fix(deps): update non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@fastify/deepmerge	^3.2.1 → ^3.2.2
@iconify-json/logos	^1.2.14 → ^1.2.15
@typescript-eslint/eslint-plugin (source)	^8.70.0 → ^8.71.0
@typescript-eslint/parser (source)	^8.70.0 → ^8.71.0
csv-parse (source)	^7.0.2 → ^7.0.3
fast-xml-parser	^5.11.1 → ^5.11.2
turbo (source)	^2.11.0 → ^2.11.7

---

Release Notes

fastify/deepmerge (@​fastify/deepmerge)

v3.2.2

Compare Source

What's Changed

• chore(license): standardise license notice by @​Fdawgs in #​84
• chore(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @​dependabot[bot] in #​85
• ci: remove unused github files by @​Tony133 in #​87
• chore(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @​dependabot[bot] in #​88
• chore(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @​dependabot[bot] in #​89
• ci: add lock-threads workflow by @​Fdawgs in #​91
• refactor(types): migrate from tsd to tstyche by @​Tony133 in #​93
• chore: update depedabot setting by @​climba03003 in #​94
• ci: pin actions to commit-hash by @​Fdawgs in #​96
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in #​97
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​98
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​99
• chore(.npmrc): add min-release-age by @​Fdawgs in #​100
• test: enforce complete coverage by @​Puppo in #​101
• ci: enable trusted publishing releases by @​Puppo in #​102

New Contributors

• @​Tony133 made their first contribution in #​87
• @​climba03003 made their first contribution in #​94
• @​Puppo made their first contribution in #​101

Full Changelog: fastify/deepmerge@v3.2.1...v3.2.2

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.71.0

Compare Source

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#​12732)

🩹 Fixes

• eslint-plugin: [no-misused-promises] handle a return outside of any function (#​12912)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#​12832)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#​12885)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.71.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

adaltas/node-csv (csv-parse)

v7.0.3

Compare Source

Bug Fixes

• csv-parse: preserve typed column keys (#​500) (745f045)
• csv-parse: type the delimiter_auto score callback arguments (#​499) (4aa04da)

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.11.2

Compare Source

What's Changed

• fix: decode Uint8Array XML input as UTF-8 by @​emme1t in #​875
• fix: type EntityDecoderOptions.setXmlVersion's version as a number by @​YevheniiKotyrlo in #​880

New Contributors

• @​emme1t made their first contribution in #​875
• @​YevheniiKotyrlo made their first contribution in #​880

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

vercel/turborepo (turbo)

v2.11.7: Turborepo v2.11.7

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.6 by @​github-actions[bot] in #​14352
• fix: Pass SDKROOT through to repository tasks by @​anthonyshew in #​14353
• chore: Update with-vite-module-federation example by @​vercel-gh-bot-5[bot] in #​14349
• fix: Ignore Vercel OIDC token rotation in .env.local cache inputs by @​anthonyshew in #​14356

Full Changelog: vercel/turborepo@v2.11.6...v2.11.7

v2.11.6: Turborepo v2.11.6

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.5 by @​github-actions[bot] in #​14329
• fix: Upgrade standalone turbo on installer reruns by @​anthonyshew in #​14330
• test: Deflake OpenTelemetry and PTY shutdown tests by @​anthonyshew in #​14331
• docs: Document standalone turbo installation by @​anthonyshew in #​14332
• ci: Install standalone turbo on Windows with PowerShell by @​anthonyshew in #​14334
• fix: Keep Yarn patch resolutions with npm protocol selectors in prune by @​anthonyshew in #​14337
• chore: Update with-tailwind example by @​vercel-gh-bot-5[bot] in #​14264
• ci: Resolve latest turbo release with workflow token by @​anthonyshew in #​14339
• chore: Update with-ultracite example by @​vercel-gh-bot-5[bot] in #​14335
• fix: Match production MFE negative lookaheads locally by @​kitfoster in #​13496
• docs: Add missing system environment variables and run flags by @​BABTUNA in #​13811
• fix: Normalize task inputs consistently for affected detection and hashing by @​anthonyshew in #​14341
• feat: Add task tags with configuration inheritance by @​anthonyshew in #​14342
• fix: Upgrade brace-expansion to latest compatible releases by @​anthonyshew in #​14347
• docs: Point security.txt to Vercel HackerOne program by @​swarnava in #​14346
• test: Deflake untracked scan-scope assertions by @​anthonyshew in #​14348
• feat: Expose task and package tags in query by @​anthonyshew in #​14343
• feat: Filter query tasks and packages by tags by @​anthonyshew in #​14344
• feat: Filter tasks by tags in the CLI by @​anthonyshew in #​14345
• fix: Complete task query metadata for non-script entrypoints by @​anthonyshew in #​14350
• fix: Infer single-package mode for query commands by @​anthonyshew in #​14351

