Repository navigation
Update development dependencies - #1558
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/development-dependencies
branch
4 times, most recently
from
October 19, 2026 10:43
9b95050 to
b503ae9
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Andrew Haines <haines@cerbos.dev>
Signed-off-by: Andrew Haines <haines@cerbos.dev>
Signed-off-by: Andrew Haines <haines@cerbos.dev>
haines
force-pushed
the
renovate/development-dependencies
branch
from
October 19, 2026 10:47
b503ae9 to
1e89418
Compare
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
haines
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
14.6.7→14.6.80.5.8→0.6.0v3.2.0→v3.3.0v7.0.1→v7.0.2ba8869c→6ba41ad10.1.0→10.1.110.2.026.11.1→26.12.026.11.1→26.12.012.8.2→12.13.012.14.0v3.0.0→v3.1.13.9.9→3.9.10v3.7.13→v3.7.14v3.7.15(+1)2.13.0→2.15.32.18.0(+2)8.71.1→8.71.25.0.3→5.0.45.0.54.6.5→4.6.7Release Notes
testing-library/user-event (@testing-library/user-event)
v14.6.8Compare Source
Bug Fixes
actions/create-github-app-token
v3.3.0Compare Source
Features
Bug Fixes
actions/upload-artifact
v7.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2
sindresorhus/execa (execa)
v10.1.1Compare Source
execaNode()and thenodeoption missing IPC in their types2633abbescapedCommandandverbosequoting arguments when using theshelloptionb2c3a54b57d643verboseoption printing colors whenstderris not a terminala2eda67stdiniterables and input transforms edge cases6925cc35f80cde.pipe()and stream conversion edge casesd3ec10dparseCommandString()andexecaNode()edge casesfb92da1timeoutandforceKillAfterDelayvaluesd9a5689result.alledge casesc4262ffnodejs/node (node)
v26.12.0: 2026-10-14, Version 26.12.0 (Current), @richardlauCompare Source
Notable Changes
1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #665337f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335Commits
30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #666042f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #665994ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602a888e51062] - build: support Python 3.15 (Mike McCready) #657502afab9a63b] - build: do not include shared gtest innodelink path (Antoine du Hamel) #66626f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #666975fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #664134e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413883250fee2] - crypto: remove KEM key locking (Filip Skokan) #664139d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #664138d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312e5360b5a08] - deps: update googletest to988ea2c(Node.js GitHub Bot) #666527eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663007872a85d] - deps: V8: cherry-pick8d14d49(Antoine du Hamel) #66627f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #666201a33e914e8] - deps: V8: cherry-pick7d5eb1d(inoway46) #665663294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #664815c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #665630e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #6625273a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #6628682223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #665308904178498] - doc: document linux-x64-musl build toolchain (Issac) #665231e8247a74e] - doc: run license-builder (github-actions[bot]) #66517b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #664531ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #6645569148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #6648332833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #664887f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #666171722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #6643005d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #665342cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #6653683f507845d] - meta: bump nodejs/node-pr-labeler todfe5eb3(Soul Lee) #666066fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #6253051f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #665561aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #665539648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #663025b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #662609ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #6640454867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #665214314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #665550e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #6662006f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #664002e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431cd86506bc2] - src: mark config file as stable (Marco Ippolito) #6643115ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #664243f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #664836cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #6648316833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #664834b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #664837ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #664836eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #6648369d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #664836b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #664838a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #6648330cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #6648342ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #6647393596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #655984ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #6657630814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #6559820441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #663389618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #663227d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #663227309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #664763d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #665284760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #6644563c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365pnpm/pnpm (pnpm)
v12.13.0: pnpm 12.13.0Compare Source
This release adds the
pnpm profileandpnpm tokencommands, thestoreIndexFormat: filessetting for stores shared over a network filesystem, and faster Python dependency resolution.Minor Changes
Added the
pnpm profilecommand to view and update registry user profile settings.Added
pnpm tokento list, create, and revoke authentication tokens on the registry.Added the
storeIndexFormatsetting. Set it tofilesto keep a store's package index as one file per package instead of the SQLiteindex.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corruptindex.db.Added the
nodePackageMapsetting, which groups the package-map settings.nodePackageMap.mode: write-onlywritesnode_modules/.package-map.jsonfor other tools without making Node.js load it.mode: loadalso makes Node.js load the map, likenodeExperimentalPackageMap: true.nodePackageMap.typereplacesnodePackageMapType. The old settings still work #14937.Patch Changes
Setting up pnpm
pnpm setupnow works when pnpm was installed with npm on macOS. It installed pnpm from npm'sbindirectory and left a$PNPM_HOME/bin/pnpmthat could not run #16855.pnpm runs again after
pnpm setupwhenglobalShimsenables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #16874.A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that
rust-toolchain.tomlnames. It used to install the MSVC toolchain.Installing packages
On macOS,
pnpm installno longer fails withERR_PNPM_LOCKFILE_WRITE_FILEwhen the project is on a virtiofs or SMB share. pnpm now falls back to a regularfsyncwhen the file system rejects a full sync #16846.On macOS,
pnpm install,pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.pnpm installnow puts the executables of a Python build backend's requirements on thePATHwhile the backend runs. Projects built withuv_buildnow install. Before, they failed with "uv-build was not properly installed".Removing a
link:dependency now also removes its symlink fromnode_moduleswhennodeLinkerishoisted#16884.pnpm-lock.yamlno longer records the tarball URL of a package installed from a scoped registry, such as one set by@types:registry=, when pnpm can rebuild the URL from that registry #16866.Packing, auditing, and pipelines
pnpm packandpnpm publishnow pack onlypackage.json, the README, the license, and the files named inmainandbinwhenfilesis an empty array. They used to pack every file in the package #16889.pnpm auditandpnpm audit signaturesno longer check runtimes installed throughdevEngines.runtime, such asnode@runtime:24.21.0, against the npm package of the same name.pnpm audit signaturesreported these runtimes as having an invalid registry signature #16869.pnpm pipelinenow runs the root's tasks whenpnpm-workspace.yamllists only the root inpackagesor omitspackages, aspnpm -r rundoes. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run,pnpm pipelinenow reports that no projects are selected #16849.Performance
pnpm installresolves Python dependencies faster. With--lockfile-only, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.
pnpm installwithenableModulesDir: falsenow verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.Platinum Sponsors
Gold Sponsors
v12.12.1: pnpm 12.12.1Compare Source
This release adds OIDC authentication to
pnpm dist-tagand thetool:protocol.pnpm publishnow checks which registry anNPM_ID_TOKENwas issued for before using it.Patch Changes
pnpm publishnow uses anNPM_ID_TOKENonly if itsaudclaim matches the selected registry, such asnpm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.pnpm dist-tag add,rm, andlsnow support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.Added the
tool:protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn.pnpm add bun@tool:1.3.0,pnx node@tool:22, andpnx yarn@tool:4work like theruntime:spelling, which stays supported as an alias. A lockfile written forruntime:stays up to date whenpackage.jsonswitches totool:, and the other way around.A named registry can no longer be called
tool.Platinum Sponsors
Gold Sponsors
v12.12.0: pnpm 12.12.0Compare Source
This release shares task results and dependency builds through a remote cache, adds the
addMissingPeerTypessetting, and letspnpm add --configandpnpm updatemanage configuration dependencies. It also fixesdangerouslyAllowAllBuildsrunning the build scripts of packages thatallowBuildsdenies.Minor Changes
pnpm pipelinecan share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache.The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new
remoteCachesetting, which names the server and holds the signing keys.pnpm pipeline --reportrecords the run under the organizationremoteCache.orgnames.Added the
addMissingPeerTypessetting, which links the@typespackage of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends onreactgets the project's@types/reactlinked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on #15689.pnpm add --configandpnpm updatenow handle configuration dependencies the way they handle other dependencies [#16814](https://redirect.github.com/pnConfiguration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.