chore(deps): update all dependencies by renovate[bot] · Pull Request #124 · vadimpiven/node_reqwest

renovate · 2026-03-21T01:57:25Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@codspeed/vitest-plugin (source)	`5.4.0` → `5.7.1`	pnpm.catalog.default	minor
@playwright/test (source)	`1.60.0` → `1.62.1`	pnpm.catalog.default	minor
@types/node (source)	`25.9.1` → `25.9.5`	pnpm.catalog.default	patch
@vitest/coverage-istanbul (source)	`4.1.7` → `4.1.10`	pnpm.catalog.default	patch
CodSpeedHQ/action	`v4.15.1` → `v4.19.1`	action	minor
actions/attest	`v4.1.0` → `v4.2.2`	action	minor
actions/attest-build-provenance	`v4.1.0` → `v4.1.1`	action	patch	`v4.2.2`
actions/cache	`v5.0.5` → `v5.1.0`	action	minor
actions/checkout	`v6.0.2` → `v6.1.0`	action	minor
actions/setup-node	`v6.4.0` → `v6.5.0`	action	minor
anyhow	`1.0.102` → `1.0.104`	workspace.dependencies	patch
aqua:BurntSushi/ripgrep	`15.1.0` → `15.2.0`	tools	minor
aqua:anchore/syft	`1.44.0` → `1.50.0`	tools	minor	`1.51.0`
aqua:aquasecurity/trivy	`0.70.0` → `0.73.0`	tools	minor
aqua:astral-sh/uv	`0.11.16` → `0.12.1`	tools	minor	`0.12.3` (+1)
aqua:cargo-bins/cargo-binstall	`1.19.1` → `1.21.1`	tools	minor
aqua:cli/cli	`2.92.0` → `2.97.0`	tools	minor
aqua:crate-ci/typos	`1.46.3` → `1.49.0`	tools	minor
aqua:hadolint/hadolint	`2.14.0` → `2.15.1`	tools	minor
bytes	`1.11.1` → `1.12.1`	workspace.dependencies	minor
codecov/codecov-action	`v6.0.1` → `v6.0.2`	action	patch
docker/build-push-action	`v7.2.0` → `v7.3.0`	action	minor
docker/dockerfile	`1.24` → `1.26`	syntax	minor
docker/login-action	`v4.2.0` → `v4.6.0`	action	minor
docker/setup-buildx-action	`v4.1.0` → `v4.2.0`	action	minor
electron	`42.2.0` → `42.8.1`	pnpm.catalog.default	minor	`42.9.0`
fd-lock	`2.1.1` → `2.2.0`	pnpm.catalog.default	minor
futures (source)	`0.3.32` → `0.3.33`	workspace.dependencies	patch	`0.3.34`
futures-util (source)	`0.3.32` → `0.3.33`	workspace.dependencies	patch	`0.3.34`
github/codeql-action	`v4.36.0` → `v4.37.6`	action	minor
github:EmbarkStudios/cargo-deny	`0.19.7` → `0.20.2`		minor
github:EmbarkStudios/cargo-deny	`0.19.7` → `0.20.2`	tools	minor
github:mikefarah/yq	`4.53.2` → `v4.53.3`	tools	patch
github:nextest-rs/nextest	`0.9.136` → `0.9.143`		patch
github:nextest-rs/nextest	`0.9.136` → `0.9.143`	tools	patch
jdx/mise	`v2026.5.15` → `v2026.8.2`		minor	`v2026.8.5` (+2)
jdx/mise-action	`v4.0.1` → `v4.2.4`	action	minor
markdownlint-cli2	`0.22.1` → `0.23.2`	pnpm.catalog.default	minor
monocart-reporter	`2.11.2` → `2.12.4`	pnpm.catalog.default	minor
node (source)	`24.15.0` → `24.19.0`	tools	minor
npm:pnpm (source)	`11.2.2` → `11.20.0`	tools	minor	`11.21.0`
oxfmt (source)	`0.51.0` → `0.62.0`	pnpm.catalog.default	minor	`0.63.0`
oxlint (source)	`1.66.0` → `1.77.0`	pnpm.catalog.default	minor	`1.78.0`
pnpm (source)	`11.2.2+sha512.36e6621fad506178936455e70247b8808ef4ec25797a9f437a93281a020484e2607f6a469a22e982987c3dbb8866e3071514ab10a4a1749e06edcd1ec118436f` → `11.20.0`	packageManager	minor	`11.21.0`
pyrefly	`==1.0.0` → `==1.2.0`	dependency-groups	minor
python (source)	`3.14.5` → `3.14.6`		patch	`3.14.7`
regex	`1.12.3` → `1.13.1`	workspace.dependencies	minor
ruff (source, changelog)	`==0.15.14` → `==0.16.1`	dependency-groups	minor	`0.16.2`
rust (source, changelog)	`nightly-2026-05-24` → `nightly-2026-08-05`	toolchain	patch	`nightly-2026-08-12` (+6)
rust (source, changelog)	`nightly-2026-05-24` → `nightly-2026-08-05`	tools	patch	`nightly-2026-08-12` (+6)
rustlang/rust	`nightly-2026-05-24` → `nightly-2026-08-04`		minor	`nightly-2026-08-12` (+3)
serde (source)	`1.0.228` → `1.0.229`	workspace.dependencies	patch
serde_json	`1.0.150` → `1.0.151`	workspace.dependencies	patch
thiserror	`2.0.18` → `2.0.19`	workspace.dependencies	patch	`2.0.20`
tokio (source)	`1.52.3` → `1.53.1`	workspace.dependencies	minor
tokio-stream (source)	`0.1.18` → `0.1.19`	workspace.dependencies	patch
tokio-util (source)	`0.7.18` → `0.7.19`	workspace.dependencies	patch
tsx (source)	`4.22.3` → `4.23.7`	pnpm.catalog.default	minor	`4.23.12` (+4)
typedoc (source)	`0.28.19` → `0.28.20`	pnpm.catalog.default	patch
undici (source)	`8.3.0` → `8.10.0`		minor
undici (source)	`8.3.0` → `8.10.0`	pnpm.catalog.default	minor
vite (source)	`8.0.14` → `8.2.0`	pnpm.catalog.default	minor	`8.2.1`
vite-plugin-dts (source)	`5.0.1` → `5.0.3`	pnpm.catalog.default	patch
vitest (source)	`4.1.7` → `4.1.10`	pnpm.catalog.default	patch
zizmor (source)	`==1.25.2` → `==1.29.0`	dependency-groups	minor
zizmorcore/zizmor-action	`v0.5.6` → `v0.6.2`	action	minor

Release Notes

CodSpeedHQ/codspeed-node (@codspeed/vitest-plugin)

`v5.7.1`

Compare Source

What's Changed

fix: emit perf maps when not parsing the full inlining logs from V8 by @GuillaumeLagrange in #85

Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1

`v5.7.0`

Compare Source

Highlights

Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set CODSPEED_WALLTIME_PROFILER=samply env variable in the codspeed action.
Added support for tinybench v5 and v6 in @codspeed/tinybench-plugin

What's Changed

Add necessary flags to dump optimized inlining info and fix walltime marker placement by @GuillaumeLagrange in #83

Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0

`v5.6.0`

Compare Source

What's Changed

feat: add MacOS support by @not-matthias in #81

Full Changelog: CodSpeedHQ/codspeed-node@v5.5.0...v5.6.0

`v5.5.0`

Compare Source

Highlights

We are introducing @codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.

Here's an example usage, but head to the docs for more information

import { bench, type Page } from "@codspeed/playwright-plugin";
import electronExecutable from "electron";
import path from "node:path";
import { fileURLToPath } from "node:url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const appRoot = path.resolve(__dirname, "..");

async function waitUntilSettled(page: Page): Promise<void> {
  await page.waitForFunction(() => {
    const main = document.getElementById("main");
    return !!main && !main.classList.contains("loading");
  });
}

await bench(
  "inbox-search-archive-threads",
  async ({ page }) => {
    await page.fill("#search", "update");
    await waitUntilSettled(page);

    await page.click("#select-visible-btn");
    await page.click("#archive-btn");
    await waitUntilSettled(page);

    await page.click('#sidebar nav button[data-view="threads"]');
    await waitUntilSettled(page);
  },
  {
    target: {
      kind: "electron",
      appPath: path.join(appRoot, "out/main/index.js"),
      cwd: appRoot,
    },
    beforeRound: async ({ page }) => {
      page.setDefaultTimeout(180_000);
      await page.waitForSelector("#main");
      await waitUntilSettled(page);
    },
  },
);

Note: this plugin is only compatible with the walltime instrument.

What's Changed

Add playwright profiling package by @GuillaumeLagrange in #80

Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0

microsoft/playwright (@playwright/test)

`v1.62.1`

Compare Source

`v1.62.0`

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

New apiResponse.timing() returns resource timing information for an API response.

Evaluation

New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
page.evaluate() and related methods now accept functions as evaluate arguments.
page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

⚠️ Debian 11 is not supported anymore.

Browser Versions

Chromium 151.0.7922.34
Mozilla Firefox 153.0
WebKit 26.5

This version was also tested against the following stable channels:

Google Chrome 151
Microsoft Edge 151

`v1.61.1`

Compare Source

`v1.61.0`

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
Supported expect.soft.poll(...).
New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
New -G command line shorthand for --grep-invert.

🛠️ Other improvements

Playwright now supports Ubuntu 26.04.
HAR and trace recordings now include WebSocket requests.

Browser Versions

Chromium 149.0.7827.55
Mozilla Firefox 151.0
WebKit 26.5

This version was also tested against the following stable channels:

Google Chrome 149
Microsoft Edge 149

vitest-dev/vitest (@vitest/coverage-istanbul)

`v4.1.10`

Compare Source

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #10680 (5c18d)
vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in #10661 (bae52)

View changes on GitHub

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

`v4.1.8`

Compare Source

🐞 Bug Fixes

browser:
- Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)
- Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in #10474 (675b4)

View changes on GitHub

CodSpeedHQ/action (CodSpeedHQ/action)

`v4.19.1`

Compare Source

Release Notes

This release ships improvements for the memory instrument.

The memory instrument now lazily attaches to allocators, which lowers the startup time to a few seconds (down from minutes on certain systems). Additionally, we shipped a series of serialization improvements, removing in some large benchmarks 3+ minutes of extra CI time.

🐛 Bug Fixes

Track successful posix_memalign allocations (#470) by @not-matthias in #470
Prompt sudo on interactive stdin (#459) by @not-matthias in #459
Reject empty command before executor setup (#467) by @not-matthias in #467

⚙️ Internals

chore: bump runner version to 4.19.1 by @github-actions[bot] in #225

💼 Other

Bump the memtrack pin to 1.3.0 by @adriencaccia in #474

Install codspeed-runner 4.19.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.19.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.19.1

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.19.0...v4.19.1

`v4.19.0`

Compare Source

Release Notes

This release adds a new --experimental-exclude-allocations feature to remove allocator time from Simulation benchmarks.

🚀 Features

Remove eager allocator discovery by @not-matthias
Attach allocator probes on demand via exec-mapping watcher by @not-matthias
Add exec-mapping watcher BPF prog and inode maps by @not-matthias
Add experimental --exclude-allocations setting by @not-matthias

🐛 Bug Fixes

Join attach worker thread on drop, not only on finish() by @not-matthias in #445
Fail loud when a watcher mapping is unresolved on a live process by @not-matthias
Canonicalize map_files dirent name for low-address mappings by @not-matthias
Classify unprefixed jemalloc builds as jemalloc by @not-matthias
Fail closed when tracking_enabled lookup fails by @not-matthias
Lower zstd compression level to -5 to reduce serialization overhead by @not-matthias
Wire MemtrackWriter serializer through BufWriter to fix per-event zstd compression bottleneck by @not-matthias

💼 Other

Let the tracker own the poller and drain on shutdown by @not-matthias
Return the underlying sink from MemtrackWriter::finish by @not-matthias

🏗️ Refactor

Split monolithic eBPF C and Rust into domain files by @not-matthias
Split memtrack into module by @not-matthias
Attach uprobes at resolved file offsets instead of func_name by @not-matthias
Align cycle-estimation flag with experimental naming scheme by @not-matthias in #425

📚 Documentation

Add crate AGENTS.md guide by @not-matthias in #455
Stop hardcoding MCP tool schemas in the optimize skill by @fargito in #451

⚡ Performance

Drain ringbuf bursts eagerly and reserve poller cores by @not-matthias in #436
Grow the event ring buffer to 256 MiB by @not-matthias
Wake the ringbuf consumer only past a data watermark by @not-matthias
Pre-size and reuse the memtrack encode window buffer by @not-matthias
Replace drain/writer threads with the encode pipeline by @not-matthias
Add parallel zstd encode pipeline for artifact events by @not-matthias
Detach BPF links in parallel at teardown by @not-matthias in #440
Resolve allocator symbol offsets in parallel by @not-matthias

🧪 Testing

Add dlopen/on-demand allocator tests + CI matrix by @not-matthias
Benchmark encode_events with a realistic allocation trace by @not-matthias

⚙️ Internals

chore: bump runner version to 4.19.0 by @github-actions[bot] in #224
Lower on-demand attach log to debug by @not-matthias in #462
Install rust toolchain by explicit channel for older rustup by @not-matthias
Also run runner-shared benchmarks in walltime mode by @not-matthias
Dedup memtrack build deps into install-bpf-deps action by @not-matthias

Install codspeed-runner 4.19.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.19.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.19.0

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.18.5...v4.19.0

`v4.18.5`

Compare Source

Release Notes

💼 Other

Bump pinned valgrind-codspeed to 3.26.0-0codspeed6 (#448) by @adriencaccia in #448
- fix: hangs on ARM64 due to atomics by @not-matthias in CodSpeedHQ/valgrind-codspeed#23
- fix(aspacem): raise amd64 managed address ceiling to 1 TiB by @not-matthias in CodSpeedHQ/valgrind-codspeed#22

Install codspeed-runner 4.18.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.4

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/

✂ Note

PR body was truncated to here.

renovate · 2026-03-21T01:57:28Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package.json

Command failed: corepack use pnpm@11.20.0

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --package futures-util@0.3.32 --precise 0.3.33
error: package ID specification `futures-util@0.3.32` did not match any packages
help: there are similar package ID specifications:

  futures-util@0.3.34

File name: Cargo.toml

Artifact update for futures-util resolved to version 0.3.34, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 0.3.33
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

greptile-apps · 2026-03-21T01:59:49Z

Greptile Summary

This is a routine automated dependency update PR from Renovate Bot, bumping a wide range of dependencies across the stack: GitHub Actions (setup-node v6.3.0, mise-action v3.6.3, zizmor-action v0.5.2, codeql-action v4.32.6), Node.js packages (pnpm 10.32.1, vitest/vite 4.1.0/8.0.0 stable releases from beta, oxfmt, oxlint, undici, electron, node-addon-slsa), Rust crates (tempfile 3.27.0), Python tools (ruff, semgrep, pyrefly, zizmor), and various aqua-managed CLI tools (uv, gh, gitleaks, shfmt, nextest). All GitHub Action references continue to be pinned by full commit SHA, which is good practice for this repository.

Most changes are straightforward version bumps with no behavioral impact on the codebase itself.
Several beta versions (vitest, vite) graduate to stable releases — a positive change.
The packageManager field in package.json was updated to pnpm@10.32.1 but the SHA512 integrity hash that was present in the old value was dropped, removing Corepack's ability to verify the pnpm binary on download.

Confidence Score: 4/5

This PR is safe to merge; the only notable finding is a non-critical omission of the Corepack integrity hash for pnpm.
All changes are automated dependency bumps. GitHub Actions remain SHA-pinned, Dockerfile images are digest-pinned, and lock files are fully regenerated. The one notable point is the missing SHA512 hash in the packageManager field, which is a best-practice/supply-chain hygiene issue rather than an active vulnerability. Everything else is routine.
package.json — missing SHA512 hash in the packageManager field.

Important Files Changed

Filename	Overview
package.json	Updated pnpm to 10.32.1 but dropped the SHA512 integrity hash from the packageManager field, removing Corepack's ability to verify the binary's integrity on download.
Dockerfile	Updated docker/dockerfile syntax to 1.22 and manylinux_2_28 base image to a new digest. Both references are pinned by SHA256. No issues found.
Cargo.lock	Updated tempfile from 3.26.0 to 3.27.0 which pulls in getrandom 0.3.4 instead of 0.4.2, and resolves different windows-sys versions for various crates. Standard lock file update.
mise.toml	Updated gitleaks, uv, gh CLI, nextest, and mvdan/sh (shfmt) to newer patch/minor versions. No issues found.
pyproject.toml	Updated pyrefly, ruff, semgrep, and zizmor to newer versions. No issues found.
pnpm-workspace.yaml	Updated catalog versions for @vitest/coverage-istanbul, electron, oxfmt, oxlint, undici, vite, and vitest from beta/older versions to stable releases. No issues found.

Comments Outside Diff (1)

package.json, line 202 (link)

Missing Corepack integrity hash for pnpm

The previous packageManager value included a +sha512 integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

corepack use pnpm@10.32.1

This will update package.json with the correct hash for 10.32.1, e.g.:

Consider asking Renovate to preserve the hash when bumping the packageManager field (the pinDigests option may help, or a custom packageRules entry targeting packageManager).

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:



Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:

```suggestion
  "packageManager": "pnpm@10.32.1+sha512.<hash-for-10.32.1>",
```

Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: "Update all dependenc..."}

codecov · 2026-04-20T21:27:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

codspeed-hq · 2026-05-18T07:49:49Z

Merging this PR will not alter performance

✅ 15 untouched benchmarks

_{Comparing renovate/all-dependencies (a483481) with main (32fd41a)}

socket-security · 2026-06-07T09:05:42Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

socket-security · 2026-06-13T02:06:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/fd-lock@2.2.0
	npm/vitest@4.1.10
	npm/@types/node@25.9.5
	npm/tsx@4.23.7
	npm/@vitest/coverage-istanbul@4.1.10
	npm/vite@8.2.0
	npm/vite-plugin-dts@5.0.3
	npm/oxfmt@0.62.0
	npm/typedoc@0.28.20
	npm/monocart-reporter@2.12.4
	npm/oxlint@1.77.0
	npm/markdownlint-cli2@0.23.2
	npm/undici@8.10.0
	npm/@codspeed/vitest-plugin@5.7.1
	npm/electron@42.8.1
	npm/@playwright/test@1.62.1
	pypi/pyrefly@1.0.0 ⏵ 1.2.0
	pypi/ruff@0.15.14 ⏵ 0.16.1	⁺¹
	pypi/zizmor@1.25.2 ⏵ 1.29.0

View full report

renovate Bot force-pushed the renovate/all-dependencies branch 4 times, most recently from 1c2d5e5 to 40653e4 Compare March 22, 2026 02:03

github-advanced-security AI found potential problems Mar 22, 2026

View reviewed changes