fix(deps): update all dependencies by renovate[bot] · Pull Request #124 · vadimpiven/node_reqwest

renovate · 2026-03-21T01:57:25Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@playwright/test (source)	`1.64.0` → `1.64.1`	pnpm.catalog.default	patch	`1.65.0`
@types/node (source)	`26.6.5` → `26.6.6`	pnpm.catalog.default	patch
@vitest/coverage-v8 (source)	`4.1.11` → `4.1.12`	pnpm.catalog.default	patch
CodSpeedHQ/action	`v5.5.0` → `v5.6.0`	action	minor	`v5.6.3` (+1)
apple-actions/import-codesign-certs	`v7.1.0` → `v7.2.0`	action	minor
aqua:anchore/syft	`1.54.1` → `1.55.0`	tools	minor	`1.57.0` (+1)
aqua:aquasecurity/trivy	`0.76.0` → `0.76.1`	tools	patch	`0.76.2`
aqua:astral-sh/uv	`0.13.1` → `0.13.6`	tools	patch	`0.13.7`
aqua:cargo-bins/cargo-binstall	`1.25.3` → `1.26.1`	tools	minor	`1.26.2`
aqua:cli/cli	`2.102.0` → `2.103.3`	tools	minor
docker/dockerfile	`1.27.1` → `1.28.0`	syntax	minor
docker/login-action	`v4.6.0` → `v4.7.0`	action	minor	`v4.8.0`
electron	`44.7.0` → `44.10.0`	pnpm.catalog.default	minor	`44.10.2` (+1)
github/codeql-action	`v4.39.0` → `v4.39.1`	action	patch	`v4.39.3` (+1)
github:nextest-rs/nextest	`0.9.148` → `0.9.150`		patch	`0.9.151`
github:nextest-rs/nextest	`0.9.148` → `0.9.150`	tools	patch	`0.9.151`
jdx/mise	`v2026.10.12` → `v2026.10.24`		patch	`v2026.11.3` (+4)
jdx/mise-action	`v5.2.0` → `v5.2.4`	action	patch	`v5.2.6` (+1)
markdownlint-cli2	`0.23.3` → `0.24.0`	pnpm.catalog.default	minor
mitmproxy	`==12.2.3` → `==12.3.1`	dependency-groups	minor
monocart-reporter	`2.14.1` → `2.15.1`	pnpm.catalog.default	minor
node (source)	`24.22.0` → `24.22.2`	tools	patch
npm:pnpm (source)	`12.14.0` → `12.16.1`	tools	minor	`12.18.0` (+1)
oxfmt (source)	`0.72.0` → `0.75.0`	pnpm.catalog.default	minor	`0.77.0` (+1)
oxlint (source)	`1.87.0` → `1.90.0`	pnpm.catalog.default	minor	`1.92.0` (+1)
pnpm (source)	`12.14.0+sha512.c18ba6d87993d3d164cb5e8948f32b2c06ee854487e06cd8d86781342fb3e5bb4634367034711e86802baa9c37bea906ce1929ad08d70884c97d801df13389a6` → `12.16.1`	packageManager	minor	`12.18.0` (+1)
pnpm (source)	`12.14.0` → `12.16.1`	dependencies	minor	`12.18.0` (+1)
python (source)	`3.14.5` → `3.15.1`		minor	`3.15.2`
ruff (source, changelog)	`==0.17.0` → `==0.17.3`	dependency-groups	patch	`0.17.4`
rust (source, changelog)	`nightly-2026-10-17` → `nightly-2026-10-30`	toolchain	patch	`nightly-2026-11-06` (+6)
rust (source, changelog)	`nightly-2026-10-17` → `nightly-2026-10-30`	tools	patch	`nightly-2026-11-06` (+6)
tauri-winres	`0.3.6` → `0.3.7`	workspace.dependencies	patch
tokio (source)	`1.53.3` → `1.54.1`	workspace.dependencies	minor
undici (source)	`8.11.2` → `8.12.3`		minor	`8.12.4`
undici (source)	`8.11.2` → `8.12.3`	pnpm.catalog.default	minor	`8.12.4`
vitest (source)	`4.1.11` → `4.1.12`	pnpm.catalog.default	patch
zizmor (source)	`==1.30.1` → `==1.31.1`	dependency-groups	minor	`1.32.0`
zizmorcore/zizmor-action	`v0.7.1` → `v0.8.0`	action	minor	`v0.8.1`

Release Notes

microsoft/playwright (@playwright/test)

`v1.64.1`

Compare Source

Bug Fixes

#43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
#43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

vitest-dev/vitest (@vitest/coverage-v8)

`v4.1.12`

Compare Source

🐞 Bug Fixes

mocker: Harden manual and redirect mocks [backport to v4] - by @sheremet-va in #11580 (b8253)

View changes on GitHub

CodSpeedHQ/action

`v5.6.0`

Compare Source

Bumps the CodSpeed runner to v5.6.0.

Highlights

More consistent CPU Simulation results

Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions.

🐛 Bug Fixes

Keep the user's HOME when wrapping commands with sudo by @lvaroqui in #588

⚙️ Internals

Bump pinned valgrind-codspeed to 3.26.0-0codspeed10 by @adriencaccia in #593
- fix(callgrind): suppress L3 warning for explicit LL settings by @not-matthias in CodSpeedHQ/valgrind-codspeed#52
- fix(initimg): stabilize Linux startup stack layout by @not-matthias in CodSpeedHQ/valgrind-codspeed#53

Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

chore: bump runner version to 5.6.0 by @github-actions[bot] in #253

Full Changelog: CodSpeedHQ/action@v5.5.0...v5.6.0

apple-actions/import-codesign-certs

`v7.2.0`

Compare Source

What's Changed

Add actionlint and zizmor by @daveisfera in Apple-Actions#219
Bump knip from 6.38.0 to 6.39.0 by @dependabot[bot] in Apple-Actions#217
Bump eslint from 10.9.1 to 10.12.0 by @dependabot[bot] in Apple-Actions#216
Bump @types/node from 26.1.2 to 26.6.4 by @dependabot[bot] in Apple-Actions#218
Add security argv unit tests by @daveisfera in Apple-Actions#227
Bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in Apple-Actions#220
Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in Apple-Actions#221
Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 by @dependabot[bot] in Apple-Actions#222
Bump eslint from 10.12.0 to 10.13.0 by @dependabot[bot] in Apple-Actions#223
Bump prettier from 3.9.9 to 3.9.10 by @dependabot[bot] in Apple-Actions#224
Bump vitest from 5.0.3 to 5.0.5 by @dependabot[bot] in Apple-Actions#225
Bump knip from 6.39.0 to 6.42.1 by @dependabot[bot] in Apple-Actions#226
Rebuild dist/ on Dependabot npm PRs by @daveisfera in Apple-Actions#229
Bump undici from 6.29.0 to 6.29.1 by @dependabot[bot] in Apple-Actions#228
Standardize dist generation on the shared esbuild setup by @daveisfera in Apple-Actions#230

Full Changelog: Apple-Actions/import-codesign-certs@v7.1.0...v7.2.0

anchore/syft (aqua:anchore/syft)

`v1.55.0`

Compare Source

Added Features

Add support for scanning IPK packages using the deb-archive-cataloger [PR #5111 @skyhisi]

Bug Fixes

Pin Gguff lib to prevent dropping packages [PR #5447 @spiffcs]
Licensing: copyright holder missing, needed for Debian packaging [Issue #5394] [PR #5414 @wagoodman]
Syft cli.Command() panics when invoked multiple times [Issue #2285] [PR #5386 @JasonMetal]

Additional Changes

bump go-make module and action together [PR #5415 @wagoodman]

Dependencies

49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

GO-2026-6603 (High) — golang.org/x/net
GO-2026-6610 (High) — golang.org/x/net
GO-2026-6611 (High) — golang.org/x/net
GO-2026-6612 (Critical) — golang.org/x/net
GO-2026-6617 (High) — golang.org/x/net

Updated (46 packages)

cloud.google.com/go/auth v0.23.2 → v0.23.3
cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
cloud.google.com/go/storage v1.65.1 → v1.68.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
github.com/github/go-spdx/v2 v2.7.0 → v2.7.1
github.com/go-git/go-billy/v5 v5.9.1 → v5.9.2
github.com/go-git/go-git/v5 v5.19.2 → v5.19.3
github.com/google/s2a-go v0.1.9 → v0.1.10
github.com/googleapis/enterprise-certificate-proxy v0.3.20 → v0.3.22
github.com/googleapis/gax-go/v2 v2.24.0 → v2.24.1
github.com/gookit/color v1.6.1 → v1.6.2
github.com/gpustack/gguf-parser-go v0.26.3 → v0.26.4
github.com/hashicorp/go-getter v1.8.9 → v1.8.10
github.com/pb33f/ordered-map/v2 v2.3.1 → v2.3.2
github.com/pjbgf/sha1cd v0.6.0 → v0.7.0
github.com/spiffe/go-spiffe/v2 v2.7.0 → v2.8.1
golang.org/x/crypto v0.57.0 → v0.58.0
golang.org/x/net v0.59.0 → v0.61.0 (🟢 remediated GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617)
golang.org/x/oauth2 v0.36.0 → v0.37.0
golang.org/x/sync v0.23.0 → v0.24.0
golang.org/x/sys v0.48.0 → v0.49.0
golang.org/x/term v0.46.0 → v0.47.0
golang.org/x/text v0.42.0 → v0.43.0
golang.org/x/tools v0.50.0 → v0.51.0
google.golang.org/api v0.294.0 → v0.299.0
google.golang.org/genproto/googleapis/rpc v0.0.0-da73d73 → v0.0.0-b142276
google.golang.org/grpc v1.83.2 → v1.84.0
modernc.org/cc/v4 v4.29.2 → v4.29.7
modernc.org/ccgo/v4 v4.35.0 → v4.36.1
modernc.org/libc v1.75.7 → v1.77.1
modernc.org/sqlite v1.59.0 → v1.60.1

Added (1 package)

github.com/pb33f/go-yaml v0.1.0

Removed (2 packages)

github.com/klauspost/cpuid/v2 v2.3.0
go.yaml.in/yaml/v4 v4.0.0-rc.2

(Full Changelog)

aquasecurity/trivy (aqua:aquasecurity/trivy)

`v0.76.1`

Compare Source

🔐 Security update: eMudhra CA incident 🛡️

Trivy v0.76.1 includes mitigations for the eMudhra intermediate CA key compromise.

Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as CVE-2026-111943.
Official container images include an updated Alpine CA trust store that rejects the affected certificate chains.

We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date.

Changelog

e713f67 release: v0.76.1 [release/v0.76] (#11445)
6647bd6 fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#11446)
e0964c9 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#11443)
992c360 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#11442)

astral-sh/uv (aqua:astral-sh/uv)

`v0.13.6`

Compare Source

Released on 2026-10-26.

Enhancements

Accept an empty UV_RUN_RECURSION_DEPTH as zero and report invalid values consistently (#22814)
Explain how to add project metadata when uv init finds a pyproject.toml without a [project] table (#22916)

Python

Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (#22938)

Preview features

Detect NVIDIA GPU capabilities when selecting compatible wheel variants with wheel-variants (#22690)
Nest each module's owners in an object in uv workspace metadata output (#22638)
Report the unsupported properties required by an incompatible wheel variant (#22719)

Performance

Reduce peak memory use when resolving large workspaces (#22860, #22863, #22864, #22866, #22870)
Reduce peak memory use when locking or upgrading large projects (#22833, #22834)
Speed up redirected output from uv export and uv pip compile (#22840)
Reuse cached or active environments when running PEP 723 scripts without dependencies (#21458)
Reduce parsing overhead for build dependency and build backend settings (#22848, #22871, #22879, #22884)
Reduce parsing overhead for project sources and workspace references (#22880, #22883)
Reduce parsing overhead for cache, exclusion, cutoff, and preview settings (#22876, #22877, #22878, #22887)
Reduce PyPI metadata parsing overhead (#22874, #22875)
Speed up parsing tool receipt requirements (#22885)

Bug fixes

Prevent uv run --active --script and uv sync --active --script from deleting non-virtual-environment directories (#21464)
Use AMD64 for platform_machine when resolving for x86-64 Windows (#22935)
Preserve free-threaded and other non-default variants in uv python upgrade (#22836)
Allow uv init --no-package and uv init --script when UV_INIT_BUILD_BACKEND is set (#22907)
Prevent panics when rendering containment markers with local versions (#22815)

Documentation

Update the Docker guide and reproduction examples to use uv 0.13.5 (#22867)

`v0.13.5`

Compare Source

Released on 2026-10-21.

Following uv 0.13.4, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to python-build-standalone 20261021, including the CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases. These builds include pip 26.2.2 both preinstalled in the managed interpreter and bundled with ensurepip, which installs pip by default when you run python -m venv. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run uv python upgrade to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

Enhancements

Report incompatible self-dependencies directly in resolution errors (#21845)

Python

Add CPython 3.15.1, 3.14.9, and 3.13.17 (#22802)

Preview features

Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants (#22535, #22536, #22687, #22688)

Performance

Reduce peak memory use when resolving dependencies across multiple environments (#22769, #22770, #22784)
Speed up exports with complex transitive extras by resolving activation across the dependency graph (#22751)
Reduce uv's binary size by keeping additional error formatters out of line (#22775)
Reduce overhead when parsing custom build cache keys (#22749)

Bug fixes

Lock packages distributed only as Android wheels without a source distribution (#22806)
Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (#22751)
Reject invalid custom build cache keys instead of silently falling back to the defaults (#22749)

Security

Reject certificate chains containing compromised eMudhra intermediate keys via rustls-webpki 0.103.16 (#22777)
Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (#22773)

`v0.13.4`

Compare Source

Released on 2026-10-20.

Preview features

Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under wheel-variants (#22512)

Other changes

Update the bundled Mozilla root certificates via webpki-root-certs 1.0.10 (#22760)

`v0.13.3`

Compare Source

Released on 2026-10-20.

Performance

Avoid severe uv export slowdowns in dependency graphs with extras (#22750)

`v0.13.2`

Compare Source

Released on 2026-10-19.

Enhancements

Report all installed packages in uv workspace metadata, including packages outside the selected resolution (#22395)
Include supported environment restrictions when exporting pylock.toml (#22596)
Retry dropped GET and HEAD requests when fetching package and index data (#22672)
Preserve encoding declarations in wheel data scripts that require shell launchers (#22526)
Show causes and hints when uv python find --script cannot discover an interpreter, including with -q (#22549)
Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh (#22538, #22572)
Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's [build-system].requires validation (#22577)

Python

Add PyPy 3.11.17 and 3.12.15 (#22578)

Preview features

Fetch and parse PEP 825 index-level variant metadata with wheel-variants (#22509, #22511)

Performance

Avoid exponential work when simplifying, traversing, and exporting complex dependency markers (#22608, #22615, #22651, #22674)
Reduce the time and memory used to parse and store complex dependency markers (#22675, #22676, #22681)
Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups (#22565, #22625)
Speed up project discovery in large workspaces by caching member names (#22635)
Reduce uv's binary size and speed up CycloneDX exports (#22431)
Reduce uv-build binary size, including Linux x86_64 wheels (#22539, #22573)
Reduce allocations when parsing TOML (#22679)

Bug fixes

Respect --exclude-newer when a newer wheel for the selected source distribution is already cached (#22685)
Prevent URL credentials from leaking through diagnostics or persisted metadata (#22600, #22601, #22617, #22622, #22646)
Keep separate cache entries for signed --find-links URLs that differ only in sensitive query values (#22630)
Honor PEP 751 environment restrictions when installing or syncing from pylock.toml (#22594)
Use configured credentials before prompting during uv publish, and avoid prompting when no upload occurs (#22593)
Match recursive build globs against complete file paths and ignore invalid license symlinks (#22581, #22583)
Return an error for invalid uv pip compile --python-version values instead of panicking (#22727)
Reject invalid pylock.toml output filenames before resolution instead of panicking (#22725)
Avoid panicking during repeated resolution conflicts involving fixed-priority packages (#22589)
Create version aliases correctly when installing managed Python into a relative directory (#22547)
Show incompatibilities from failing uv pip check invocations with -q (#22544)
Treat logically equivalent dependency markers as equal regardless of construction order (#22680)

Rust API

Require the opt-in unsafe-url feature to use raw url::Url APIs in uv-pep508 (#22623)

