Repository navigation
fix(deps): update all non-major dependencies - #6
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
dependencies
Contributor
Author
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
17 times, most recently
from
October 29, 2026 22:16
e2c845f to
0831ebf
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 30, 2026 02:01
0831ebf to
14b3568
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v0.23.3→v0.24.0v3.2.0→v3.3.0v0.17.1→v0.17.3v10.2.0→v10.3.30.13.1→0.13.6==0.9.92→==0.9.97==1.6.6→==1.7.3==1.6.6→==1.7.3==1.2.12→==1.2.18==3.1.1→==3.1.2==0.14.1→==0.14.16==3.6.1→==3.7==2.5.3→==2.5.4==3.22.1→==3.41.0==1.62.0→==1.64.1==2.13.5→==2.14.2==9.1.1→==9.2.0==1.2.3→==1.2.444.168.2→44.198.0==0.7.27→==0.8.5==0.25.2→==0.26.0==0.24.1→==0.25.1Note: The
pre-commitmanager in Renovate is not supported by thepre-commitmaintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.Release Notes
DavidAnson/markdownlint-cli2
v0.24.0Compare Source
actions/create-github-app-token
v3.3.0Compare Source
Features
Bug Fixes
astral-sh/ruff-pre-commit
v0.17.3Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.17.3
v0.17.2Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.17.2
astral-sh/setup-uv
v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallbackCompare Source
Changes
This release contains something that should have been included a very long time ago. Sorry for sleeping on that.
This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)
Also a big thank you to @soujasK for a set of bugfixes 👏
🐛 Bug fixes
🧰 Maintenance
📚 Documentation
v10.3.2: 🌈 update known checksums for 0.13.5Compare Source
Changes
🧰 Maintenance
📚 Documentation
v10.3.1: 🌈 preserve cache error class names in save-cache bundleCompare Source
Changes
This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn
##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.🐛 Bug fixes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v10.3.0: 🌈 Add Python architecture selectionCompare Source
Changes
This release adds the
python-archinput to select a Python architecture independently of the Python version. Withuv0.13.0 or later, setpython-arch: x86_64to use x64 Python on Windows ARM64 runners.It also includes embedded checksums for
uvreleases through 0.13.0.🚀 Enhancements
python-archsupport @zanieb (#1079)🧰 Maintenance
⬆️ Dependency updates
astral-sh/uv-pre-commit
v0.13.6Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.6
v0.13.5Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.5
v0.13.4Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.4
v0.13.3Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.3
v0.13.2Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.2
Graphify-Labs/graphify (graphifyy)
v0.9.97Compare Source
_redact_rationale_labelsinside_safe_extract), so no extractor can skip it, and it now covers more leak shapes: URL userinfo with an empty user or with//@in the password, PEM private-key bodies, tokens glued to surrounding text by_(for exampleghp_...), Slackxoxe-refresh tokens, short JWTs, and Common Lisp docstrings that previously built labels without redacting. Benign strings (hashes,sk-prose, URLs without userinfo) are left alone (#4647, thanks @0xkaushik-ai).>=4.14.2in themcpextra, above CVE-2026-63374 (an IDNA 2003 vs 2008 hostname-validation bypass that let a MITM on a non-ASCII domain present a cert for a different ASCII host, CVSS 9.3). anyio is only a transitive dependency and the lockfile already resolves 4.15.1, so this is a floor to stop a future re-resolution from regressing.#is not part of the heading text (## Setup ##is "Setup"), up to three spaces of indent are allowed (four is an indented code block), and a hash-only line like## ##mints no node (#4790, #4791, thanks @jaimemartinez).~~~block that contains a```line is no longer lost (#4787, #4788, thanks @jaimemartinez).on/off/yes/noare no longer folded to booleans (a workflowon:block is extracted, not turned into aTruenode) (#4784, #4785, thanks @jaimemartinez).