⬆️ Update all non-major dependencies#486

Open

renovate[bot] wants to merge 1 commit intomasterfrom

renovate/all-minor-patch

Contributor

renovate bot commented Aug 19, 2025 •

edited

Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/cache (changelog)	action	digest	`0400d5f` → `0057852`
actions/checkout (changelog)	action	digest	`08eba0b` → `34e1148`
biomejs/setup-biome (changelog)	action	digest	`454fa0d` → `4c91541`
cors	dependencies	patch	`2.8.5` → `2.8.6`
docker/build-push-action (changelog)	action	digest	`2634353` → `10e90e3`
docker/login-action (changelog)	action	digest	`184bdaa` → `c94ce9f`
docker/metadata-action (changelog)	action	digest	`c1e5197` → `c299e40`
docker/setup-buildx-action (changelog)	action	digest	`e468171` → `8d2750c`
dotenv	dependencies	minor	`17.2.1` → `17.3.1`
express (source)	dependencies	minor	`5.1.0` → `5.2.1`
express-rate-limit	dependencies	minor	`8.0.1` → `8.3.1`
pino (source)	dependencies	minor	`9.9.0` → `9.14.0`
pino-pretty	devDependencies	patch	`13.1.1` → `13.1.3`
pnpm (source)	packageManager	minor	`10.14.0` → `10.32.1`
pnpm (source)		minor	`10.14.0` → `10.32.1`
pnpm/action-setup (changelog)	action	digest	`a7487c7` → `fc06bc1`
tsup (source)	devDependencies	patch	`8.5.0` → `8.5.1`
tsx (source)	devDependencies	minor	`4.20.4` → `4.21.0`

Release Notes

expressjs/cors (cors)

`v2.8.6`

==================

Improve documentation (API, context, examples...)
Remove additional markdown files from tarball

motdotla/dotenv (dotenv)

`v17.3.1`

Changed

Fix as2 example command in README and update spanish README

`v17.3.0`

Added

Add a new README section on dotenv’s approach to the agentic future.

Changed

Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

`v17.2.4`

Changed

Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

`v17.2.3`

Changed

Fixed typescript error definition (#912)

`v17.2.2`

Added

🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.

expressjs/express (express)

`v5.2.1`

=======================

Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

`v5.2.0`

========================

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
deps: body-parser@^2.2.1
A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

express-rate-limit/express-rate-limit (express-rate-limit)

`v8.3.1`

You can view the changelog here.

`v8.3.0`

You can view the changelog here.

`v8.2.2`

`v8.2.1`

You can view the changelog here.

`v8.2.0`

You can view the changelog here.

`v8.1.1`

`v8.1.0`

You can view the changelog here.

`v8.0.2`

pinojs/pino (pino)

`v9.14.0`

What's Changed

feat(types): add LogFnFields by @samchungy in #2254
[v9.x] Update to pinojs redact by @mcollina in #2322
Revert setlevel opt in 9.x by @mcollina in #2323

Full Changelog: pinojs/pino@v9.13.1...v9.14.0

`v9.13.1`

What's Changed

fix(log): better logfn handling of generics by @rozzilla in #2309

Full Changelog: pinojs/pino@v9.13.0...v9.13.1

`v9.13.0`

What's Changed

build(deps): bump actions/checkout from 4.3.0 to 5.0.0 by @dependabot[bot] in #2301
build(deps): bump actions/github-script from 7 to 8 by @dependabot[bot] in #2303
build(deps-dev): bump @yao-pkg/pkg from 6.3.0 to 6.7.0 by @dependabot[bot] in #2306
perf: optimize .child by @ronag in #2300
docs(ecosystem): add eslint-plugin-pino to ecosystem page by @orzarchi in #2297

New Contributors

@ronag made their first contribution in #2300
@orzarchi made their first contribution in #2297

Full Changelog: pinojs/pino@v9.12.0...v9.13.0

`v9.12.0`

What's Changed

types: expose stdTimeFunctions on nested namespace pino while preserv… by @tawseefnabi in #2263
test: exclude Windows + Node 18.18 from test matrix by @aryamohanan in #2292
Replace fast-redact with slow-redact by @mcollina in #2298

New Contributors

@tawseefnabi made their first contribution in #2263

Full Changelog: pinojs/pino@v9.11.0...v9.12.0

`v9.11.0`

What's Changed

feat: added timestamp rfc3339 format with nanoseconds by @edge33 in #2251
fix: gracefully handle missing diagChannel.tracingChannel on Node < 18.19 by @aryamohanan in #2290

New Contributors

@edge33 made their first contribution in #2251
@aryamohanan made their first contribution in #2290

Full Changelog: pinojs/pino@v9.10.0...v9.11.0

`v9.10.0`

What's Changed

docs: Move pino-logflare out of legacy transports list by @kamilogorek in #2283
Add support for Pear and Bare runtimes by @yassernasc in #2278
Add tracing channels by @jsumners-nr in #2281
Add pino-console to ecoystem page by @mcollina in #2288

New Contributors

@kamilogorek made their first contribution in #2283
@yassernasc made their first contribution in #2278
@jsumners-nr made their first contribution in #2281

Full Changelog: pinojs/pino@v9.9.5...v9.10.0

`v9.9.5`

What's Changed

fix: allow object type in %s placeholder by @mcollina in #2277

Full Changelog: pinojs/pino@v9.9.4...v9.9.5

`v9.9.4`

What's Changed

fix(logfn): use unknown type by @rozzilla in #2276

Full Changelog: pinojs/pino@v9.9.3...v9.9.4

`v9.9.3`

What's Changed

fix(types): compatibility when leveraging parameters by @rozzilla in #2273

New Contributors

@rozzilla made their first contribution in #2273

Full Changelog: pinojs/pino@v9.9.2...v9.9.3

`v9.9.2`

What's Changed

Avoid setLevel in child when possible by @mcollina in #2271

Full Changelog: pinojs/pino@v9.9.1...v9.9.2

`v9.9.1`

What's Changed

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #2268
build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in #2269
fix: TypeScript regression with boolean values in %s placeholders by @mcollina in #2262

Full Changelog: pinojs/pino@v9.9.0...v9.9.1

pinojs/pino-pretty (pino-pretty)

`v13.1.3`

What's Changed

Add in the README file a snippet to use pino-pretty only for dev by @himito in #623
build(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #626
build(deps-dev): bump borp from 0.20.2 to 0.21.0 by @dependabot[bot] in #627
build(deps-dev): bump pino from 9.14.0 to 10.1.0 by @dependabot[bot] in #628
build(deps): bump pino-abstract-transport from 2.0.0 to 3.0.0 by @dependabot[bot] in #629
Update format-time.js documentation to match functionality by @g-sanner in #632
build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #636
build(deps): bump fast-copy from 3.0.2 to 4.0.0 by @dependabot[bot] in #637
fix: messageFormat print 0 value by @gutenye in #635

New Contributors

@himito made their first contribution in #623
@g-sanner made their first contribution in #632
@gutenye made their first contribution in #635

Full Changelog: pinojs/pino-pretty@v13.1.2...v13.1.3

`v13.1.2`

What's Changed

build(deps-dev): bump typescript from 5.8.3 to 5.9.2 by @dependabot[bot] in #609
build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #621
build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in #622
fix: allow esm import for isColorSupported by @JoeCap08055 in #616
Use neostandard and remove pre-commit by @jsumners in #624
fix: missing property on objectColorizer by @IronGeek in #625

New Contributors

@JoeCap08055 made their first contribution in #616
@IronGeek made their first contribution in #625

Full Changelog: pinojs/pino-pretty@v13.1.1...v13.1.2

pnpm/pnpm (pnpm)

`v10.32.1`: pnpm 10.32.1

Patch Changes

Fix a regression where pnpm-workspace.yaml without a packages field caused all directories to be treated as workspace projects. This broke projects that use pnpm-workspace.yaml only for settings (e.g. minimumReleaseAge) without defining workspace packages #10909.

Platinum Sponsors

Gold Sponsors

`v10.32.0`: pnpm 10.32

Minor Changes

Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #10136.

Patch Changes

Reverted change related to setting explicitly the npm config file path, which caused regressions.
Reverted fix related to lockfile-include-tarball-url. Fixes #10915.

Platinum Sponsors

Gold Sponsors

`v10.31.0`

`v10.30.3`

`v10.30.2`

`v10.30.1`: pnpm 10.30.1

Patch Changes

Use the /-/npm/v1/security/audits/quick endpoint as the primary audit endpoint, falling back to /-/npm/v1/security/audits when it fails #10649.

Platinum Sponsors

Gold Sponsors

`v10.30.0`: pnpm 10.30

Minor Changes

pnpm why now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.

Patch Changes

Revert pnpm why dependency pruning to prefer correctness over memory consumption. Reverted PR: #7122.
Optimize pnpm why and pnpm list performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #10596.

Platinum Sponsors

Gold Sponsors

`v10.29.3`

`v10.29.2`

`v10.29.1`: pnpm 10.29.1

Minor Changes

The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
Support configuring auditLevel in the pnpm-workspace.yaml file #10540.
Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #10436.

Patch Changes

Fixed pnpm list --json returning incorrect paths when using global virtual store #10187.
Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #10290.
Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.
Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #10176.
Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #10281.
Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #10460.
Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #10540.
update tar to version 7.5.7 to fix security issue

Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842
Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #10325.
Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #10271.
pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #10561.
Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #10457.

Platinum Sponsors

Gold Sponsors

`v10.28.2`: pnpm 10.28.2

Patch Changes

Security fix: prevent path traversal in directories.bin field.
When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.
Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

`v10.28.1`

`v10.28.0`

`v10.27.0`

`v10.26.2`: pnpm 10.26.2

Patch Changes

Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #10307.
Fix installation of Git dependencies using annotated tags #10335.

Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the ac

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot added the dependencies label

renovate bot force-pushed the renovate/all-minor-patch branch from 3b90d0c to 2ec52f3 Compare

August 24, 2025 06:10

renovate bot changed the title ~~⬆️ Update pnpm to v10.15.0~~ ⬆️ Update all non-major dependencies

renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from be19934 to 1e57306 Compare

September 5, 2025 18:09

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 6903a5b to 83e9ca4 Compare

September 13, 2025 21:59

renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 9f682e2 to 5a4debf Compare

September 24, 2025 14:31

renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 0de0403 to d2230c2 Compare

October 2, 2025 16:49

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from cf4fea8 to 358c0df Compare

October 10, 2025 02:25

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 5260e71 to 8d64716 Compare

October 14, 2025 10:53

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 070965b to 48ad60c Compare

October 22, 2025 01:42

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from c1e2f33 to adc14eb Compare

December 1, 2025 21:47

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 0ed4940 to 9dd1ab8 Compare

December 15, 2025 13:38

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 505d04e to 2f82a36 Compare

December 23, 2025 17:06

renovate bot force-pushed the renovate/all-minor-patch branch from 2f82a36 to 089cb22 Compare

December 31, 2025 01:49

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from ba8b4f3 to 79c9bbb Compare

January 11, 2026 00:36

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from ba33824 to d65e1fd Compare

January 22, 2026 17:46

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from f90b303 to 63ac322 Compare

January 28, 2026 14:55

renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 1f38638 to c042db9 Compare

February 12, 2026 20:50

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 083a2da to 6ba7ffb Compare

February 17, 2026 20:57

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from d9e3c0d to 3c78f8c Compare

February 26, 2026 11:12

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 7b271fa to 2991429 Compare

March 9, 2026 18:40


          ⬆️ Update all non-major dependencies

a9994d2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels