fix(deps): update dependency iconv-lite to v0.7.3 - #8601
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
requested review from
darcyYe,
gao-sun,
simeng-li and
wangsijie
as code owners
March 31, 2026 08:18
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
March 31, 2026 08:24
f9bb03b to
6ff57e4
Compare
COMPARE TO
|
| Name | Diff |
|---|---|
| packages/connectors/connector-alipay-native/package.json | 0 Bytes |
| packages/connectors/connector-alipay-web/package.json | 0 Bytes |
| packages/connectors/connector-dingtalk-web/package.json | 0 Bytes |
| packages/core/package.json | 0 Bytes |
| pnpm-lock.yaml | 📉 -330 Bytes |
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
April 1, 2026 20:21
6ff57e4 to
f1bc54d
Compare
charIeszhao
previously approved these changes
Apr 2, 2026
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
April 8, 2026 07:24
f1bc54d to
a10bb9d
Compare
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
April 22, 2026 06:18
a10bb9d to
2aac529
Compare
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
April 29, 2026 10:04
2aac529 to
65e0159
Compare
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
May 6, 2026 09:22
65e0159 to
59037e9
Compare
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
May 12, 2026 09:22
59037e9 to
d7f91c7
Compare
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
July 9, 2026 10:20
d7de36b to
3acbfc1
Compare
renovate
Bot
force-pushed
the
renovate/iconv-lite-0.x
branch
from
July 10, 2026 10:18
3acbfc1 to
da514f9
Compare
| "dayjs": "^1.10.5", | ||
| "got": "^14.0.0", | ||
| "iconv-lite": "^0.6.3", | ||
| "iconv-lite": "^0.7.0", |
| "dayjs": "^1.10.5", | ||
| "got": "^14.0.0", | ||
| "iconv-lite": "^0.6.3", | ||
| "iconv-lite": "^0.7.0", |
| "dayjs": "^1.10.5", | ||
| "got": "^14.0.0", | ||
| "iconv-lite": "^0.6.3", | ||
| "iconv-lite": "^0.7.0", |
| "http-errors": "^2.0.0", | ||
| "i18next": "^22.4.15", | ||
| "iconv-lite": "0.6.3", | ||
| "iconv-lite": "0.7.3", |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Comments suppressed due to low confidence (1)
packages/connectors/connector-dingtalk-web/package.json:10
- The repo now mixes a pinned
iconv-liteversion in core (0.7.3) with caret ranges in connectors (^0.7.0). In a monorepo this can easily lead to multiple installed versions and inconsistent runtime behavior. Consider aligning the strategy across packages (e.g., pin all to the same version or use the same range), ideally via a shared workspace constraint/override so upgrades stay consistent.
"iconv-lite": "^0.7.0",
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Comments suppressed due to low confidence (1)
packages/core/package.json:71
- The repo now uses mixed versioning strategies for
iconv-lite(core is pinned to an exact version, while connectors use a caret range). This can lead to inconsistent upgrade behavior across packages and makes it harder to reason about dependency updates. Consider standardizing to a single approach (e.g., all^0.7.3for consistent patch/minor uptake, or all exact versions for reproducibility), and if using workspaces, optionally enforce a single version via workspace/overrides/resolutions.
"iconv-lite": "0.7.3",
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (1)
packages/connectors/connector-dingtalk-web/package.json:10
- The repo now mixes an exact pin (
"0.7.3"inpackages/core) with a caret range ("^0.7.0"here and in other connectors). Consider standardizing the versioning strategy across packages (either pin everywhere for reproducible installs, or use consistent ranges everywhere) to reduce surprise drift between workspaces.
"iconv-lite": "^0.7.0",
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (1)
packages/core/package.json:71
- Within this PR, core pins
iconv-liteto an exact version while the connectors use a caret range. This can lead to multiple resolved versions in a monorepo and harder-to-debug behavior differences. Consider standardizing the versioning strategy (all pinned, or all ranged) and/or enforcing a single version via workspace overrides/resolutions.
"iconv-lite": "0.7.3",
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (1)
packages/core/package.json:71
- The repo now pins
iconv-liteto an exact version inpackages/core(0.7.3) but uses a caret range in connectors (^0.7.0). This can lead to multiple versions being installed across the workspace and makes upgrades harder to reason about. Consider standardizing the versioning strategy across packages (all pinned or all ranged), or centralizing via a workspace-level override/resolution so all packages converge on the sameiconv-liteversion.
"iconv-lite": "0.7.3",
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (1)
pnpm-lock.yaml:13403
- The lockfile entry for the GitHub-hosted
oidc-providertarball no longer includes anintegrityhash. This weakens tamper detection for that downloaded artifact compared to other tarball resolutions that includeintegrity.
