Skip to content

Update all non-major dependencies - #187

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 11, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@types/node (source) 25.9.5 → 25.9.9 age confidence devDependencies patch
actions/setup-node v7.0.0 → v7.1.0 age confidence action minor
actions/upload-artifact v7.0.1 → v7.0.2 age confidence action patch
brace-expansion 5.0.9 → 5.0.12 age confidence overrides patch
eslint (source) 10.8.1 → 10.13.0 age confidence devDependencies minor
globals 17.9.0 → 17.13.0 age confidence devDependencies minor
js-yaml 5.2.3 → 5.5.0 age confidence overrides minor
oxsecurity/megalinter v10.0.0 → v10.1.0 age confidence action minor
prettier (source) 3.9.6 → 3.9.10 age confidence devDependencies patch
serialize-javascript 7.1.0 → 7.1.2 age confidence overrides patch

Release Notes

actions/setup-node

v7.1.0

Compare Source

What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

juliangruber/brace-expansion (brace-expansion)

v5.0.12

Compare Source

v5.0.11

Compare Source

v5.0.10

Compare Source

eslint/eslint (eslint)

v10.13.0

Compare Source

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#​21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#​21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#​21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#​21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#​21287) (lumir)

Chores

v10.12.0

Compare Source

Features

  • 4618052 feat: handle astral letters in new-cap (#​21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#​21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#​21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#​21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#​21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#​21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#​21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#​21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#​21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#​21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#​21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#​21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#​21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#​21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#​21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#​21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#​21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#​21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#​21354) (renovate[bot])
  • 182a6e9 chore: update dependency prettier to v3.9.8 (#​21352) (renovate[bot])
  • f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#​21339) (Jarren)
  • b95fb6c chore: update dependency prettier to v3.9.7 (#​21347) (renovate[bot])
  • 3782dd4 chore: update ecosystem plugins (#​21342) (ESLint Bot)

v10.11.0

Compare Source

Features

  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#​21271) (Pavel)
  • 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#​21316) (electrohyun)
  • d3dd47f feat: only exempt new-cap built-ins that reference the global (#​21290) (sethamus)

Bug Fixes

  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#​21311) (xbinaryx)
  • b684bb1 fix: make TimePass.parse optional in types and docs (#​21313) (ntnyq)
  • 26d11bc fix: don't report __proto__ properties in object-shorthand (#​21310) (xbinaryx)

Documentation

  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#​21312) (bytedoe)
  • 6c789ff docs: Update README (GitHub Actions Bot)
  • 5997825 docs: clarify preserve-caught-error known limitation (#​21294) (Akinyemi Toluwalase)

Chores

  • 520dd77 perf: Implement fast paths in critical areas (#​21210) (Nicholas C. Zakas)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#​21330) (Francesco Trotta)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#​21331) (renovate[bot])
  • 24310e3 chore: update ecosystem plugins (#​21324) (ESLint Bot)
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#​21318) (dependabot[bot])
  • ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#​21221) (Nicholas C. Zakas)
  • c832660 chore: Upgrade Stylelint to the latest version in docs (#​21245) (Jung Hyeon Jun)
  • f9f88fc chore: update ecosystem plugins (#​21308) (ESLint Bot)
  • fc81076 ci: add more types integration tests (#​20395) (Nitin Kumar)

v10.10.0

Compare Source

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#​21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#​21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#​21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#​20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#​21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#​21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#​21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#​21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#​21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#​21286) (한국)
  • 8724829 docs: update compat table links (#​21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#​21256) (Müslüm Yılmaz)

Chores

v10.9.1

Compare Source

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#​21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#​21248) (Francesco Trotta)

Chores

v10.9.0

Compare Source

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#​21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#​21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#​21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#​21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#​21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#​21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#​21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#​21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#​21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#​21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

sindresorhus/globals (globals)

v17.13.0

Compare Source


v17.12.0

Compare Source


v17.11.0

Compare Source


v17.10.0

Compare Source


nodeca/js-yaml (js-yaml)

v5.5.0

Compare Source

Changed
  • Updated argparse to v3.
  • Updated development dependencies.
Fixed
  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #​801.
  • Report the exact position of non-printable characters in errors, #​801.

v5.4.3

Compare Source

Fixed
  • Fixed loading a whitespace-only block scalar followed by a less indented
    line, #​802.

v5.4.2

Compare Source

Fixed
  • forceQuotes no longer quotes non-string scalars, #​798.

v5.4.1

Compare Source

Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
    CPU usage, #​797.

v5.4.0

Compare Source

Added
  • Added the scalarStyleRules dumper option to customize string formatting.
    See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
    and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
    explicit tags use the separate tagged property. Alias nodes now contain
    only kind and anchor. This only affects code that directly constructs or
    edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
    side effects.
  • Reworked scalar style selection. This can change formatting without changing
    loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #​791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
    including alias and property-only keys, #​786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
    1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
    needed to preserve trailing newlines.

v5.3.0

Compare Source

This release focuses on reworking the documentation and making small
architectural improvements before moving forward.

Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
  • Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE,
    COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old
    exports are still preserved, but deprecated.
  • Made identify mandatory for custom tag definitions. Use
    identify: () => false for load-only tags.
Deprecated
  • Deprecated flat constant exports. Use grouped ones instead.
Removed
  • Removed the MERGE_KEY export (not used anymore after last fixes).
Fixed
  • Validate << sequence items at merge time, so aliased merge sources are
    checked too.
  • Resolve << outside of a mapping key as the plain string '<<', matching
    v4, instead of leaking an internal symbol into the result.
oxsecurity/megalinter

v10.1.0

Compare Source

  • Core

    • MegaLinter now prints a crash traceback when it is killed by a fatal signal (SIGSEGV, SIGBUS…), instead of exiting silently with no clue about what happened (#​8779)
    • The LLM Advisor supports a new provider, OrcaRouter, an OpenAI-compatible AI gateway: set LLM_PROVIDER: orcarouter and ORCAROUTER_API_KEY in your environment to get fix suggestions routed through OrcaRouter (see the OrcaRouter provider page) (#​8826)
  • New linters

    • biome, one fast toolchain linting, formatting and sorting imports of JavaScript, TypeScript, JSX, TSX, JSON, CSS and GraphQL files, available as JAVASCRIPT_BIOME, TYPESCRIPT_BIOME, JSX_BIOME, TSX_BIOME, JSON_BIOME, CSS_BIOME and GRAPHQL_BIOME (#​8706)
      • Activated only when a biome.json or biome.jsonc configuration file is found in the repository
      • Supports APPLY_FIXES (safe fixes with --write) and native SARIF output
      • EXCLUDED_DIRECTORIES are forwarded in project lint mode through a generated configuration extending the workspace one
    • ApexGuru, the AI-driven engine of Salesforce Code Analyzer, available as SALESFORCE_CODE_ANALYZER_APEXGURU (#​8820)
      • Detects SOQL inefficiencies, critical anti-patterns and scalability hotspots in your .cls and .trigger files, with line-level highlights, severity ratings and suggested fixes
      • The analysis runs in a connected Salesforce org, not locally: store the auth url of the target org in a CI secret named SFDX_AUTH_URL, and MegaLinter logs in to that org before the scan
      • The scan is sent to that org explicitly, so a .sfdx/sfdx-config.json left at the root of the repository, usually naming a long gone scratch org, can not hijack it
      • Inactive by default: it activates only when SFDX_AUTH_URL is defined, so nothing changes for existing Salesforce projects
      • Requires ApexGuru to be enabled on the org: it needs Scale Center, and is available for Unlimited Edition production orgs, full copy sandboxes, Signature orgs and Scale Test customers
      • A run where the engine could not analyze anything is reported as an error rather than a silent success, together with the reason and how to fix it
      • Supports native SARIF output, like the other Code Analyzer engines
    • tofu fmt, the built-in formatter of OpenTofu (the MPL-2.0 licensed fork of Terraform), available as TERRAFORM_TOFU_FMT (#​8729)
      • Analyzes .tofu files only, the OpenTofu specific extension, so it never doubles up with TERRAFORM_TERRAFORM_FMT which keeps .tf
      • To format your .tf files with OpenTofu instead, set TERRAFORM_TOFU_FMT_FILE_EXTENSIONS: [".tofu", ".tf", ".tfvars"] and DISABLE_LINTERS: [TERRAFORM_TERRAFORM_FMT]
      • Supports APPLY_FIXES to rewrite files in the canonical OpenTofu style
    • tofu validate, the built-in validator of OpenTofu, available as TERRAFORM_TOFU_VALIDATE (#​8793)
      • Reports what formatters and rule-based linters can not see: unsupported or missing arguments, wrong attribute types, references to undeclared variables, locals or outputs, and broken module input contracts
      • Analyzes .tofu files only, like TERRAFORM_TOFU_FMT, leaving .tf free for a future terraform validate linter. To validate .tf files, set TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS: [".tofu", ".tf"]
      • Validates one whole module per directory, so every .tf and .tofu file of a selected directory is parsed and can produce diagnostics
      • Every directory is initialized with tofu init -backend=false beforehand, so no state is read, no state lock is taken and no cloud credentials are needed
      • Set TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS to change those initialization arguments, for example adding -lockfile=readonly to have an out-of-sync .terraform.lock.hcl reported as an error instead of being updated
  • Disabled linters

    • COFFEE_COFFEELINT is disabled: CoffeeScript tooling is discontinued, and coffeelint can not receive EXCLUDED_DIRECTORIES in project lint mode (it has no exclusion option and reads .coffeelintignore only from its working directory). The linter will be removed in a future version (#​8720)
    • GRAPHQL_GRAPHQL_SCHEMA_LINTER is disabled: graphql-schema-linter is unmaintained, with no release or commit since May 2022, and its peer dependency range pins graphql to ^15 || ^16, which held the whole GraphQL install back from graphql v17. Use GRAPHQL_BIOME to lint your GraphQL files. The linter will be removed in a future version (#​8894)
  • Re-enabled linters

    • spectral is back as API_SPECTRAL, together with the API descriptor, to lint your OpenAPI, AsyncAPI and Arazzo specifications (#​8717)
      • It was removed in v10.0.0 because it crashed at startup on every run: the cause has been found and fixed
      • Nothing to change in your configuration: API_SPECTRAL works again in ENABLE_LINTERS / DISABLE_LINTERS, and the default ruleset file is still .spectral.yaml
  • Linters enhancements

    • TERRAFORM_TFLINT now documents the tflint native GITHUB_TOKEN_github_com variable to authenticate plugin downloads on github.com, which is the recommended way to fix tflint --init failures when your GITHUB_TOKEN targets a GitHub Enterprise instance (#​8795)
      • Set your github.com token in GITHUB_TOKEN_github_com, then list it in TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES: tflint gives it priority over GITHUB_TOKEN, which other linters and reporters keep using
      • PAT_GITHUB_COM is deprecated: it still works and now logs a warning, and will be removed in a future major release
    • CLOJURE_CLJSTYLE now forwards EXCLUDED_DIRECTORIES through its native repeatable --ignore argument, instead of a temporary .cljstyle written in your repository. Exclusions are now also applied when your repository already has a .cljstyle config, whose own ignore patterns are preserved (#​8720)
    • SQL_SQLFLUFF does not receive EXCLUDED_DIRECTORIES in project lint mode anymore: sqlfluff reads path exclusions only from a .sqlfluffignore, .sqlfluff or pyproject.toml located inside the analyzed sources, where MegaLinter used to write a temporary file. List the directories to skip in your own .sqlfluffignore, or keep the default list_of_files lint mode where MegaLinter filters the files itself (#​8720)
    • SARIF output is now available for 13 more linters: zizmor, bicep_linter, cppcheck, clj-kondo, roslynator, htmlhint, protolint, sqlfluff, swiftlint, osv-scanner, trufflehog, jscpd and lintr. Enable it the same way as any other SARIF-capable linter, with SARIF_REPORTER: true (optionally scoped with SARIF_REPORTER_LINTERS) (#​8715)
      • The 4 Salesforce Code Analyzer engines (SALESFORCE_CODE_ANALYZER_APEX, _AURA, _LWC, _FLOW) also gained SARIF output: their report switches from CSV to SARIF automatically when SARIF reporting is requested
      • csharp_roslynator is bumped from 0.12.0 to 0.13.0, the first release including its SARIF output support
      • clj-kondo's upstream SARIF output currently nests the region property one level too deep, which may affect line/column display in strict SARIF consumers (clj-kondo/clj-kondo#2345)
    • Prettier linters (JSON_PRETTIER, YAML_PRETTIER, JAVASCRIPT_PRETTIER, TYPESCRIPT_PRETTIER) now tell you how to install a Prettier plugin when one declared in your .prettierrc fails to load with Cannot find package ... imported from noop.js (#​6980)
      • Prettier v3 resolves plugins with a native ESM import() from the workspace and ignores NODE_PATH, so plugins installed with the default cwd: root land in /node-deps where Prettier never looks for them
      • The guidance surfaced in the log is to install them through <LINTER_KEY>_PRE_COMMANDS with cwd: workspace, which keeps plain package names in .prettierrc so the very same config still works when you run Prettier locally without MegaLinter
  • Fixes

    • MegaLinter does not crash anymore with This module only works with the 'fork' start method right after Processing linters on [N] parallel cores, which made every v10.0.0 run fail unless PARALLEL: false was set (#​8808)
      • The PARALLEL: false workaround is not needed anymore, on the main image as well as on custom flavors
      • Messages logged by linters running in parallel are back in the console and in megalinter.log, including the extra output of LOG_LEVEL: DEBUG
    • PAT_GITHUB_COM is now hidden from the linters commands, like every other credential variable (#​8795)
      • The GitHub Personal Access Token used by TERRAFORM_TFLINT was sent in cleartext to every linter, as it matched no pattern of SECURED_ENV_VARIABLES_DEFAULT
      • The default list now hides any variable named PAT, PAT_* or *_PAT (PAT_GITHUB_COM, AZURE_PAT...), and tflint --init still receives the real token
      • Add such a variable to <LINTER_KEY>_UNSECURED_ENV_VARIABLES if one of your linters really needs to read it
    • Fixed random Segmentation fault crashes of MegaLinter itself, which stopped the whole run with no error message (#​8733). MegaLinter threads now get a full-size stack instead of the 128 KiB default of the Alpine images
    • Fixed leaked git processes when APPLY_FIXES is active: one was left behind by every fixer linter, which could exhaust the available file descriptors on long runs (#​8779)
    • Fixed random crashes of project-mode linters (REPOSITORY_TRIVY, REPOSITORY_GRYPE, REPOSITORY_SYFT…) caused by MegaLinter writing temporary ignore files inside the analyzed sources: a file appearing then disappearing while another linter walked the repository aborted its scan (walk dir error: ... no such file or directory). MegaLinter now writes only in REPORT_OUTPUT_FOLDER, never in your sources (#​8720)
    • EXCLUDED_DIRECTORIES and ADDITIONAL_EXCLUDED_DIRECTORIES are now forwarded to project lint mode linters even when the directory is nested, not only when it sits at the root of your repository (#​8806)
      • A directory like infrastructure/cdk.out was previously scanned anyway, for example by REPOSITORY_BETTERLEAKS, which reported findings in generated files
      • Excluded entries are now looked up the same way MegaLinter filters files: by directory name, at any nesting level
      • Nothing changes when the excluded directory does not exist in your repository: it is still not sent to the linters
      • This also covers PYTHON_BANDIT, YAML_V8R, CSHARP_DOTNET_FORMAT, VBDOTNET_DOTNET_FORMAT and REPOSITORY_LS_LINT, whose exclusions are anchored on the repository root: they now receive the path of each nested directory found
      • A ^-anchored FILTER_REGEX_EXCLUDE keeps excluding root-level directories only: ^docs/ does not silence findings in packages/a/docs anymore
      • Looking up the excluded directories never descends into an excluded directory, and costs no extra repository scan: it reuses the one MegaLinter already does to list your files, and falls back to a single scan when only changed files are analyzed
    • REPOSITORY_TRUFFLEHOG does not silently skip findings anymore in a directory whose name merely ends with an excluded one: with dist excluded, secrets in my-dist/ were not reported (#​8811)
    • REPORT_OUTPUT_FOLDER is now always excluded from what linters analyze, even when you override EXCLUDED_DIRECTORIES, and even when the folder does not exist yet when a linter starts (#​8720)
    • The API reporter variables (API_REPORTER, API_REPORTER_URL…) are not flagged as deprecated anymore in the configuration JSON schema: they were collateral damage of the removal of the API des

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
⚠️ ACTION actionlint 4 2 0 0.1s
✅ ACTION zizmor 4 0 0 1.85s
✅ COPYPASTE jscpd yes no no 0.87s
✅ JAVASCRIPT eslint 11 0 0 1.94s
✅ JSON jsonlint 9 0 0 0.37s
✅ JSON npm-package-json-lint yes no no 0.5s
✅ JSON prettier 9 0 0 0.77s
✅ JSON v8r 9 0 0 15.81s
⚠️ MARKDOWN markdownlint 7 18 0 0.95s
⚠️ MARKDOWN markdown-table-formatter 7 1 0 0.35s
✅ REPOSITORY betterleaks yes no no 0.72s
✅ REPOSITORY checkov yes no no 23.0s
✅ REPOSITORY git_diff yes no no 0.02s
✅ REPOSITORY grype yes no no 63.88s
✅ REPOSITORY osv-scanner yes no no 0.5s
✅ REPOSITORY secretlint yes no no 1.39s
✅ REPOSITORY syft yes no no 2.01s
✅ REPOSITORY trivy yes no no 10.93s
✅ REPOSITORY trivy-sbom yes no no 0.42s
✅ REPOSITORY trufflehog yes no no 4.84s
✅ SPELL cspell 40 0 0 4.05s
⚠️ SPELL lychee 27 4 0 0.93s
✅ TYPESCRIPT eslint 1 0 0 0.38s
✅ TYPESCRIPT prettier 1 0 0 0.43s
⚠️ TYPESCRIPT ts-standard 1 1 0 0.43s
✅ YAML prettier 9 0 0 0.5s
✅ YAML v8r 9 0 0 7.26s
✅ YAML yamllint 9 0 0 0.55s

Detailed Issues

⚠️ ACTION / actionlint - 2 errors
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:15: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:21: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~
⚠️ SPELL / lychee - 4 errors
📝 Summary
---------------------
🔍 Total...........75
🔗 Unique..........63
✅ Successful......24
⏳ Timeouts.........0
🔀 Redirected.......7
👻 Excluded........47
❓ Unknown..........0
🚫 Errors...........4
⛔ Unsupported......4

Errors in README.md
[403] https://npmjs.org/package/java-caller (at 5:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://npmjs.org/package/java-caller (at 6:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://www.npmjs.com/package/java-caller (at 4:1) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/njre (at 16:145) | Rejected status code: 403 Forbidden

Hint: Followed 7 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdown-table-formatter - 1 error
1 files contain markdown tables to format:
- README.md
⚠️ MARKDOWN / markdownlint - 18 errors
CHANGELOG.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 442]
CODE_OF_CONDUCT.md:58:44 error MD034/no-bare-urls Bare URL used [Context: "nicolas.vuillamy@gmail.com"]
CODE_OF_CONDUCT.md:71:14 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
CODE_OF_CONDUCT.md:76:1 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:47 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:1 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:67:361 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:69:123 error MD060/table-column-style Table column style [Table pipe has extra space to the left for style "compact"]
README.md:73:315 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:74:310 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:75:208 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:76:233 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
⚠️ TYPESCRIPT / ts-standard - 1 error
Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@github-actions

github-actions Bot commented Aug 11, 2026 •

Copy link
Copy Markdown
Contributor

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
⚠️ ACTION actionlint 4 2 0 0.03s
✅ ACTION zizmor 4 0 0 1.96s
✅ COPYPASTE jscpd yes no no 0.43s
✅ JAVASCRIPT eslint 11 0 0 1.01s
✅ JSON jsonlint 9 0 0 0.09s
✅ JSON npm-package-json-lint yes no no 0.26s
✅ JSON prettier 9 0 0 0.31s
✅ JSON v8r 9 0 0 10.52s
⚠️ MARKDOWN markdownlint 7 18 0 0.3s
⚠️ MARKDOWN markdown-table-formatter 7 1 0 0.17s
✅ REPOSITORY betterleaks yes no no 1.07s
✅ REPOSITORY checkov yes no no 21.67s
✅ REPOSITORY git_diff yes no no 0.01s
✅ REPOSITORY grype yes no no 65.48s
❌ REPOSITORY osv-scanner yes 5 no 0.56s
✅ REPOSITORY secretlint yes no no 0.79s
✅ REPOSITORY syft yes no no 1.42s
✅ REPOSITORY trivy yes no no 12.3s
✅ REPOSITORY trivy-sbom yes no no 0.19s
✅ REPOSITORY trufflehog yes no no 1.65s
✅ SPELL cspell 40 0 0 2.49s
⚠️ SPELL lychee 27 4 0 0.79s
✅ TYPESCRIPT eslint 1 0 0 0.23s
✅ TYPESCRIPT prettier 1 0 0 0.27s
⚠️ TYPESCRIPT ts-standard 1 1 0 0.28s
✅ YAML prettier 9 0 0 0.39s
✅ YAML v8r 9 0 0 5.91s
✅ YAML yamllint 9 0 0 1.28s

Detailed Issues

❌ REPOSITORY / osv-scanner - 5 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 161 packages
End status: 31 dirs visited, 82 inodes visited, 1 Extract calls, 4.228129ms elapsed, 4.22845ms wall time

Total 3 packages affected by 5 known vulnerabilities (0 Critical, 2 High, 3 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
5 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-p498-v437-472g | 5.7  | npm       | @humanfs/node (dev)   | 0.16.7  | 0.16.8        | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.10        | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.12        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.11        | package-lock.json |
| https://osv.dev/GHSA-r3ph-w7gj-g6xm | 5.3  | npm       | js-yaml (dev)         | 5.2.3   | 5.4.1         | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
⚠️ ACTION / actionlint - 2 errors
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:15: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:21: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~
⚠️ SPELL / lychee - 4 errors
📝 Summary
---------------------
🔍 Total...........75
🔗 Unique..........63
✅ Successful......24
⏳ Timeouts.........0
🔀 Redirected.......7
👻 Excluded........47
❓ Unknown..........0
🚫 Errors...........4
⛔ Unsupported......4

Errors in README.md
[403] https://npmjs.org/package/java-caller (at 5:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://npmjs.org/package/java-caller (at 6:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://www.npmjs.com/package/java-caller (at 4:1) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/njre (at 16:145) | Rejected status code: 403 Forbidden

Hint: Followed 7 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdown-table-formatter - 1 error
1 files contain markdown tables to format:
- README.md
⚠️ MARKDOWN / markdownlint - 18 errors
CHANGELOG.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 442]
CODE_OF_CONDUCT.md:58:44 error MD034/no-bare-urls Bare URL used [Context: "nicolas.vuillamy@gmail.com"]
CODE_OF_CONDUCT.md:71:14 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
CODE_OF_CONDUCT.md:76:1 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:47 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:1 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:67:361 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:69:123 error MD060/table-column-style Table column style [Table pipe has extra space to the left for style "compact"]
README.md:73:315 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:74:310 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:75:208 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:76:233 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
⚠️ TYPESCRIPT / ts-standard - 1 error
Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@renovate renovate Bot changed the title Update dependency globals to v17.10.0 Update dependency globals to v17.11.0 Aug 12, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from fa4646a to 77fd348 Compare August 12, 2026 15:42
@renovate renovate Bot changed the title Update dependency globals to v17.11.0 Update all non-major dependencies Aug 14, 2026
@renovate

renovate Bot commented Aug 14, 2026 •

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EOVERRIDE
npm error Override for brace-expansion@5.0.12 conflicts with direct dependency
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-16T16_15_58_467Z-debug-0.log

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 77fd348 to 6ea1e12 Compare September 5, 2026 16:36
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 6ea1e12 to 85cc3ab Compare October 7, 2026 16:04
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 85cc3ab to d004bb0 Compare October 8, 2026 05:25

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants