chore(deps): update all non-major dependencies#730
Merged
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
21 times, most recently
from
6ee1a3f to
16d00f2
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
51fc3af to
0653656
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.11.21→0.11.231.70.0→1.71.02.94.0→2.95.02026.6.0→2026.6.13.5.0→3.5.2v2.60.0→v2.60.1v4.524.1→v4.526.02.35.4→2.35.9v2.60.0→v2.60.1v1.21.0→v1.22.0v1.23.01.0.8→1.0.10v0.6.0→v0.7.0v2026.6.9→v2026.6.11v4.1.0→v4.2.024.16.0→24.17.07.0.0-dev.20260614.1→7.0.0-dev.20260620.17.0.0-dev.20260621.120.0.11→20.0.140.30.0→0.30.111.6.0→11.8.0Release Notes
astral-sh/uv (aqua:astral-sh/uv)
v0.11.23Compare Source
Released on 2026-06-19.
Bug fixes
pre-commit-uv(#19925)pyproject.tomlwould be treated as standalone projects (#19926)v0.11.22Compare Source
Released on 2026-06-18.
Enhancements
uv publish(#19831)TYandRUFFenv vars for providing paths for binaries used byuv formatanduv check(#19821)Preview features
uv.tomlandpyproject.toml(#18437)uv check --no-sync(#19909)--scripttouv checkanduv metadata(#19860)workspace metadata(#19862)uv auditoutput (#19872)Performance
Bug fixes
include-groupentries that have additional fields (#19866)backend-paths exist when building sdists (#19834)pylock.tomlfiles do not have an unsupported alock-version(#19869)packages.requires-pythonof apylock.toml(#19868)uvto be recursively invoked by PEP 517 build hooks (#19879)credentials.tomlfiles (#19815)uv pip list(#19867)uv tree --invert(#19910)uv venvin a project (#19837)uv tree(#19905)Documentation
Other changes
bufbuild/buf (aqua:bufbuild/buf)
v1.71.0Compare Source
cli/cli (aqua:cli/cli)
v2.95.0: GitHub CLI 2.95.0Compare Source
Read repository files and directories with
gh repo read-fileandgh repo read-dirTwo new preview commands read repository contents without cloning:
Both commands default to the repository's default branch, accept
--refto target any branch, tag, or commit, and support--json,--jq, and--templatefor scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.What's Changed
✨ Features
repo read-fileandrepo read-dirby @babakks in #13580🐛 Fixes
📚 Docs & Chores
Full Changelog: cli/cli@v2.94.0...v2.95.0
cloudflare/cloudflared (aqua:cloudflare/cloudflared)
v2026.6.1Compare Source
SHA256 Checksums:
jdx/usage (aqua:jdx/usage)
v3.5.2Compare Source
🔍 Other Changes
v3.5.1Compare Source
🐛 Bug Fixes
📚 Documentation
🛡️ Security
📦️ Dependency Updates
New Contributors
aquaproj/aqua (aquaproj/aqua)
v2.60.1Compare Source
d5b02b2fix(unarchive): prevent archive extraction from writing outside the destinationFor more details, please see the security advisory.