@implementsinterfaces are extracted asimplementsedges instead of being silently dropped (#4820, thanks @ayushcodes10).provider "aws"blocks no longer collapse into one and lose attributes), and aprovider = aws.westreference resolves to it instead of dangling; alocalliterally namedprovideris no longer misread (#4819, thanks @ayushcodes10).END PROGRAMreattach to the enclosing program instead of sticking to the nested one, via a program stack (#4824, thanks @ayushcodes10).wire:clickdirective binds the bare method name: dotted modifiers (wire:click.prevent="submit") are matched, call arguments are trimmed from the name (deleteItem(5)bindsdeleteItem), and a$-prefixed magic action mints no fabricated edge (#4823, thanks @ayushcodes10).recordis recognised as a type with its own methods in the regex fallback (the default path without the optionalpascalextra), matching the tree-sitter path;operatormembers are extracted too (#4825, thanks @ayushcodes10).Operatordeclaration is extracted as anoperator-kind member of its class and its body is walked for calls, so a helper call inside an operator no longer vanishes (#4821, thanks @ayushcodes10).callresolves to the subroutine it actually names instead of a target salted with the calling file's name (which never resolved), using the extractor's own cross-file stub idiom (#4795, thanks @ayushcodes10).graphify query --help/-h(and nowgraphify explain --help/-h) with nothing else prints usage instead of running a literal query for the text "--help"; a longer question that merely contains "--help" as a substring still runs as a query (#4830, thanks @curl-man).and-chainedmodule ... and ...orclass ... and ...is extracted, not just the first, so later bindings are no longer silently dropped; each carries its own source line (#4822, thanks @ayushcodes10).taskmethod is modeled like afunctionone (its own node,methodedge and parameter-type references), and a task-local variable no longer leaks as a false field reference on the class (#4774, thanks @ayushcodes10).relationis dropped instead of persisted, on both the build and the raw--no-clusterwrite paths, and alias folding (relationshiptorelation) runs before the check (#4810, thanks @legendteddy; reproducer also filed as #4826 by @sunhouy).Path.globrejects (a**component or an absolute pattern) is skipped with a warning instead of crashing the wholeextractrun (#4681, #4687, thanks @Deepjyoti-Sarmah).[[wikilink]]is slugged through the sameexport._obsidian_safe_stemthe export uses, so the link matches the file the export actually writes instead of dangling (#4696, thanks @ayushcodes10).get/gets/got/gettingare dropped from query terms (like the existingwork/works), so a framework hub labelled "Get" is not pulled in as a BFS seed by an exact-match bonus; node lookups for a literalGetstill resolve (#4686, thanks @AndresDiagoM).v0.9.96Compare Source
>=13.0.0on Python 3.11+ (staying at>=12.3.0on 3.10, which Pillow 13 no longer supports) and pypdf to>=6.19.0, and the lockfile is refreshed to patched versions of transitive dependencies (pyjwt, cryptography, certifi, urllib3, anyio, fsspec, soupsieve, virtualenv). This clears the bulk of the open Dependabot advisories; the Pillow image-parsing CVEs are only patched upstream for Python 3.11+, so a 3.10 install keeps the newest 3.10-compatible Pillow.detect()classifies as a paper (arXiv markers, an Abstract) is included in the watch quick-scan rebuild instead of contributing zero nodes; a paper that already has a semantic layer is still excluded from the AST quick-scan (#4750, #4751, thanks @jaimemartinez; reported by @yeochul-jeon).WAITING,REQUESTED,PENDING, ...) counts as pending CI, so a PR gated on a deployment-protection job is no longer read as ready (#4730, thanks @rudycelekli).importsandcalls) instead of only the first edge (#4731, thanks @rudycelekli).members/node_idsaliases has its numeric member ids coerced to strings like the canonicalnodeslist, so the hyperedge is no longer dropped (#4732, thanks @rudycelekli).extracted/Extracted) is still evidence-checked before it folds to theEXTRACTEDenum, so an un-verified node is not presented as solid (#4733, thanks @rudycelekli).run()no longer resolves to_run()); a lone folded method still resolves, and a genuine collision fails closed (#4734, thanks @rudycelekli).extension on T { }declaration is detected and extracted (the name is optional), so its members attach to the extended type (#4741, thanks @ayushcodes10).max_tokens(which DeepSeek honours) rather thanmax_completion_tokens(which it ignores), so responses are no longer silently uncapped (#4739, #4753, thanks @Ethereal49; reported by @snapp-kenya).*.xamlto*.xaml.cs) resolves deterministically regardless of directory iteration order, so a graph built on a case-sensitive filesystem is stable (#4747, thanks @anishraja04).module/namespaceno longer prints a spurious "minted by two different files" warning (#4756, thanks @idachev).graphify extractrecords each run's token usage tographify-out/cost.json(the same ledger the skill writes), so a standalone extract refresh updates the cost history (#1769, #4765, thanks @smngvlkz).