New Contributors

• @​swarnava made their first contribution in #​14346

Full Changelog: vercel/turborepo@v2.11.5...v2.11.6

v2.11.5: Turborepo v2.11.5

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.4 by @​github-actions[bot] in #​14231
• test: Move Python opt-in hint into filter contracts by @​anthonyshew in #​14228
• test: Move dependency-output summary assertion into contract by @​anthonyshew in #​14230
• test: Move dependency-output selection and validation cases to engine contracts by @​anthonyshew in #​14232
• test: Move Cargo exclude-only scope coverage by @​anthonyshew in #​14238
• test: Move Cargo cache-authority cases to contracts by @​anthonyshew in #​14240
• test: Move JIT dependency graph scenario into engine contract by @​anthonyshew in #​14235
• test: Move dependency-output hash cases into task-hash contracts by @​anthonyshew in #​14233
• test: Move Cargo task-filter cases into crate contracts by @​anthonyshew in #​14239
• test: Move JIT input hash timing cases into task-hash contracts by @​anthonyshew in #​14234
• test: Move package input normalization cases into engine contracts by @​anthonyshew in #​14236
• test: Move structured startup and JIT input cases into contracts by @​anthonyshew in #​14237
• fix: Back off remote artifact requests during outages by @​anthonyshew in #​14222
• chore: Release Turborepo 2.11.5-canary.1 by @​github-actions[bot] in #​14245
• test: Make new-package lockfile filter deterministic by @​anthonyshew in #​14241
• test: Trim redundant Go cache builds by @​anthonyshew in #​14242
• test: Reduce Go versioned-name test matrix by @​anthonyshew in #​14243
• test: Move Go binary checks into contracts by @​anthonyshew in #​14246
• test: Consolidate Go format smokes by @​anthonyshew in #​14244
• test: Reuse Cargo build artifacts safely by @​anthonyshew in #​14247
• test: Separate prune planning matrix from buildability smoke by @​anthonyshew in #​14248
• feat: Bundle docs in turbo npm package by @​anthonyshew in #​14108
• chore: Release Turborepo 2.11.5-canary.2 by @​github-actions[bot] in #​14249
• fix: Stabilize pnpm per-workspace lockfile hashes by @​anthonyshew in #​14253
• chore: Upgrade factory Next.js to 16.3.3 by @​anthonyshew in #​14254
• fix: Update js-yaml to address CVE-2026-84375 by @​anthonyshew in #​14255
• chore: Upgrade Next.js in docs and factory for CVE-2026-94545 by @​anthonyshew in #​14256
• fix: Remove unmaintained proc-macro-error2 by @​anthonyshew in #​14257
• refactor: Replace clap in production CLIs with usage-rs by @​anthonyshew in #​14259
• chore: Remove tiny-gradient dependency by @​anthonyshew in #​14260
• refactor: Replace human-panic with local crash reporting by @​anthonyshew in #​14261
• chore: Remove unused struct_iterable dependency by @​anthonyshew in #​14258
• fix: Sign complete on-disk artifacts after local cache writes by @​anthonyshew in #​14265
• chore: Remove derive_setters dependency by @​anthonyshew in #​14266
• chore: Remove port_scanner dependency by @​anthonyshew in #​14267
• chore: Remove unused Rust dependency declarations by @​anthonyshew in #​14268
• refactor: Remove unused public Rust APIs by @​anthonyshew in #​14269
• refactor: Use workspace Rust edition across crates by @​anthonyshew in #​14270
• chore: Clean up Rust Clippy exceptions by @​anthonyshew in #​14271
• refactor: Group task-hash and uv generation context by @​anthonyshew in #​14279
• refactor: Remove unused global hash wrapper by @​anthonyshew in #​14281
• refactor: Remove unused file-hash telemetry argument by @​anthonyshew in #​14282
• refactor: Remove dead CLI code and crate-wide allowance by @​anthonyshew in #​14283
• refactor: Remove dead Microfrontends config code by @​anthonyshew in #​14284
• refactor: Remove unused UI task types and dead-code allowance by @​anthonyshew in #​14286
• refactor: Remove unused Cache archive test helper and dead code allowance by @​anthonyshew in #​14287
• chore: Narrow Run dead-code allowances by @​anthonyshew in #​14285
• chore: Remove resolved TODO markers by @​anthonyshew in #​14288
• fix: Use map_while for invariant text prefixes by @​anthonyshew in #​14289
• test: Cover globwalk parent traversal by @​anthonyshew in #​14290
• fix: Wait for watcher setup with Tokio wait_for by @​anthonyshew in #​14292
• test: Exercise SCM package hashing for symlinks by @​anthonyshew in #​14291
• fix: Reject empty tokens when reading token files by @​anthonyshew in #​14293
• test: Verify Yarn transparent workspace handling by @​anthonyshew in #​14294
• fix: Format pnpm v5 package names by @​anthonyshew in #​14295
• fix: Report package manager error source paths by @​anthonyshew in #​14296
• fix: Resolve LSP task references with JSONC AST by @​anthonyshew in #​14298
• chore: Remove stale package watcher TODO by @​anthonyshew in #​14299
• fix: Validate scope selector glob bases by @​anthonyshew in #​14300
• fix: Add path context to globwatch errors by @​anthonyshew in #​14301
• docs: Document wax pattern and walk semantics by @​anthonyshew in #​14302
• chore: Remove resolved filewatch input-set TODO by @​anthonyshew in #​14303
• docs: Document FSEvents event translation by @​anthonyshew in #​14305
• refactor: Group run-cache task context by @​anthonyshew in #​14304
• chore: Document package watcher task-input filtering by @​anthonyshew in #​14306
• chore: Remove stale const_format lint workaround by @​anthonyshew in #​14307
• refactor: Route regex groups through Grouping by @​anthonyshew in #​14308
• perf: Parse character classes without compiling regex by @​anthonyshew in #​14310
• chore: Drop unused Biome dependencies from turbopath by @​anthonyshew in #​14311
• chore: Unify jsonc-parser versions by @​anthonyshew in #​14312
• chore: Remove error-only dependency edges by @​anthonyshew in #​14313
• perf: Emit casing flags only when they change by @​anthonyshew in #​14309
• perf: Avoid formatting Bun lockfiles during parsing by @​anthonyshew in #​14314
• test: Assert process manager stop postconditions by @​anthonyshew in #​14297
• perf: Serve a static GraphiQL page by @​anthonyshew in #​14315
• perf: Upgrade serde_json to reduce CLI size by @​anthonyshew in #​14316
• perf: Upgrade Ratatui to reduce TUI allocations by @​anthonyshew in #​14317
• fix: Restore TUI log streaming after Ratatui upgrade by @​anthonyshew in #​14318
• feat: Add version-matched agent guidance by @​anthonyshew in #​14250
• fix: Restore Rust builds after agent guidance changes by @​anthonyshew in #​14319
• chore: Release Turborepo 2.11.5-canary.3 by @​github-actions[bot] in #​14320
• docs: Update Turborepo schema URL example by @​yousefdawood7 in #​14321
• feat: Publish versioned standalone turbo archives by @​anthonyshew in #​14322
• fix: Run standalone archive job on manual releases by @​anthonyshew in #​14323
• chore: Release Turborepo 2.11.5-canary.4 by @​github-actions[bot] in #​14324
• feat: Add standalone installers URLs for curl | bash by @​anthonyshew in #​14325
• fix: Isolate installer test environment by @​anthonyshew in #​14326
• fix: Pass repository to release asset commands by @​anthonyshew in #​14327
• chore: Release Turborepo 2.11.5-canary.5 by @​anthonyshew in #​14328

New Contributors

• @​yousefdawood7 made their first contribution in #​14321

Full Changelog: vercel/turborepo@v2.11.4...v2.11.5

v2.11.4: Turborepo v2.11.4

Compare Source

What's Changed

Changelog

• fix: Respect negated global dependencies in affected detection by @​anthonyshew in #​14164
• chore: Release Turborepo 2.11.3 by @​github-actions[bot] in #​14165
• test: Share Go compilation caches across integration tests by @​anthonyshew in #​14166
• refactor: Add injectable manifest loading to repository graphs by @​anthonyshew in #​14167
• test: Move Go and Cargo scope planning into crate tests by @​anthonyshew in #​14168
• refactor: Extract subprocess-free Go observation assembly by @​anthonyshew in #​14169
• test: Move Cargo environment hash contracts into crates by @​anthonyshew in #​14170
• test: Move Cargo output layout matrices to repository contracts by @​anthonyshew in #​14171
• test: Cover Go discovery identities in memory by @​anthonyshew in #​14172
• test: Cover Go hash inputs in repository contracts by @​anthonyshew in #​14174
• test: Move uv hash input contracts into crates by @​anthonyshew in #​14175
• test: Cover Go task selection in the engine by @​anthonyshew in #​14173
• test: Inject uv discovery for native task contracts by @​anthonyshew in #​14176
• test: Inject query contracts over repository graphs by @​anthonyshew in #​14177
• test: Inject dry-run task summary contracts by @​anthonyshew in #​14178
• test: Expose prune workspace selection plan by @​anthonyshew in #​14179
• test: Inject change detection at scope entry point by @​anthonyshew in #​14180
• test: Move uv lock affectedness planning into repository contracts by @​anthonyshew in #​14184
• test: Use virtual clock for package watcher events by @​anthonyshew in #​14181
• test: Move Cargo task query and dry-run planning into contracts by @​anthonyshew in #​14185
• test: Move uv quality query and dry-run projections into contracts by @​anthonyshew in #​14186
• test: Move JavaScript hash and framework projections into contracts by @​anthonyshew in #​14188
• test: Cover prune closure and native layout plans in process by @​anthonyshew in #​14189
• test: Cover mixed-toolchain scope filters through injection by @​anthonyshew in #​14190
• test: Make package watcher suppression and rediscovery deterministic by @​anthonyshew in #​14191
• test: Inject watch run lifecycle and event collection by @​anthonyshew in #​14192
• test: Move recursive root-script guard into process-free contract by @​anthonyshew in #​14193
• test: Move Go query and summary parity into crate contracts by @​anthonyshew in #​14187
• test: Remove duplicate CLI filter matrix cases by @​anthonyshew in #​14194
• test: Trim duplicate prune materialization cases by @​anthonyshew in #​14195
• test: Match Go library summary path on Windows by @​anthonyshew in #​14197
• test: Cover mixed-toolchain watch task selection in process by @​anthonyshew in #​14196
• test: Preserve Windows SystemRoot in strict-env fixture by @​anthonyshew in #​14198
• test: Retain real watch smokes after selection migration by @​anthonyshew in #​14199
• fix: Only reject secondary go.work files Go reads for workspace members by @​voiys in #​14183
• test: Split Go north-star cache invalidation into hash contracts by @​anthonyshew in #​14201
• test: Avoid deleting built prune output in cross-toolchain prune test by @​anthonyshew in #​14202
• test: Move turbo.json validation cases into crate contracts by @​anthonyshew in #​14203
• chore: Update with-solid example by @​vercel-gh-bot-2[bot] in #​14200
• refactor: Split RunBuilder execution context construction into phases by @​anthonyshew in #​14204
• refactor: Inject remote cache status probe by @​anthonyshew in #​14205
• refactor: Inject inputs into config resolution by @​anthonyshew in #​14206
• feat: Add affected query APIs to turborepo-query by @​anthonyshew in #​14207
• refactor: Wire CLI through affected query APIs by @​anthonyshew in #​14208
• feat: Add pure microfrontend port resolver by @​anthonyshew in #​14209
• refactor: Inject change detection into affected run paths by @​anthonyshew in #​14210
• test: Move affectedTasks planning cases into query contracts by @​anthonyshew in #​14214
• refactor: Route get-mfe-port through the pure resolver by @​anthonyshew in #​14215
• test: Count native discovery for JavaScript-only selections by @​anthonyshew in #​14216
• fix: Disable remote cache after unrecoverable forbidden responses by @​anthonyshew in #​14218
• perf: Send cache analytics in larger batches by @​anthonyshew in #​14219
• perf: Batch dry-run remote cache existence checks by @​anthonyshew in #​14220
• test: Move config precedence cases into funnel contracts by @​anthonyshew in #​14217
• test: Move affected run planning into RunBuilder contracts by @​anthonyshew in #​14212
• fix: Coordinate artifact requests after rate limiting by @​anthonyshew in #​14221
• fix: Share concurrent remote-cache token recovery by @​anthonyshew in #​14223
• refactor: Make repository context inputs injectable by @​anthonyshew in #​14224
• refactor: Group Run state into execution and services contexts by @​anthonyshew in #​14225
• test: Move Cargo prune layout checks into in-process plan contracts by @​anthonyshew in #​14226
• test: Move Cargo and Go discovery cases into contracts by @​anthonyshew in #​14227
• fix: Put version in turbo query JSON output instead of a separate banner by @​anthonyshew in #​14229

New Contributors

• @​voiys made their first contribution in #​14183

Full Changelog: vercel/turborepo@v2.11.3...v2.11.4

v2.11.3: Turborepo v2.11.3

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.2 by @​github-actions[bot] in #​14107
• refactor: Remove experimental Cargo compile cache by @​anthonyshew in #​14110
• refactor: Remove clap from turborepo-types by @​anthonyshew in #​14111
• chore: Use canary turbo for Vercel builds by @​anthonyshew in #​14112
• refactor: Extract turborepo-tracing crate by @​anthonyshew in #​14113
• refactor: Remove Run boundaries extension by @​vercel-gh-bot-2[bot] in #​14114
• refactor: Relocate child spawning to turborepo-process by @​vercel-gh-bot-3[bot] in #​14115
• docs: Drop stale support-policy entry from getting-started nav by @​Neekoras in #​14116
• refactor: Move CLI configuration overrides into CLI by @​anthonyshew in #​14119
• fix: Avoid microfrontend polyrepo warnings by @​anthonyshew in #​14118
• refactor: Add run and execution selector DTOs by @​anthonyshew in #​14120
• chore: Release Turborepo 2.11.3-canary.1 by @​github-actions[bot] in #​14121
• test: Reuse Go cache in invalidation test by @​anthonyshew in #​14122
• chore: Release Turborepo 2.11.3-canary.2 by @​github-actions[bot] in #​14124
• test: Avoid overlapping concurrent cache restores by @​anthonyshew in #​14125
• refactor: Rewire Opts to consume selectors by @​anthonyshew in #​14126
• refactor: Extract task filtering into dedicated crate by @​anthonyshew in #​14127
• refactor: Extract task access into dedicated crate by @​anthonyshew in #​14128
• refactor: Extract MicrofrontendsConfigs by @​anthonyshew in #​14133
• chore: Update with-rollup example by @​vercel-gh-bot-5[bot] in #​14123
• refactor: Move unified turbo.json loader by @​anthonyshew in #​14134
• refactor: Extract package watcher crate by @​anthonyshew in #​14135
• refactor: Extract prune input DTO by @​anthonyshew in #​14136
• fix: Ignore gitignored files in boundaries by @​anthonyshew in #​14137
• fix: Stabilize boundaries tag order in prune by @​anthonyshew in #​14138
• fix: Normalize affected task input globs by @​anthonyshew in #​14140
• chore: Release Turborepo 2.11.3-canary.3 by @​github-actions[bot] in #​14141
• refactor: Extract prune orchestration by @​anthonyshew in #​14142
• ci: Update Node.js test matrices by @​anthonyshew in #​14139
• refactor: Add Turborepo run context crate by @​anthonyshew in #​14143
• refactor: Add repository run context by @​anthonyshew in #​14144
• refactor: Use RepoContext in task graph visitor by @​anthonyshew in #​14145
• refactor: Extract repository discovery from run builder by @​anthonyshew in #​14146
• refactor: Extract run execution context construction by @​anthonyshew in #​14147
• refactor: Extract run services construction by @​anthonyshew in #​14148
• refactor: Promote task graph to dedicated crate by @​anthonyshew in #​14150
• refactor: Extract run options into dedicated crate by @​anthonyshew in #​14152
• docs: Remove duplicated word in the 1.9 blog post by @​Neekoras in #​14129
• refactor: Promote run and watch to dedicated crates by @​anthonyshew in #​14153
• refactor: Extract run command orchestration by @​anthonyshew in #​14154
• refactor: Rename turborepo-lib to turborepo-cli by @​anthonyshew in #​14155
• refactor: Slim query API interface by @​anthonyshew in [#​14157](https://redirect.github.com/v

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.