*.sigand*.pemfiles are no longer included in the release assets*.bundlefiles are renamed to*.sigstore.jsonFixes
#4938 Remove GitHub Release Attestation verification
aquaproj/aqua-registry (aquaproj/aqua-registry)
v4.526.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.525.0...v4.526.0
🎉 New Packages
#55428 Latias94/merman - Mermaid.js, but headless, in Rust @yashikota
#55421 coder/boo - A GNU screen style terminal multiplexer built on libghostty @yashikota
Fixes
#55443 Rename bitnami-labs/sealed-secrets to bitnami/sealed-secrets
#55445 suzuki-shunsuke/ghtkn: support v0.2.6 or later
v4.525.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.524.1...v4.525.0
🎉 New Packages
#55397 #55401 CycloneDX/cdxgen - Creates CycloneDX Bill of Materials (BOM) from source code and container images @sebdanielsson
#55389 fallow-rs/fallow: Codebase intelligence for TypeScript and JavaScript. Free static layer: unused code, duplication, circular deps, complexity hotspots, architecture boundaries. Optional paid runtime layer: hot-path review and cold-path deletion evidence from real production traffic. Rust-native, sub-second, zero-config framework support @wancup
Fixes
#55395 haskell/ghcup-hs: Support Windows @cprecioso
#55393 Remove the verification of release attestations
aws/aws-cli (aws/aws-cli)
v2.35.9Compare Source
v2.35.8Compare Source
v2.35.7Compare Source
v2.35.6Compare Source
v2.35.5Compare Source
endevco/aube (github:endevco/aube)
v1.22.0: : Scoped registry tokens and a pnpm-lockfile parity sweepCompare Source
Added
//host/:@​scope:_authToken) for multi-org registries like GitHub Packages, withaube login --scopewriting scoped entries (#899)Fixed
/{name}/{version}routes (#905)pnpm-lock.yamlparity and re-resolution gaps: stop peer suffixes at the supplier, record hosted-git deps as codeload tarballs, render git/tarball peer suffixes as resolved specs, stamp pnpm config checksums on update/remove/dedupe/audit, and re-resolve when.pnpmfile.{cjs,mjs}changes (#896)sharedWorkspaceLockfile=false: per-member warm-path freshness, warm-path relink of deleted membernode_modules, andpackageExtensionsapplied to git/tarball/directory deps (#891)pnpm-workspace.yamlas a hard workspace boundary, matching pnpm — a member's settings-only yaml configures a single-package workspace rather than being skipped (#889)pnpm-lock.yamlformatting and field parity gaps: record every declared optional-dep arch, flow-formcpu/os/libc, re-indenttransitivePeerDependencies, reordercatalogs:, round-tripdeprecated:, dropengines: {node: '*'}, markoptional: truesnapshots, emittransitivePeerDependencies, and synthesizepeerDependenciesfor meta-only peers (#893)doctormessages (#888)Changed
process::exit, so embedding aube as a library no longer tears down the host process (#897)💚 Sponsor aube
aube is part of jdx.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
google-antigravity/antigravity-cli (github:google-antigravity/antigravity-cli)
v1.0.10Compare Source
antigravity_guidebuiltin skill to provide instant, in-context reference guides for the Antigravity 2.0, CLI, IDE, and SDK.git log --graph) for visual parity with hg/jj./helpmenu for easy troubleshooting.glamourto v2.0.1 for cleaner headings and block padding.rundll32.settings.jsonpreservation.$or.) in saved rules, preventing infinite prompt loops.v1.0.9Compare Source
>,2>&1), and unparseable strings to prevent sandbox escapes..gitto the core list of dangerous paths, preventing unauthorized or destructive repository modifications.python -c "print(1)") would silently fail to match at runtime due to flawed whitespace tokenization.--conversation/-c-p ...) where the CLI would dump the entire historical conversation transcript instead of only printing the newly generated response.sorafujitani/ccsession (github:sorafujitani/ccsession)
v0.7.0: ccsession 0.7.0Compare Source
ccsession v0.7.0
An fzf-powered session picker for resuming local agent sessions.
Features
.agents/skills/ccsession, so agents can search, compare, preview, and hand off prior local sessions without reimplementing the session-store logic.ccsession list --json --limitemits machine-readable candidates, andccsession resume-specprints the non-launching resume target before any interactive process is started.Contributors
Thanks to @sorafujitani for the work in this release!
See the README for installation instructions.
v0.6.1: ccsession 0.6.1Compare Source
ccsession v0.6.1
An fzf-powered session picker for resuming local agent sessions across Claude Code, Codex, OpenCode, and Grok.
Fixes
Performance
--allscan, filtered scan, and grep now fan out across backends concurrently while preserving source-order aggregation, composite keys, and backend-specific error context.Contributors
Thanks to @sorafujitani for the work in this release!
