chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #2909 · go-task/task

renovate · 2026-07-06T02:16:06Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@types/node (source)	`24.13.2` → `24.13.3`	devDependencies	patch
charm.land/bubbles/v2	`v2.1.0` → `v2.1.1`	require	patch
charm.land/bubbletea/v2	`v2.0.7` → `v2.0.8`	require	patch
charm.land/lipgloss/v2	`v2.0.4` → `v2.0.5`	require	patch
cloud.google.com/go/auth	`v0.20.0` → `v0.21.0`	indirect	minor
github.com/aws/aws-sdk-go-v2	`v1.42.0` → `v1.42.1`	indirect	patch
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	`v1.7.13` → `v1.7.14`	indirect	patch
github.com/aws/aws-sdk-go-v2/config	`v1.32.26` → `v1.32.28`	indirect	patch
github.com/aws/aws-sdk-go-v2/credentials	`v1.19.25` → `v1.19.27`	indirect	patch
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	`v1.18.29` → `v1.18.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/configsources	`v1.4.29` → `v1.4.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	`v2.7.29` → `v2.7.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/v4a	`v1.4.30` → `v1.4.31`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	`v1.13.12` → `v1.13.13`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/checksum	`v1.9.22` → `v1.9.23`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	`v1.13.29` → `v1.13.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	`v1.19.30` → `v1.19.31`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/s3	`v1.104.1` → `v1.105.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/signin	`v1.2.1` → `v1.3.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/sso	`v1.31.4` → `v1.32.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/ssooidc	`v1.36.7` → `v1.37.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/sts	`v1.43.4` → `v1.44.0`	indirect	minor
github.com/charmbracelet/ultraviolet	`f39628c` → `f5a850f`	indirect	digest
github.com/googleapis/enterprise-certificate-proxy	`v0.3.17` → `v0.3.18`	indirect	patch
github.com/googleapis/gax-go/v2	`v2.22.0` → `v2.23.0`	indirect	minor
github.com/klauspost/compress	`v1.18.7` → `v1.19.0`	indirect	minor
go	`1.26.4` → `1.26.5`		patch
golang.org/x/sync	`v0.21.0` → `v0.22.0`	require	minor
golang.org/x/sys	`v0.46.0` → `v0.47.0`	indirect	minor
golang.org/x/text	`v0.38.0` → `v0.39.0`	indirect	minor
google.golang.org/api	`v0.287.0` → `v0.287.1`	indirect	patch
google.golang.org/genproto	`925bb5d` → `f0a9213`	indirect	digest
google.golang.org/genproto/googleapis/api	`925bb5d` → `f0a9213`	indirect	digest
google.golang.org/genproto/googleapis/rpc	`925bb5d` → `f0a9213`	indirect	digest
mvdan.cc/sh/moreinterp	`19def06` → `2255122`	require	digest
netlify-cli	`26.1.0` → `26.2.0`	devDependencies	minor
pnpm (source)	`11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b` → `11.10.0`	packageManager	minor
pnpm (source)	`11.9.0` → `11.10.0`		minor

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

charmbracelet/bubbles (charm.land/bubbles/v2)

`v2.1.1`

Compare Source

Lil’ Textarea Fix

This is a tiny patch to fix a bug in textarea where the prompt character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles,
Charm 🌞

Changelog

Fixed

d2b2217: fix(textarea): apply prompt style on all lines, including fillers (@meowgorithm)

Docs

a13f110: docs: fix typo in README (#921) (@Rohan5commit)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/bubbletea (charm.land/bubbletea/v2)

`v2.0.8`

Compare Source

Graphemes, schmraphemes

No terminal can render emojis perfectly, but we can try. This release improves some very specific edge cases around emoji rendering. Enjoy!

