- Update all non-major dependencies with digest and pinDigest

[blumilk-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@tailwindcss/typography	^0.5.19 -> ^0.5.20			dependencies	patch
@tailwindcss/vite (source)	^4.2.4 -> ^4.3.3			dependencies	minor
alpinejs (source)	^3.15.11 -> ^3.15.12			dependencies	patch
autoprefixer	^10.4.27 -> ^10.5.4			dependencies	patch
axios (source)	^1.13.5 -> ^1.13.6			dependencies	patch
axllent/mailpit (source)	v1.29.7 -> v1.30.7				minor
composer	2.9.7 -> 2.9.8			stage	patch
docker/build-push-action	v7.2.0 -> v7.3.0			action	minor
docker/login-action	v4.2.0 -> v4.6.0			action	minor
docker/metadata-action	v6.1.0 -> v6.2.0			action	minor
docker/setup-buildx-action	v4.1.0 -> v4.2.0			action	minor
filament/spatie-laravel-media-library-plugin (source)	^3.3.50 -> ^3.3.54			require	patch
laravel/telescope	^5.20.0 -> ^5.22.1			require-dev	minor
livewire/livewire	^3.7.15 -> ^3.8.3			require	patch	3.8.4
node	24.11.1-bookworm-slim -> 24.19.0-bookworm-slim			stage	minor
nunomaduro/collision	^8.9.4 -> ^8.9.5			require-dev	patch
php	8.3.30-fpm-bookworm -> 8.3.33-fpm-bookworm			final	patch
phpunit/phpunit (source)	^11.5.55 -> ^11.5.56			require-dev	patch
postcss (source)	^8.5.12 -> ^8.5.26			dependencies	patch
postgres	17.9 -> 17.10			final	minor
registry.blumilk.pl/internal-public/lmt-postgres	234ae47 -> 92fe26f				digest
registry.blumilk.pl/internal-public/lmt-postgres	cf30f96 -> e62c39e				digest
tailwindcss (source)	^4.1.18 -> ^4.3.3			dependencies	minor
vite (source)	^6.4.1 -> ^6.4.3			dependencies	patch
xdebug/xdebug	3.5.1 -> 3.5.3				patch

---

Release Notes

tailwindlabs/tailwindcss-typography (@​tailwindcss/typography)

v0.5.20

Compare Source

Fixed

• Support installing with stable versions of Tailwind CSS v4 (#​424)

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.3

Compare Source

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)

v4.3.2

Compare Source

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#​20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#​20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#​20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#​20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#​20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#​20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#​20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#​20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#​20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#​20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#​20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#​20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#​20289)

v4.3.1

Compare Source

Added

• Add --silent option to suppress output in @tailwindcss/cli (#​20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#​20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#​20052)
• Allow @apply to be used with CSS mixins (#​19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#​20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#​20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#​20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#​20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#​20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#​20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#​20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#​20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#​20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#​19588)
• Allow @variant to be used inside addBase (#​19480)
• Ensure @source globs with symlinks are preserved (#​20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#​20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#​20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#​20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#​20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#​20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#​20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#​20228)

Changed

• Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#​20196)
• Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#​20196)

v4.3.0

Compare Source

Added

• Add @container-size utility (#​18901)
• Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#​19981, #​20019)
• Add scrollbar-gutter-* utilities (#​20018)
• Add zoom-* utilities (#​20020)
• Add tab-* utilities (#​20022)
• Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#​19996)
• Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#​19996)
• Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#​19989)

Fixed

• Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#​19949)
• Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#​19965)
• Ensure CSS files containing @variant are processed by @tailwindcss/vite (#​19966)
• Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#​19980)
• Canonicalization: preserve significant _ whitespace in arbitrary values (#​19986)
• Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#​19986)
• Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#​19988)
• Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#​19991)
• Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#​19918)
• Allow multiple @utility definitions with the same name but different value types (#​19777)
• Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#​19707)
• Ensure start and end legacy utilities without values do not generate CSS (#​20003)
• Ensure --value(…) is required in functional @utility definitions (#​20005)
• Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#​20011)

postcss/autoprefixer (autoprefixer)

v10.5.4

Compare Source

• Fixed prefixed rule duplication (by @​xianjianlf2).

v10.5.3

Compare Source

• Fixed brackets and gradient parser (@​alanturing881).

v10.5.2

Compare Source

• Moved -webkit-fill-available before -moz-available, so Firefox
  will use -webkit- version which is closer to stretch.

v10.5.1

Compare Source

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

axllent/mailpit (axllent/mailpit)

v1.30.7

Compare Source

Chore

• Add software license information (#​724)
• Update Go dependencies
• Update node dependencies
• Update GitHub Actions dependencies

Fix

• Database lock when delete request contains duplicate IDs (#​723)

Test

• Add tests for requests containing duplicate & invalid IDs

v1.30.6

Compare Source

Security

• Implement POP3 failed login tracking and disconnect after multiple attempts
• Redact POP3 password in debug logs to prevent credential exposure
• Prevent WebSocket CORS origin check bypass via percent-encoded path (GHSA-8r62-w5wh-fc5m)

Chore

• Add ReadHeaderTimeout to HTTP server configuration
• Update node dependencies
• Update Go dependencies
• Update caniemail database
• Update Github Actions dependencies

Fix

• Prevent protocol desynchronization by draining oversized message data
• Prevent marking already deleted POP messages for deletion
• Ensure deleted POP3 messages are excluded from LIST and STAT commands
• Update content type handling for attachments to ensure proper file downloads
• Sanitise active Content-Type in attachment downloads
• Escape file names in Content-Disposition header for thumbnail responses
• Allow passwords with spaces in POP3 authentication
• Implement dot-stuffing for TOP commands in POP3 server
• Correct order of setting headers and writing HTTP error response
• Handle client disconnection during DATA read with appropriate logging in SMTPD server (#​721)

Test

• Add brute force POP3 login protection test
• Add more WebSocket CORS tests
• Enhance CORS middleware tests for HTML preview route handling

v1.30.5

Compare Source

Security

• Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5v97)

Chore

• Update Go dependencies
• Update node dependencies

v1.30.4

Compare Source

Security

• Reject oversized image dimensions in thumbnail handler before full decode (GHSA-75mr-qw9x-3r39)
• Enforce command line length limits in SMTP and POP3 handlers (GHSA-w878-pj84-3j5v)

Chore

• Update Github Actions
• Refactor browser storage settings for consistency (#​715)
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update Github Action requirements

Fix

• Exclude supported clients in HTML check results (#​716)

v1.30.3

Compare Source

Feature

• Add link check rate limiting and caching mechanism

Chore

• Update Go dependencies
• Update node dependencies

Fix

• Correctly parse after/before datetimes with timestamp in search query (#​704)
• Update Swagger response definitions for MessageHeadersResponse (#​703)
• Refactor Web UI configuration definitions in Swagger documentation
• Handle MaxBytesError in SendMessageHandler and return JSON error response

v1.30.2

Compare Source

Security

• Fix incomplete SSRF protection in IsInternalIP() detection for IPv6 transition mechanisms (GHSA-w4mc-hhc6-xp28)

Feature

• Add wait support to readyz (#​697)

Chore

• Compress websocket messages once per broadcast to improve performance (#​695)
• Toggle websocket compression using HTTP compression setting
• Update Github Actions dependencies
• Update Go dependencies
• Update node dependencies

Fix

• Adjust header setting order in error response functions (#​699)

Test

• Add readyz tests

v1.30.1

Compare Source

Security

• Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r)
• Pin Github Actions workflow versions using full commit SHA
• Do not use npm cache to prevent cache poisoning
• Disable GitHub Actions credential persistence for checkout steps

Chore

• Enhance schema application logging (#​688)
• Change log level to Info for database vacuuming message (#​688)
• Update Github Action workflows
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

v1.30.0

Compare Source

Security

• Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes (GHSA-fpxj-m5q8-fphw)
• Include CGNAT (Carrier-Grade NAT) in internal IP checks (GHSA-j3fj-qppj-fmmc)
• Block internal IP access by default in HTML check (GHSA-j3fj-qppj-fmmc)
• Fix for path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs (GHSA-qx5x-85p8-vg4j)
• Fix concurrent map read & write in proxy CSS rewriter (GHSA-w4vj-r5pg-3722)

Feature

• New loading indicator, reduce flash during message transitions (#​682)

