Repository navigation
fix(deps): update minor updates (minor) - #557
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Signed-off-by: Renovate Bot <bot@renovateapp.com>
renovate
Bot
added
the
c: dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
>=5.4.3→>=5.5.0^5.4.3→^5.5.0](https://renovatebot.com/diffs/npm/js-yaml@>=5.0.0 <=5.2.1/5.4.3/5.5.0)12.13.0→12.14.0^4.0.0→^4.1.0^8.11.2→^8.12.2^8.11.2→^8.12.2](https://renovatebot.com/diffs/npm/undici@>=7.0.0 <7.28.0/8.11.2/8.12.2)^8.11.2→^8.12.2](https://renovatebot.com/diffs/npm/undici@>=8.0.0 <8.5.0/8.11.2/8.12.2)bump,lockfileUpdate, orrollbackupdates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).Release Notes
nodeca/js-yaml (js-yaml@<=4.1.1)
v5.5.0Compare Source
Changed
argparseto v3.Fixed
,,], and}at the start of block plain scalars, #801.pnpm/pnpm (pnpm)
v12.14.0: pnpm 12.14.0Compare Source
This release adds the
sideEffectsCache.excludesetting, stopspnpm installfrom waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.Minor Changes
Added the
sideEffectsCache.excludesetting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on aremoteCacheserver. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the samename,@scope/*, andname@versionpatterns asminimumReleaseAgeExclude#5271.pnpm loginnow prints thenpm-noticeresponse header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.Patch Changes
Installing packages
pnpm installandpnpm addno longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes #16839.pnpm install,pnpm addandpnpm updatenow reusepnpm-lock.yamlwhen the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package anoverridesentry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry #16923.pnpm installnow looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. WithlinkWorkspacePackagesenabled, it used to rungit ls-remoteonce per project #16899.A filtered install, such as
pnpm install --filter <pkg>, now keeps thepnpm-lock.yamlentries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #16931.pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install #16901.
An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #16929.
Running commands and scripts
pnpm no longer aborts with a core dump when the reader of its output has exited, as in
pnpm list | head -1orpnpm start 2>&1 | head -1. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 #16904 pnpm/tasks#132.On Windows,
pnpm exec,pnpm run, and commands such aspnpm nxnow return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited #16930.Commands that do not write the project manifest now leave a missing
package.jsonabsent. This covers queries such aspnpm whyandpnpm outdated,pnpm fetch,pnpm dedupe --check, and commands that exit with an error, such aspnpm rt ls. These commands used to create one from the initialization template.pnpm sbomrun from a lockfile alone now reports the root component asunknownwith version0.0.0#16907.pnpm runnow reports a failed script as a JSON record under--reporter=ndjson. It printed a plain[ELIFECYCLE]line to stderr.pnpm runno longer prints[ELIFECYCLE] Command failed with exit code N.to stderr when a script fails under--reporter=silent,--silent, or--loglevel=silent.pnpm pipeline --dry-runno longer writes a run report when no projects are selected. With--jsonit prints{"tasks": []}pnpm/tasks#126.Packing and publishing
pnpm packandpnpm publishnow ship the whole gitignored directory thatmain,browser, orbinpoints into, as npm does. Previously only themainandbinfiles themselves were packed, and a gitignoredbrowserfile was left out #16908.pnpm packandpnpm publishnow honor a.npmignoreor.gitignoreinside a subdirectory whenpackage.jsonhas afilesfield. The package root's ignore files and those inherited from the workspace are still skipped #16909.Setting up pnpm and toolchains
--registry,--https-proxy,--http-proxy, and--no-proxynow apply when pnpm resolves and downloads the pnpm version a project pins inpackageManager. Before, these lookups went tohttps://registry.npmjs.org/, which a firewall that only allows a private registry blocks #16911.On Windows,
pnpm installnow installs the Rust toolchain for rustup's default host, so a machine set up withrustup set default-host x86_64-pc-windows-gnugets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain #16854.Platinum Sponsors
Gold Sponsors
keithamus/sort-package-json (sort-package-json)
v4.1.0Compare Source
Features
nodejs/undici (undici@<6.24.0)
v8.12.2Compare Source
Security fixes
High severity
Denial of service via TLS 1.2 certificate-changing renegotiation
CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.
TLS certificate validation bypass through dropped
AgentoptionsCVE-2026-109383 · GHSA-2m5v-pch6-74hx
Agentused a JSON-based clone for constructor options, which silently removed function-valued TLS options such ascheckServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.Cache poisoning and cross-user disclosure through cross-origin redirects
CVE-2026-109829 · GHSA-4w7w-5xrc-9h26
When an originless
Agentcombined redirect and shared-cache interceptors ascompose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.Denial of service through excessive
Content-EncodingvaluesCVE-2026-109869 · GHSA-xjj6-f33q-929c
A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although
fetch()rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.Medium severity
Denial of service through the
decompressinterceptorCVE-2026-87029 · GHSA-55wc-3pg8-jfw6
An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when
decompresswas composed with a handler such asdumpwith a size limit. This release converts downstream handler exceptions into per-request errors.Subresource Integrity bypass with non-lowercase algorithm tokens
CVE-2026-109841 · GHSA-f72v-6w45-q472
fetch()treated valid mixed-case or uppercase SRI algorithm tokens, such asSHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.Denial of service through unbounded EventSource parser state
CVE-2026-109924 · GHSA-4qv8-2p9j-2685
A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny
data:fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.Denial of service through unbounded automatic WebSocket PONG buffering
CVE-2026-109932 · GHSA-9fm3-97px-rjf6
A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.
Full Changelog: nodejs/undici@v8.12.1...v8.12.2
v8.12.1Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.12.0...v8.12.1
v8.12.0Compare Source
What's Changed
.md->.htmlby @avivkeller in #5602New Contributors
Full Changelog: nodejs/undici@v8.11.2...v8.12.0
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.