Skip to content

Update all dependencies - #26

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies
Open

Update all dependencies#26
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 7, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@becklyn/eslint (source) ^1.1.2 → ^1.3.1 age confidence devDependencies minor
@becklyn/next (source) ^2.0.0 → ^2.2.0 age confidence dependencies minor
@becklyn/prettier (source) ^2.1.2 → ^2.1.14 age confidence devDependencies patch
@becklyn/tsconfig (source) ^1.0.0 → ^1.1.3 age confidence devDependencies minor
@fraym/auth ^0.36.0 → ^0.50.3 age confidence dependencies minor
@fraym/react ^0.36.0 → ^0.50.3 age confidence dependencies minor
@fraym/streams ^0.36.0 → ^0.50.3 age confidence dependencies minor
@types/node (source) ^22.15.21 → ^22.20.1 age confidence devDependencies minor
@types/react (source) ^19.1.5 → ^19.2.18 age confidence devDependencies minor
@types/react-dom (source) ^19.1.5 → ^19.2.4 age confidence devDependencies minor
@urql/exchange-retry (source) ^1.3.1 → ^1.3.2 age confidence dependencies patch
gql.tada (source) ^1.8.10 → ^1.11.3 age confidence dependencies minor
graphql-ws (source) ^6.0.5 → ^6.2.0 age confidence dependencies minor
node (source) >=22 → >=22.23.2 age confidence engines minor
react (source) ^19.1.0 → ^19.2.8 age confidence dependencies minor
react-dom (source) ^19.1.0 → ^19.2.8 age confidence dependencies minor
sass ^1.89.0 → ^1.102.0 age confidence dependencies minor
typescript (source) ^5.8.3 → ^5.9.3 age confidence devDependencies minor

Release Notes

Becklyn-Studios/ts-libs (@​becklyn/eslint)

v1.3.1

Compare Source

Patch Changes

v1.3.0

Compare Source

v1.2.3

Compare Source

Patch Changes

v1.2.2

Compare Source

v1.2.1

Compare Source

Patch Changes

v1.2.0

Compare Source

Minor Changes

v1.1.8

Compare Source

Patch Changes

v1.1.7

Compare Source

Patch Changes

v1.1.6

Compare Source

Patch Changes

v1.1.5

Compare Source

Patch Changes
  • d8b104f: Add/update homepage and repsitory urls for all packages

v1.1.4

Compare Source

Patch Changes

v1.1.3

Compare Source

Patch Changes
fraym/fraeym (@​fraym/auth)

v0.50.3

Compare Source

v0.50.2

Compare Source

v0.50.1

Compare Source

v0.50.0

Compare Source

v0.49.7

Compare Source

v0.49.6

Compare Source

v0.49.5

Compare Source

v0.49.4

Compare Source

v0.49.3

Compare Source

v0.49.2

Compare Source

v0.49.1

Compare Source

v0.49.0

Compare Source

v0.48.3

Compare Source

v0.48.2

Compare Source

v0.48.1

Compare Source

v0.48.0

Compare Source

v0.47.0

Compare Source

v0.46.0

Compare Source

v0.45.0

Compare Source

v0.44.1

Compare Source

v0.44.0

Compare Source

v0.43.0

Compare Source

v0.42.0

Compare Source

v0.41.1

Compare Source

v0.41.0

Compare Source

v0.40.0

Compare Source

v0.39.0

Compare Source

v0.38.4

Compare Source

v0.38.3

Compare Source

v0.38.2

Compare Source

v0.38.1

Compare Source

v0.38.0

Compare Source

v0.37.2

Compare Source

v0.37.1

Compare Source

v0.37.0

Compare Source

urql-graphql/urql (@​urql/exchange-retry)

v1.3.2

Compare Source

Patch Changes
0no-co/gql.tada (gql.tada)

v1.11.3

Compare Source

Patch Changes

v1.11.2

Compare Source

Patch Changes

v1.11.1

Compare Source

Patch Changes

v1.11.0

Compare Source

Minor Changes
  • Add typed readResult testing utility, which, unlike unsafe_readResult, accepts fragments as an array and then becomes fully typed
    Submitted by @​kitten (See #​555)
  • Move testing functions API to gql.tada/testing, increasing separation. This isn't a breaking change as maskFragments and unsafe_readResult are (for now) re-exported from the main entrypoint
    Submitted by @​kitten (See #​555)
Patch Changes

v1.10.2

Compare Source

Patch Changes
  • Unroll tokenizer type into batch of 4 steps, which extends its range. This allows us to parse slightly longer documents with a very slight impact on parser performance. This means we're now bound by the parser/selection type depth, instead of by the tokenizer
    Submitted by @​kitten (See #​551)
  • Update to @0no-co/graphqlsp@^1.17.1
    Submitted by @​kitten (See #​553)
  • Updated dependencies (See #​553)

v1.10.1

Compare Source

Patch Changes

v1.10.0

Compare Source

Minor Changes
Patch Changes
  • Upgrade @0no-co/graphqlsp to ^1.16.0 and use findAllCallExpressions' new collectFragments: false option in the turbo command, replacing the plugin-info proxy that previously disabled fragment definition lookups. This also picks up graphqlsp's memoized gql.tada type probe, which reduces type checker work for non-GraphQL calls during call discovery
    Submitted by @​JoviDeCroock (See #​539)
  • Upgrade graphql.web
    Submitted by @​kitten (See #​548)
  • Improve the type-level GraphQL parser's TypeScript checker performance by dispatching from leading tokens and skipping parser branches that cannot match
    Submitted by @​JoviDeCroock (See #​542)
  • Updated dependencies (See #​535, #​539, #​538, #​541, #​546, #​548, 97cc2c7, #​537, #​545, #​547, and #​540)

v1.9.3

Compare Source

Patch Changes

v1.9.2

Compare Source

Patch Changes

v1.9.1

Compare Source

Patch Changes
  • Use function overloads for the turbo cache to skip parseDocument during batch typechecking
    Submitted by @​EDjur (See #​511)

v1.9.0

Compare Source

Minor Changes
Patch Changes

v1.8.13

Compare Source

Patch Changes

v1.8.12

Compare Source

Patch Changes

v1.8.11

Compare Source

Patch Changes
  • ⚠️ Fix in-type tokenizer to support trailing comments
    Submitted by @​kitten (See #​449)
enisdenjo/graphql-ws (graphql-ws)

v6.2.0

Compare Source

Minor Changes

v6.1.1

Compare Source

Patch Changes

  • #​680 3fdd82f Thanks @​kkhys! - Disposing of a client event listener twice no longer removes an unrelated listener

    The unsubscribe function returned by client.on spliced at indexOf(listener) without checking for -1, so removing an already-removed listener would splice(-1, 1) and silently drop the most recently registered listener of the same event. This happens in practice without any double-dispose by the user: emits iterate over a copy of the listeners, so a one-shot internal listener that already unlistened itself during a nested emit (e.g. when client.terminate() is called from within a closed/error listener) is re-invoked from the copy and unlistens again, knocking out registered closed/error listeners.

v6.1.0

Compare Source

Minor Changes

v6.0.8

Compare Source

Patch Changes

  • #​667 fc03004 Thanks @​endigma! - Fix the server sending a Complete message after an Error message for subscriptions.

    Previously, when a subscription's async iterable threw an error, the server would send:

    {"id":"1","type":"error","payload":[{"message":"..."}]}
{"id":"1","type":"complete"}

    Per the protocol spec:

    Error: This message terminates the operation and no further messages will be sent.

    Complete (Server → Client): If the server dispatched the Error message relative to the original Subscribe message, no Complete message will be emitted.

    The server now correctly sends only the Error message:

    {"id":"1","type":"error","payload":[{"message":"..."}]}

    Clients that correctly follow the spec should be unaffected, as they are expected to ignore messages for operations they consider already completed.

v6.0.7

Compare Source

Patch Changes

  • #​665 5536292 Thanks @​enisdenjo! - Remove uWebSockets.js from peer dependencies in package.json

    It does not exist on NPM anymore and could lead to weird behavior when installing dependencies with npm. Nothing else changes, using graphql-ws with uWebSockets.js still works.

v6.0.6

Compare Source

Patch Changes
nodejs/node (node)

v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)
Commits

v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

Commits

v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits

v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @​marco-ippolito

Compare Source

Commits

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 01:59 AM, on the first Monday of the month (* 0-1 * * 1#1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 7 times, most recently from 6a9526b to 4f9fb13 Compare July 15, 2025 17:06
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 6 times, most recently from 6eadd5d to a324030 Compare July 22, 2025 13:12
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 5 times, most recently from 7d3a49b to e093824 Compare July 31, 2025 23:51
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 4 times, most recently from 5f4e5df to f583445 Compare August 8, 2025 21:23
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 4 times, most recently from 98a89d9 to 023a73d Compare August 31, 2025 09:52
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 3 times, most recently from dfc3fe9 to f610dc0 Compare September 13, 2025 19:44
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 6 times, most recently from 48539e9 to b4788bb Compare September 22, 2025 12:59
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 9 times, most recently from aab7bfd to dc38b68 Compare September 29, 2025 23:29
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 7 times, most recently from 80b1d7c to 89ab77c Compare October 7, 2025 08:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jesko-plitt