Consider regenerating the lockfile with the repo’s standard pnpm version/settings (or adjusting the install step) so the tarball integrity is recorded; if pnpm intentionally omits integrity for gitHosted resolutions in this repo, it would be good to confirm that’s expected and acceptable from a supply-chain/security perspective.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (2)
pnpm-lock.yaml:9001
@xmldom/xmldom@0.8.13is now marked as deprecated with “critical issues, please update to the latest version”. Even though this PR focuses oniconv-lite, this is a security/maintenance signal worth addressing (upgrade and re-resolve dependents) to avoid relying on a known-problematic version.
pnpm-lock.yaml:13403- The lockfile entry for the git-hosted
oidc-providertarball no longer includes anintegritychecksum (it only hasgitHosted+tarball). That reduces lockfile reproducibility/supply-chain verification compared to the previous state; please regenerate the lockfile with pnpm to ensure this is the expected format, or restore the integrity field if pnpm supports it for this source.
|
|
||
| oidc-provider@https://codeload.github.com/logto-io/node-oidc-provider/tar.gz/513c523c0e68ee6112da8c871cce86204a136163: | ||
| resolution: {integrity: sha512-KaUwCyEEDSZILL2ua2f9SsQ2oSrgq04JAmkQzq2gj7VJyREH3zQS14G7MhfDYxEKjAhO4JZ6bUGzZjW/0Q5pEg==, tarball: https://codeload.github.com/logto-io/node-oidc-provider/tar.gz/513c523c0e68ee6112da8c871cce86204a136163} | ||
| resolution: {gitHosted: true, tarball: https://codeload.github.com/logto-io/node-oidc-provider/tar.gz/513c523c0e68ee6112da8c871cce86204a136163} |
Comment on lines
+8998
to
+9001
| '@xmldom/xmldom@0.8.13': | ||
| resolution: {integrity: sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==} | ||
| engines: {node: '>=10.0.0'} | ||
| deprecated: this version has critical issues, please update to the latest version |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (2)
pnpm-lock.yaml:13402
- The lockfile entry for the git-hosted
oidc-providertarball no longer includes anintegrityvalue. This reduces install reproducibility and removes a tamper check for the downloaded artifact; pnpm previously recorded an integrity hash for this same tarball.
pnpm-lock.yaml:9001 @xmldom/xmldom@0.8.13is now marked as deprecated with a notice that it has critical issues. If this package is still required, it’s worth updating the pinned/overridden version so installs don’t rely on a known-problematic release.
- Files reviewed: 4/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The dependency bump is consistently applied in package manifests and the lockfile reflects the expected new resolution without introducing suspicious or broken entries.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 4/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The dependency/version bumps are consistent across the updated package manifests and the lockfile reflects the expected iconv-lite@0.7.3 resolutions for those importers.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 4/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The change is a straightforward dependency version bump with consistent updates across package manifests and the lockfile.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 4/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No unresolved review comments remain, and the supplied assessments support approval.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 4/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The lockfile update contains additional non-iconv-lite resolution changes that should be minimized (or explicitly explained) before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 4/5 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
19117
to
19121
| eslint-import-resolver-typescript: 3.6.1(@typescript-eslint/parser@7.7.0(eslint@8.57.0)(typescript@5.5.3))(eslint-plugin-import@2.29.1(@typescript-eslint/parser@7.7.0(eslint@8.57.0)(typescript@5.5.3))(eslint@8.57.0))(eslint@8.57.0) | ||
| eslint-plugin-consistent-default-export-name: 0.0.15 | ||
| eslint-plugin-eslint-comments: 3.2.0(eslint@8.57.0) | ||
| eslint-plugin-import: 2.29.1(@typescript-eslint/parser@7.7.0(eslint@8.57.0)(typescript@5.5.3))(eslint-import-resolver-typescript@3.6.1(@typescript-eslint/parser@7.7.0(eslint@8.57.0)(typescript@5.5.3))(eslint-plugin-import@2.29.1(@typescript-eslint/parser@7.7.0(eslint@8.57.0)(typescript@5.5.3))(eslint@8.57.0))(eslint@8.57.0))(eslint@8.57.0) | ||
| eslint-plugin-import: 2.29.1(@typescript-eslint/parser@7.7.0(eslint@8.57.0)(typescript@5.5.3))(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0) | ||
| eslint-plugin-n: 17.2.1(eslint@8.57.0) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.6.3→0.7.3^0.6.3→^0.7.0Release Notes
pillarjs/iconv-lite (iconv-lite)
v0.7.3: 0.7.3Compare Source
🚀 Improvements
iso-8859-8-iandiso-8859-8-echarset aliases - by @baptistejamin in #394🐞 Bug fixes
Fix UTF-32 streaming across chunk boundaries - by @spokodev and @bjohansebas in #393
When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer
decode/encodewere unaffected.New Contributors
Full Changelog: pillarjs/iconv-lite@v0.7.2...v0.7.3
v0.7.2Compare Source
🐞 Bug fixes
Correction of CommonJS exports in TypeScript definitions - by @plbstl in #366
Fixed the TypeScript definitions to correctly represent the CommonJS exports of the library.
This resolves issues where consumers using TypeScript would encounter errors due to incorrect
type definitions that did not align with the actual module exports.
v0.7.1Compare Source
🚀 Improvements
v0.7.0Compare Source
🐞 Bug fixes
Handle split surrogate pairs when encoding utf8 - by @yosion-p and @ashtuchkin in #282:
Handle a case where streaming utf8 encoder (converting js strings -> buffers) encounters
surrogate pairs split between chunks (last character of one chunk is high surrogate and first
character of the next chunk is a low surrogate).
Avoid false positives in encodingExists by using objects without a prototype - by @bjohansebas in #328
The encodingExists method could return incorrect results if the lookup matched properties inherited
from the prototype of the object that stores the encodings, such as constructor and others. This change
replaces that object with one that has no prototype, ensuring that only explicitly defined valid encodings
in the library are considered. In addition, the fix is applied to the internal cache system to avoid the same
kind of false positives
🚀 Improvements
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.