See the README for installation instructions.
jdx/mise (jdx/mise)
v2026.6.11: : apk bootstrap, cleaner Windows shims, and aqua polishCompare Source
A focused release that adds Alpine
apkas a bootstrap package manager, stops the default Windowsexeshims from leaking into WSL, and fixes a handful of aqua, HTTP cache, Rust, and Deno corners.Added
bootstrap: Alpine Linux
apkjoins apt, dnf, pacman, and brew as a supported[bootstrap.packages]manager. Specify packages asapk:name(with optional@version), or pass--manager apkexplicitly; status, install, and upgrade all wire through the same paths as the other Linux managers (#10476 by @jdx).registry: Added
pinnipedto the registry (#10456 by @tony-sol).Fixed
mise run //projects/backendandmise run //...no longer behave like//projects/backend:*— the monorepo pattern parser now rejects path-only targets with a clear error pointing to//path:<task>or//path:*(#10479 by @jdx).exewindows_shim_modeno longer writes a second, extension-less bash shim next to<tool>.exe. Git Bash / Cygwin / MSYS2 already resolve a bareghtogh.exe, and dropping the extras stops them from leaking into WSL via/mnt/c/...PATH interop (the source of themise: not found/ infinite-recursion loops).filemode still emits the bash shim where it is required. Old extras are cleaned up on the nextreshim(#10475 by @JamBalaya56562).format_overridesare now parsed from the aqua registry and applied to the compiled package model. They run after version overrides and before normal platform overrides — matching aqua's own ordering — so per-OS archive formats finally resolve correctly. Aqua registry caches will rebuild on first use due to a serialized-layout bump (#10461 by @risu729).{{.Asset}}.minisignow render against the selected package asset, fixing signature verification for packages likejedisct1/minisign0.12 (#10462 by @risu729)..sha256sumfiles use PowerShellGet-FileHashmulti-line output. mise now parses that format alongside the standard whitespace-delimited one, validates the algorithm/length, and stores hashes lowercased as"<algo>:<hash>"(#10464 by @risu729).strip_componentsis now resolved before HTTP archive cache lookup and folded into thehttp-tarballscache key. Stripped and unstripped extractions of the same URL no longer share a cache entry, fixing tool-stub installs that re-used a previousbin_path-based extract (#10468 by @risu729).mise linkversions. External symlink targets remain classified as linked. This fixesmise install --lockedidempotency for HTTP-backed tools (#10463 by @risu729).rust-toolchain.tomlprofile,components, andtargetsare now stored on the generatedToolRequest, so install and lockfile-option resolution both read the samerequest.options()instead of re-parsing the file. As a side effect, lockfile keys are canonicalized: TOML arrays now match comma-separated strings,components/targetsare sorted and deduplicated, and an emptyprofileno longer emits a spurious key (#10178 by @risu729).COLORTERMis now passed through to child processes (alongsideTERM), preserving 24-bit truecolor signalling in sandboxed environments (#10451 by @sschuberth).2027.5.0, matching the warning emitted by the CLI (#10453 by @reitzig).minimum_release_ageexample uses6mo(not6m) for "6 months", matching jiff's friendly duration format (#10193 by @sisp).Changed
fuzzy-matchercrate (archived, last published 2020) withnucleo-matcherfor registry/task suggestion scoring and picker highlight indices (#10467 by @risu729).os-releaseandsys-infocrates in favor of mise's internal/etc/os-releaseparser, which is now shared by libc detection, env, Swift, and Erlang Linux fallbacks (#10465 by @risu729).Aqua Registry
New packages:
Latias94/merman,bitnami/sealed-secrets,coder/boo. Updated:suzuki-shunsuke/ghtkn.New Contributors
Full Changelog: jdx/mise@v2026.6.10...v2026.6.11
💚 Sponsor mise
mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.
v2026.6.10: : Env defaults, Unix 7z, and stale-PATH fixesCompare Source
A focused release that adds a
defaultshorthand for env vars, brings.7zarchive support to Unix, and cleans up several long-standing PATH and shim edge cases on Linux, macOS, Windows, and WSL.Added
env: New
{ default = "fallback" }shorthand for[env](and config/task[vars]). The default applies only when the variable is unset or empty; existing non-empty values from the process env or earlier config are preserved. Mixingdefaultwithvalue,required, oragenow fails with a clear message (#10441 by @jdx).backend:
.7zarchives now extract on Unix as well as Windows, andstrip_componentsprobing works cross-platform. Migrated from the unmaintainedsevenz-rusttosevenz-rust2, and tightened extraction to reject directory traversal and absolute paths (#10434 by @risu729).Fixed
env_shell_expandis enabled,${VAR:-default}now follows POSIX semantics: empty strings are treated as missing (fallback applies),${VAR-default}only substitutes when the variable is unset, and fallback text is recursively expanded (e.g.${NONEXISTENT:-$OTHER}). Braced parsing is also stricter — unterminated${…stays literal and}inside$(…)no longer closes the brace (#10445 by @jdx, fixes #10444).mise x/run/envnow strip mise-managed install directories from the inherited PATH when composing the child environment. Stale entries carried in from a frozen env snapshot (IDE terminals, CI wrappers, AI-agent harnesses) no longer sit ahead of the freshly injected bin dir, so subshells,#!/usr/bin/envshebangs, and package-manager workers all resolve the requested tool version (#10422 by @JamBalaya56562, addresses #10345).os.executenow run under the same sanitizedmise_envascmd.exec. Combined with new resolution oftools = trueenv values during install, this fixes setups like gcloud depending on python where a singlemise installpreviously leftCLOUDSDK_PYTHONpointing at a nonexistent path (#10432 by @JamBalaya56562, fixes #10282).WSL_DISTRO_NAME/WSL_INTEROP/WSLInterop), drop their own dir from PATH, andexecthe tool directly. This breaks the infinitemise xloop that happened when the Windows shims dir was exposed at/mnt/c/...inside WSL, and gives a clean<tool>: not foundwhen no Linux tool is installed.file-mode shims are now also flagged version-stale so a normal reshim regenerates them on upgrade (#10421 by @JamBalaya56562, addresses #10299).make_symlinkon Unix now creates the link at a unique temp name in the destination dir and atomicallyrename(2)s it into place. This eliminates the noisyfailed to ln -sf … File exists (os error 17)warnings that surfaced when several mise processes (shellhook-env, direnv, editor integrations) raced on the same tracked-config link, e.g. when spawning a new git worktree (#10414 by @JamBalaya56562, fixes #10292)..ps1) over their extensionless siblings, and extensionless takeover only applies when the match is unambiguous and stays within the same config family (#10443 by @jdx).Changed
number_prefix(RUSTSEC-2025-0119) and stalehumansizecrates withbytesize. Size strings in generatedtool-stubcomments andmise cache pruneoutput now use nativebytesizeIEC formatting — e.g.821.69 KiBbecomes821.7 KiBand2.15 MiBbecomes2.2 MiB(#10438 by @risu729).Full Changelog: jdx/mise@v2026.6.9...v2026.6.10
💚 Sponsor mise
mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.
jdx/mise-action (jdx/mise-action)
v4.2.0: : Bootstrap mode & wget fallbackCompare Source
This release adds an opt-in bootstrap mode for projects that use
mise bootstrap, and makes the action work on runner images that shipwgetbut notcurl.Added
Bootstrap mode (#522) by @jdx
Three new inputs let the action drive
mise bootstrapinstead ofmise install:bootstrap: true, the action runsmise bootstrapunder the existinginstallgate and setsMISE_EXPERIMENTAL=1automatically.mise --locked bootstrap, matching the auto-lock behavior introduced formise installin v4.1.0.install_argscannot be combined withbootstrap: true— the action fails fast and tells you to usebootstrap_skip/bootstrap_argsinstead, because full bootstrap doesn't support partial tool install args.{{bootstrap_hash}}template variable is included in the default cache key (and available in customcache_keytemplates) so bootstrap and non-bootstrap configurations don't share caches.bootstrap_skiprelies onmise bootstrap --skipfrom jdx/mise#10497, so make sure you're on a recent mise version if you use it.Fixed
wgetwhencurlis unavailable (#521) by @risu729 — The action used to hard-codecurlfor fetching the mise binary, tar/zip archives, and the latestVERSIONlookup, which broke on minimal runner images that only shipwget. It now preferscurland transparently falls back towget, preserving the streamingdownload | tarfast path for.tar.gzand.tar.zstinstalls on Linux/macOS. Proxy support is unchanged — both tools honorHTTP_PROXY/HTTPS_PROXY. Addresses jdx/mise#10488.Documentation
Full Changelog: jdx/mise-action@v4.1.0...v4.2.0
nodejs/node (node)
v24.17.0: 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #6289166e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #638203a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #63703138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8559224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85431beb4f707] - (CVE-2026-48928) tls: fix case-senConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.