Skip to content

chore(deps): update all dependencies#69

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies
Open

chore(deps): update all dependencies#69
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-dependencies

Conversation

@renovate

@renovate renovate Bot commented May 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
actions/attest action patch v4.1.0 → v4.1.1 v4.2.0 age confidence
actions/cache action minor v5.0.5 → v5.1.0 age confidence
actions/checkout action patch v6.0.2 → v6.0.3 age confidence
aqua:aquasecurity/trivy minor 0.70.0 → 0.72.0 age confidence
aqua:cli/cli minor 2.92.0 → 2.96.0 age confidence
aqua:crate-ci/typos minor 1.46.1 → 1.48.0 age confidence
aqua:mikefarah/yq patch 4.53.2 → 4.53.3 age confidence
aqua:zizmorcore/zizmor minor 1.24.1 → 1.26.1 1.27.0 age confidence
codecov/codecov-action action patch v6.0.0 → v6.0.2 age confidence
github/codeql-action action minor v4.35.4 → v4.37.0 v4.37.1 age confidence
jdx/mise minor v2026.5.3 → v2026.7.5 v2026.7.7 (+1) age confidence
jdx/mise-action action minor v4.0.1 → v4.2.0 v4.2.1 age confidence
pnpm (source) packageManager minor 11.0.8+sha512.4c4097e1dd2d42372c4e7fa5a791ff28fc75a484c7ac192e64b1df0fdef17594ba982f9b4fed9adfb3c757846f565b799b2763fb3733d1de1bcb82cf46684912 → 11.11.0 11.15.1 (+3) age confidence
zizmorcore/zizmor-action action patch v0.5.3 → v0.5.7 v0.6.0 age confidence

Release Notes

actions/attest (actions/attest)

v4.1.1

Compare Source

What's Changed

Full Changelog: actions/attest@v4.1.0...v4.1.1

actions/cache (actions/cache)

v5.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

actions/checkout (actions/checkout)

v6.0.3

Compare Source

aquasecurity/trivy (aqua:aquasecurity/trivy)

v0.72.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10907

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0720-2026-06-30

v0.71.2

Compare Source

Changelog

v0.71.1

Compare Source

Changelog

  • 164b383 release: v0.71.1 [release/v0.71] (#​10818)
  • a72d9a4 fix(oci): validate artifact filename
  • 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#​10825)
  • a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#​10821)
  • 43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#​10812)
  • ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#​10815)

v0.71.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10767

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0710-2026-06-01

cli/cli (aqua:cli/cli)

v2.96.0: GitHub CLI 2.96.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.95.0...v2.96.0

v2.95.0: GitHub CLI 2.95.0

Compare Source

Read repository files and directories with gh repo read-file and gh repo read-dir

Two new preview commands read repository contents without cloning:

# Read a single file to stdout
gh repo read-file README.md --repo cli/cli

# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli

# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli

# List the entries in a directory
gh repo read-dir script --repo cli/cli

Both commands default to the repository's default branch, accept --ref to target any branch, tag, or commit, and support --json, --jq, and --template for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.

[!NOTE]
gh repo read-file and gh repo read-dir are in preview and subject to change without notice.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.94.0...v2.95.0

v2.94.0: GitHub CLI 2.94.0

Compare Source

Issue types, sub-issues, and relationships in gh issue

issue-view-monas-cafe-with-frame

This release brings GitHub's advanced issue features to gh issue create, edit, view, and list. You can set and view an issue's type, organize work with sub-issues, and track blocked-by and blocking relationships without leaving the command line:

# Set an issue's type
gh issue create --type Bug
gh issue edit 123 --type Bug

# Organize work with sub-issues
gh issue create --parent 100
gh issue edit 100 --add-sub-issue 123

# Track blocked-by and blocking relationships
gh issue create --blocked-by 200
gh issue edit 123 --add-blocking 300

Issue types and sub-issues are available on GitHub.com and GHES 3.17+; relationships require GHES 3.19+.

Manage discussions with gh discussion

discussion-view-monas-cafe-with-frame

This release introduces the discussion command set for working with GitHub Discussions in gh:

# List discussions
gh discussion list

# View a discussion, its comments, or replies to a comment
gh discussion view 123 --comments

# Create a discussion
gh discussion create

# Edit a discussion
gh discussion edit 123

# Comment on a discussion
gh discussion comment 123

# Reply to a comment using its URL
gh discussion comment <url>

Run gh discussion --help for more information.

[!NOTE]
The discussion command set is in preview and is subject to change without notice.

Equip your agents with new gh features

Teach your agents how to leverage new GitHub CLI features on release day by installing the gh skill:

# Install
gh skill install cli/cli gh --scope user

# Or update
gh skill update gh

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.93.0...v2.94.0

v2.93.0: GitHub CLI 2.93.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands.

Users are advised to update gh to version v2.93.0 as soon as possible.

For more information see: GHSA-8xvp-7hj6-mcj9

Support agents in gh secret command set

The gh secret command set can now set agent secrets. For more information, see "Configuring secrets and variables for Copilot cloud agent".