Documentation

Clarify credential lookup, environment synchronization, managed Python, and integration guidance (#22542)

Other changes

Use stable sh.astral.* signing identifiers for macOS binaries (#22648)

cargo-bins/cargo-binstall (aqua:cargo-bins/cargo-binstall)

`v1.26.1`

Compare Source

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

Other changes:

`v1.26.0`

Compare Source

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

reject bin names that escape the install dir, thank you @NotAFlightRisk for spotting and reporting this (GHSA-jxjx-4v2j-96qg #2712)
add --completions flag to print shell completions (#2701)
add --dns to select the DNS resolver at runtime (#1699 #2709)

Other changes:

upgrade dependencies

cli/cli (aqua:cli/cli)

`v2.103.3`: GitHub CLI 2.103.3

Compare Source

What's Changed

🐛 Fixes

fix(gh auth status): explain expired expiring tokens with --no-refresh by @babakks in #14815

Full Changelog: cli/cli@v2.103.2...v2.103.3

`v2.103.2`: GitHub CLI 2.103.2

Compare Source

🐛 Fixes

Allow server to arbitrate which GitHub App installation tokens can attach files by @martinajir in #14804
Defer --attach credential checks to the upload endpoint by @BagToad in #14805

New Contributors

@martinajir made their first contribution in #14804

Full Changelog: cli/cli@v2.103.1...v2.103.2

`v2.103.1`: GitHub CLI 2.103.1

Compare Source

What's Changed

🐛 Fixes

Avoid repeating the skill installation safety warning by @tommaso-moro in #14784
feat(gh auth login): hint at --expiring when no preference is set by @babakks in #14798

📚 Docs & Chores

Document extrepo installation on Debian by @williammartin in #14796

Dependencies

Update github.com/digitorus/pkcs7 dependency by @bdehamer in #14791

Full Changelog: cli/cli@v2.103.0...v2.103.1

`v2.103.0`: GitHub CLI 2.103.0

Compare Source

Expiring, auto-refreshing OAuth tokens (preview)

gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.

To opt in for a single sign-in, run:

gh auth login --expiring

To prefer expiring credentials for every sign-in, run:

gh config set expiring_credentials enabled

gh auth status shows whether a credential is refreshable and when the current access token expires. Both gh auth status and gh auth token automatically refresh the access token when needed. Expiring tokens are available on github.com and GHE.com; on hosts t

[!IMPORTANT]
✂ PR body was truncated to here.

greptile-apps · 2026-03-21T01:59:49Z

Greptile Summary

This is a routine automated dependency update PR from Renovate Bot, bumping a wide range of dependencies across the stack: GitHub Actions (setup-node v6.3.0, mise-action v3.6.3, zizmor-action v0.5.2, codeql-action v4.32.6), Node.js packages (pnpm 10.32.1, vitest/vite 4.1.0/8.0.0 stable releases from beta, oxfmt, oxlint, undici, electron, node-addon-slsa), Rust crates (tempfile 3.27.0), Python tools (ruff, semgrep, pyrefly, zizmor), and various aqua-managed CLI tools (uv, gh, gitleaks, shfmt, nextest). All GitHub Action references continue to be pinned by full commit SHA, which is good practice for this repository.

Most changes are straightforward version bumps with no behavioral impact on the codebase itself.
Several beta versions (vitest, vite) graduate to stable releases — a positive change.
The packageManager field in package.json was updated to pnpm@10.32.1 but the SHA512 integrity hash that was present in the old value was dropped, removing Corepack's ability to verify the pnpm binary on download.

Confidence Score: 4/5

This PR is safe to merge; the only notable finding is a non-critical omission of the Corepack integrity hash for pnpm.
All changes are automated dependency bumps. GitHub Actions remain SHA-pinned, Dockerfile images are digest-pinned, and lock files are fully regenerated. The one notable point is the missing SHA512 hash in the packageManager field, which is a best-practice/supply-chain hygiene issue rather than an active vulnerability. Everything else is routine.
package.json — missing SHA512 hash in the packageManager field.

Important Files Changed

Filename	Overview
package.json	Updated pnpm to 10.32.1 but dropped the SHA512 integrity hash from the packageManager field, removing Corepack's ability to verify the binary's integrity on download.
Dockerfile	Updated docker/dockerfile syntax to 1.22 and manylinux_2_28 base image to a new digest. Both references are pinned by SHA256. No issues found.
Cargo.lock	Updated tempfile from 3.26.0 to 3.27.0 which pulls in getrandom 0.3.4 instead of 0.4.2, and resolves different windows-sys versions for various crates. Standard lock file update.
mise.toml	Updated gitleaks, uv, gh CLI, nextest, and mvdan/sh (shfmt) to newer patch/minor versions. No issues found.
pyproject.toml	Updated pyrefly, ruff, semgrep, and zizmor to newer versions. No issues found.
pnpm-workspace.yaml	Updated catalog versions for @vitest/coverage-istanbul, electron, oxfmt, oxlint, undici, vite, and vitest from beta/older versions to stable releases. No issues found.

Comments Outside Diff (1)

package.json, line 202 (link)

Missing Corepack integrity hash for pnpm

The previous packageManager value included a +sha512 integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

corepack use pnpm@10.32.1

This will update package.json with the correct hash for 10.32.1, e.g.:

Consider asking Renovate to preserve the hash when bumping the packageManager field (the pinDigests option may help, or a custom packageRules entry targeting packageManager).

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:



Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:

```suggestion
  "packageManager": "pnpm@10.32.1+sha512.<hash-for-10.32.1>",
```

Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: "Update all dependenc..."}

codecov · 2026-04-20T21:27:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

codspeed · 2026-05-18T07:49:49Z

Merging this PR will improve performance by 33.93%

3 warnings

⚠️ 10 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚠️ 2 benchmarks with a significant change ran on different hardware

Their base and head results were measured on machines with a different CPU, core count or memory, so the changes might not come from the code. Run base and head on the same runner type.

Learn more about Macro Runners

See affected benchmarks

⚠️ 2 benchmarks with a significant change ran in a different software environment

Their base and head results were measured with a different OS or toolchain, such as compiler, runtime or library versions, so the changes might come from this difference rather than from the code. Open an affected benchmark to see what changed.

See affected benchmarks

⚡ 2 improved benchmarks
✅ 13 untouched benchmarks

Performance Changes

	Benchmark	`BASE`	`HEAD`	Efficiency
⚡	`node-reqwest.Agent`	119.8 ms	82.6 ms	+44.97%
⚡	`node-reqwest.Agent`	127.2 ms	102.8 ms	+23.73%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing renovate/all-dependencies (150b605) with main (5644fe5)}

socket-security · 2026-06-07T09:05:42Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

socket-security · 2026-10-20T19:56:02Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
cargo/tokio@1.53.3 ⏵ 1.54.1
npm/@vitest/coverage-v8@4.1.11 ⏵ 4.1.12				⁺²
npm/vitest@4.1.11 ⏵ 4.1.12
npm/@types/node@26.6.5 ⏵ 26.6.6	⁺¹		⁺¹
npm/oxfmt@0.72.0 ⏵ 0.75.0	^-7		⁺¹
npm/markdownlint-cli2@0.23.3 ⏵ 0.24.0			⁺¹	^-4
npm/monocart-reporter@2.14.1 ⏵ 2.15.1			⁺¹	⁺¹
npm/oxlint@1.87.0 ⏵ 1.90.0			⁺¹	^-1
npm/undici@8.11.2 ⏵ 8.12.3		⁺⁴⁰	⁺¹
pypi/mitmproxy@12.2.3 ⏵ 12.3.1
npm/electron@44.7.0 ⏵ 44.10.0		⁺¹⁶	⁺¹
cargo/tauri-winres@0.3.6 ⏵ 0.3.7
npm/@playwright/test@1.64.0 ⏵ 1.64.1
pypi/ruff@0.17.0 ⏵ 0.17.3	⁺¹
pypi/zizmor@1.30.1 ⏵ 1.31.1

View full report

renovate Bot force-pushed the renovate/all-dependencies branch 4 times, most recently from 1c2d5e5 to 40653e4 Compare March 22, 2026 02:03

github-advanced-security AI found potential problems Mar 22, 2026

View reviewed changes