Changelog

db569ad: fix(deps): bump ultraviolet for emoji-related rendering improvements

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/lipgloss (charm.land/lipgloss/v2)

`v2.0.5`

Compare Source

Changelog

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

googleapis/google-cloud-go (cloud.google.com/go/auth)

`v0.21.0`

Compare Source

bigquery:
- Add OpenCensus tracing.
firestore:
- BREAKING CHANGE: If a document does not exist, return a DocumentSnapshot
  whose Exists method returns false. DocumentRef.Get and Transaction.Get
  return the non-nil DocumentSnapshot in addition to a NotFound error.
  DocumentRef.GetAll and Transaction.GetAll return a non-nil
  DocumentSnapshot instead of nil.
- Add DocumentIterator.Stop. Call Stop whenever you are done with a
  DocumentIterator.
- Added Query.Snapshots and DocumentRef.Snapshots, which provide realtime
  notification of updates. See https://cloud.google.com/firestore/docs/query-data/listen.
- Canceling an RPC now always returns a grpc.Status with codes.Canceled.
spanner:
- Add CommitTimestamp, which supports inserting the commit timestamp of a
  transaction into a column.

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

`v1.42.1`

Compare Source

Module Highlights

github.com/aws/aws-sdk-go-v2/service/acm: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/aiops: v1.6.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/appflow: v1.50.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/appsync: v1.51.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/athena: v1.55.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.58.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/b2bi: v1.0.0-preview.79
- Feature: Updated APIs to support custom validation rules.
github.com/aws/aws-sdk-go-v2/service/bedrock: v1.45.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/bedrockagent: v1.50.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.9.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/bedrockdataautomationruntime: v1.7.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/braket: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/chatbot: v1.14.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.26.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudcontrol: v1.28.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.65.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudsearch: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudtraildata: v1.16.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudwatchevents: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.57.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/codeartifact: v1.38.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/codegurusecurity: v1.16.3
- Documentation: Documentation update to notify users of the discontinuation of Amazon CodeGuru Security.
github.com/aws/aws-sdk-go-v2/service/codestarnotifications: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/connectparticipant: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/controltower: v1.26.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/costandusagereportservice: v1.33.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/datazone: v1.39.0
- Feature: Releasing the following features - Asset classification that lets users use restricted terms for classifying assets if they have the right permissions. Also adding a new enum value "Moving" to project status.
github.com/aws/aws-sdk-go-v2/service/dax: v1.28.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/devicefarm: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/devopsguru: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/directconnect: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/docdbelastic: v1.19.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/ec2: v1.246.0
- Feature: Added IPv6 support for AWS Client VPN.
github.com/aws/aws-sdk-go-v2/service/eks: v1.72.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/emrcontainers: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/finspacedata: v1.33.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/forecast: v1.41.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/fsx: v1.61.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/groundstation: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/health: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/iotdataplane: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/iotfleethub: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/iotsitewise: v1.51.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/kendra: v1.60.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/keyspaces: v1.23.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/kinesisanalytics: v1.30.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/kinesisvideoarchivedmedia: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lambda: v1.77.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lexmodelsv2: v1.56.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lexruntimeservice: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/licensemanager: v1.36.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lookoutequipment: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/mailmanager: v1.17.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/marketplacecatalog: v1.36.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/mediaconvert: v1.82.0
- Feature: This release adds support for input rendition selection for HLS input, adds new Share API to enable sharing jobs with AWS Support for support investigations, and adds INCLUDE_AS_TS to iFrameOnlyManifest setting for HLS outputs.
github.com/aws/aws-sdk-go-v2/service/mediapackagevod: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/mediastore: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/migrationhubstrategy: v1.26.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/odb: v1.4.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/opensearchserverless: v1.25.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/opsworkscm: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/outposts: v1.56.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/pcaconnectorad: v1.15.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/personalizeruntime: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/qbusiness: v1.33.0
- Feature: The Amazon Q Business GetDocumentContent operation now supports retrieval of the extracted text content in JSON format.
github.com/aws/aws-sdk-go-v2/service/redshiftserverless: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/repostspace: v1.14.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/resiliencehub: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi: v1.30.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sagemakeredge: v1.30.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sagemakerfeaturestoreruntime: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sagemakerruntime: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/serverlessapplicationrepository: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/servicecatalog: v1.38.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sfn: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/shield: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/snowball: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sqs: v1.42.1
- Documentation: Documentation update for Amazon SQS Supports Large Payload Message feature
github.com/aws/aws-sdk-go-v2/service/ssoadmin: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/storagegateway: v1.42.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/support: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/supportapp: v1.18.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/taxsettings: v1.16.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/timestreaminfluxdb: v1.16.0
- Feature: Add MAINTENANCE status for DbInstance and DbCluster
github.com/aws/aws-sdk-go-v2/service/transcribe: v1.52.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/transcribestreaming: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/translate: v1.33.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/wellarchitected: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/workspacesthinclient: v1.20.0
- Feature: Remove incorrect endpoint tests

googleapis/enterprise-certificate-proxy (github.com/googleapis/enterprise-certificate-proxy)

