Skip to content

chore(deps): update dependency hk to v2 - #274

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-jdx-hk
Open

chore(deps): update dependency hk to v2#274
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-jdx-hk

Conversation

@renovate

@renovate renovate Bot commented Sep 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF
hk tools major 1.58.1 → 2.5.0 OpenSSF Scorecard

Release Notes

jdx/hk (hk)

v2.5.0

Compare Source

🚀 Features
  • (builtins) keep CRLF files CRLF in trailing_whitespace, newlines, and mixed_line_ending by @​jdx in #​1621
  • (builtins) report revive findings as diagnostics by @​jdx in #​1626
  • (builtins) report buf_lint and clang_format findings as diagnostics by @​jdx in #​1627
  • (builtins) report actionlint findings as diagnostics by @​jdx in #​1623
  • (builtins) report flake8 findings as diagnostics by @​jdx in #​1624
  • (builtins) report mypy, mado and six more linters as diagnostics by @​jdx in #​1630
  • (config) read column-less, prefixed and summarized output with the gcc diagnostic format by @​jdx in #​1629
  • (init) detect 47 more tools from their config files by @​jdx in #​1576
  • (mcp) let agents run checks on changed or unstaged files only by @​jdx in #​1600
  • (mcp) let agents run checks on staged files only by @​jdx in #​1640
  • (test) assert normalized diagnostics in step tests by @​jdx in #​1622
  • (validate) warn about misspelled properties, no-op depends, unmatchable globs and loose min_hk_version by @​jdx in #​1590
🐛 Bug Fixes
  • (agent) make --safe refuse a hook report with unknown or destructive effect by @​jdx in #​1573
  • (agent) make Claude Code and Codex Stop hooks block with a valid decision and exit 0 by @​jdx in #​1604
  • (builtins) check large files and case conflicts in binary files by @​jdx in #​1571
  • (check) fail on unknown --step names instead of passing after running no steps by @​jdx in #​1603
  • (ci) fail test:bats on a mistyped path or when no tests run by @​jdx in #​1563
  • (cli) keep generated output exit codes on closed pipes by @​jdx in #​1540
  • (cli) print failures once, without Rust locations or a bogus fix hint by @​jdx in #​1588
  • (config) union user skip_steps, skip_hooks and hide_warnings with the project's, and warn when hk.local.pkl replaces hk.pkl by @​jdx in #​1596
  • (config) honor top-level jobs, accept documented HK_STASH values, and fix the hk config crash by @​jdx in #​1594
  • (config) honor subproject skip_steps and warn about ignored subproject settings by @​jdx in #​1615
  • (docs) stop sidebar links showing through the logo when it bounces by @​jdx in #​1554
  • (git) skip tracked files with non-UTF-8 names with a warning in --all, --glob, --from-ref and file arguments by @​jdx in #​1613
  • (init) explain why a hook is missing and print next steps after hk init by @​jdx in #​1564
  • (install) correct the --force-local message when a global install exists by @​jdx in #​1616
  • (install) keep hook commands working after hk upgrades and under a minimal PATH by @​jdx in #​1597
  • (mcp) make cancel_run stop the real hk run instead of sticking in cancelling by @​jdx in #​1607
  • (mcp) cap step output in structured results and report pre-run failures by @​jdx in #​1605
  • (mcp) include untracked and binary files in get_diff and surface capture errors by @​jdx in #​1601
  • (pkl) load configs that amend the v1 package schema by @​jdx in #​1560
  • (pkl) hide mirror credentials in failed package download errors by @​jdx in #​1620
  • (pkl) show file, line and column for Pkl syntax errors, including in imported files by @​jdx in #​1598
  • (stash) preserve CRLF when restoring unstaged files by @​jdx in #​1535
  • (stash) restore unstaged text over a staged binary file no step changed by @​jdx in #​1580
  • (stash) stash tracked files whose names start with a colon by @​jdx in #​1614
  • (stash) keep a staged edit when its worktree copy was reverted to HEAD by @​jdx in #​1602
  • (stash) keep a merge or cherry-pick in progress when stashing the worktree by @​jdx in #​1609
  • (stash) restore hk's own stash entry by commit id so concurrent stashes are never touched by @​jdx in #​1637
  • (stash) serialize stash and restore across hk processes and linked worktrees by @​jdx in #​1636
  • (stash) restore stashed changes when hk is terminated and recover them after a crash by @​jdx in #​1641
  • (step) isolate formatter patches from concurrent commands and staging by @​nettlesh in #​1392
  • (step) keep interactive steps in hk's process group by @​jdx in #​1557
  • (step) say "command not found" when an argv step's tool is not installed by @​jdx in #​1579
  • (step) add exec_ok for condition shell tests and stop exec panicking by @​jdx in #​1610
  • (step) run steps that depend on a step with no files instead of hanging by @​jdx in #​1584
  • (step) select files in directories whose names contain brackets or braces by @​jdx in #​1592
  • (step) keep percent signs in file names literal under cmd.exe by @​jdx in #​1568
  • (step) end tools left running by a fail-fast cancel on Windows by @​jdx in #​1625
