chore(deps): update all dependencies by renovate[bot] · Pull Request #124 · vadimpiven/node_reqwest

renovate · 2026-03-21T01:57:25Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@codspeed/vitest-plugin (source)	`5.4.0` → `5.7.1`	pnpm.catalog.default	minor
@playwright/test (source)	`1.60.0` → `1.61.1`	pnpm.catalog.default	minor
@types/node (source)	`25.9.1` → `25.9.4`	pnpm.catalog.default	patch	`25.9.5`
@vitest/coverage-istanbul (source)	`4.1.7` → `4.1.9`	pnpm.catalog.default	patch	`4.1.10`
CodSpeedHQ/action	`v4.15.1` → `v4.18.1`	action	minor	`v4.18.5` (+2)
actions/attest	`v4.1.0` → `v4.1.1`	action	patch
actions/attest-build-provenance	`v4.1.0` → `v4.1.1`	action	patch
actions/cache	`v5.0.5` → `v5.1.0`	action	minor
actions/checkout	`v6.0.2` → `v6.0.3`	action	patch
anyhow	`1.0.102` → `1.0.103`	workspace.dependencies	patch
aqua:anchore/syft	`1.44.0` → `1.46.0`		minor
aqua:aquasecurity/trivy	`0.70.0` → `0.72.0`		minor
aqua:astral-sh/uv	`0.11.16` → `0.11.26`		patch	`0.11.28` (+1)
aqua:cargo-bins/cargo-binstall	`1.19.1` → `1.20.1`		minor
aqua:cli/cli	`2.92.0` → `2.96.0`		minor
aqua:crate-ci/typos	`1.46.3` → `1.48.0`		minor
bytes	`1.11.1` → `1.12.0`	workspace.dependencies	minor	`1.12.1`
codecov/codecov-action	`v6.0.1` → `v6.0.2`	action	patch
docker/build-push-action	`v7.2.0` → `v7.3.0`	action	minor
docker/dockerfile	`1.24` → `1.25`	syntax	minor
docker/login-action	`v4.2.0` → `v4.3.0`	action	minor	`v4.4.0`
docker/setup-buildx-action	`v4.1.0` → `v4.2.0`	action	minor
electron	`42.2.0` → `42.5.2`	pnpm.catalog.default	minor	`42.6.1` (+1)
fd-lock	`2.1.1` → `2.2.0`	pnpm.catalog.default	minor
github/codeql-action	`v4.36.0` → `v4.36.3`	action	patch	`v4.37.0`
github:EmbarkStudios/cargo-deny	`0.19.7` → `0.19.9`		patch	`0.20.2`
github:mikefarah/yq	`4.53.2` → `v4.53.3`		patch
github:nextest-rs/nextest	`0.9.136` → `0.9.138`		patch	`0.9.140`
jdx/mise	`v2026.5.15` → `v2026.7.0`		minor	`v2026.7.5` (+4)
jdx/mise-action	`v4.0.1` → `v4.2.0`	action	minor
markdownlint-cli2	`0.22.1` → `0.23.0`	pnpm.catalog.default	minor
monocart-reporter	`2.11.2` → `2.12.2`	pnpm.catalog.default	minor
node (source)	`24.15.0` → `24.18.0`		minor
npm:pnpm (source)	`11.2.2` → `11.9.0`		minor	`11.11.0` (+1)
oxfmt (source)	`0.51.0` → `0.57.0`	pnpm.catalog.default	minor	`0.58.0`
oxlint (source)	`1.66.0` → `1.72.0`	pnpm.catalog.default	minor	`1.73.0`
pnpm (source)	`11.2.2+sha512.36e6621fad506178936455e70247b8808ef4ec25797a9f437a93281a020484e2607f6a469a22e982987c3dbb8866e3071514ab10a4a1749e06edcd1ec118436f` → `11.9.0`	packageManager	minor	`11.11.0` (+1)
pyrefly	`==1.0.0` → `==1.1.1`	dependency-groups	minor
python	`3.14.5` → `3.14.6`		patch
quay.io/pypa/manylinux_2_28	`65f13b3` → `c0cc074`	final	digest
regex	`1.12.3` → `1.12.4`	workspace.dependencies	patch	`1.13.0`
ruff (source, changelog)	`==0.15.14` → `==0.15.20`	dependency-groups	patch	`0.15.21`
rust (source, changelog)	`nightly-2026-05-24` → `nightly-2026-07-03`	toolchain	patch	`nightly-2026-07-09` (+5)
rustlang/rust	`nightly-2026-05-24` → `nightly-2026-07-02`		minor	`nightly-2026-07-09` (+6)
tsx (source)	`4.22.3` → `4.22.5`	pnpm.catalog.default	patch	`4.23.0`
undici (source)	`8.3.0` → `8.6.0`		minor	`8.7.0`
undici (source)	`8.3.0` → `8.6.0`	pnpm.catalog.default	minor	`8.7.0`
vite (source)	`8.0.14` → `8.1.3`	pnpm.catalog.default	minor	`8.1.4`
vite-plugin-dts (source)	`5.0.1` → `5.0.3`	pnpm.catalog.default	patch
vitest (source)	`4.1.7` → `4.1.9`	pnpm.catalog.default	patch	`4.1.10`
zizmor (source)	`==1.25.2` → `==1.26.1`	dependency-groups	minor
zizmorcore/zizmor-action	`v0.5.6` → `v0.5.7`	action	patch

Release Notes

CodSpeedHQ/codspeed-node (@codspeed/vitest-plugin)

`v5.7.1`

Compare Source

What's Changed

fix: emit perf maps when not parsing the full inlining logs from V8 by @GuillaumeLagrange in #85

Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1

`v5.7.0`

Compare Source

Highlights

Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set CODSPEED_WALLTIME_PROFILER=samply env variable in the codspeed action.
Added support for tinybench v5 and v6 in @codspeed/tinybench-plugin

What's Changed

Add necessary flags to dump optimized inlining info and fix walltime marker placement by @GuillaumeLagrange in #83

Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0

`v5.6.0`

Compare Source

What's Changed

feat: add MacOS support by @not-matthias in #81

Full Changelog: CodSpeedHQ/codspeed-node@v5.5.0...v5.6.0

`v5.5.0`

Compare Source

Highlights

We are introducing @codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.

Here's an example usage, but head to the docs for more information

import { bench, type Page } from "@&#8203;codspeed/playwright-plugin";
import electronExecutable from "electron";
import path from "node:path";
import { fileURLToPath } from "node:url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const appRoot = path.resolve(__dirname, "..");

async function waitUntilSettled(page: Page): Promise<void> {
  await page.waitForFunction(() => {
    const main = document.getElementById("main");
    return !!main && !main.classList.contains("loading");
  });
}

await bench(
  "inbox-search-archive-threads",
  async ({ page }) => {
    await page.fill("#search", "update");
    await waitUntilSettled(page);

    await page.click("#select-visible-btn");
    await page.click("#archive-btn");
    await waitUntilSettled(page);

    await page.click('#sidebar nav button[data-view="threads"]');
    await waitUntilSettled(page);
  },
  {
    target: {
      kind: "electron",
      appPath: path.join(appRoot, "out/main/index.js"),
      cwd: appRoot,
    },
    beforeRound: async ({ page }) => {
      page.setDefaultTimeout(180_000);
      await page.waitForSelector("#main");
      await waitUntilSettled(page);
    },
  },
);

Note: this plugin is only compatible with the walltime instrument.

What's Changed

Add playwright profiling package by @GuillaumeLagrange in #80

Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0

microsoft/playwright (@playwright/test)

`v1.61.1`

Compare Source

`v1.61.0`

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
Supported expect.soft.poll(...).
New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
New -G command line shorthand for --grep-invert.

🛠️ Other improvements

Playwright now supports Ubuntu 26.04.
HAR and trace recordings now include WebSocket requests.

Browser Versions

Chromium 149.0.7827.55
Mozilla Firefox 151.0
WebKit 26.5

This version was also tested against the following stable channels:

Google Chrome 149
Microsoft Edge 149

vitest-dev/vitest (@vitest/coverage-istanbul)

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

`v4.1.8`

Compare Source

🐞 Bug Fixes

browser:
- Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)
- Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in #10474 (675b4)

View changes on GitHub

CodSpeedHQ/action (CodSpeedHQ/action)

`v4.18.1`

Compare Source

Release Notes

🚀 Features

Bump go-runner to 1.2.1 by @adriencaccia in #421

Install codspeed-runner 4.18.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.1

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

`v4.18.0`

Compare Source

Release Notes

🚀 Features

Bump valgrind-codspeed to 3.26.0-0codspeed4
Bump samply by @GuillaumeLagrange in #415
Set env var to have node dump inlining information by @GuillaumeLagrange
Change isolation logic to include samply and non root fallback by @GuillaumeLagrange
Add experimental --cycle-estimation flag by @not-matthias in #412
Make samply-codspeed a submodule rather than git rev with cargo by @GuillaumeLagrange in #416

🐛 Bug Fixes

Honor locally-installed valgrind on non-apt systems by @not-matthias in #414

Install codspeed-runner 4.18.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.18.0

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

`v4.17.6`

Compare Source

Release Notes

🚀 Features

feat: skip hash check error when installing pre-release by @GuillaumeLagrange in #215
Show memtrack capability status in setup status by @not-matthias
Run memtrack sudo-less via file capabilities by @not-matthias
Use extra events when using samply on linux by @GuillaumeLagrange in #404
Update PerfEvent to also support samply format by @GuillaumeLagrange
Use isolation for with samply by @GuillaumeLagrange
Make eh_frame_hdr optional in unwind data (V4) by @not-matthias

🐛 Bug Fixes

Keep rolling buffer off during executor setup by @not-matthias in #411
Gate memory executor behind Linux target by @not-matthias
Enable tracking when running without IPC by @not-matthias
Tolerate RLIMIT_MEMLOCK EPERM on modern kernels by @not-matthias
Install libc6-dbg during valgrind setup by @not-matthias in #394
Skip rustup-wrapped proxy in trace-children by @not-matthias in #405
Retry streamed uploads on transient failures by @not-matthias in #399
Extract unwind data for binaries without eh_frame_hdr by @not-matthias

💼 Other

Drop OpenSSL, move TLS stack to rustls (#406) by @art049 in #406

🏗️ Refactor

Split executor privilege granting into grant_privileges by @not-matthias

📚 Documentation

Add unwind data version changelog by @not-matthias in #393

⚙️ Internals

chore: bump runner version to 4.17.6 by @github-actions[bot] in #216
Grant memtrack file capabilities before memory tests by @not-matthias in #407
Bump samply to support additional events by @GuillaumeLagrange
Add helper script to use local versions of samply and framehop easily by @GuillaumeLagrange

Install codspeed-runner 4.17.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.17.6/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.17.6

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.17.5...v4.17.6

`v4.17.5`

Compare Source

Release Notes

This release bundles all runner changes from 4.17.1 through 4.17.5.

🚀 Features

Add optional mode arg to target setup by @fargito in #397
Restore DYLD_INSERT_LIBRARIES from SAMPLY_ alias by @not-matthias
Bump valgrind-codspeed to 3.26.0-0codspeed3 by @adriencaccia

🐛 Bug Fixes

Purge inherited mappings on execve to fix unknown symbols (#392) by @GuillaumeLagrange in #392
Use %p in log file path to avoid multi-process overwrite by @not-matthias in #381
Compare codspeed iteration of installed valgrind by @not-matthias

💼 Other

Enable set -u to match go.sh by @not-matthias in #389

🏗️ Refactor

Parse codspeed iteration from version string by @not-matthias

⚙️ Internals

Bump samply by @not-matthias
Bump samply to fix sigkill by @not-matthias in #386
Log detected valgrind version by @not-matthias in #390
Bump samply-codspeed to disable jit classification and add fp-anchoring to unwinding (#382) by @GuillaumeLagrange in #382

Install codspeed-runner 4.17.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.17.5/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.17.5

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.17.0...v4.17.5

`v4.17.0`

Compare Source

Release Notes

🚀 Features

Configure samply symbol resolution env vars by @not-matthias
Add CODSPEED_WALLTIME_PROFILER override by @not-matthias
Make benchmark isolation profiler-driven by @not-matthias
Add profile-based auth configuration (#366) by @art049 in #366
Bump instrument-hooks to not use stubs on macos (#373) by @GuillaumeLagrange in #373
Pin codspeed-go-runner installer downloads with sha256 verification by @art049 in #362
Pin downloaded binaries with sha256 verification by @art049
Search NixOS debug info path by @not-matthias in #354
Inherit process mapping on forks by @GuillaumeLagrange
Bundle samply via library crate by @not-matthias
Add samply profiler for macOS by @not-matthias
Rename CODSPEED_PERF_ENABLED to CODSPEED_PROFILER_ENABLED by @not-matthias
Add Profiler trait abstraction by @not-matthias
Restore cursor on ctrl c by @GuillaumeLagrange in #341
Validate tokens and repository access up front by @GuillaumeLagrange

🐛 Bug Fixes

Use introspected env for memory executor by @GuillaumeLagrange
Misleading DCE advice in setup-harness (#350) by @SuperMuel in #350
Flush rolling buffer when executor errors by @not-matthias in #352
Use brew-installed bash for samply on macOS by @not-matthias in #347
Keep old name aliases to for deserialization purposes by @GuillaumeLagrange in #345
Handle malformed token from backend better by @GuillaumeLagrange
Disable PYTHON_PERF_JIT_SUPPORT on macOS by @not-matthias
Use mach_absolute_time for FIFO timestamps on macOS by @not-matthias
Use O_RDWR to open FIFOs on all Unix platforms by @not-matthias

💼 Other

Select profiler via typed CLI arg by @GuillaumeLagrange in #379
Bump workspace dependencies (#370) by @art049 in #370
Make api_client the single source of truth for the auth token by @GuillaumeLagrange
Bump gql_client to partial-data fork by @GuillaumeLagrange

🏗️ Refactor

Centralize internal re-exec via InternalCommands::get_command_builder by @not-matthias in #338
Rename Benchmark FIFO commands/markers to Profiler/Round by @not-matthias
Rename Profiler::wrap to wrap_command by @not-matthias
Share Linux profiler sysctl setup by @not-matthias
Port PerfRunner to Profiler trait by @not-matthias
Rename PerfMetadata to WalltimeMetadata by @not-matthias
Move perf module under profiler/ by @not-matthias
Rename FifoCommand::PingPerf to PingProfiler by @not-matthias
Rename IntegrationMode::Perf to Walltime by @not-matthias

🧪 Testing

Update valgrind snapshot tests by @adriencaccia

⚙️ Internals

Add taplo config file by @GuillaumeLagrange in #363
Bump samply fork to use framehop-codspeed by @not-matthias
Add retry to sha256 tests to prevent transient failures by @GuillaumeLagrange in #375
Update setarch command arguments to use long options (#304) by @xtqqczze in #304
Bump valgrind-codspeed to 3.26.0-0codspeed2
Fix macOS rustup cache corruption in install-rust action by @GuillaumeLagrange in #357
Give each bpf-tests shard its own cache key by @not-matthias in #358
Shard bpf-tests by integration test binary by @not-matthias
Use rustup show instead of toolchain install by @GuillaumeLagrange in #349
Disable profiler in macos-basic-run-test by @not-matthias
Upload the basic run to validate auth of integration test by @GuillaumeLagrange
Move samply fork from AvalancheHQ to CodSpeedHQ by @not-matthias
Remove the cursor hiding by @GuillaumeLagrange

Install codspeed-runner 4.17.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.17.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.17.0

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.15.1...v4.17.0

actions/attest (actions/attest)

`v4.1.1`

[Comp

✂ Note

PR body was truncated to here.

renovate · 2026-03-21T01:57:28Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package.json

Command failed: corepack use pnpm@11.9.0

greptile-apps · 2026-03-21T01:59:49Z

Greptile Summary

This is a routine automated dependency update PR from Renovate Bot, bumping a wide range of dependencies across the stack: GitHub Actions (setup-node v6.3.0, mise-action v3.6.3, zizmor-action v0.5.2, codeql-action v4.32.6), Node.js packages (pnpm 10.32.1, vitest/vite 4.1.0/8.0.0 stable releases from beta, oxfmt, oxlint, undici, electron, node-addon-slsa), Rust crates (tempfile 3.27.0), Python tools (ruff, semgrep, pyrefly, zizmor), and various aqua-managed CLI tools (uv, gh, gitleaks, shfmt, nextest). All GitHub Action references continue to be pinned by full commit SHA, which is good practice for this repository.

Most changes are straightforward version bumps with no behavioral impact on the codebase itself.
Several beta versions (vitest, vite) graduate to stable releases — a positive change.
The packageManager field in package.json was updated to pnpm@10.32.1 but the SHA512 integrity hash that was present in the old value was dropped, removing Corepack's ability to verify the pnpm binary on download.

Confidence Score: 4/5

This PR is safe to merge; the only notable finding is a non-critical omission of the Corepack integrity hash for pnpm.
All changes are automated dependency bumps. GitHub Actions remain SHA-pinned, Dockerfile images are digest-pinned, and lock files are fully regenerated. The one notable point is the missing SHA512 hash in the packageManager field, which is a best-practice/supply-chain hygiene issue rather than an active vulnerability. Everything else is routine.
package.json — missing SHA512 hash in the packageManager field.

Important Files Changed

Filename	Overview
package.json	Updated pnpm to 10.32.1 but dropped the SHA512 integrity hash from the packageManager field, removing Corepack's ability to verify the binary's integrity on download.
Dockerfile	Updated docker/dockerfile syntax to 1.22 and manylinux_2_28 base image to a new digest. Both references are pinned by SHA256. No issues found.
Cargo.lock	Updated tempfile from 3.26.0 to 3.27.0 which pulls in getrandom 0.3.4 instead of 0.4.2, and resolves different windows-sys versions for various crates. Standard lock file update.
mise.toml	Updated gitleaks, uv, gh CLI, nextest, and mvdan/sh (shfmt) to newer patch/minor versions. No issues found.
pyproject.toml	Updated pyrefly, ruff, semgrep, and zizmor to newer versions. No issues found.
pnpm-workspace.yaml	Updated catalog versions for @vitest/coverage-istanbul, electron, oxfmt, oxlint, undici, vite, and vitest from beta/older versions to stable releases. No issues found.

Comments Outside Diff (1)

package.json, line 202 (link)

Missing Corepack integrity hash for pnpm

The previous packageManager value included a +sha512 integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

corepack use pnpm@10.32.1

This will update package.json with the correct hash for 10.32.1, e.g.:

Consider asking Renovate to preserve the hash when bumping the packageManager field (the pinDigests option may help, or a custom packageRules entry targeting packageManager).

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:



Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: package.json
Line: 202

Comment:
**Missing Corepack integrity hash for pnpm**

The previous `packageManager` value included a `+sha512` integrity hash that Corepack uses to cryptographically verify the pnpm binary on download. The new value omits this hash entirely, so Corepack will skip integrity verification when bootstrapping pnpm from this field.

You can restore supply-chain integrity by running:

```bash
corepack use pnpm@10.32.1
```

This will update `package.json` with the correct hash for 10.32.1, e.g.:

```suggestion
  "packageManager": "pnpm@10.32.1+sha512.<hash-for-10.32.1>",
```

Consider asking Renovate to preserve the hash when bumping the `packageManager` field (the [`pinDigests`](https://docs.renovatebot.com/configuration-options/#pindigests) option may help, or a custom `packageRules` entry targeting `packageManager`).

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: "Update all dependenc..."}

codecov · 2026-04-20T21:27:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

codspeed-hq · 2026-05-18T07:49:49Z

Merging this PR will not alter performance

✅ 15 untouched benchmarks

_{Comparing renovate/all-dependencies (a483481) with main (32fd41a)}

socket-security · 2026-06-07T09:05:42Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: pypi `zizmor` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pyproject.toml → `pypi/zizmor@1.26.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/zizmor@1.26.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `zizmor` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pyproject.toml → `pypi/zizmor@1.26.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/zizmor@1.26.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

socket-security · 2026-06-13T02:06:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/anyhow@1.0.102 ⏵ 1.0.103
	cargo/bytes@1.11.1 ⏵ 1.12.0
	pypi/ruff@0.15.14 ⏵ 0.15.20
	pypi/pyrefly@1.0.0 ⏵ 1.1.1
	pypi/zizmor@1.25.2 ⏵ 1.26.1

View full report

renovate Bot force-pushed the renovate/all-dependencies branch 4 times, most recently from 1c2d5e5 to 40653e4 Compare March 22, 2026 02:03

github-advanced-security AI found potential problems Mar 22, 2026

View reviewed changes