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.92.0...v2.93.0

crate-ci/typos (aqua:crate-ci/typos)

v1.48.0

Compare Source

Features
  • Updated the dictionary with the June 2026 changes

v1.47.2

Compare Source

Fixes
  • Don't correct inferrable
  • Correct unused inferible variant

v1.47.1

Compare Source

Fixes
  • Don't correct requestors

v1.47.0

Compare Source

Features
  • Updated the dictionary with the May 2026 changes

v1.46.3

Compare Source

Fixes
  • Don't correct to sequentials
  • Don't correct to subdolder

v1.46.2

Compare Source

Fixes
  • Don't correct to criterias
  • Don't correct to replaceables

v1.46.1

Compare Source

Fixes
  • Don't correct to confidentials
mikefarah/yq (aqua:mikefarah/yq)

v4.53.3

Compare Source

zizmorcore/zizmor (aqua:zizmorcore/zizmor)

v1.26.1

Compare Source

This is a small corrective release for 1.26.0.

v1.26.0

Compare Source

New Features 🌈🔗

  • New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#​1985)

    Many thanks to @​andrew for proposing and implementing this improvement!

  • New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#​2085)

    Many thanks to @​terror for proposing and implementing this improvement!

  • New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#​2061)

    Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗

Performance Improvements 🚄🔗

  • Most online audits are significantly faster, thanks to more precise retry handling (#​2036)
    Bug Fixes 🐛🔗

  • Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#​2026)

    Many thanks to @​fionn for implementing this fix!

  • Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#​2040)

  • Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#​2055)

  • Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#​2059, #​2069)

  • Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#​2073)

  • Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#​2102)

  • Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#​2098)

  • The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#​1748, #​2095)

Changes ⚠️🔗

  • The impostor-commit audit no longer suggests auto-fixes, to avoid incorrectly minimizing the amount of manual remediation work needed (#​2054)

  • The JSON and SARIF outputs no longer contain a misleading prefix key (#​2095)

v1.25.2

Compare Source

Bug Fixes 🐛🔗

v1.25.1

Compare Source

Bug Fixes 🐛🔗

v1.25.0

Compare Source

New Features 🌈🔗

  • zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#​1913)

    Many thanks to @​Proximyst for proposing and implementing this improvement!

  • New audit: github-app detects dangerous usages of GitHub App installation tokens (#​1926)

  • New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#​1820)

  • zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#​1935)

  • zizmor's LSP now honors the --persona flag on the CLI (#​1943)

  • zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#​1965)

Enhancements🔗

Performance Improvements 🚄🔗

  • The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#​1998)
    Bug Fixes 🐛🔗

  • Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#​1904)

  • Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#​1909)

  • Fixed a bug where the unpinned-images audit would miss images defined in container: clauses (#​1944)

  • Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#​1945)

  • Fixed a bug where the cache-poisoning audit would fail to detect some release trigger

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented May 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@greptile-apps

greptile-apps Bot commented May 16, 2026

Copy link
Copy Markdown

Greptile Summary

Bumps the packageManager field in package.json from pnpm@11.0.8 to pnpm@11.0.9 with an updated SHA512 integrity hash, as generated by Renovate.

  • The new hash (34ce82e6…) is a valid 128-character SHA512 hex digest matching pnpm 11.0.9.
  • The 11.0.9 release is a patch containing bug fixes for GitLab-hosted dependencies, NPM_CONFIG_USERCONFIG handling, pnpm pack bundling, CLI crash on old Node.js, and pnpm publish --provenance semver metadata.

Confidence Score: 5/5

This is a single-line patch bump to the package manager version with a verified integrity hash — no application logic is touched.

The only change is updating the packageManager field to pnpm 11.0.9, a patch release with exclusively bug fixes. The SHA512 hash is correctly formatted (128-character hex digest). No production code, dependencies, or configuration is affected beyond the toolchain version itself.

No files require special attention.

Important Files Changed

Filename Overview
package.json Updates packageManager field from pnpm 11.0.8 to 11.0.9 with a new SHA512 integrity hash; patch-only change with no structural modifications.

Reviews (1): Last reviewed commit: "chore(deps): update pnpm to v11.0.9" | Re-trigger Greptile

@renovate
renovate Bot force-pushed the renovate/all-dependencies branch from 3ab57c0 to 577b53d Compare May 16, 2026 12:49
@renovate renovate Bot changed the title chore(deps): update pnpm to v11.0.9 chore(deps): update all dependencies May 16, 2026
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 13 times, most recently from 32522fa to b85bcd5 Compare May 23, 2026 21:32
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 12 times, most recently from 00d9da8 to db5f0ab Compare May 31, 2026 09:03
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch from db5f0ab to 5ed2bcd Compare June 3, 2026 14:15
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 6 times, most recently from 0f2212c to 4caf698 Compare June 18, 2026 00:41
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 11 times, most recently from aa7baf4 to de2acdb Compare June 25, 2026 11:35
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 7 times, most recently from dff2d4d to f3c196b Compare July 2, 2026 04:39
@renovate
renovate Bot force-pushed the renovate/all-dependencies branch 5 times, most recently from 12e2980 to 1272663 Compare July 9, 2026 09:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants