fix(deps): update all non-major dependencies - #913
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8c4d39ca7e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| specifier: ^17.0.1 | ||
| version: 17.0.3 | ||
| version: 18.0.9 |
There was a problem hiding this comment.
This importer now records marked as 18.0.9 even though apps/differ/package.json still declares ^17.0.1, so the lockfile is not consistent with the workspace manifests; there are similar mismatches later, such as apps/staged resolving prettier-plugin-svelte 3.5.2 for ^4.1.1. The workflows run pnpm install --frozen-lockfile (for example .github/workflows/differ-ci.yml:73), and the pnpm install docs state that in CI, installation fails when a present lockfile needs an update and that workspace installs cover all projects (https://pnpm.io/cli/install), so these CI jobs will stop before tests/builds run.
Useful? React with 👍 / 👎.
7213ece to
b94370a
Compare
0825d9f to
16098e6
Compare
ff3d66b to
9ba89a8
Compare
ℹ️ Artifact update noticeFile name: apps/penpal/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by Details:
|
266866f to
4c77d54
Compare
4c77d54 to
87270b4
Compare
This PR contains the following updates:
7.1.2→7.3.00.5.19→0.5.202.3.2→2.3.32.7.1→2.7.32.9.0→2.9.12.3.5→2.3.62.4.3→2.4.42.10.1→2.11.03.0.4→3.0.524.11.0→24.13.32.16.0→2.16.15.1.4→5.2.0v6.0.3→v6.1.08.18.0→8.20.01.0.102→1.0.1040.1.89→0.1.920.22→0.232.18.1→2.19.00.4.44→0.4.454.6.0→4.6.60.11→0.121.1.9→1.1.100.20→0.21v1.9.0→v1.10.1v1.4.1→v1.7.0v1.8.2→v1.8.56.2.6→6.3.00.4.25→0.4.3329.0.2→29.1.10.2.185→0.2.1890.4.29→0.4.340.4.33→0.4.3418.0.5→18.0.1117.0.3→17.0.611.12.3→11.17.20.4→0.50.31.2→0.31.30.8.4→0.8.510.33.0→10.34.58.5.16→8.5.263.9.4→3.9.63.5.0→3.5.20.9→0.100.13.2→0.13.40.47→0.480.39→0.402.5.0→2.6.01.96.1→1.98.02.17.5→2.17.71.0.149→1.0.1511.3.0→1.5.11.6.05.56.4→5.57.04.7.1→4.7.61.1.1→1.2.13.2.2→3.3.12.3.2→2.3.32.7.2→2.7.32.9.0→2.9.12.5.4→2.5.52.3.5→2.3.62.4.2→2.4.42.10.1→2.11.02.0.18→2.0.201.51.1→1.53.10.7.18→0.7.190.6→0.70.47→0.481.23.0→1.26.01.24.0→1.26.08.1.0→8.2.27.3.1→7.3.6Release Notes
sveltejs/vite-plugin-svelte (@sveltejs/vite-plugin-svelte)
v7.3.0Compare Source
Minor Changes
dynamicCompileOptions(#1386)Patch Changes
v7.2.0Compare Source
Minor Changes
v7.1.4Compare Source
Patch Changes
v7.1.3Compare Source
Patch Changes
tailwindlabs/tailwindcss-typography (@tailwindcss/typography)
v0.5.20Compare Source
Fixed
tauri-apps/plugins-workspace (@tauri-apps/plugin-clipboard-manager)
v2.3.3Compare Source
vitejs/vite-plugin-react (@vitejs/plugin-react)
v5.2.0Compare Source
actions/checkout (actions/checkout)
v6.1.0Compare Source
ajv-validator/ajv (ajv)
v8.20.0Compare Source
What's Changed
Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0
dtolnay/anyhow (anyhow)
v1.0.104Compare Source
syndev-dependency to version 3v1.0.103Compare Source
Error::downcast_mut(#451, #452)dtolnay/async-trait (async-trait)
v0.1.92Compare Source
v0.1.91Compare Source
v0.1.90Compare Source
marshallpierce/rust-base64 (base64)
v0.23.1Compare Source
v0.23.0Compare Source
simd-unsafefeature:Simdpicks the bestinstruction set at runtime (AVX2 on
x86_64, NEON onaarch64) and falls back to the scalarGeneralPurposeengine, whileAvx2andNeontarget one instruction set with no runtimedetection and work in
no_std. The engines support the standard and URL-safe alphabets.huntabyte/bits-ui (bits-ui)
v2.19.0Compare Source
Minor Changes
formto the hidden input (#2089)Patch Changes
fix(DateField): keep focus on the year while correcting its first digit (#2100)
fix(Tooltip): close
Tooltip.Triggeronpointerdownfor any pointer button so right/middle click dismiss the tooltip and cancel a pending delayed open (#2101)fix(RadioGroup): don't select item on pointer-driven focus- #2098 (#2098)
v2.18.2Compare Source
Patch Changes
fix(DismissibleLayer): cancel pending
afterSleeptimer on destroy to preventderived_inertand stale document listeners (#2080) (#2087)fix(TextSelectionLayer): don't read the
refbox in#pointerdownbefore the enabled check, which emittedderived_inerton every document pointerdown when a leaked listener outlived its component (#2107)fix(AlertDialog): pass
disabledthrough to button inAlertDialog.Cancel(#2068)chronotope/chrono (chrono)
v0.4.45: 0.4.45Compare Source
What's Changed
clap-rs/clap (clap)
v4.6.6Compare Source
Features
Command::get_overridden_usagev4.6.5Compare Source
v4.6.4Compare Source
Internal
v4.6.3Compare Source
Fixes
"literal".function()as attribute valuesv4.6.2Compare Source
Fixes
aliaswhen there is only onev4.6.1Compare Source
Fixes
console-rs/dialoguer (dialoguer)
v0.12.0: 0.12.0Compare Source
What's Changed
select.rsexample by @jwodder in #289thiserrorwith a manual impl by @CosmicHorrorDev in #327rust-lang/flate2-rs (flate2)
v1.1.10Compare Source
What's Changed
Crcstruct by @MikkelPaulson in #540README.mdin a private module by @bushrat011899 in #562no_stdsupport using nightlyalloc_ioby @bushrat011899 in #559get_mut()documentation to make clear how 'inner` can be used by @Byron in #558New Contributors
Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10
rust-lang/git2-rs (git2)
v0.21.0Compare Source
0.20.4...main
Added
unstable-sha256Cargo feature,along with
*_extAPI variants that accept anObjectFormat.#1206
opts::set_cache_max_size()andopts::get_cached_memory().#1188
Repository::object_format()and a newObjectFormatenum.#1204
Repository::set_config().#1208
merge_file()along withMergeFileInput.#1210
Repository::refdb_compress()for packing loose refs.#1221
Refdbtype, along withRepository::refdb()andRepository::set_refdb().Repository::refdb_compress()now delegates toRefdb::compress().#1228
Revspec::into_objects().#1230
BlameHunk::final_committer(),BlameHunk::orig_committer(),BlameHunk::summary(), andBlameHunk::summary_bytes().#1231
CloneforReference.#1233
Repository::author_from_env()andRepository::committer_from_env().#1237
impl From<Utf8Error> for Error.#1239
Changed
ssh,https, andcredCargo features are no longer enabled by default.Previously
default = ["ssh", "https"]; nowdefault = [].Enable them explicitly if you rely on credential helpers or transport support.
#1168
CredentialHelperand theurldependency are now gated behind the newcredCargo feature.Enabling
sshorhttpstransitively enablescred.#1168
#1173
Option<&str>now return
Result<&str, Error>orResult<Option<&str>, Error>,so callers can distinguish a missing value from a non-UTF-8 one.
#1241
BlameHunk::final_signature,BlameHunk::final_committer,BlameHunk::orig_signature, andBlameHunk::orig_committernow return
Optionto avoid segfaults when signature information is missing.#1254
#1242
Fixed
MergeOptions::skip_reuc()to use the correctGIT_MERGE_SKIP_REUCflag.#1194
Repository::submodules()now returns anErrorwhen the underlyinggit_submodule_lookup()call to libgit2 fails, rather than panicking with a failed assertion.#1220
Reference::is_valid_name()now propagates errors fromCStringconversion instead of panicking.#1229
Remote::list()to return an empty list instead of erroringwhen the remote advertises no refs.
#1250
ReferenceNamesnow returns anErrfor non-UTF-8 branch names instead of panicking.#1239
Documentation
git_checkout_head.#1149
IndexAddOptionflags.#1163
sshfeature.#1187
Repository::tag_foreach().#1190
StatusOptions.#1199
#1219
Signature::from_raw_const()docs.#1222
#1223
#1224
CheckoutBuilder::update_index()documentation.#1232
#1235
Repository::stash_save_ext()docs.#1245
#1243
CheckoutBuilder::refresh()docs.#1252
Internals
civet/conduitfrom dev-dependencies.#1170
#1171
#1177
#1182
#1196
#1198
timefrom 0.3.41 to 0.3.47.#1215
#1244
#1246
Repository::statuses().#1251
#1201
#1205
fsnotify/fsnotify (github.com/fsnotify/fsnotify)
v1.10.1Compare Source
Changes and fixes
inotify: don't remove sibling watches sharing a path prefix (#754)
inotify, windows: don't rename sibling watches sharing a path prefix
(#755)
v1.10.0Compare Source
This version of fsnotify needs Go 1.23.
Changes and fixes
inotify: improve initialization error message (#731)
inotify: send Rename event if recursive watch is renamed (#696)
inotify: avoid copying event buffers when reading names (#741)
kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#748)
kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#740)
windows: fix nil pointer dereference in remWatch (#736)
windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#709, #749)
modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)
v1.7.0Compare Source
This release brings full support for protocol version
2026-07-28.The wire protocol is largely rewritten: a stateless model with per-request
_meta, a newserver/discoverRPC replacing theinitializehandshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unifiedsubscriptions/listenstream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.The streamable HTTP transport accepts requests at protocol version
2026-07-28only whenStreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, setStateless = true; if you want to keep stateful sessions, your clients will negotiate down to2025-11-25.Backward compatibility with
2025-11-25and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.This release consolidates everything shipped in
v1.7.0-pre.1,v1.7.0-pre.2, andv1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.v1.7.0-pre.3is already successfully used by GitHub, serving more than half a million users.Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)
The
initialize/notifications/initializedhandshake is removed in2026-07-28. Each request now carries_meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities}so the server can validate the peer without state. A newserver/discoverRPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacyinitializeif discover fails. Resumability (Last-Event-ID, standalone GET) is removed;ping,logging/setLevel,resources/subscribe, andresources/unsubscribeare also removed on this revision and rejected withMethodNotFound.MissingRequiredClientCapabilityerror data by @guglielmo-san (#1005)UnsupportedProtocolVersionerror by @guglielmo-san (#989)Subscriptions listen ([SEP-2575](https://redirec
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.