete-v4.6.5)

[Compare
Source](https://github.com/clap-rs/clap/compare/v4.6.4...v4.6.5)

###
[`v4.6.4`](https://github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#464---2026-07-21)

[Compare
Source](https://github.com/clap-rs/clap/compare/v4.6.3...v4.6.4)

##### Internal

- Update to syn v3

###
[`v4.6.3`](https://github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#463---2026-07-20)

[Compare
Source](https://github.com/clap-rs/clap/compare/v4.6.2...v4.6.3)

##### Fixes

- *(derive)* Allow `"literal".function()` as attribute values

###
[`v4.6.2`](https://github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#462---2026-07-15)

[Compare
Source](https://github.com/clap-rs/clap/compare/v4.6.1...v4.6.2)

##### Fixes

- *(help)* Say `alias` when there is only one

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4xMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update rust crate async-compression to v0.4.43 (block#4456)
238e6c2 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[async-compression](https://github.com/Nullus157/async-compression)
| dependencies | patch | `0.4.42` → `0.4.43` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>Nullus157/async-compression (async-compression)</summary>

###
[`v0.4.43`](https://github.com/Nullus157/async-compression/releases/tag/async-compression-v0.4.43)

[Compare
Source](https://github.com/Nullus157/async-compression/compare/async-compression-v0.4.42...async-compression-v0.4.43)

##### Other

- Fix hang when decoding a corrupt subsequent zstd frame
([#&#8203;470](https://github.com/Nullus157/async-compression/pull/470))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4xMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update rust crate diffy to v0.5.1 (block#4466)
877aee1 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [diffy](https://github.com/bmwill/diffy) | dependencies |
patch | `0.5.0` → `0.5.1` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>bmwill/diffy (diffy)</summary>

###
[`v0.5.1`](https://github.com/bmwill/diffy/blob/HEAD/CHANGELOG.md#051---2026-07-18)

[Compare
Source](https://github.com/bmwill/diffy/compare/0.5.0...0.5.1)

##### Fixed

- [#&#8203;85](https://github.com/bmwill/diffy/pull/85)
  Merge conflict markers are now always placed on their own lines.
  Previously, a conflicting hunk at the end of a file without a trailing
  newline glued the next marker onto its last content line, producing
  unparseable output. This matches `git merge-file --diff3` behavior.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update rust crate async-trait to v0.1.91 (block#4458)
e549a17 
This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [async-trait](https://github.com/dtolnay/async-trait) |
dependencies | patch | `0.1.89` → `0.1.91` | `0.1.92` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>dtolnay/async-trait (async-trait)</summary>

###
[`v0.1.91`](https://github.com/dtolnay/async-trait/compare/0.1.90...0.1.91)

[Compare
Source](https://github.com/dtolnay/async-trait/compare/0.1.90...0.1.91)

###
[`v0.1.90`](https://github.com/dtolnay/async-trait/releases/tag/0.1.90)

[Compare
Source](https://github.com/dtolnay/async-trait/compare/0.1.89...0.1.90)

- Update to syn 3

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4xMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update rust crate arc-swap to v1.9.2 (block#4448)
8f0230f 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [arc-swap](https://github.com/vorner/arc-swap) | dependencies
| patch | `1.9.1` → `1.9.2` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>vorner/arc-swap (arc-swap)</summary>

###
[`v1.9.2`](https://github.com/vorner/arc-swap/blob/HEAD/CHANGELOG.md#192)

- Document RefCnt must not panic
([#&#8203;208](https://github.com/vorner/arc-swap/issues/208)).

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update rust crate anyhow to v1.0.104 (block#4447)
e189104 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [anyhow](https://github.com/dtolnay/anyhow) | dependencies |
patch | `1.0.103` → `1.0.104` |
| [anyhow](https://github.com/dtolnay/anyhow) |
workspace.dependencies | patch | `1.0.103` → `1.0.104` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>dtolnay/anyhow (anyhow)</summary>

###
[`v1.0.104`](https://github.com/dtolnay/anyhow/releases/tag/1.0.104)

[Compare
Source](https://github.com/dtolnay/anyhow/compare/1.0.103...1.0.104)

- Update `syn` dev-dependency to version 3

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update all non-major dependencies (block#3049)
4d5cd89 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) | Type |
Update |
|---|---|---|---|---|---|
|
[@isomorphic-git/lightning-fs](https://github.com/isomorphic-git/lightning-fs)
| [`4.6.2` →
`4.6.3`](https://renovatebot.com/diffs/npm/@isomorphic-git%2flightning-fs/4.6.2/4.6.3)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@isomorphic-git%2flightning-fs/4.6.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@isomorphic-git%2flightning-fs/4.6.2/4.6.3?slim=true)
| dependencies | patch |
|
[@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/main/packages/plugin-react#readme)
([source](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react))
| [`6.0.3` →
`6.0.5`](https://renovatebot.com/diffs/npm/@vitejs%2fplugin-react/6.0.3/6.0.5)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitejs%2fplugin-react/6.0.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitejs%2fplugin-react/6.0.3/6.0.5?slim=true)
| devDependencies | patch |
|
[@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/main/packages/plugin-react#readme)
([source](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react))
| [`6.0.3` →
`6.0.5`](https://renovatebot.com/diffs/npm/@vitejs%2fplugin-react/6.0.3/6.0.5)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitejs%2fplugin-react/6.0.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitejs%2fplugin-react/6.0.3/6.0.5?slim=true)
| dependencies | patch |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) |
`v4.0.2` → `v4.0.3` |
![age](https://developer.mend.io/api/mc/badges/age/github-tags/dorny%2fpaths-filter/v4.0.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/dorny%2fpaths-filter/v4.0.2/v4.0.3?slim=true)
| action | patch |
| [isomorphic-git](https://isomorphic-git.org/)
([source](https://github.com/isomorphic-git/isomorphic-git)) |
[`1.38.7` →
`1.38.10`](https://renovatebot.com/diffs/npm/isomorphic-git/1.38.7/1.38.10)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/isomorphic-git/1.38.10?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/isomorphic-git/1.38.7/1.38.10?slim=true)
| dependencies | patch |
| [postcss](https://postcss.org/)
([source](https://github.com/postcss/postcss)) | [`8.5.19` →
`8.5.26`](https://renovatebot.com/diffs/npm/postcss/8.5.19/8.5.26) |
![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.26?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.19/8.5.26?slim=true)
| devDependencies | patch |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>isomorphic-git/lightning-fs
(@&#8203;isomorphic-git/lightning-fs)</summary>

###
[`v4.6.3`](https://github.com/isomorphic-git/lightning-fs/releases/tag/v4.6.3)

[Compare
Source](https://github.com/isomorphic-git/lightning-fs/compare/v4.6.2...v4.6.3)

##### Bug Fixes

- IDB interface
([#&#8203;127](https://github.com/isomorphic-git/lightning-fs/issues/127))
([035e472](https://github.com/isomorphic-git/lightning-fs/commit/035e4725b9e6aa72d10cadc5ace20dec7ac76afb))

</details>

<details>
<summary>vitejs/vite-plugin-react
(@&#8203;vitejs/plugin-react)</summary>

###
[`v6.0.5`](https://github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#605-2026-07-30)

[Compare
Source](https://github.com/vitejs/vite-plugin-react/compare/f4b549822ec239799d746c030abb0b9a7d8f0a04...68c0cb8796ce18bd049c3d05c5210eaf0617eac0)

##### Fixed the react compiler preset filter to be linear
([#&#8203;1353](https://github.com/vitejs/vite-plugin-react/pull/1353))

The improved filter in v6.0.3 was non-linear and caused a performance
regression
([#&#8203;1349](https://github.com/vitejs/vite-plugin-react/issues/1349)).
The filter was changed to be linear to avoid that.

###
[`v6.0.4`](https://github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#604-2026-07-22)

[Compare
Source](https://github.com/vitejs/vite-plugin-react/compare/640fd358a0e82393acfce4e92e19a6ac6e1641a7...f4b549822ec239799d746c030abb0b9a7d8f0a04)

##### Fixed `$RefreshSig$ is not defined` error when running `vite dev`
with `NODE_ENV=production`

When running `vite dev` with `NODE_ENV=production`, the app errored with
`$RefreshSig$ is not defined`.
This error is now fixed.

</details>

<details>
<summary>dorny/paths-filter (dorny/paths-filter)</summary>

###
[`v4.0.3`](https://github.com/dorny/paths-filter/blob/HEAD/CHANGELOG.md#v403)

[Compare
Source](https://github.com/dorny/paths-filter/compare/v4.0.2...v4.0.3)

- [Document safe handling of file list outputs in
workflows](https://github.com/dorny/paths-filter/pull/326)
- [Escape multi-line filenames in list-files shell and csv
output](https://github.com/advisories/GHSA-7hc6-8hq5-9q2m)
- [Add 'some-with-excludes' predicate
quantifier](https://github.com/dorny/paths-filter/pull/322)
- [Add contents permission to PR
example](https://github.com/dorny/paths-filter/pull/248)
- [Scope base-ignored warning to API
path](https://github.com/dorny/paths-filter/pull/319)
- [Update outputs in readme to account for the 'every'
predicate-quantifier](https://github.com/dorny/paths-filter/pull/247)

</details>

<details>
<summary>isomorphic-git/isomorphic-git (isomorphic-git)</summary>

###
[`v1.38.10`](https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.10)

[Compare
Source](https://github.com/isomorphic-git/isomorphic-git/compare/v1.38.9...v1.38.10)

##### Bug Fixes

- **statusMatrix:** do not traverse symlinks in GitWalkerFs
([#&#8203;1215](https://github.com/isomorphic-git/isomorphic-git/issues/1215))
([#&#8203;2382](https://github.com/isomorphic-git/isomorphic-git/issues/2382))
([90ea101](https://github.com/isomorphic-git/isomorphic-git/commit/90ea101d329daa84b99cc0140a6275896ebbaf68))

###
[`v1.38.9`](https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.9)

[Compare
Source](https://github.com/isomorphic-git/isomorphic-git/compare/v1.38.8...v1.38.9)

##### Bug Fixes

- Preserve binary files when writing conflicted working tree
([#&#8203;2380](https://github.com/isomorphic-git/isomorphic-git/issues/2380))
([b41b1ab](https://github.com/isomorphic-git/isomorphic-git/commit/b41b1abc3df87326e639b49d0694915540d6dfb5))

###
[`v1.38.8`](https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.8)

[Compare
Source](https://github.com/isomorphic-git/isomorphic-git/compare/v1.38.7...v1.38.8)

##### Bug Fixes

- unsafe symlink from cherry pick
([#&#8203;2377](https://github.com/isomorphic-git/isomorphic-git/issues/2377))
([4664c8e](https://github.com/isomorphic-git/isomorphic-git/commit/4664c8e1147c3c7ba87c027e92093d28607ef4c0))

</details>

<details>
<summary>postcss/postcss (postcss)</summary>

###
[`v8.5.26`](https://github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8526)

[Compare
Source](https://github.com/postcss/postcss/compare/8.5.25...8.5.26)

- Fixed `list.split()` regression (by
[@&#8203;lazerg](https://github.com/lazerg)).
- Track symlinks in path protection in source map loading (by
[@&#8203;drengir1](https://github.com/drengir1)).