  • (step) exclude a directory's files when a step or group exclude names it by @​jdx in #​1606
  • (step) report diagnostic paths relative to the repository root for steps that run in a subdirectory by @​jdx in #​1638
  • (step) run a custom shell directly on Windows and accept a quoted shell path by @​jdx in #​1628
  • (step) batch Windows cmd shims below the cmd.exe line limit by @​jdx in #​1618
  • (step) type scripts whose env shebang has -S, options or variables by @​jdx in #​1611
  • (step) keep diagnostics from every started job when another job fails by @​jdx in #​1642
  • (step) report steps stopped by Ctrl-C as cancelled instead of failed by @​jdx in #​1643
  • (util) check files whose 8 KiB probe splits a multibyte char and keys in non-UTF-8 files by @​jdx in #​1572
  • (util) accept git-generated merge and revert titles in check-conventional-commit by @​jdx in #​1566
  • (util) check protected branch, exec bits and case conflicts against git's own state by @​jdx in #​1577
  • (util) keep non-UTF-8 files and symlinks intact in fix-smart-quotes by @​jdx in #​1570
  • (validate) reject dependency cycles, self-dependencies and invalid step globs at load time by @​jdx in #​1567
📚 Documentation
  • (builtins) show file selectors, script commands and options in the catalogue by @​jdx in #​1562
  • (config) explain where diagnostics come from and when a step needs diagnostic_format by @​jdx in #​1619
  • (config) document sharing one configuration across repositories by @​jdx in #​1591
  • (settings) describe pkl rewrite and CA variables for the built-in evaluator by @​jdx in #​1617
  • refresh competitor benchmark for v2.4.0 by @​jdx in #​1536
  • replace the sea shanty with Bound for the Main and its music video by @​jdx in #​1541
  • take the new shanty video down if its poster cannot be published by @​jdx in #​1543
  • add a sea shanty mode to the landing page by @​jdx in #​1544
  • keep a link to the sea shanty when scripting is off by @​jdx in #​1545
  • generate the pirate CLI reference from the English one by @​jdx in #​1550
  • restrict AI replies on Discussions and Issues and note the instant ban by @​jdx in #​1559
  • start getting started with a first configuration that needs no linters by @​jdx in #​1561
  • correct stash, type-checker lock, and patch-apply descriptions by @​jdx in #​1578
  • add lefthook and husky with lint-staged migration guides by @​jdx in #​1589
⚡ Performance
  • (config) evaluate only the builtins a config uses, cutting cold load from ~1.4 s to ~0.07 s by @​jdx in #​1581
  • (git) skip the untracked scan for runs that name their files, e.g. hk check FILE by @​jdx in #​1587
  • (stash) restore unstaged files no step changed with one git process by @​jdx in #​1612
  • (stash) stop rescanning the worktree before stashing, saving ~80 ms on large repos by @​jdx in #​1595
  • (step) resolve workspace_indicator once per directory, saving ~120 ms per step in large monorepos by @​jdx in #​1599
  • (step) run read-only check-only steps side by side in fix hooks by @​jdx in #​1586
  • use mimalloc as the global allocator by @​jdx in #​1635
  • bump pklr to 4.0.0 (hk validate 14x faster) by @​jdx in #​1644
🧪 Testing
  • (windows) run every e2e-win case and cover fix, staging and installed hooks by @​jdx in #​1574
  • fix bats teardown and event-order flakes and surface CI retries by @​jdx in #​1583
🛡️ Security
  • (deps) update dependency esbuild to ^0.28.0 by @​renovate[bot] in #​1548
  • (step) refuse check_diff patches that write inside .git by @​jdx in #​1585
  • point the landing page at the sea shanty by @​jdx in #​1542
  • turn sea shanty mode into a pirate edition of the whole docs site by @​jdx in #​1549
  • document what hk executes, global hook reach, and --safe limits in a security model page by @​jdx in #​1575
  • bring the sea shanty contributing page up to date with the English page by @​jdx in #​1631
🔍 Other Changes
  • (benchmark) gate hook stashing and cold config loads in the perf check by @​jdx in #​1608
  • (entire) store checkpoints in a private repository by @​jdx in 74bd981
  • (entire) commit codex session hooks by @​jdx in 71966d2
  • (entire) commit claude session hooks by @​jdx in 2298ebf
  • (entire) store checkpoints in a private repository by @​jdx in 4a4e806
  • (entire) restore lower-cost trail findings by @​jdx in 6eed674
  • (install) refuse legacy hook installs that overwrite foreign hooks or symlinks by @​jdx in #​1593
  • (release) smoke-run every release archive before the release is created by @​jdx in #​1565
  • (security) check RustSec advisories in CI and document gh release verify by @​jdx in #​1569
  • unblock the docs deploy and stop re-rendering unchanged videos by @​jdx in #​1551
  • limit each contributor to one open draft PR by @​jdx in #​1555
  • lint test code by running clippy with --all-targets by @​jdx in #​1582
  • combine hosted Bats configurations by @​jdx in #​1633
  • skip full checks for docs-only pull requests by @​jdx in #​1634
  • remove redundant package.homepage from Cargo.toml by @​jdx in #​1639
📦️ Dependency Updates