Chore

• Remove gorilla/mux dependency and replace with stdlib routing
• Remove logrus dependency and implement slog-based logging
• Remove go-telnet dependency and implement TCP/Unix socket handling for SMTP
• Replace lithammer/shortuuid with custom shortuuid implementation and update tests
• Improve iframe height adjustment with optional chaining
• Bump axios version to v1.16.0
• Refactor Prometheus metrics implementation and remove unused dependencies
• Refactor MarkRead and MarkUnread functions to only broadcast changes of modified messages
• Optimize tag retrieval by batching message IDs in List and Search functions
• Enhance SetMessageTags function to improve tag handling and batch deletions
• Optimize MarkRead and MarkUnread functions to reduce database calls and improve performance
• Refactor pruneMessages function to eliminate duplicate ID checks using a map
• Refactor addMessageTag function to remove mutex and ensure safe concurrent inserts
• Refactor Hub to use atomic clientCount for safe concurrent client tracking
• Ensure websocket connection is closed on client unregistration
• Simplify writePump by using WriteMessage and remove unnecessary newline handling
• Add message dump max-message-size flag and refactor message handling
• Add message ingest max-message-size flag and refactor message handling
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Validate SMTP XCLIENT args before processing

Build

• Update CI actions to use npm ci
• Tag Docker edge build with next patch versions

docker/build-push-action (docker/build-push-action)

v7.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1567
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1545 #​1572
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1568
• Bump js-yaml from 4.1.1 to 4.3.0 in #​1566
• Bump tmp from 0.2.5 to 0.2.7 in #​1547
• Bump undici from 6.24.1 to 6.27.0 in #​1564
• Bump vite from 7.3.2 to 7.3.6 in #​1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

docker/login-action (docker/login-action)

v4.6.0

Compare Source

• Harden buildx scoped config path handling by @​crazy-max in #​1059
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1095.0 in #​1051
• Bump js-yaml from 5.2.1 to 5.2.2 in #​1057
• Bump postcss from 8.5.10 to 8.5.22 in #​1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Compare Source

• Surface Docker Hub OIDC error responses by @​crazy-max in #​1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Compare Source

• Support dhi.io as Docker Hub OIDC registry by @​crazy-max in #​1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Compare Source

• Docker Hub OIDC login support by @​crazy-max in #​1048
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1091.0 in #​1037
• Bump @​docker/actions-toolkit from 0.92.0 to 0.94.0 in #​1044 #​1050
• Bump brace-expansion from 1.1.13 to 1.1.16 in #​1046
• Bump js-yaml from 5.2.0 to 5.2.1 in #​1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Compare Source

• Skip empty registry-auth secret mask by @​crazy-max in #​1035
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1077.0 #​1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 #​999 #​1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1004 #​1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #​1017
• Bump js-yaml from 4.1.1 to 5.2.0 in #​1028
• Bump sigstore from 4.1.0 to 4.1.1 in #​1031
• Bump tmp from 0.2.5 to 0.2.7 in #​1002
• Bump undici from 6.24.1 to 6.27.0 in #​1020
• Bump vite from 7.3.3 to 7.3.6 in #​1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

docker/metadata-action (docker/metadata-action)

v6.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​689
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​663
• Bump @​actions/github from 9.0.0 to 9.1.1 in #​666
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​672 #​696
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​690
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​693
• Bump csv-parse from 6.2.1 to 7.0.0 in #​683
• Bump js-yaml from 4.1.1 to 4.3.0 in #​688
• Bump moment-timezone from 0.6.1 to 0.6.2 in #​664
• Bump semver from 7.7.4 to 7.8.5 in #​665 #​695
• Bump sigstore from 4.1.0 to 4.1.1 in #​694
• Bump tmp from 0.2.5 to 0.2.7 in #​673
• Bump undici from 6.25.0 to 6.27.0 in #​686
• Bump vite from 7.3.2 to 7.3.6 in #​685

Full Changelog: docker/metadata-action@v6.1.0...v6.2.0

docker/setup-buildx-action (docker/setup-buildx-action)

v4.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​572
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​557 #​580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​576
• Bump js-yaml from 4.1.1 to 5.2.0 in #​562
• Bump sigstore from 4.1.0 to 4.1.1 in #​577
• Bump tmp from 0.2.5 to 0.2.7 in #​556
• Bump undici from 6.25.0 to 6.27.0 in #​570
• Bump vite from 7.3.2 to 7.3.6 in #​569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

filamentphp/spatie-laravel-media-library-plugin (filament/spatie-laravel-media-library-plugin)

v3.3.54

Compare Source

v3.3.53

Compare Source

v3.3.52

Compare Source

v3.3.51

Compare Source

laravel/telescope (laravel/telescope)

v5.22.1

Compare Source

• Fix BatchWatcher::recordBatch docblock copied from JobWatcher by @​darkdi in #​1753

v5.22.0

Compare Source

• Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group by @​dependabot[bot] in #​1747
• Bump immutable from 5.1.5 to 5.1.9 by @​dependabot[bot] in #​1748
• Bump postcss from 8.5.4 to 8.5.23 by @​dependabot[bot] in #​1749
• [5.x] Add CSP nonce support by @​roger-hermasch in #​1752

v5.21.0

Compare Source

• Bump axios from 1.14.0 to 1.15.0 by @​dependabot[bot] in #​1715
• Bump follow-redirects from 1.15.11 to 1.16.0 by @​dependabot[bot] in #​1716
• Bump axios from 1.15.0 to 1.15.2 by @​dependabot[bot] in #​1718
• Pin GitHub Actions to commit SHAs and add Dependabot config by @​joetannenbaum in #​1720
• Bump shivammathur/setup-php from 2.37.0 to 2.37.1 in the github-actions group by @​dependabot[bot] in #​1725
• Bump axios from 1.15.2 to 1.16.0 by @​dependabot[bot] in #​1727
• GitHub Actions hardening by @​nunomaduro in #​1730
• Bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group by @​dependabot[bot] in #​1731
• Pin pull requests and issues workflows to latest laravel/.github by @​nunomaduro in #​1732
• Add Dependabot cooldown of 5 days by @​nunomaduro in #​1733
• Enable Dependabot auto-merge by @​nunomaduro in #​1734
• Bump shivammathur/setup-php from 2.37.1 to 2.37.2 in the github-actions group by @​dependabot[bot] in #​1737
• Bump form-data from 4.0.5 to 4.0.6 by @​dependabot[bot] in #​1739
• [5.x] Clear stale exception and failed tag when a job is marked processed by @​EhabAmawi in #​1741
• Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @​dependabot[bot] in #​1743
• [5.x] Normalize dashboard JavaScript line endings by @​lazerg in #​1744
• [5.x] Order deletes when pruning and clearing to prevent deadlocks by @​lazerg in #​1745
• Bump axios from 1.16.0 to 1.18.0 by @​dependabot[bot] in #​1746

livewire/livewire (livewire/livewire)

v3.8.3

Compare Source

What's Changed

• [3.x] Fix wire:model.blur recreating deleted array entries by @​people-sea in #​10370
• [3.x] Improve query string parsing and effect handling by @​joshhanley in #​10467

Full Changelog: livewire/livewire@v3.8.2...v3.8.3

v3.8.2

Compare Source

What's Changed

• [3.x] Only report corrupt component payloads in debug mode by @​calebporzio in #​10329
• [3.x] Validate page query parameter in SupportPagination by @​pkoury in #​10311

New Contributors

• @​pkoury made their first contribution in #​10311

Full Changelog: livewire/livewire@v3.8.1...v3.8.2

v3.8.1

Compare Source

What's Changed

• [3.x] Fix file uploads hanging silently on network-level failures by @​joshhanley in #​10283
• [3.x] Handle unknown components during release token verification by @​joshhanley in #​10321

Full Changelog: livewire/livewire@v3.8.0...v3.8.1

nodejs/node (node)

v24.19.0: 2026-08-03, Version 24.19.0 'Krypton' (LTS), @​aduh95

Compare Source

Notable Changes

• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #​64036
• [35222948be] - (SEMVER-MINOR) deps: update Ope

---

Configuration

📅 Schedule: Branch creation - On day 1 of the month, every 3 months ( * * 1 */3 * ) in timezone Europe/Warsaw, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[blumilk-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update filament/spatie-laravel-media-library-plugin:3.3.54 laravel/telescope:5.22.1 livewire/livewire:3.8.3 nunomaduro/collision:8.9.5 phpunit/phpunit:11.5.56 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Dependency laravel/framework is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Dependency mockery/mockery is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Dependency fakerphp/faker is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Dependency laravel/tinker is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires filament/spatie-laravel-media-library-plugin ^3.3.54 -> satisfiable by filament/spatie-laravel-media-library-plugin[v3.3.54].
    - filament/spatie-laravel-media-library-plugin v3.3.54 requires filament/support v3.3.54 -> found filament/support[v3.3.54] but these were not loaded, likely because it conflicts with another require.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-08-13T07_12_26_381Z-debug-0.log

[blumilk-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.