###
[`v8.5.25`](https://github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8525)

[Compare
Source](https://github.com/postcss/postcss/compare/8.5.24...8.5.25)

- Fixed 8.5.17 visitor regression.
- Fixed `list.split()` for non-string values (by
[@&#8203;amir-rezaei](https://github.com/amir-rezaei)).

###
[`v8.5.24`](https://github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8524)

[Compare
Source](https://github.com/postcss/postcss/compare/8.5.23...8.5.24)

- Preserve the BOM after the processing (by
[@&#8203;hdimer](https://github.com/hdimer)).

###
[`v8.5.23`](https://github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8523)

[Compare
Source](https://github.com/postcss/postcss/compare/8.5.22...8.5.23)

- Do not load source map without `opts.from` for security reasons.

###
[`v8.5.22`](https://github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8522)

[Compare
Source](https://github.com/postcss/postcss/compare/8.5.21...8.5.22)

- Fixed custom property losing semicolon before a comment (by
[@&#8203;sarathfrancis90](https://github.com/sarathfrancis90)).

###
[`v8.5.21`](https://github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8521)

[Compare
Source](https://github.com/postcss/postcss/compare/8.5.20...8.5.21)

- Fixed childless at-rule losing semicolon before comment (by
[@&#8203;sarathfrancis90](https://github.com/sarathfrancis90)).
- Fixed docs (by [@&#8203;isker](https://github.com/isker)).

###
[`v8.5.20`](https://github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8520)

[Compare
Source](https://github.com/postcss/postcss/compare/8.5.19...8.5.20)

- Fixed missing space if `AtRule#params` is set after (by
[@&#8203;sarathfrancis90](https://github.com/sarathfrancis90)).
- Fixed mixing AST error on warnings (by
[@&#8203;MahinAnowar](https://github.com/MahinAnowar)).

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEyLjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @bhargavms
chore(deps): update dependency @tanstack/react-virtual to v3.14.9 (bl…
2d880a1 
…ock#4439)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@tanstack/react-virtual](https://tanstack.com/virtual)
([source](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual))
| [`3.14.8` →
`3.14.9`](https://renovatebot.com/diffs/npm/@tanstack%2freact-virtual/3.14.8/3.14.9)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@tanstack%2freact-virtual/3.14.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tanstack%2freact-virtual/3.14.8/3.14.9?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Release Notes

<details>
<summary>TanStack/virtual (@&#8203;tanstack/react-virtual)</summary>

###
[`v3.14.9`](https://github.com/TanStack/virtual/blob/HEAD/packages/react-virtual/CHANGELOG.md#3149)

[Compare
Source](https://github.com/TanStack/virtual/compare/@tanstack/react-virtual@3.14.8...@tanstack/react-virtual@3.14.9)

##### Patch Changes

- Updated dependencies
\[[`a5417b4`](https://github.com/TanStack/virtual/commit/a5417b4b0d3c82876747bb9635db7239c28d3e44)]:
-
[@&#8203;tanstack/virtual-core](https://github.com/tanstack/virtual-core)@&#8203;3.17.7

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
bhargavms pushed a commit that referenced this pull request Aug 18, 2026
@renovate @wesbillman @bhargavms
chore(deps): update react monorepo (block#4441)
9e6e90c 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react)
([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react))
| [`19.2.17` →
`19.2.18`](https://renovatebot.com/diffs/npm/@types%2freact/19.2.17/19.2.18)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2freact/19.2.18?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2freact/19.2.17/19.2.18?slim=true)
|
|
[@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react-dom)
([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom))
| [`19.2.3` →
`19.2.4`](https://renovatebot.com/diffs/npm/@types%2freact-dom/19.2.3/19.2.4)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2freact-dom/19.2.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2freact-dom/19.2.3/19.2.4?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/buzz).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4xMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Wes <wesbillman@users.noreply.github.com>
Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automerge Allow Bulldozer to auto merge this PR not-ai-assisted size/XL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@finn-devops @jai