chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #2909 · go-task/task

renovate · 2026-07-06T02:16:06Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@types/node (source)	`24.13.2` → `24.13.3`	devDependencies	patch
charm.land/bubbles/v2	`v2.1.0` → `v2.1.1`	require	patch
charm.land/bubbletea/v2	`v2.0.7` → `v2.0.8`	require	patch
charm.land/lipgloss/v2	`v2.0.4` → `v2.0.5`	require	patch
cloud.google.com/go/auth	`v0.20.0` → `v0.21.0`	indirect	minor
github.com/aws/aws-sdk-go-v2	`v1.42.0` → `v1.42.1`	indirect	patch
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	`v1.7.13` → `v1.7.14`	indirect	patch
github.com/aws/aws-sdk-go-v2/config	`v1.32.26` → `v1.32.29`	indirect	patch
github.com/aws/aws-sdk-go-v2/credentials	`v1.19.25` → `v1.19.28`	indirect	patch
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	`v1.18.29` → `v1.18.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/configsources	`v1.4.29` → `v1.4.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	`v2.7.29` → `v2.7.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/v4a	`v1.4.30` → `v1.4.31`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	`v1.13.12` → `v1.13.13`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/checksum	`v1.9.22` → `v1.9.23`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	`v1.13.29` → `v1.13.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	`v1.19.30` → `v1.19.31`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/s3	`v1.104.1` → `v1.105.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/signin	`v1.2.1` → `v1.4.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/sso	`v1.31.4` → `v1.32.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/ssooidc	`v1.36.7` → `v1.37.0`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/sts	`v1.43.4` → `v1.44.0`	indirect	minor
github.com/charmbracelet/ultraviolet	`f39628c` → `f5a850f`	indirect	digest
github.com/googleapis/enterprise-certificate-proxy	`v0.3.17` → `v0.3.18`	indirect	patch
github.com/googleapis/gax-go/v2	`v2.22.0` → `v2.23.0`	indirect	minor
github.com/klauspost/compress	`v1.18.7` → `v1.19.0`	indirect	minor
github.com/planetscale/vtprotobuf	`ba97887` → `8ae5a48`	indirect	digest
go	`1.26.4` → `1.26.5`		patch
golang.org/x/crypto	`v0.53.0` → `v0.54.0`	indirect	minor
golang.org/x/exp	`c48552f` → `9ea1abe`	indirect	digest
golang.org/x/net	`v0.56.0` → `v0.57.0`	indirect	minor
golang.org/x/sync	`v0.21.0` → `v0.22.0`	require	minor
golang.org/x/sys	`v0.46.0` → `v0.47.0`	indirect	minor
golang.org/x/term	`v0.44.0` → `v0.45.0`	require	minor
golang.org/x/text	`v0.38.0` → `v0.40.0`	indirect	minor
google.golang.org/api	`v0.287.0` → `v0.288.0`	indirect	minor
google.golang.org/genproto	`925bb5d` → `f0a9213`	indirect	digest
google.golang.org/genproto/googleapis/api	`925bb5d` → `f0a9213`	indirect	digest
google.golang.org/genproto/googleapis/rpc	`925bb5d` → `f0a9213`	indirect	digest
mvdan.cc/sh/moreinterp	`19def06` → `2255122`	require	digest
netlify-cli	`26.1.0` → `26.2.0`	devDependencies	minor
pnpm (source)	`11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b` → `11.11.0`	packageManager	minor
pnpm (source)	`11.9.0` → `11.11.0`		minor
prettier (source)	`3.9.4` → `3.9.5`	devDependencies	patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

charmbracelet/bubbles (charm.land/bubbles/v2)

`v2.1.1`

Compare Source

Lil’ Textarea Fix

This is a tiny patch to fix a bug in textarea where the prompt character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles,
Charm 🌞

Changelog

Fixed

d2b2217: fix(textarea): apply prompt style on all lines, including fillers (@meowgorithm)

Docs

a13f110: docs: fix typo in README (#921) (@Rohan5commit)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/bubbletea (charm.land/bubbletea/v2)

`v2.0.8`

Compare Source

Graphemes, schmraphemes

No terminal can render emojis perfectly, but we can try. This release improves some very specific edge cases around emoji rendering. Enjoy!

Changelog

db569ad: fix(deps): bump ultraviolet for emoji-related rendering improvements

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/lipgloss (charm.land/lipgloss/v2)

`v2.0.5`

Compare Source

Changelog

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

googleapis/google-cloud-go (cloud.google.com/go/auth)

`v0.21.0`

Compare Source

bigquery:
- Add OpenCensus tracing.
firestore:
- BREAKING CHANGE: If a document does not exist, return a DocumentSnapshot
  whose Exists method returns false. DocumentRef.Get and Transaction.Get
  return the non-nil DocumentSnapshot in addition to a NotFound error.
  DocumentRef.GetAll and Transaction.GetAll return a non-nil
  DocumentSnapshot instead of nil.
- Add DocumentIterator.Stop. Call Stop whenever you are done with a
  DocumentIterator.
- Added Query.Snapshots and DocumentRef.Snapshots, which provide realtime
  notification of updates. See https://cloud.google.com/firestore/docs/query-data/listen.
- Canceling an RPC now always returns a grpc.Status with codes.Canceled.
spanner:
- Add CommitTimestamp, which supports inserting the commit timestamp of a
  transaction into a column.

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

`v1.42.1`

Compare Source

Module Highlights

github.com/aws/aws-sdk-go-v2/service/acm: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/aiops: v1.6.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/appflow: v1.50.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/appsync: v1.51.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/athena: v1.55.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.58.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/b2bi: v1.0.0-preview.79
- Feature: Updated APIs to support custom validation rules.
github.com/aws/aws-sdk-go-v2/service/bedrock: v1.45.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/bedrockagent: v1.50.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.9.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/bedrockdataautomationruntime: v1.7.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/braket: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/chatbot: v1.14.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.26.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudcontrol: v1.28.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.65.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudsearch: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudtraildata: v1.16.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudwatchevents: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.57.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/codeartifact: v1.38.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/codegurusecurity: v1.16.3
- Documentation: Documentation update to notify users of the discontinuation of Amazon CodeGuru Security.
github.com/aws/aws-sdk-go-v2/service/codestarnotifications: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/connectparticipant: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/controltower: v1.26.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/costandusagereportservice: v1.33.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/datazone: v1.39.0
- Feature: Releasing the following features - Asset classification that lets users use restricted terms for classifying assets if they have the right permissions. Also adding a new enum value "Moving" to project status.
github.com/aws/aws-sdk-go-v2/service/dax: v1.28.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/devicefarm: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/devopsguru: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/directconnect: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/docdbelastic: v1.19.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/ec2: v1.246.0
- Feature: Added IPv6 support for AWS Client VPN.
github.com/aws/aws-sdk-go-v2/service/eks: v1.72.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/emrcontainers: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/finspacedata: v1.33.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/forecast: v1.41.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/fsx: v1.61.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/groundstation: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/health: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/iotdataplane: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/iotfleethub: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/iotsitewise: v1.51.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/kendra: v1.60.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/keyspaces: v1.23.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/kinesisanalytics: v1.30.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/kinesisvideoarchivedmedia: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lambda: v1.77.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lexmodelsv2: v1.56.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lexruntimeservice: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/licensemanager: v1.36.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/lookoutequipment: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/mailmanager: v1.17.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/marketplacecatalog: v1.36.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/mediaconvert: v1.82.0
- Feature: This release adds support for input rendition selection for HLS input, adds new Share API to enable sharing jobs with AWS Support for support investigations, and adds INCLUDE_AS_TS to iFrameOnlyManifest setting for HLS outputs.
github.com/aws/aws-sdk-go-v2/service/mediapackagevod: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/mediastore: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/migrationhubstrategy: v1.26.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/odb: v1.4.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/opensearchserverless: v1.25.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/opsworkscm: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/outposts: v1.56.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/pcaconnectorad: v1.15.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/personalizeruntime: v1.32.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/qbusiness: v1.33.0
- Feature: The Amazon Q Business GetDocumentContent operation now supports retrieval of the extracted text content in JSON format.
github.com/aws/aws-sdk-go-v2/service/redshiftserverless: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/repostspace: v1.14.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/resiliencehub: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi: v1.30.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sagemakeredge: v1.30.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sagemakerfeaturestoreruntime: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sagemakerruntime: v1.37.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/serverlessapplicationrepository: v1.29.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/servicecatalog: v1.38.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sfn: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/shield: v1.34.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/snowball: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/sqs: v1.42.1
- Documentation: Documentation update for Amazon SQS Supports Large Payload Message feature
github.com/aws/aws-sdk-go-v2/service/ssoadmin: v1.35.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/storagegateway: v1.42.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/support: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/supportapp: v1.18.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/taxsettings: v1.16.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/timestreaminfluxdb: v1.16.0
- Feature: Add MAINTENANCE status for DbInstance and DbCluster
github.com/aws/aws-sdk-go-v2/service/transcribe: v1.52.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/transcribestreaming: v1.31.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/translate: v1.33.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/wellarchitected: v1.39.0
- Feature: Remove incorrect endpoint tests
github.com/aws/aws-sdk-go-v2/service/workspacesthinclient: v1.20.0
- Feature: Remove incorrect endpoint tests

googleapis/enterprise-certificate-proxy (github.com/googleapis/enterprise-certificate-proxy)

`v0.3.18`

Compare Source

googleapis/gax-go (github.com/googleapis/gax-go/v2)

`v2.23.0`

Compare Source

Features

v2: add http.response.status_code to TransportTelemetryData (#513) (7d5554f)

Bug Fixes

correct min go version (#517) (fc62896)

klauspost/compress (github.com/klauspost/compress)

`v1.19.0`

Compare Source

What's Changed

zstd: Add true concurrent stream encoding by @klauspost in #1136
zstd: arm64 decoder asm by @lizthegrey in #1160
zstd: avoid unused BuildDict encoder allocation by @snissn in #1147
flate: Add inflate checkpoints by @klauspost in #1154
snappy/s2: Limit length of varint in decodedLen by @eustas in #1148
gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @z9z in #1149
zip: add NameDecoder callback for legacy encoding rewrite by @SAY-5 in #1150
huff0: Allow building tables from histogram. by @klauspost in #1155
huff0: Allow building table from oversized histogram. by @klauspost in #1156
s2sx: Clean symlink targets by @klauspost in #1163

New Contributors

@snissn made their first contribution in #1147
@eustas made their first contribution in #1148
@z9z made their first contribution in #1149
@SAY-5 made their first contribution in #1150
@HNO3Miracle made their first contribution in #1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

golang/go (go)

`v1.26.5`

Compare Source

googleapis/google-api-go-client (google.golang.org/api)

`v0.288.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3647) (510a0c1)

`v0.287.1`

Compare Source

Documentation

Remove old TODO file (#3645) (9d7a6b8)

netlify/cli (netlify-cli)

`v26.2.0`

Compare Source

Features

add watch-ignore flag (#8271) (fc30bcc)

Bug Fixes

add a stacktrace for monitoring (#8301) (30ba6a1)
add commandname to error reporting (#8303) (004df96)
deps: replace lodash with native utilities (#8189) (137fbf0)
deps: update dependency @netlify/blobs to ^10.7.9 (#8291) (419a749)
deps: update dependency @netlify/dev to ^4.18.7 (#8292) (1985b3b)
deps: update dependency @netlify/dev-utils to ^4.4.6 (#8293) (392af83)
deps: update dependency @netlify/edge-functions to ^3.0.8 (#8295) (7d00215)
deps: update dependency @netlify/functions to ^5.3.0 (#8296) (42393a4)
deps: update dependency @netlify/images to ^1.3.10 (#8298) (20fb23d)
dev: execute dev command with shell operators (&&, ||, etc.) (#8234) (d07599e)
silence zip output when creating source zips (#8323) (e6fbebc)

pnpm/pnpm (pnpm)

`v11.11.0`

Compare Source

Minor Changes

508b8c2: Added the pnpm access command for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.

Patch Changes

c70e33e: Allow allowBuilds entries for git-hosted packages to match by repository URL without pinning the resolved commit hash. This lets trusted git repositories keep running their build scripts after branch updates without approving each new commit, while package-name-only rules still do not approve git-hosted artifacts.
3067e4f: Reduced peak memory usage during cold-cache dependency resolution. The metadata fetch is memoized for the whole resolution phase, and it was retaining each package's raw registry response body (used only to mirror the response to disk) for that entire time. The memoized cache now holds a body-less copy, so the raw body only lives as long as the call that writes the disk mirror. On large graphs that fetch full metadata (e.g. with minimumReleaseAge or trustPolicy enabled) this cuts peak RSS by roughly 30%, back in line with pnpm 10. The resolved lockfile is unchanged.
51300fd: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at formatGlobalVirtualStorePath, the single point every global-virtual-store slot path funnels through — closing the same escape in the isolated linker, the resolver's dependency-graph builder, and the config-dependency installer.
f8058eb: Reject symlinked pnpm-lock.yaml files when reading or writing the env lockfile document.
9318a11: Allow registries and namedRegistries to be configured in the global config.yaml file.
51300fd: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
14332f0: Fail instead of silently removing an optional dependency's locked entries from pnpm-lock.yaml when the registry cannot resolve it. Previously, when registry metadata lacked a version that the lockfile already pinned (for example, a mirror that had not synced a recent release yet), pnpm install and pnpm dedupe silently dropped the optional dependency's entries — emptying maps such as the platform binaries of @napi-rs/canvas — so the lockfile differed between machines and frozen installs on other hosts had nothing to link #12853.
fecfe83: Fixed peer dependency resolution with autoInstallPeers when a workspace package depends on a version of a package that a transitive dependency's self-contained closure also provides for itself. The peer providers that are attached to the root project for reuse are no longer peer-resolved a second time in the root context, so packages inside such a closure no longer get their peers bound to the root project's incompatible version #4993.
5a4daec: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry, namedRegistries, and pnprServer.
d1da02e: pnpm publish no longer prints credentials when the target registry is configured with inline user:pass@ credentials (e.g. registry=https://user:pass@example.com/). They are now redacted both from the "publishing to registry" line and from the OIDC (trusted publishing) failure messages.
dcfc611: pnpm self-update now honors trustPolicy=no-downgrade. It resolves the target pnpm version against full registry metadata, so it refuses to switch to a version whose supply-chain trust evidence is weaker than an earlier-published one, the same way a regular install does.
a8ad82d: Register the pn alias in generated shell completion scripts.
25bd5c3: Fixed standalone installer downgrades from pnpm v12 to v11.
23996e9: pnpm runtime set <name> <version> now validates its arguments: the name must be node, deno, or bun, and the version must not contain a comma. Previously these were interpolated straight into a pnpm add selector, where an unsupported name or a comma (e.g. node 22,is-positive) could be misread as a list of packages or a local directory and install unintended packages or bins.

`v11.10.0`

Compare Source

Minor Changes

e2e3c81: Added the issues command as an alias of bugs, so pnpm issues opens the package's bug tracker URL in the browser.
8491f8e: Added the prefix command which prints the current package prefix directory (or global prefix directory if -g / --global is used).
3425e80: Added an _auth setting for configuring registry authentication as a single structured (URL-keyed) value. It can be set in the global pnpm config (config.yaml) or, for CI, via the pnpm_config__auth environment variable. The env form sidesteps the GitHub Actions / bash / zsh limitation that broke the existing pnpm_config_//host/:_authToken=… form (env var names containing /, :, or . are silently dropped). Closes #12314.

The value is keyed by registry URL so each secret is explicitly bound to the host that may receive it. Registry URL keys must use http or https and must not include credentials, query strings, or fragments:
```
export pnpm_config__auth='{"https://registry.npmjs.org":{"@&#8203;":{"authToken":"npm-token"},"@&#8203;org":{"authToken":"org-token"}}}'
```
The equivalent in the global config.yaml:
```
_auth:
  https://registry.npmjs.org:
    "@&#8203;":
      authToken: npm-token
    "@&#8203;org":
      authToken: org-token
```
Within each registry URL, @ means registry-wide/default credentials and package scopes like @org bind credentials to that scope on the same host. The only supported credential field is authToken (maps to _authToken / bearer auth); the deprecated basicAuth / username + password forms are intentionally not accepted here.

Each entry also infers a trusted registry route: @ routes the default registry (and pnpm add <pkg> resolves there), and @org routes that scope. Because the credential and destination host arrive in one trusted value, repo-controlled pnpm-workspace.yaml or project .npmrc cannot redirect the token to a different host. _auth is honored only from the env var and the global config — it is ignored in a project pnpm-workspace.yaml / .npmrc, so repo-controlled config can never supply registry auth. Precedence: CLI flags (--registry, --@scope:registry) > pnpm_config__auth > global config.yaml _auth > pnpm-workspace.yaml.

Both pnpm_config__auth (lowercase, documented form) and PNPM_CONFIG__AUTH (all-caps, the shell convention some CI runners apply) are honored. If both are set, lowercase wins unless it is empty, in which case uppercase is used. The env var wins over the global config.yaml _auth on a conflicting key. tokenHelper is not supported in _auth. Parsing is strict: a malformed value (bad JSON, wrong shape, invalid registry URL or scope, an unsupported credential field) fails fast with an error rather than being silently dropped.

Pacquet parity note: the pacquet (Rust) port supports the same single credential field as the TS CLI: authToken.
a33eeec: pnpm self-update and packageManager version-switching can now install and link pnpm v12 (the Rust port), published with equal content under both the pnpm and @pnpm/exe names on the next-12 dist-tag. Its native binaries

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-09T17:57:34Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.10` -> `1.26.4`

renovate Bot added area: dependencies Changes related to dependency files. lang: go Pull requests that update Go code. lang: javascript Pull requests that update Javascript code. labels Jul 6, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 39011ed to f0caa2f Compare July 9, 2026 17:56

chore(deps): update all non-major dependencies

fbdee29

renovate Bot force-pushed the renovate/all-minor-patch branch from f0caa2f to fbdee29 Compare July 9, 2026 23:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update all non-major dependencies#2909

chore(deps): update all non-major dependencies#2909
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Lil’ Textarea Fix

Changelog

Fixed

Docs

Graphemes, schmraphemes

Changelog

Changelog

Module Highlights

Features

Bug Fixes

What's Changed

New Contributors

Features

Documentation

Features

Bug Fixes

Minor Changes

Patch Changes

Minor Changes

Configuration

Uh oh!

renovate Bot commented Jul 9, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 6, 2026 •

edited

Loading