iframe-proxy

renovate · 2026-10-12T00:59:38Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Release Notes

actions/checkout

`v7.0.1`

Compare Source

Skip running unsafe pr check if input is default by @aiqiaoy in #2518
Trim only ascii whitespace for branch by @aiqiaoy in #2521
Escape values passed to --unset by @aiqiaoy in #2530
Various dependency updates

actions/setup-node

`v7.1.0`

Compare Source

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in #1421
Support absolute paths in node-version-file by @v-mahabaleshwars in #1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in #1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in #1578
docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in #1593
Fixed cache recommendation syntax by @SubJunk in #1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in #1583
Upgrade @actions/cache to 6.2.0 by @philip-gai in #1584
Pin @types/node to v24 by @v-priyagupta108 in #1585
Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in #1599
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #1598
Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in #1590
Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in #1610
Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in #1602
Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in #1629
Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in #1616
Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in #1615
Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in #1631
Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in #1636
Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in #1638
Update dependencies and add license files by @v-HarithaVattikuti in #1642
Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in #1635

New Contributors

@v-jitenderpalsingh made their first contribution in #1580
@philip-gai made their first contribution in #1584
@gperdomor made their first contribution in #1421
@SubJunk made their first contribution in #1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

docker/build-push-action

`v7.4.0`

Compare Source

Use the shared error helper for Buildx commands by @crazy-max in #1620
Prevent workflow command injection in metadata logs by @crazy-max in #1617
Bump @docker/actions-toolkit from 0.92.0 to 0.100.0 in #1614 #1618 #1621
Bump @humanfs/node from 0.16.7 to 0.16.8 in #1609
Bump brace-expansion from 1.1.13 to 1.1.18 in #1592
Bump csv-parse from 7.0.0 to 7.0.2 in #1613
Bump js-yaml from 4.3.0 to 4.3.2 in #1605 #1615
Bump nanoid from 3.3.16 to 3.3.18 in #1611
Bump postcss from 8.5.10 to 8.5.25 in #1590
Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #1606
Bump sigstore from 4.1.0 to 4.1.1 in #1577
Bump undici from 6.27.0 to 6.28.0 in #1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

`v7.3.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #1567
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #1545 #1572
Bump @sigstore/core from 3.1.0 to 3.2.1 in #1568
Bump js-yaml from 4.1.1 to 4.3.0 in #1566
Bump tmp from 0.2.5 to 0.2.7 in #1547
Bump undici from 6.24.1 to 6.27.0 in #1564
Bump vite from 7.3.2 to 7.3.6 in #1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

docker/login-action

`v4.7.0`

Compare Source

Preserve explicit ECR settings in registry-auth by @crazy-max in #1089
Use registry hosts for scoped credentials by @crazy-max in #1088
Raise Docker Hub OIDC max expiry to 6 hours by @crazy-max in #1068
Log Docker Hub OIDC token exchange progress by @crazy-max in #1061
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1154.0 in #1093
Bump @docker/actions-toolkit from 0.94.0 to 0.107.0 in #1100
Bump @humanfs/node from 0.16.7 to 0.16.8 in #1077
Bump csv-parse from 7.0.1 to 7.0.3 in #1078
Bump handlebars from 4.7.9 to 4.7.10 in #1091
Bump js-yaml from 5.2.2 to 5.5.0 in #1066
Bump postcss from 8.5.22 to 8.5.26 in #1071
Bump postcss-selector-parser from 7.1.1 to 7.1.6 in #1092
Bump source-map-js from 1.2.1 to 1.2.2 in #1090
Bump undici from 6.27.0 to 6.29.1 in #1085
Bump uuid from 14.0.1 to 14.0.3 in #1096

Full Changelog: docker/login-action@v4.6.0...v4.7.0

`v4.6.0`

Compare Source

Harden buildx scoped config path handling by @crazy-max in #1059
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1095.0 in #1051
Bump js-yaml from 5.2.1 to 5.2.2 in #1057
Bump postcss from 8.5.10 to 8.5.22 in #1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

`v4.5.2`

Compare Source

Surface Docker Hub OIDC error responses by @crazy-max in #1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

`v4.5.1`

Compare Source

Support dhi.io as Docker Hub OIDC registry by @crazy-max in #1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

`v4.5.0`

Compare Source

Docker Hub OIDC login support by @crazy-max in #1048
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1091.0 in #1037
Bump @docker/actions-toolkit from 0.92.0 to 0.94.0 in #1044 #1050
Bump brace-expansion from 1.1.13 to 1.1.16 in #1046
Bump js-yaml from 5.2.0 to 5.2.1 in #1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

`v4.4.0`

Compare Source

Skip empty registry-auth secret mask by @crazy-max in #1035
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 #1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

`v4.3.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #1022
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 #999 #1030
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #1004 #1027
Bump @sigstore/core from 3.1.0 to 3.2.1 in #1023
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #1029
Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #1017
Bump js-yaml from 4.1.1 to 5.2.0 in #1028
Bump sigstore from 4.1.0 to 4.1.1 in #1031
Bump tmp from 0.2.5 to 0.2.7 in #1002
Bump undici from 6.24.1 to 6.27.0 in #1020
Bump vite from 7.3.3 to 7.3.6 in #1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

docker/setup-buildx-action

`v4.4.1`

Compare Source

Skip BuildKit image pre-pulls for explicit endpoints by @crazy-max in #624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

`v4.4.0`

Compare Source

Use official Buildx releases for cloud driver by @crazy-max in #606
Pull BuildKit image before builder creation by @crazy-max in #609
Use shared error helpers for Buildx and Docker commands by @crazy-max in #620
Bump @docker/actions-toolkit from 0.95.0 to 0.100.0 in #610 #618 #619
Bump @humanfs/node from 0.16.7 to 0.16.8 in #614
Bump js-yaml from 5.3.0 to 5.4.2 in #608 #617
Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

`v4.3.0`

Compare Source

Bump @docker/actions-toolkit from 0.92.0 to 0.95.0 in #595
Bump brace-expansion from 1.1.13 to 1.1.18 in #600
Bump js-yaml from 5.2.0 to 5.3.0 in #585
Bump postcss from 8.5.10 to 8.5.25 in #598
Bump undici from 6.27.0 to 6.28.0 in #601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

`v4.2.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #572
Bump @actions/core from 3.0.0 to 3.0.1 in #551
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #557 #580
Bump @sigstore/core from 3.1.0 to 3.2.1 in #573
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #576
Bump js-yaml from 4.1.1 to 5.2.0 in #562
Bump sigstore from 4.1.0 to 4.1.1 in #577
Bump tmp from 0.2.5 to 0.2.7 in #556
Bump undici from 6.25.0 to 6.27.0 in #570
Bump vite from 7.3.2 to 7.3.6 in #569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

docker/setup-qemu-action

`v4.4.0`

Compare Source

Use the shared error helper for Docker commands by @crazy-max in #345
Bump @docker/actions-toolkit from 0.96.0 to 0.100.0 in #344
Bump @humanfs/node from 0.16.7 to 0.16.8 in #340
Bump js-yaml from 4.3.1 to 4.3.2 in #342
Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

`v4.3.0`

Compare Source

Bump @docker/actions-toolkit from 0.92.0 to 0.96.0 in #336
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #316
Bump brace-expansion from 1.1.15 to 1.1.18 in #332
Bump js-yaml from 4.2.0 to 4.3.1 in #334
Bump postcss from 8.5.10 to 8.5.25 in #331
Bump sigstore from 4.1.0 to 4.1.1 in #317
Bump undici from 6.27.0 to 6.28.0 in #333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

`v4.2.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #311
Bump @actions/core from 3.0.0 to 3.0.1 in #295
Bump @docker/actions-toolkit from 0.91.0 to 0.92.0 in #315
Bump @sigstore/core from 3.1.0 to 3.2.1 in #312
Bump js-yaml from 4.1.1 to 4.2.0 in #310
Bump tmp from 0.2.6 to 0.2.7 in #304
Bump undici from 6.26.0 to 6.27.0 in #308
Bump vite from 7.3.2 to 7.3.6 in #307

Full Changelog: docker/setup-qemu-action@v4.1.0...v4.2.0

npm/cli (npm)

`v12.2.1`

Compare Source

Bug Fixes

b317f16 #9941 write registry allowScripts keys under install-strategy=linked (#9941) (@manzoorwanijk)

Dependencies

7b0c2e8 #10088 http-cache-semantics@4.3.0 (@reggi)
e9e99b4 #10088 undici@6.29.0 (@reggi)
857d7df #10088 postcss-selector-parser@7.1.6 (@reggi)
bc7bb3a #10088 ip-address@10.7.2 (@reggi)
7614360 #10088 brace-expansion@5.0.12 (@reggi)
workspace: @npmcli/arborist@10.0.4
workspace: libnpmdiff@9.0.4
workspace: libnpmexec@11.0.4
workspace: libnpmfund@8.0.4
workspace: libnpmpack@10.0.4

`v12.2.0`

Compare Source

Features

9741b64 #10038 dist-tag: support OIDC authentication (#10038) (@reggi, @Copilot)

Documentation

0c3b82a #10017 update npm stage docs to reflect that it can create new packages (#10017) (@shmam, @Copilot)

Dependencies

workspace: @npmcli/config@11.2.0

oxc-project/oxc (oxlint)

`v1.89.0`

Compare Source

🐛 Bug Fixes

9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)

`v1.88.0`

Compare Source

🚀 Features

3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

`v1.87.0`: oxlint v1.87.0

Compare Source

🚀 Features

42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)
ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#26925) (camc314)

`v1.86.0`

Compare Source

🚀 Features

9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

pinojs/pino (pino)

`v10.4.0`

Compare Source

What's Changed

Add warning on incompatible formatters.level with multi-target transports by @lraveri in #2381
chore: use TSTyche for type testing by @mrazauskas in #2376
Add Sentry Native Integration Docs by @KyleTryon in #2394
docs: add flush limitation warning for pino-pretty, fix #1015 by @mcollina in #2402
feat(browser): add redaction support by @abhu85 in #2396
chore: lint the type declaration file by @mrazauskas in #2408
chore: remove TSTyche config file by @mrazauskas in #2409
docs: clarify multi-target formatter limitation by @mcollina in #2410
No bots allowed by @mcollina in #2412
build(deps): bump real-require from 0.2.0 to 1.0.0 by @dependabot[bot] in #2414
build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in #2418
fix: use util.getCallSites when able to allow frozen intrinsics by @CarlOlson in #2294
Update AWS Lambda reference in asynchronous docs by @urbanautomaton in #2413
chore: update license by @Tony133 in #2375
fix: add named default export by @mrazauskas in #2421
Update contrib doc by @jsumners in #2424
docs: use @hono/structured-logger for Pino with Hono by @brunorodmoreira in #2425
chore(deps): remove pre-commit by @kshitijanurag in #2423
build(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #2427
build(deps-dev): bump eslint-plugin-promise from 6.6.0 to 7.3.0 by @dependabot[bot] in #2428
build(deps-dev): bump tstyche from 6.2.0 to 7.1.0 by @dependabot[bot] in #2429
test: fix flaky transport config test by @mcollina in #2434
chore: upgrade typescript to v6.0.2 by @Tony133 in #2419
docs: fix typo "compatability" → "compatibility" in README by @premsreelathasugeendran in #2435
docs: warn against untrusted top-level log keys by @mcollina in #2450
test(transport): keep event loop alive while awaiting async flush by @YBJ0000 in #2470
docs: clarify Node.js version support policy in LTS doc by @youdie006 in #2472
fix: honor per-target level filter on single-element targets array by @mcollina in #2432
fix(multistream): resolve string level labels in write() by @xianjianlf2 in #2474
fix: escape child binding keys by @mcollina in #2452
docs: clarify stringification limits by @mcollina in #2475
fix: add setBindings to the browser logger by @ankit1324 in #2471
build(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #2486
build(deps-dev): bump through2 from 4.0.2 to 5.0.10 by @dependabot[bot] in #2488
build(deps-dev): bump bole from 5.0.29 to 6.0.7 by @dependabot[bot] in #2489
build(deps-dev): bump eslint-plugin-n from 17.23.2 to 18.2.2 by @dependabot[bot] in #2492
build(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #2485
fix: log objects with an own proto key instead of crashing by @spokodev in #2457
fix: build the redaction shape without Object.prototype by @luantaraschi in #2495
ci: add Node.js 26 to test matrix by @aquie00t in #2480
fix(multistream): fix clone add crash and missing end/remove methods by @spellsaif in #2493
ci: check pull requests target main by @marktran0710 in #2500
build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 by @dependabot[bot] in #2513
build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 by @dependabot[bot] in #2515
Delete .github/dependabot.yml by @jsumners in #2517
docs: document the APIs that are unavailable in the browser by @kavish-19 in #2521
ci: pin lock-threads to upstream v6.0.2 to fix token validation failure by @simpleqt in #2525
Add bindings() method to browser logger by @RT1811 in #2504
docs: Note that serializers run on child bindings at creation time by @itz-puneet in #2518
docs: fix the pino-pretty flush explanation after thread-stream#198 by @k-adm in #2524

New Contributors

@lraveri made their first contribution in #2381
@KyleTryon made their first contribution in #2394
@abhu85 made their first contribution in #2396
@CarlOlson made their first contribution in #2294
@urbanautomaton made their first contribution in #2413
@brunorodmoreira made their first contribution in #2425
@kshitijanurag made their first contribution in #2423
@premsreelathasugeendran made their first contribution in #2435
@YBJ0000 made their first contribution in #2470
@youdie006 made their first contribution in #2472
@xianjianlf2 made their first contribution in #2474
@ankit1324 made their first contribution in #2471
@spokodev made their first contribution in #2457
@luantaraschi made their first contribution in #2495
@aquie00t made their first contribution in #2480
@spellsaif made their first contribution in #2493
@marktran0710 made their first contribution in #2500
@kavish-19 made their first contribution in #2521
@simpleqt made their first contribution in #2525
@RT1811 made their first contribution in #2504
@itz-puneet made their first contribution in #2518
@k-adm made their first contribution in #2524

Full Changelog: pinojs/pino@v10.3.1...v10.4.0

vercel/turborepo (turbo)

`v2.11.10`: Turborepo v2.11.10

Compare Source

What's Changed

Changelog

fix: Allow non-recursive Turbo commands in root tasks by @sahyl in #14814
chore: Release Turborepo 2.11.9 by @github-actions[bot] in #14824
chore(deps): Update dependency @vercel/geistdocs to v2 by @vercel-gh-bot-4[bot] in #14417
chore: Update with-gatsby example by @vercel-gh-bot-3[bot] in #14796
fix: Avoid pnpm batch-shim shutdown hangs on Windows by @sahyl in #14819
chore(deps): Update dependency @vercel/geistdocs to v2.11.0 by @vercel-gh-bot-3[bot] in #14832
fix: Exclude tool-managed directories from local dependency inputs by @PedroRosalba in #14696
fix: Match git's text=auto binary detection in file hashing by @PedroRosalba in #14697
fix: Drop @react-router/dev from Remix match list by @Pcmhacker-piro in #14800
fix: Match package configuration files and directory inputs in task-level affected detection by @PedroRosalba in #14804
fix: Parse pnpm 8 single-project lockfiles by @PedroRosalba in #14806
fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @PedroRosalba in #14805
docs: Generate the sitemap from Geistdocs sources by @molebox in #14865
fix: Restore cached symlinks when outputs are already on disk by @PedroRosalba in [#14807](https://r

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 3am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): Update all non-major dependencies

57453b9

renovate Bot force-pushed the renovate/all-minor-patch branch from fb8c0de to 57453b9 Compare October 23, 2026 22:21

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

chore(deps): Update all non-major dependencies - #182

chore(deps): Update all non-major dependencies#182
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Package	Type	Update	Change
actions/checkout	action	patch	`v7.0.0` → `v7.0.1`
actions/setup-node	action	minor	`v7.0.0` → `v7.1.0`
docker/build-push-action	action	minor	`v7.2.0` → `v7.4.0`
docker/login-action	action	minor	`v4.2.0` → `v4.7.0`
docker/setup-buildx-action	action	minor	`v4.1.0` → `v4.4.1`
docker/setup-qemu-action	action	minor	`v4.1.0` → `v4.4.0`
npm (source)	packageManager	minor	`12.1.0` → `12.2.1`
oxlint (source)	devDependencies	minor	`1.85.0` → `1.89.0`
pino (source)	dependencies	minor	`10.3.1` → `10.4.0`
supabase/postgres		minor	`15.14.1.138` → `15.19.0.007`
turbo (source)	devDependencies	patch	`2.11.2` → `2.11.10`
vitest (source)	devDependencies	patch	`5.0.1` → `5.0.5`

Sunbelt Computer Software

PL/B Language Development and Support

Conversation

renovate Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Bug Fixes

Dependencies

Features

Documentation

Dependencies

🐛 Bug Fixes

🚀 Features

v1.87.0: oxlint v1.87.0

🚀 Features

🐛 Bug Fixes

🚀 Features

What's Changed

New Contributors

v2.11.10: Turborepo v2.11.10

What's Changed

Changelog

Configuration

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 12, 2026 •

edited

Loading

`v1.87.0`: oxlint v1.87.0

`v2.11.10`: Turborepo v2.11.10