v2.4.0

Compare Source

🚀 Features
  • (builtins) keep CRLF files CRLF in trailing_whitespace, newlines, and mixed_line_ending by @​jdx in #​1621
  • (builtins) report revive findings as diagnostics by @​jdx in #​1626
  • (builtins) report buf_lint and clang_format findings as diagnostics by @​jdx in #​1627
  • (builtins) report actionlint findings as diagnostics by @​jdx in #​1623
  • (builtins) report flake8 findings as diagnostics by @​jdx in #​1624
  • (builtins) report mypy, mado and six more linters as diagnostics by @​jdx in #​1630
  • (config) read column-less, prefixed and summarized output with the gcc diagnostic format by @​jdx in #​1629
  • (init) detect 47 more tools from their config files by @​jdx in #​1576
  • (mcp) let agents run checks on changed or unstaged files only by @​jdx in #​1600
  • (mcp) let agents run checks on staged files only by @​jdx in #​1640
  • (test) assert normalized diagnostics in step tests by @​jdx in #​1622
  • (validate) warn about misspelled properties, no-op depends, unmatchable globs and loose min_hk_version by @​jdx in #​1590
🐛 Bug Fixes
  • (agent) make --safe refuse a hook report with unknown or destructive effect by @​jdx in #​1573
  • (agent) make Claude Code and Codex Stop hooks block with a valid decision and exit 0 by @​jdx in #​1604
  • (builtins) check large files and case conflicts in binary files by @​jdx in #​1571
  • (check) fail on unknown --step names instead of passing after running no steps by @​jdx in #​1603
  • (ci) fail test:bats on a mistyped path or when no tests run by @​jdx in #​1563
  • (cli) keep generated output exit codes on closed pipes by @​jdx in #​1540
  • (cli) print failures once, without Rust locations or a bogus fix hint by @​jdx in #​1588
  • (config) union user skip_steps, skip_hooks and hide_warnings with the project's, and warn when hk.local.pkl replaces hk.pkl by @​jdx in #​1596
  • (config) honor top-level jobs, accept documented HK_STASH values, and fix the hk config crash by @​jdx in #​1594
  • (config) honor subproject skip_steps and warn about ignored subproject settings by @​jdx in #​1615
  • (docs) stop sidebar links showing through the logo when it bounces by @​jdx in #​1554
  • (git) skip tracked files with non-UTF-8 names with a warning in --all, --glob, --from-ref and file arguments by @​jdx in #​1613
  • (init) explain why a hook is missing and print next steps after hk init by @​jdx in #​1564
  • (install) correct the --force-local message when a global install exists by @​jdx in #​1616
  • (install) keep hook commands working after hk upgrades and under a minimal PATH by @​jdx in #​1597
  • (mcp) make cancel_run stop the real hk run instead of sticking in cancelling by @​jdx in #​1607
  • (mcp) cap step output in structured results and report pre-run failures by @​jdx in #​1605
  • (mcp) include untracked and binary files in get_diff and surface capture errors by @​jdx in #​1601
  • (pkl) load configs that amend the v1 package schema by @​jdx in #​1560
  • (pkl) hide mirror credentials in failed package download errors by @​jdx in #​1620
  • (pkl) show file, line and column for Pkl syntax errors, including in imported files by @​jdx in #​1598
  • (stash) preserve CRLF when restoring unstaged files by @​jdx in #​1535
  • (stash) restore unstaged text over a staged binary file no step changed by @​jdx in #​1580
  • (stash) stash tracked files whose names start with a colon by @​jdx in #​1614
  • (stash) keep a staged edit when its worktree copy was reverted to HEAD by @​jdx in #​1602
  • (stash) keep a merge or cherry-pick in progress when stashing the worktree by @​jdx in #​1609
  • (stash) restore hk's own stash entry by commit id so concurrent stashes are never touched by @​jdx in #​1637
  • (stash) serialize stash and restore across hk processes and linked worktrees by @​jdx in #​1636
  • (stash) restore stashed changes when hk is terminated and recover them after a crash by @​jdx in #​1641
  • (step) isolate formatter patches from concurrent commands and staging by @​nettlesh in #​1392
  • (step) keep interactive steps in hk's process group by @​jdx in #​1557
  • (step) say "command not found" when an argv step's tool is not installed by @​jdx in #​1579
  • (step) add exec_ok for condition shell tests and stop exec panicking by @​jdx in #​1610
  • (step) run steps that depend on a step with no files instead of hanging by @​jdx in #​1584
  • (step) select files in directories whose names contain brackets or braces by @​jdx in #​1592
  • (step) keep percent signs in file names literal under cmd.exe by @​jdx in #​1568
  • (step) end tools left running by a fail-fast cancel on Windows by @​jdx in #​1625
  • (step) exclude a directory's files when a step or group exclude names it by @​jdx in #​1606
  • (step) report diagnostic paths relative to the repository root for steps that run in a subdirectory by @​jdx in #​1638
