chore: update auto merge on patch or minor by renovate[bot] · Pull Request #66 · inversify/db

renovate · 2026-07-25T08:50:27Z

This PR contains the following updates:

Package	Change	Type	Update	Pending
@inversifyjs/foundation-vitest-config	`0.2.0` → `0.2.1`	devDependencies	patch
eslint (source)	`10.7.0` → `10.8.0`	devDependencies	minor
inversify (source)	`^8.2.2` → `^8.2.3`	peerDependencies	patch
knip (source)	`6.27.0` → `6.29.0`	devDependencies	minor
lint-staged	`17.1.0` → `17.2.0`	devDependencies	minor
node (source)	`24.18.0` → `24.18.1`		patch
pnpm (source)	`11.15.1` → `11.17.0`	tool-constraint	minor	`11.18.0`
pnpm (source)	`11.15.1` → `11.17.0`	packageManager	minor	`11.18.0`

Release Notes

inversify/monorepo (@inversifyjs/foundation-vitest-config)

`v0.2.1`

Compare Source

Patch Changes

Updated config to exclude fixture files.

eslint/eslint (eslint)

`v10.8.0`

Compare Source

Features

2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
c5963f7 docs: Update README (GitHub Actions Bot)

Chores

4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

webpro-nl/knip (knip)

`v6.29.0`: Release 6.29.0

Compare Source

fix(glob): do not follow symbolic links in async glob (#1900) (b7d5ce2) - thanks @mogelbrod!
Add built-in compiler for tsrx (db05e01)
Fix -u shortcut for --duration (932b926)

`v6.28.0`: Release 6.28.0

Compare Source

Update oxc-resolver (resolve #1889) (1444f6a)
Keep entry-exported members public (resolve #1890) (94967c1)
Don't un-ignore sibling paths on unrelated gitignore negations (resolve #1891) (5c026ba)
Memoize the gitignore shadowed-pattern check (a5fa3b0)
Ignore nested files under a gitignore dir/* pattern (404a53e)
Track types referenced by JSDoc imports (resolve #1888) (6ae48aa)
Update oxc-parser (02ca17a)
feat: markdownlint-cli2 (#1887) (323b96f) - thanks @Zamiell!
Update rolldown snapshot (009e509)
Resolve $GITHUB_ACTION_PATH in GHA composite actions (ead489f)
Don't report node: specifiers as unlisted dependencies (1a7114f)
Discover tsdown CLI entries (0d47a45)
Discover Convex function modules (e01f21c)
Ignore common system binaries (cd00306)
Add OpenClaw plugin (73a2d7d)
Discover Tailwind CLI input stylesheet (resolve #1551) (9ae5fee)
Discover Angular global stylesheets from angular.json (fb9e048)
Hint when project patterns exclude a compiled extension (74de516)
Ignore common global binaries (a99a206)
Run multiple preprocessors in sequence (8443583)
fix(nuxt): resolve nuxt module paths (#1896) (3c8594f) - thanks @danielroe!
Report unused re-exports when ignoreExportsUsedInFile is set (#1895) (a113a5f) - thanks @mlm20!
Pass -w to pnpm add in sentry ecosystem test (ea8c8ac)
Update sentry snapshot (b75768d)
Record all traversed dirs in glob cache (resolve #1897) (81be1d4)
Invalidate glob cache when .gitignore changes (baff301)
Improve Nuxt and Nitro plugin resolution (86ffab7)
fix: don't treat [-]-c[heck] as config flag for prettier (#1902) (b7266ee) - thanks @davidkna-sap!
Use Entra ID to publish VS Code extension (4236253)
Remove obsolete trust policy exclusions (630d5f9)
Update dependencies (810147b)
Migrate from typescript/native-preview to typescript (140a25a)

lint-staged/lint-staged (lint-staged)

`v17.2.0`

Compare Source

Minor Changes

#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
```
/** @&#8203;type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};
```
Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:
```
/** @&#8203;type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};
```

`v17.1.1`

Compare Source

Patch Changes

#1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

nodejs/node (node)

`v24.18.1`: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

Compare Source

This is a security release.

Notable Changes

(CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
(CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
(CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
(CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
(CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
(CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
(CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
(CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
(CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
(CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
(CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
deps: update llhttp to 9.4.3 (Paolo Insogna)
deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

[6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
[bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #64713
[9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
[8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
[a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
[34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
[95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
[fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
[ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
[9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
[6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
[af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
[05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

pnpm/pnpm (pnpm)

`v11.17.0`: pnpm 11.17

Compare Source

Minor Changes

Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #13220.

pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes

The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.
Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #13232.
Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #13164.
Revert script ordering change for pnpm run --sequential /regex/
Support the from-git argument in the pnpm version command.
When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors

Gold Sponsors

`v11.16.0`: pnpm 11.16

Compare Source

Minor Changes

The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.
Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.
Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.
Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:
```
update:
  ignoreDeps: # was updateConfig.ignoreDependencies
    - webpack
    - "@&#8203;babel/*"

audit:
  level: high # was auditLevel
  ignore: # was auditConfig.ignoreGhsas
    - GHSA-xxxx-yyyy-zzzz
```
update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

Fixed pnpm add --save-exact/--save-prefix and pnpm update writing a package's version with the peerDependencies range's prefix (e.g. ^19.2.7 instead of the requested 19.2.7) whenever the same package also appeared in peerDependencies. A real dependencies/devDependencies/optionalDependencies entry now takes precedence over a same-named peerDependencies entry when computing the current specifiers #13108.

Platinum Sponsors

Gold Sponsors

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot requested a review from notaphplover as a code owner July 25, 2026 08:50

renovate Bot force-pushed the renovate/auto-merge-on-patch-or-minor branch from 4a0f75d to c5f9541 Compare July 25, 2026 12:29

renovate Bot changed the title ~~chore: update dependency lint-staged to v17.1.1~~ chore: update auto merge on patch or minor Jul 25, 2026

renovate Bot force-pushed the renovate/auto-merge-on-patch-or-minor branch 6 times, most recently from 01ea4bd to 7690825 Compare July 29, 2026 17:43

chore: update auto merge on patch or minor

ad00d17

renovate Bot force-pushed the renovate/auto-merge-on-patch-or-minor branch from 7690825 to ad00d17 Compare July 29, 2026 21:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: update auto merge on patch or minor - #66

chore: update auto merge on patch or minor#66
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/auto-merge-on-patch-or-minor

renovate Bot commented Jul 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.2.1

Patch Changes

v10.8.0

Features

Bug Fixes

Documentation

Chores

v6.29.0: Release 6.29.0

v6.28.0: Release 6.28.0

v17.2.0

Minor Changes

v17.1.1

Patch Changes

v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @​juanarbol

Notable Changes

Commits

v11.17.0: pnpm 11.17

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.16.0: pnpm 11.16

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 25, 2026 •

edited

Loading

`v0.2.1`

`v10.8.0`

`v6.29.0`: Release 6.29.0

`v6.28.0`: Release 6.28.0

`v17.2.0`

`v17.1.1`

`v24.18.1`: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

`v11.17.0`: pnpm 11.17

`v11.16.0`: pnpm 11.16