`v0.3.18`

Compare Source

googleapis/gax-go (github.com/googleapis/gax-go/v2)

`v2.23.0`

Compare Source

Features

v2: add http.response.status_code to TransportTelemetryData (#513) (7d5554f)

Bug Fixes

correct min go version (#517) (fc62896)

klauspost/compress (github.com/klauspost/compress)

`v1.19.0`

Compare Source

What's Changed

zstd: Add true concurrent stream encoding by @klauspost in #1136
zstd: arm64 decoder asm by @lizthegrey in #1160
zstd: avoid unused BuildDict encoder allocation by @snissn in #1147
flate: Add inflate checkpoints by @klauspost in #1154
snappy/s2: Limit length of varint in decodedLen by @eustas in #1148
gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @z9z in #1149
zip: add NameDecoder callback for legacy encoding rewrite by @SAY-5 in #1150
huff0: Allow building tables from histogram. by @klauspost in #1155
huff0: Allow building table from oversized histogram. by @klauspost in #1156
s2sx: Clean symlink targets by @klauspost in #1163

New Contributors

@snissn made their first contribution in #1147
@eustas made their first contribution in #1148
@z9z made their first contribution in #1149
@SAY-5 made their first contribution in #1150
@HNO3Miracle made their first contribution in #1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

golang/go (go)

`v1.26.5`

Compare Source

googleapis/google-api-go-client (google.golang.org/api)

`v0.287.1`

Compare Source

Documentation

Remove old TODO file (#3645) (9d7a6b8)

netlify/cli (netlify-cli)

`v26.2.0`

Compare Source

Features

add watch-ignore flag (#8271) (fc30bcc)

Bug Fixes

add a stacktrace for monitoring (#8301) (30ba6a1)
add commandname to error reporting (#8303) (004df96)
deps: replace lodash with native utilities (#8189) (137fbf0)
deps: update dependency @netlify/blobs to ^10.7.9 (#8291) (419a749)
deps: update dependency @netlify/dev to ^4.18.7 (#8292) (1985b3b)
deps: update dependency @netlify/dev-utils to ^4.4.6 (#8293) (392af83)
deps: update dependency @netlify/edge-functions to ^3.0.8 (#8295) (7d00215)
deps: update dependency @netlify/functions to ^5.3.0 (#8296) (42393a4)
deps: update dependency @netlify/images to ^1.3.10 (#8298) (20fb23d)
dev: execute dev command with shell operators (&&, ||, etc.) (#8234) (d07599e)
silence zip output when creating source zips (#8323) (e6fbebc)

pnpm/pnpm (pnpm)

`v11.10.0`

Compare Source

Minor Changes

e2e3c81: Added the issues command as an alias of bugs, so pnpm issues opens the package's bug tracker URL in the browser.
8491f8e: Added the prefix command which prints the current package prefix directory (or global prefix directory if -g / --global is used).
3425e80: Added an _auth setting for configuring registry authentication as a single structured (URL-keyed) value. It can be set in the global pnpm config (config.yaml) or, for CI, via the pnpm_config__auth environment variable. The env form sidesteps the GitHub Actions / bash / zsh limitation that broke the existing pnpm_config_//host/:_authToken=… form (env var names containing /, :, or . are silently dropped). Closes #12314.

The value is keyed by registry URL so each secret is explicitly bound to the host that may receive it. Registry URL keys must use http or https and must not include credentials, query strings, or fragments:
```
export pnpm_config__auth='{"https://registry.npmjs.org":{"@&#8203;":{"authToken":"npm-token"},"@&#8203;org":{"authToken":"org-token"}}}'
```
The equivalent in the global config.yaml:
```
_auth:
  https://registry.npmjs.org:
    "@&#8203;":
      authToken: npm-token
    "@&#8203;org":
      authToken: org-token
```
Within each registry URL, @ means registry-wide/default credentials and package scopes like @org bind credentials to that scope on the same host. The only supported credential field is authToken (maps to _authToken / bearer auth); the deprecated basicAuth / username + password forms are intentionally not accepted here.

Each entry also infers a trusted registry route: @ routes the default registry (and pnpm add <pkg> resolves there), and @org routes that scope. Because the credential and destination host arrive in one trusted value, repo-controlled pnpm-workspace.yaml or project .npmrc cannot redirect the token to a different host. _auth is honored only from the env var and the global config — it is ignored in a project pnpm-workspace.yaml / .npmrc, so repo-controlled config can never supply registry auth. Precedence: CLI flags (--registry, --@scope:registry) > pnpm_config__auth > global config.yaml _auth > pnpm-workspace.yaml.

Both pnpm_config__auth (lowercase, documented form) and PNPM_CONFIG__AUTH (all-caps, the shell convention some CI runners apply) are honored. If both are set, lowercase wins unless it is empty, in which case uppercase is used. The env var wins over the global config.yaml _auth on a conflicting key. tokenHelper is not supported in _auth. Parsing is strict: a malformed value (bad JSON, wrong shape, invalid registry URL or scope, an unsupported credential field) fails fast with an error rather than being silently dropped.

Pacquet parity note: the pacquet (Rust) port supports the same single credential field as the TS CLI: authToken.
a33eeec: pnpm self-update and packageManager version-switching can now install and link pnpm v12 (the Rust port), published with equal content under both the pnpm and @pnpm/exe names on the next-12 dist-tag. Its native binaries ship as @pnpm/exe.<platform>-<arch> packages, which pnpm's built-in installer links directly — no Node.js launcher, so the command pays no Node startup cost. v12 is initialized exactly like @pnpm/exe, including per-platform global-virtual-store hashing. From v12 onward the install converges on the unscoped pnpm package (the Rust exe) — even when updating from the SEA @pnpm/exe build.
1dd12bd: When resolving through a pnpr install-accelerator server, pnpm no longer forwards its own upstream registry credentials in the resolve request. Only the Authorization header identifying the caller to pnpr is sent. The pnpr server now selects upstream credentials from its own route policy (operator-configured upstream credential aliases), so private dependencies resolve through a pnpr-managed alias the caller is authorized to use, rather than by sending the client's registry tokens to the server.
1e81761: Expose web authentication authUrl and doneUrl in JSON error output when OTP is required in a non-interactive terminal #12724.

Patch Changes

2f389d6: Added the Node.js release team's new signing key (Stewart X Addison, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD) to the embedded Node.js release keys, so runtimes whose SHASUMS256.txt is signed by the new releaser verify successfully.
acbdb94: Fixed shell tab completion not suggesting workspaces after the -F alias for --filter option.
dcabb78: Fixed pnpm up -r <pkg> bumping unrelated packages that have open semver ranges. Previously, any update mutation nullified the lockfile-derived preferredVersions globally, so packages with ^x.y.z ranges could re-resolve to newer compatible versions even though the user only asked to update a specific package. The install layer now always seeds preferredVersions from the lockfile, and caller-supplied preferred versions (such as the vulnerability penalties of pnpm audit --fix) layer on top of the seed instead of replacing it. The targeted package still bumps: the per-resolve updateRequested flag makes the resolver ignore the target's own lockfile pins.

Closes #10662.
d539172: Fixed pnpm pack and pnpm publish failing when prepack generates files that are included in the package and postpack cleans them up.
be6505a: Hardened global package management:
- On Windows, removing or updating a global package now also cleans up the node.exe flavor of a bin, so a stale node.exe no longer survives on PATH after uninstall, and a new global install no longer silently overwrites an existing node.exe.
- pnpm add -g pnpm@<version> (and @pnpm/exe@<version>) is now rejected like the bare pnpm form, pointing to pnpm self-update.
- Dependency aliases read from a global package's manifest are validated before being joined onto node_modules paths, preventing a tampered manifest from escaping the install directory.
- Each global install group is created in its own freshly-made directory (no longer reusing a colliding or pre-existing path).
- Removing or updating a global package no longer unlinks a bin that belongs to a different globally installed package.
25c7388: pnpm now rejects jsr: specifiers whose package name is not a valid npm package name — an empty scope or name (e.g. jsr:@scope/), path separators inside the name, or any other shape validate-npm-package-name rejects — with ERR_PNPM_INVALID_JSR_PACKAGE_NAME instead of silently converting them into a malformed @jsr/... npm package name.
25c7388: pnpm now rejects named-registry specifiers (e.g. gh:) whose package name is not a valid npm package name — an empty scope (e.g. gh:@/bar), path separators inside the name (e.g. gh:@scope/../name), or any other shape validate-npm-package-name rejects — with ERR_PNPM_INVALID_NAMED_REGISTRY_PACKAGE_NAME instead of passing the name through to registry URLs and metadata cache file paths.
96da7c5: node-gyp's gyp_main.py and gyp entrypoints are now packed with the executable bit in the pnpm and @pnpm/exe tarballs. Without it, building native addons from source could fail with a permission error.
99982b9: Sped up resolution and reduced memory use against registries that ignore npm's abbreviated metadata format and always return the full package document (for example, Azure DevOps Artifacts). pnpm now strips such documents down to the abbreviated field set before caching them. Resolution output is unchanged, and registries that honor the abbreviated format (such as the npm registry) pay no extra cost.
11a7fdd: Sped up offline and --prefer-offline resolution on large workspaces (e.g. pnpm dedupe --offline, pnpm install --offline). Package metadata loaded from the local cache is now kept in memory, so each package's metadata is parsed once per command instead of once per dependent that references it.
2c7369d: pnpm pack-app now rejects --entry / pnpm.app.entry and --output-dir / pnpm.app.outputDir values that are absolute paths or escape the project directory via .. (or a symlink that resolves outside it), and refuses to write the produced executable when its target path already exists as a symlink (or other non-regular file). This prevents a repository-controlled package.json from embedding host files (such as an SSH key) into the produced executable, writing build artifacts outside the project, or overwriting an arbitrary file through a committed symlink. The new error codes are ERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT, ERR_PNPM_PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT, and ERR_PNPM_PACK_APP_OUTPUT_FILE_NOT_REGULAR.

When ad-hoc signing macOS targets, pnpm pack-app now runs the system codesign by absolute path and resolves ldid to a location outside the project, so a repository-controlled node_modules/.bin on PATH cannot hijack the signer.
ce5d5a5: Relative paths in patchedDependencies are now resolved against the lockfile directory when computing patch file hashes, so running pnpm install from a subdirectory no longer fails with ENOENT looking for the patch file in the wrong location #12762.
ebb4096: pnpm peers no longer reports a conflict for a missing peer dependency that is ignored via pnpm.peerDependencyRules.ignoreMissing.
dcabb78: Fixed a prototype-pollution hazard when seeding preferred versions: a dependency named __proto__ in a manifest or in pnpm-lock.yaml could write through Object.prototype (or crash the install) while the preferred-versions map was being built. The maps are now null-prototype objects, so crafted package names land as plain keys.
f38e696: Hardened pnpm deploy --force so it refuses unsafe deploy targets such as workspace roots, parent directories, out-of-workspace paths, and symlinked target parents.
806c3ec: pnpm no longer warns about ignored project-level auth settings when PNPM_CONFIG_NPMRC_AUTH_FILE points at the project .npmrc — setting it to that file is an explicit opt-in to trusting it, so auth env variables in it are expanded pnpm/pnpm#12480.
991405e: Restore differential rendering (ansi-diff) to fix duplicated output lines introduced by #12351.
c121235: Fixed the topological order of --filtered commands (pnpm run, pnpm exec, pnpm publish, pnpm pack, pnpm rebuild) when the selected projects depend on

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added area: dependencies Changes related to dependency files. lang: go Pull requests that update Go code. lang: javascript Pull requests that update Javascript code. labels Jul 6, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from f37aab7 to c0f5a39 Compare July 8, 2026 11:34

chore(deps): update all non-major dependencies

511e100

renovate Bot force-pushed the renovate/all-minor-patch branch from c0f5a39 to 511e100 Compare July 8, 2026 13:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update all non-major dependencies#2909

chore(deps): update all non-major dependencies#2909
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Lil’ Textarea Fix

Changelog

Fixed

Docs

Graphemes, schmraphemes

Changelog

Changelog

Module Highlights

Features

Bug Fixes

What's Changed

New Contributors

Documentation

Features

Bug Fixes

Minor Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 6, 2026 •

edited

Loading