Skip to content

chore(deps): update all non-major dependencies - #263

Merged
jdwillmsen merged 2 commits into
mainfrom
renovate/all-minor-patch
Oct 26, 2026
Merged

chore(deps): update all non-major dependencies#263
jdwillmsen merged 2 commits into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@angular-devkit/build-angular 22.2.3 → 22.2.4 age confidence devDependencies patch
@angular-eslint/eslint-plugin (source) 22.2.0 → 22.6.0 age confidence devDependencies minor
@angular-eslint/eslint-plugin-template (source) 22.2.0 → 22.6.0 age confidence devDependencies minor
@angular-eslint/template-parser (source) 22.2.0 → 22.6.0 age confidence devDependencies minor
@angular/build 22.2.3 → 22.2.4 age confidence devDependencies patch
@nx/angular (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/devkit (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/eslint (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/eslint-plugin (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/gradle (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/js (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/module-federation (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/playwright (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/web (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/webpack (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@nx/workspace (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
@redocly/cli 2.51.1 → 2.71.0 age confidence devDependencies minor
@swc/core (source) 1.16.1 → 1.16.20 age confidence devDependencies patch
@typescript-eslint/eslint-plugin (source) 8.69.0 → 8.72.0 age confidence devDependencies minor
@typescript-eslint/parser (source) 8.69.0 → 8.72.0 age confidence devDependencies minor
@typescript-eslint/utils (source) 8.69.0 → 8.72.0 age confidence devDependencies minor
angular-eslint (source) 22.2.0 → 22.6.0 age confidence devDependencies minor
eslint (source) 10.9.1 → 10.13.0 age confidence devDependencies minor
github.com/jackc/pgx/v5 v5.10.0 → v5.11.0 age confidence require minor
github.com/prometheus/client_golang v1.24.1 → v1.25.0 age confidence require minor
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 → v0.72.0 age confidence require minor
go.opentelemetry.io/otel v1.46.0 → v1.47.0 age confidence require minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 → v1.47.0 age confidence require minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 → v1.47.0 age confidence require minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 → v1.47.0 age confidence require minor
go.opentelemetry.io/otel/sdk v1.46.0 → v1.47.0 age confidence require minor
go.opentelemetry.io/otel/trace v1.46.0 → v1.47.0 age confidence require minor
golang.org/x/crypto v0.56.0 → v0.58.0 age confidence require minor
gradle (source) 9.7.1 → 9.8.2 age confidence minor
memfs 4.69.1 → 4.80.0 age confidence pnpm-workspace.overrides minor
ng-packagr 22.2.1 → 22.2.5 age confidence devDependencies patch
nx (source) 23.2.1 → 23.3.1 age confidence devDependencies minor
pnpm (source) 12.5.1 → 12.15.0 age confidence packageManager minor
webpack 5.110.3 → 5.112.2 age confidence devDependencies minor
webpack@>=5.111.0 <5.111.2 [5.110.3 → 5.112.2](https://renovatebot.com/diffs/npm/webpack@>=5.111.0 <5.111.2/5.110.3/5.112.2) age confidence pnpm-workspace.overrides minor
yaml (source) 2.9.0 → 2.9.1 age confidence devDependencies patch
org.springdoc:springdoc-openapi-starter-webmvc-ui (source) 3.1.0 → 3.1.1 age confidence dependencies patch 3.2.0
dev.nx.gradle.project-graph 0.1.25 → 0.1.26 age confidence plugin patch
org.springframework.boot (source) 4.1.1 → 4.1.2 age confidence plugin patch

Release Notes

angular/angular-cli (@​angular-devkit/build-angular)

v22.2.4

Compare Source

@​angular/cli
Commit Type Description
63e45bcfe fix keep schematic positional arguments in index order
6053771cb fix only load autocompletion in interactive shells
@​schematics/angular
Commit Type Description
eec8dc049 fix apply viewEncapsulation to generated application components
3a549925e fix correct error and warning messages in environments schematic
fe119a7c7 fix show routing module suffixes in findModule error
36d988001 fix skip webWorkerTsConfig for unit-test builder test targets
460167cd3 fix use the generated class name when declaring in an NgModule
@​angular/build
Commit Type Description
c235a9554 fix add integrity metadata for all initial chunks beyond the module preload limit
80c7480b4 fix align lazy route entry names with workspace root for SSR modulepreload
b94627706 fix attach location to Sass errors and guard stack parsing
0dc103735 fix correct typos and spacing in error and warning messages
3e464c3f5 fix invalidate Vite module cache for removed dev server output files
7d9ba6280 fix match proxy glob patterns against URL pathname only
3aa7e93cc fix name the provider packages in the unit-test browsers error
e78cf0ae9 fix preserve diagnostic locations at offset 0 and guard empty files
b3baa20c6 fix support quotes in styles and polyfills paths
648aff9eb fix use component file path in inline stylesheet diagnostic locations
a9bec13b5 fix use distinct chunk naming for web worker bundles
a05723948 fix watch only explicitly added paths in chokidar watcher
35702a598 perf avoid reading external component stylesheets twice
@​angular/ssr
Commit Type Description
3beb2551c fix resolve query parameter placeholders in redirect targets (#​34321)
ff3f3727a fix resolve route parameters in redirect targets (#​34321)
d365b0008 fix use only the first value of the X-Forwarded-Prefix header
angular-eslint/angular-eslint (@​angular-eslint/eslint-plugin)

v22.6.0

Compare Source

🚀 Features
  • eslint-plugin: [prefer-standalone] add allowExplicitStandalone option (#​3237)
🩹 Fixes
  • eslint-plugin: [prefer-signal-model] rewrite the emit calls of the removed output (#​3200)
  • eslint-plugin: ensure prefix rule option schema is fully typed (#​3246)
  • eslint-plugin: [reactive-context-must-read-signal] ignore inherited primitive names (#​3201)
❤️ Thank You

v22.5.0

Compare Source

🚀 Features
  • eslint-plugin: [sort-keys-in-type-decorator] disallow unconfigured properties (#​3193)
❤️ Thank You
  • Максим Иванов

v22.4.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

v22.3.0

Compare Source

🚀 Features
  • eslint-plugin: [reactive-context-must-read-signal] add new rule (#​3090)
  • eslint-plugin: [inject-at-top] add additionalInjectFunctions option (#​3169)
  • eslint-plugin: [use-injectable-provided-in] add allowProvidedInNull option (#​3152)
🩹 Fixes
  • eslint-plugin: [reactive-context-must-read-signal] improve getter and function detection (#​3175)
  • eslint-plugin: [prefer-signal-model] don't report when input and output types differ (#​3089)
  • eslint-plugin: [prefer-signal-model] skip inputs with transform option (#​3050)
  • eslint-plugin: [no-implicit-take-until-destroyed] report methods also called outside DI context (#​3164)
❤️ Thank You
angular-eslint/angular-eslint (@​angular-eslint/eslint-plugin-template)

v22.6.0

Compare Source

🩹 Fixes
  • eslint-plugin-template: [conditional-complexity] check control flow (#​3260)
  • template-parser: traverse @​defer hydrate triggers (#​3231)
❤️ Thank You

v22.5.0

Compare Source

This was a version bump only for eslint-plugin-template to align it with other projects, there were no code changes.

v22.4.0

Compare Source

🚀 Features
  • eslint-plugin-template: [no-inline-styles] add "dynamic" option value for style bindings (#​3190)
  • eslint-plugin-template: add prefer-style-binding rule (#​3188)
  • eslint-plugin-template: [no-inline-styles] allow [style] bindings via allowBindToStyle (#​3112)
  • eslint-plugin-template: support regex entries in ignoreWithDirectives option (#​3180)
  • eslint-plugin-template: [click-events-have-key-events] add requireKeyCode and allowedKeyCodes options (#​3178)
🩹 Fixes
  • eslint-plugin-template: [prefer-at-else] avoid unsafe content projection fixes (#​3189)
  • eslint-plugin-template: [no-nested-tags] treat ng-template as a nesting boundary (#​3187)
  • eslint-plugin-template: [prefer-self-closing-tags] ignore all index.html files (#​3184)
  • eslint-plugin-template: [eqeqeq] honor allowNullOrUndefined across compiler copies (#​3182)
  • eslint-plugin-template: [prefer-self-closing-tags] ignore children of svg and math elements (#​3181)
❤️ Thank You

v22.3.0

Compare Source

This was a version bump only for eslint-plugin-template to align it with other projects, there were no code changes.

angular-eslint/angular-eslint (@​angular-eslint/template-parser)

v22.6.0

Compare Source

🩹 Fixes
❤️ Thank You

v22.5.0

Compare Source

This was a version bump only for template-parser to align it with other projects, there were no code changes.

v22.4.0

Compare Source

This was a version bump only for template-parser to align it with other projects, there were no code changes.

v22.3.0

Compare Source

This was a version bump only for template-parser to align it with other projects, there were no code changes.

nrwl/nx (@​nx/angular)

v23.3.1

Compare Source

23.3.1 (2026-10-23)

🩹 Fixes
❤️ Thank You

v23.3.0

Compare Source

23.3.0 (2026-10-07)

🚀 Features
  • angular: support ngrx v22 (#​36950)
  • angular-rspack: scaffold and run SSR apps on the @​angular/ssr application engine (#​36298)
  • core: emit a runbook and per-step instructions for orchestrated migrate runs (#​36766)
  • core: report the cache location alongside usage (#​36959)
  • core: share one workspace walk across processes through the files archive (#​36980)
  • core: hash a continuous dependency's inputs into the task it serves (#​37017)
  • core: guarantee terminal output files and add an agent-friendly summary output style (#​36703)
  • core: add includeIgnored filesets and let the workspace context own the daemon's watch (#​37025)
  • core: cache plugin capabilities so reading them costs at most one load (#​36999)
  • core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#​36918)
  • core: add sandbox target configuration for observed-IO opt-out (#​36853)
  • core: hash tasks from Nx Cloud I/O snapshots (#​37036)
  • core: replace the sandbox target property with ultracache (#​37165)
  • core: opt in to selecting affected tasks instead of projects (#​36825)
  • core: record unresolved migrations and cap retries in orchestrated migrate runs (#​36986)
  • core: report an active orchestrated migrate run instead of resuming it (#​36988)
  • core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#​36989)
  • core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#​37242)
  • core: explain why each task is affected with --explain (#​36885)
  • core: run a final agent validation pass at the end of an orchestrated migrate run (#​37069)
  • js: cache TypeScript reference expansion during createNodes (#​37003, #​37002)
  • linter: add a batched @​nx/oxlint:lint executor (#​36827)
  • nx-cloud: add nx cloud demo link to cloud prompts (#​36956)
  • nx-cloud: remove the never option from the nx cloud prompt (#​37079)
  • repo: add a .NET example for @​nx/dotnet (#​36701)
  • testing: support cypress v16 (#​36953)
  • vitest: support vitest 5 (#​37142)
🩹 Fixes
  • angular: correct declaration maps and exports of buildable libraries (#​36373, #​36357)
  • angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#​36972, #​36970)
  • angular-rspack: keep class field closures per instance in minified builds (#​37066, #​37050)
  • angular-rspack: update piscina to address critical vulnerability (#​37252)
  • bundling: write the esbuild bundle to an overridden outputPath (#​37101, #​37091)
  • bundling: clear typescript update timer when a rollup build closes its watch program (#​37196)
  • core: separate daemon runtime env from graph identity (#​36565, #​36564)
  • core: validate the migrations path before extracting package migrations (#​36887)
  • core: release per-run process listeners and task history results (#​36866)
  • core: read the pnpm 12 min-release-age policy instead of deferring to an install (#​36915, #​36914)
  • core: carry minimumReleaseAge into pruned pnpm deploy output (#​36900, #​36899)
  • core: report how a plugin worker was lost instead of always calling it an exit (#​36894)
  • core: keep the cache in the workspace on CI (#​36922)
  • core: restore the wasm walker imports dropped by a stray cfg attribute (#​36924)
  • core: avoid mutating target options when resolving configurations (#​36934)
  • core: carry pnpm's package-manager document into the pruned lockfile (#​36947)
  • core: keep agentic migrations within the Windows command line limit (#​36578, #​36551)
  • core: give plugin workers a minute to receive the load message (#​36977)
  • core: detect changes in paths that git escapes (#​36660, #​35722)
  • core: combine Windows watcher recursive root and rescan recovery (#​36912)
  • core: deduplicate external inputs before hash plan allocation (#​36992)
  • core: make nx planning and hashing faster (#​36994)
  • core: keep continuous dependencies reached through a project without the target (#​37024)
  • core: load the native binding from one path per vitest worker (#​37039)
  • core: bump smol-toml to 1.7.1 for GHSA-7w5x-hrqm-74c2 (#​37059, #​37011)
  • core: make nx migrate resolve the requested nx version under npm 12 (#​36901, #​36762)
  • core: send task workers a task graph without run results (#​37015)
  • core: carry task terminal outputs to plugins by path (#​36787)
  • core: accept pr and canary releases in the migrate provenance check (#​36976)
  • core: show the underlying errors when the project graph fails (#​37103)
  • core: resolve project glob groups by prefix and literal lookup when hashing (#​37068)
  • core: skip Nx Console and AI agents checks in CI and speed up e2e browser and port helpers (#​37119)
  • core: watch with notify's CORE event mask so file reads cannot overflow inotify (#​37136)
  • core: support pnpm 12 install configuration and shims (#​37116)
  • core: reduce package-json inference overhead (#​37089)
  • core: narrow workspace glob searches to literal directory prefixes (#​37126)
  • core: read glob syntax from the glob parser in one place (#​37169)
  • core: prevent stale lockfile caches from breaking the project graph (#​37210)
  • core: pass only ultracache config to the snapshot eligibility walk (#​37212)
  • core: speed up daemon start by collecting ignore files in one walk (#​37211)
  • core: copy cached outputs into the workspace in parallel (#​37085, #​37090)
  • core: remove axios from the published nx package (#​36706)
  • core: make glob escapes work the same on every platform (#​37215)
  • core: build the daemon's ignore rules from the file scan (#​37220)
  • core: traverse past module-format package.json stubs when locating npm dependencies (#​36985, #​36984)
  • core: cache only declared outputs under ultracache (#​37243)
  • core: treat a cache record whose artifacts are missing as a miss (#​37111, #​37110)
  • core: close the task DB before nx reset deletes workspace-data (#​37250)
  • core: let nx reset finish after the Nx Cloud cleanup step (#​37251)
  • core: skip batch cache lookups for deferred tasks until their deps run (#​37259)
  • core: keep ultracache exclusions with the globs they trim (#​37285)
  • core: answer daemon output tracking from the workspace context (#​37217, #​37086)
  • core: stop merging declared negations into ultracache file groups (#​37304)
  • core: omit empty user next steps in create-nx-workspace agent output (#​37277)
  • core: reuse the stored ultracache configurations without an age limit (#​37305)
  • core: size the default cache bound from its own filesystem (#​37269)
  • core: accept --final-validation with a migrate CLI pinned below 23.2.0 (#​37294)
  • docker: skip unused git lookups during target inference (#​37124)
  • dotnet: declare evaluated inputs, invalidate on imports, and keep restore products out of cached outputs (#​36958)
  • dotnet: ship the ci-workflow templates and detect Microsoft.Testing.Platform projects (#​36981)
  • expo: gate the sdk 54 jest migration on the jest config instead of package.json (#​36834, #​35669)
  • js: resolve tsconfig to absolute path so ${configDir} paths type-check without baseUrl (#​36445)
  • js: handle empty npm view output in release-publish executor (#​36397, #​36358)
  • js: export NodeExecutorOptions from @​nx/js/executors (#​37143)
  • js: keep internal tsconfig project references on Windows (#​37058, #​37053)
  • linter: reuse the project graph inside ESLint concurrency workers (#​37080)
  • linter: reduce repeated path normalization during ESLint inference (#​37125)
  • misc: scan package projects for env vars (#​36847)
  • misc: record pnpm 11 build script decisions in generators (#​36814)
  • module-federation: skip undeclared default packages when sharing (#​37223, #​37108)
  • nextjs: bundle the server entry of Rollup-built libraries (#​36778)
  • nextjs: use out/ as default output dir when output is export (#​34530)
  • nx-dev: stop reading removed NextRequest.geo in AI api routes (#​37275)
  • react: make freshly generated react and rspack workspaces usable (#​36964)
  • release: exclude AI coding agents from the changelog Thank You section (#​36892)
  • release: use the release group name when resolving the previous tag for fixed groups (#​36554)
  • release: redact the token in the GitHub and GitLab release error output (#​36852)
  • release: optimize publish metadata query for JS projects (#​37013)
  • release: preserve private dev-only workspace dependencies (#​37193, #​37192)
  • repo: provision JDK 17 for Gradle builds with mise (#​36965)
  • repo: guard JAVA17_HOME against an uninstalled JDK (#​36969)
  • repo: force-fetch the website branch in the docs sync skill (#​36973)
  • repo: pin npm 11 for nightly e2e tests (#​37018)
  • repo: bump next past the critical RCE advisories (#​36983)
  • repo: point a seeded e2e workspace at the local pnpm store (#​37140)
  • repo: run pnpm -v outside the repo in e2e utils (#​37151)
  • repo: make e2e base workspace template failures clean and uncached (#​37194)
  • repo: pin hyperfine to 1.20.0 in CI agents (c8dda36996)
  • repo: hash local registry storage from sources again (#​37303)
  • rspack: write the normalized cache option in NxAppRspackPlugin (#​36905, #​36878)
  • testing: resolve coverageDirectory like jest and emit forward-slash outputs (#​37074, #​36910)
  • testing: hold the Cypress 16 migration only when a Vite component testing project resolves Vite 7 (#​37123)
  • vite: correct tsconfig paths fallback resolution (#​36424, #​36400)
  • vite: wait for raced esm modules before retrying config load (#​37042)
  • vite: defer nxViteTsPaths tsconfig parsing during graph construction (#​37182)
  • vitest: memoize ancestor tsconfig walks in createNodes (#​37027)
  • vitest: widen the vitest peerDependency to allow v5 (#​37055, #​37051)
  • vitest: infer inputs for setup files outside the project root (#​36920)
  • web: add --port to @​nx/web:app and reserve e2e ports (#​37254)
  • webpack: cap the generated webpack version below 5.111.0 (#​37034)
❤️ Thank You

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on saturday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from jdwillmsen as a code owner October 25, 2026 02:26
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 25, 2026
@renovate

renovate Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: apps/backend/identity-service/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=1 day

Details:

Package Change
golang.org/x/sync v0.22.0 -> v0.24.0
golang.org/x/sys v0.47.0 -> v0.49.0
golang.org/x/text v0.41.0 -> v0.43.0
File name: apps/backend/servicediscovery/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=1 day

Details:

Package Change
go.opentelemetry.io/otel/metric v1.46.0 -> v1.47.0
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 -> v0.0.0-20260928230214-8a89bd6388cc
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 -> v0.0.0-20260928230214-8a89bd6388cc
File name: libs/backend/shared/servicehttp/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=1 day

Details:

Package Change
go 1.26 -> 1.26.0
github.com/prometheus/client_model v0.6.2 -> v0.6.3
github.com/prometheus/common v0.70.1 -> v0.72.0
github.com/prometheus/procfs v0.21.1 -> v0.22.0
golang.org/x/sys v0.47.0 -> v0.48.0

@coderabbitai

coderabbitai Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: jdwlabs/apps
  • Branch: main
  • File: .coderabbit.yaml
  • Commit: 9c45c75
  • Layers: Repository YAML
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 6a3bf78a-2e26-4401-b99c-cec11dc08c62

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@jdwlabs-review-bot

jdwlabs-review-bot Bot commented Oct 25, 2026

Copy link
Copy Markdown

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Dependency Version Bump

The PR updates several Go dependencies including github.com/jackc/pgx/v5 from v5.10.0 to v5.11.0 and golang.org/x/crypto from v0.56.0 to v0.58.0. While these are patch/minor updates, they could introduce subtle behavioral changes or compatibility issues that need verification in the context of the application's usage of these libraries.

 
github.com/jackc/pgx/v5 v5.11.0
github.com/testcontainers/testcontainers-go v0.44.0
github.com/testcontainers/testcontainers-go/modules/postgres v0.44.0
golang.org/x/crypto v0.58.0
New OpenTelemetry Dependencies

The PR introduces new OpenTelemetry dependencies such as go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp and related packages. These additions may affect tracing and metrics collection behavior, requiring careful review to ensure proper configuration and no unintended side effects in observability.

 
	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0
	go.opentelemetry.io/otel v1.47.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.47.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0
	go.opentelemetry.io/otel/sdk v1.47.0
	go.opentelemetry.io/otel/trace v1.47.0
)

@jdwlabs-review-bot

jdwlabs-review-bot Bot commented Oct 25, 2026

Copy link
Copy Markdown

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
General
Updated OpenTelemetry dependencies

Upgrade OpenTelemetry libraries to newer versions to incorporate latest features,
stability improvements, and compatibility fixes.

apps/backend/servicediscovery/go.mod [7-13]

-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0
-	go.opentelemetry.io/otel v1.46.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0
-	go.opentelemetry.io/otel/sdk v1.46.0
-	go.opentelemetry.io/otel/trace v1.46.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0
+	go.opentelemetry.io/otel v1.47.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.47.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0
+	go.opentelemetry.io/otel/sdk v1.47.0
+	go.opentelemetry.io/otel/trace v1.47.0
Suggestion importance[1-10]: 9

__

Why: This suggestion accurately captures the intent to upgrade multiple OpenTelemetry dependencies in servicediscovery/go.mod. It correctly identifies and updates several related libraries from v0.71.0/v1.46.0 to v0.72.0/v1.47.0, which represents a significant version bump across the board. This is a high-impact improvement for observability and monitoring capabilities.

High
Updated database and crypto dependencies

Update the PostgreSQL driver and crypto library to their latest versions to benefit
from performance improvements, bug fixes, and security patches.

apps/backend/identity-service/go.mod [7-10]

-	github.com/jackc/pgx/v5 v5.10.0
-	golang.org/x/crypto v0.56.0
+	github.com/jackc/pgx/v5 v5.11.0
+	golang.org/x/crypto v0.58.0
Suggestion importance[1-10]: 8

__

Why: The suggestion correctly identifies and updates two key dependencies: github.com/jackc/pgx/v5 from v5.10.0 to v5.11.0 and golang.org/x/crypto from v0.56.0 to v0.58.0. These are important updates that bring performance improvements, bug fixes, and security patches, making this a high-impact suggestion.

Medium
Updated frontend and tooling dependencies

Bump pnpm, ESLint plugins, Nx packages, and other tooling to their latest versions
to ensure access to new features, bug fixes, and performance enhancements.

package.json [5-79]

-  "pnpm": "12.5.1",
-  "@angular-eslint/eslint-plugin": "22.2.0",
-  "@angular-eslint/eslint-plugin-template": "22.2.0",
-  "@angular-eslint/template-parser": "22.2.0",
-  "@angular/build": "22.2.3",
-  "@nx/angular": "23.2.1",
-  "@nx/devkit": "23.2.1",
-  "@nx/eslint": "23.2.1",
-  "@nx/eslint-plugin": "23.2.1",
-  "@nx/gradle": "23.2.1",
-  "@nx/js": "23.2.1",
-  "@nx/module-federation": "23.2.1",
-  "@nx/playwright": "23.2.1",
-  "@nx/web": "23.2.1",
-  "@nx/webpack": "23.2.1",
-  "@nx/workspace": "23.2.1",
-  "@redocly/cli": "2.51.1",
-  "@swc/core": "1.16.1",
-  "@typescript-eslint/eslint-plugin": "8.69.0",
-  "@typescript-eslint/parser": "8.69.0",
-  "@typescript-eslint/utils": "8.69.0",
-  "angular-eslint": "22.2.0",
-  "eslint": "10.9.1",
-  "ng-packagr": "22.2.1",
-  "nx": "23.2.1",
-  "webpack": "5.110.3",
-  "yaml": "2.9.0"
+  "pnpm": "12.15.0",
+  "@angular-eslint/eslint-plugin": "22.6.0",
+  "@angular-eslint/eslint-plugin-template": "22.6.0",
+  "@angular-eslint/template-parser": "22.6.0",
+  "@angular/build": "22.2.4",
+  "@nx/angular": "23.3.1",
+  "@nx/devkit": "23.3.1",
+  "@nx/eslint": "23.3.1",
+  "@nx/eslint-plugin": "23.3.1",
+  "@nx/gradle": "23.3.1",
+  "@nx/js": "23.3.1",
+  "@nx/module-federation": "23.3.1",
+  "@nx/playwright": "23.3.1",
+  "@nx/web": "23.3.1",
+  "@nx/webpack": "23.3.1",
+  "@nx/workspace": "23.3.1",
+  "@redocly/cli": "2.71.0",
+  "@swc/core": "1.16.20",
+  "@typescript-eslint/eslint-plugin": "8.72.0",
+  "@typescript-eslint/parser": "8.72.0",
+  "@typescript-eslint/utils": "8.72.0",
+  "angular-eslint": "22.6.0",
+  "eslint": "10.13.0",
+  "ng-packagr": "22.2.5",
+  "nx": "23.3.1",
+  "webpack": "5.112.2",
+  "yaml": "2.9.1"
Suggestion importance[1-10]: 7

__

Why: The suggestion comprehensively covers updating various tooling and dependency versions in package.json, including pnpm, Angular ESLint plugins, Nx packages, and others. While it's a solid overall improvement, it's a general maintenance update rather than addressing a specific bug or critical issue, hence a moderate score.

Medium

@jdwillmsen jdwillmsen added risk/R2 merge-captain tag/code merge-captain tag/deps merge-captain tag/tests merge-captain labels Oct 26, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 11cc066 to ea2ce94 Compare October 26, 2026 06:20
@jdwillmsen @claude
fix(deps): hold angular build and webpack, repair CI for nx 23.3 and …
306dd4e 
…gradle 9.8

Hold @angular/build and @angular-devkit/build-angular at 22.2.3 and webpack
at 5.110.3: 22.2.4 pulls webpack 5.112.x, which cannot resolve
webpack/lib/util/extractUrlAndGlobal and breaks the module-federation
production builds. Add Renovate allowedVersions rules so these are not
re-proposed until upstream is fixed.

Exempt Gradle processTestResources from the cacheable-inputs workspace check
(Nx 23.3 now surfaces it). Ignore Gradle build output from prettier since
Gradle 9.8 writes problems-report.html there.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@renovate

renovate Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@jdwillmsen
jdwillmsen merged commit d48a2dc into main Oct 26, 2026
23 checks passed
@jdwillmsen
jdwillmsen deleted the renovate/all-minor-patch branch October 26, 2026 06:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jdwillmsen jdwillmsen Awaiting requested review from jdwillmsen jdwillmsen is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file Review effort 3/5 risk/R2 merge-captain tag/code merge-captain tag/deps merge-captain tag/tests merge-captain

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jdwillmsen