@(Link().toMany())) are recovered as a decorator reference, and a lossy-parse warning names the real error region (#4711, #4715, thanks @Deepjyoti-Sarmah).const X = require('pkg')binding for an external package keeps its node (with the package as source) sonew X()still resolves, while a require of a corpus-local file still folds to the required module (#4688, #4702, thanks @ayushcodes10).obj/andbin/output is pruned only when build evidence is present (restore/runtime markers nearby), so a C# project scanned after a build no longer ingests generated sources while a realsrc/binstays (#4742, thanks @Great-Peace).GRAPHIFY_REBUILD_TIMEOUT(default 600s,0disables), with a thread-Timer fallback whereSIGALRMis unavailable orwatch()runs off the main thread (aSIGALRMarm there raisesValueErrorand would tear the watcher down before the rebuild ran), so a hung rebuild no longer stalls the watcher (#2173, #4724, thanks @danieldutu).source_filesentinel like other languages, instead of a node that fails validation (#4725, #4728, thanks @madanlalit; reported by @alopezradicle).useis scoped to the crate it names, souse serde_json::Valueno longer resolves to a same-named type in another crate; a namedpub usere-export is followed and a manifest-less binding staysINFERRED(#4699, #4712, thanks @Deepjyoti-Sarmah).INFERRED); it requires a single unambiguous producer and class (#4726, thanks @keny11300).graphify updatewith no relevant input change skips the detect/extract/build pipeline and leaves the outputs untouched, keyed on the scan file-set, config,.graphifyrc, extractor epoch, and an output-completeness stamp; a scanned file with no manifest row (including one whose extraction previously failed) still forces a full rebuild so a later fix is never skipped (#4740, #4748, thanks @Deepjyoti-Sarmah; reported by @lavaxun).v0.9.95Compare Source
Twenty-one community pull requests. A security pass on install: the skill-install writes go through randomly-named temp files instead of predictable ones, so a pre-planted symlink can no longer redirect a write. Extraction: Python, Go, C++ and Rust explicit type aliases (and Rust
unionitems) are extracted as type nodes so references resolve instead of minting sourceless stubs, each C# method overload gets its own node bound by argument count, and a package.json dependency's manifest entry links to the node that references it. Plus a one-root-per-repo tree on merged graphs, extended-length cache paths on Windows, and binary media no longer counted as text. The AST cache schema is bumped, so the first build after upgrading re-extracts.SKILL.md, references) through a randomly-namedmkstemp/mkdtempfile created withO_EXCLand restrictive mode instead of a predictable*.tmpname, so a local attacker who pre-creates a symlink at that path can no longer redirect the write to clobber an arbitrary file; the final move stays atomic (#4513, thanks @Mahdifotohi).X: TypeAlias = ...,type X = ...,NewType) is extracted as a type node, so a field or parameter typed by the alias resolves to it instead of minting a sourceless stub; an implicit assignment, a local alias, or a re-export is left alone (#4578, thanks @madhusudanpatnaik).type A = Balias is extracted as a type node (tree-sitter parses it as atype_alias, not atype_spec), so references resolve to it; a re-export (type Field = pkg.Field) mints no node (#4579, thanks @madhusudanpatnaik).using A = B;ortypedef B A;alias is extracted as a type node so references resolve; a member alias inside a class and a same-name re-export are excluded (#4580, thanks @madhusudanpatnaik).typealias and aunionitem are extracted as type nodes (a union's fields reference their types like a struct), so references resolve instead of minting stubs; an impl-associatedtypeis excluded (#4581, Refs #4285, thanks @madhusudanpatnaik; reported by @jonatasbcardio-boop).graphify export treeon a merged multi-repo graph gives each repo its own root (keyed by the repo tag) instead of conflating same-path files from different repos; untagged nodes are not counted as a repo (#4524, #4525, thanks @AromalBiju1).\\?\) paths, so a deep cache path over the 260-character limit no longer fails extraction with aFileNotFoundError; a no-op off Windows (#4542, thanks @omsenjalia).package.jsondependency's manifest entry links (declares) to the ref node that importing code resolves to, so the manifest entry and its importers share one node instead of being orphaned; the entry is relabelledname@range(#4569, #4572, thanks @Deepjyoti-Sarmah; reported by @BiSide)..yaml/.ymlfiles are now extracted structurally (a file node pluscontainsedges to keys) and classified as code rather than documents, so HelmConfiguration
📅 Schedule: (in timezone UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.