  • (step) run a custom shell directly on Windows and accept a quoted shell path by @​jdx in #​1628
  • (step) batch Windows cmd shims below the cmd.exe line limit by @​jdx in #​1618
  • (step) type scripts whose env shebang has -S, options or variables by @​jdx in #​1611
  • (step) keep diagnostics from every started job when another job fails by @​jdx in #​1642
  • (step) report steps stopped by Ctrl-C as cancelled instead of failed by @​jdx in #​1643
  • (util) check files whose 8 KiB probe splits a multibyte char and keys in non-UTF-8 files by @​jdx in #​1572
  • (util) accept git-generated merge and revert titles in check-conventional-commit by @​jdx in #​1566
  • (util) check protected branch, exec bits and case conflicts against git's own state by @​jdx in #​1577
  • (util) keep non-UTF-8 files and symlinks intact in fix-smart-quotes by @​jdx in #​1570
  • (validate) reject dependency cycles, self-dependencies and invalid step globs at load time by @​jdx in #​1567
📚 Documentation
  • (builtins) show file selectors, script commands and options in the catalogue by @​jdx in #​1562
  • (config) explain where diagnostics come from and when a step needs diagnostic_format by @​jdx in #​1619
  • (config) document sharing one configuration across repositories by @​jdx in #​1591
  • (settings) describe pkl rewrite and CA variables for the built-in evaluator by @​jdx in #​1617
  • refresh competitor benchmark for v2.4.0 by @​jdx in #​1536
  • replace the sea shanty with Bound for the Main and its music video by @​jdx in #​1541
  • take the new shanty video down if its poster cannot be published by @​jdx in #​1543
  • add a sea shanty mode to the landing page by @​jdx in #​1544
  • keep a link to the sea shanty when scripting is off by @​jdx in #​1545
  • generate the pirate CLI reference from the English one by @​jdx in #​1550
  • restrict AI replies on Discussions and Issues and note the instant ban by @​jdx in #​1559
  • start getting started with a first configuration that needs no linters by @​jdx in #​1561
  • correct stash, type-checker lock, and patch-apply descriptions by @​jdx in #​1578
  • add lefthook and husky with lint-staged migration guides by @​jdx in #​1589
⚡ Performance
  • (config) evaluate only the builtins a config uses, cutting cold load from ~1.4 s to ~0.07 s by @​jdx in #​1581
  • (git) skip the untracked scan for runs that name their files, e.g. hk check FILE by @​jdx in #​1587
  • (stash) restore unstaged files no step changed with one git process by @​jdx in #​1612
  • (stash) stop rescanning the worktree before stashing, saving ~80 ms on large repos by @​jdx in #​1595
  • (step) resolve workspace_indicator once per directory, saving ~120 ms per step in large monorepos by @​jdx in #​1599
  • (step) run read-only check-only steps side by side in fix hooks by @​jdx in #​1586
  • use mimalloc as the global allocator by @​jdx in #​1635
  • bump pklr to 4.0.0 (hk validate 14x faster) by @​jdx in #​1644
🧪 Testing
  • (windows) run every e2e-win case and cover fix, staging and installed hooks by @​jdx in #​1574
  • fix bats teardown and event-order flakes and surface CI retries by @​jdx in #​1583
🛡️ Security
  • (deps) update dependency esbuild to ^0.28.0 by @​renovate[bot] in #​1548
  • (step) refuse check_diff patches that write inside .git by @​jdx in #​1585
  • point the landing page at the sea shanty by @​jdx in #​1542
  • turn sea shanty mode into a pirate edition of the whole docs site by @​jdx in #​1549
  • document what hk executes, global hook reach, and --safe limits in a security model page by @​jdx in #​1575
  • bring the sea shanty contributing page up to date with the English page by @​jdx in #​1631
🔍 Other Changes
  • (benchmark) gate hook stashing and cold config loads in the perf check by @​jdx in #​1608
  • (entire) store checkpoints in a private repository by @​jdx in 74bd981
  • (entire) commit codex session hooks by @​jdx in 71966d2
  • (entire) commit claude session hooks by @​jdx in 2298ebf
  • (entire) store checkpoints in a private repository by @​jdx in 4a4e806
  • (entire) restore lower-cost trail findings by @​jdx in 6eed674
  • (install) refuse legacy hook installs that overwrite foreign hooks or symlinks by @​jdx in #​1593
  • (release) smoke-run every release archive before the release is created by @​jdx in #​1565
  • (security) check RustSec advisories in CI and document gh release verify by @​jdx in #​1569
  • unblock the docs deploy and stop re-rendering unchanged videos by @​jdx in #​1551
  • limit each contributor to one open draft PR by @​jdx in #​1555
  • lint test code by running clippy with --all-targets by @​jdx in #​1582
  • combine hosted Bats configurations by @​jdx in #​1633
  • skip full checks for docs-only pull requests by @​jdx in #​1634
  • remove redundant package.homepage from Cargo.toml by @​jdx in #​1639
📦️ Dependency Updates

v2.3.1

Compare Source

🚀 Features
  • (builtins) apply pinact's fixes as a patch with new hk util sarif-diff by @​jdx in #​1515
  • (builtins) give seven formatters a check_diff with new hk util format-diff by @​jdx in #​1514
  • (builtins) add check_diff to ruff, oxfmt, shellharden, and go_lines by @​jdx in #​1516
  • (step) warn when a check_diff patch doesn't apply by @​jdx in #​1517
  • (step) apply check_diff patches in hk instead of running git apply by @​jdx in #​1520
  • (test) add "diff" step tests that require check_diff patches to apply by @​jdx in #​1518
🐛 Bug Fixes
  • (builtins) run selene and zizmor once in fix mode by @​jdx in #​1511
  • (builtins) let go_lines take an argv prefix by @​jdx in #​1523
  • (install) make concurrent local installs reliable by @​jdx in #​1533
  • (step) apply go mod tidy and isort diffs and keep carriage returns in patches by @​jdx in #​1513
  • (step) stop finished check_diff jobs leaving a spinner on screen by @​jdx in #​1530
  • (step) stage files created by check_diff patches by @​jdx in #​1524
📚 Documentation
⚡ Performance
  • (builtins) apply trailing_whitespace and newlines diffs instead of rerunning them by @​jdx in #​1528
  • (fix) run read-only check_diff steps in parallel with steps that read the same files by @​jdx in #​1519
🧪 Testing
  • (builtins) test rumdl builtins against rumdl 0.2.77 by @​jdx in #​1512
🔍 Other Changes
📦️ Dependency Updates

v2.3.0

Compare Source

🚀 Features
  • (builtins) apply pinact's fixes as a patch with new hk util sarif-diff by @​jdx in #​1515
  • (builtins) give seven formatters a check_diff with new hk util format-diff by @​jdx in #​1514
  • (builtins) add check_diff to ruff, oxfmt, shellharden, and go_lines by @​jdx in #​1516
  • (step) warn when a check_diff patch doesn't apply by @​jdx in #​1517
  • (step) apply check_diff patches in hk instead of running git apply by @​jdx in #​1520
  • (test) add "diff" step tests that require check_diff patches to apply by @​jdx in #​1518
🐛 Bug Fixes
  • (builtins) run selene and zizmor once in fix mode by @​jdx in #​1511
  • (builtins) let go_lines take an argv prefix by @​jdx in #​1523
  • (install) make concurrent local installs reliable by @​jdx in #​1533
  • (step) apply go mod tidy and isort diffs and keep carriage returns in patches by @​jdx in #​1513
  • (step) stop finished check_diff jobs leaving a spinner on screen by @​jdx in #​1530
  • (step) stage files created by check_diff patches by @​jdx in #​1524
📚 Documentation
⚡ Performance
  • (builtins) apply trailing_whitespace and newlines diffs instead of rerunning them by @​jdx in #​1528
  • (fix) run read-only check_diff steps in parallel with steps that read the same files by @​jdx in #​1519
🧪 Testing
  • (builtins) test rumdl builtins against rumdl 0.2.77 by @​jdx in #​1512
🔍 Other Changes
📦️ Dependency Updates

v2.2.0

Compare Source

🚀 Features
  • (config) add batch_min_files to set the fewest files per batch by @​jdx in #​1475
🐛 Bug Fixes
  • (builtins) apply jq and yq check_diff patches instead of rerunning the tool by @​jdx in #​1468
  • (stash) skip stashing before the first commit with the git CLI backend by @​jdx in #​1469
  • (step) stop git from crashing with SIGBUS while another step rewrites a file by @​jdx in #​1476
📚 Documentation
  • (benchmarks) compare only configurations that are safe by design by @​jdx in #​1465
  • (benchmarks) lead with results and simplify the method on the benchmarks page by @​jdx in #​1472
  • refresh competitor benchmark for v2.2.0 by @​jdx in #​1462
⚡ Performance
  • (release) PGO-optimize the x86_64 musl and macOS arm64 binaries by @​jdx in #​1470
  • (step) stage each fixer's files as soon as it finishes by @​jdx in #​1466
  • (step) release a job slot while waiting for another step's files by @​jdx in #​1473
🛡️ Security
  • (benchmark) show each scenario's mode on the benchmarks page by @​jdx in #​1467
🔍 Other Changes
  • (benchmark) run competitors' whitespace fixers from pre-commit-hooks and isolate black's cache by @​jdx in #​1463
  • (benchmark) measure hk's yq builtin as shipped by @​jdx in #​1474
  • accept pull request titles whose description starts with an acronym by @​jdx in 32f72df
📦️ Dependency Updates
  • upda

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/major-jdx-hk branch 2 times, most recently from 4b82b17 to abbaecb Compare September 18, 2026 11:53
@github-actions

github-actions Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Vulnerability summary (fs) — latest: run #660

Critical High Medium Low Unknown
0 7 4 1 0

Change since last run: Critical 0 (=) · High 7 (+4) · Medium 4 (=) · Low 1 (=) · Unknown 0 (=)
Risk≥40: 1 (=)

Grype (risk-based)

⚠️ 1 at/above risk threshold 40

Critical High Medium Low Negligible Unknown
1 7 4 1 0 0

Top by risk

Vulnerability Package Sev Risk EPSS KEV
GHSA-xm6r-4466-mr74 orientdb-core 1.5.1 Critical 68.7 0.73
GHSA-j288-q9x7-2f5v commons-lang 2.6 Medium 1.4 0.02
GHSA-w33c-445m-f8w7 okio 1.6.0 Medium 0.7 0.01
GHSA-pvp8-3xj6-8c6x commons-configuration 1.6 Low 0.6 0.02
GHSA-p6pp-m3f8-5c89 jackson-core 2.22.2 High 0.4 0.01
GHSA-p6pp-m3f8-5c89 jackson-core 3.1.2 High 0.4 0.01
GHSA-r7wm-3cxj-wff9 jackson-core 3.1.2 High 0.4 0.00
GHSA-7hhh-6rmp-j9qf jackson-core 2.22.2 High 0.4 0.00
GHSA-7hhh-6rmp-j9qf jackson-core 3.1.2 High 0.4 0.00
GHSA-cxp5-3px4-pw24 jackson-databind 2.22.2 High 0.3 0.00

Links: workflow run · HTML report · SBOM · Grype report

Previous runs (2)

run #658 · 2026-10-01T11:40:12.204Z

Critical High Medium Low Unknown
0 3 4 1 0

Risk≥40: 1

run #654 · 2026-09-28T19:53:57.639Z

Critical High Medium Low Unknown
0 1 4 1 0

Risk≥40: 1

@github-actions

github-actions Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Vulnerability summary (docker.io/wetransform/hale-cli:latest) — latest: run #660

Critical High Medium Low Unknown
0 16 62 28 0

Change since last run: Critical 0 (=) · High 16 (+8) · Medium 62 (=) · Low 28 (=) · Unknown 0 (=)
Risk≥40: 2 (=)

Grype (risk-based)

⚠️ 2 at/above risk threshold 40

Critical High Medium Low Negligible Unknown
2 16 137 42 9 0

Top by risk

Vulnerability Package Sev Risk EPSS KEV
GHSA-xm6r-4466-mr74 orientdb-core 1.5.1 Critical 68.7 0.73
GHSA-xm6r-4466-mr74 orientdb-core 1.5.1 Critical 68.7 0.73
GHSA-j288-q9x7-2f5v commons-lang 2.6 Medium 1.4 0.02
GHSA-j288-q9x7-2f5v commons-lang 2.6 Medium 1.4 0.02
CVE-2023-31486 perl-base 5.34.0-3ubuntu1.8 Medium 0.9 0.02
GHSA-w33c-445m-f8w7 okio 1.6.0 Medium 0.7 0.01
GHSA-w33c-445m-f8w7 okio 1.6.0 Medium 0.7 0.01
CVE-2025-59375 libexpat1 2.4.7-1ubuntu0.7 Medium 0.7 0.01
GHSA-pvp8-3xj6-8c6x commons-configuration 1.6 Low 0.6 0.02
GHSA-pvp8-3xj6-8c6x commons-configuration 1.6 Low 0.6 0.02

Links: workflow run · HTML report · SBOM · Grype report

Previous runs (4)

run #658 · 2026-10-01T11:44:27.957Z

Critical High Medium Low Unknown
0 8 62 28 0

Risk≥40: 2

run #654 · 2026-09-28T19:54:48.681Z

Critical High Medium Low Unknown
0 2 62 18 0

Risk≥40: 2

run #648 · 2026-09-23T18:20:03.755Z

Critical High Medium Low Unknown
0 2 59 18 0

Risk≥40: 2

run #646 · 2026-09-18T23:29:22.163Z

Critical High Medium Low Unknown
0 2 62 18 0

Risk≥40: 2

@renovate
renovate Bot force-pushed the renovate/major-jdx-hk branch 3 times, most recently from 681c2f7 to 21a2a85 Compare September 25, 2026 02:39
@renovate
renovate Bot force-pushed the renovate/major-jdx-hk branch 4 times, most recently from 62c0fb0 to 9610083 Compare October 1, 2026 11:16
@renovate
renovate Bot force-pushed the renovate/major-jdx-hk branch from 9610083 to a43a147 Compare October 4, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/major renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants