fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #2054 · HarperFast/harper

renovate · 2026-08-03T07:46:09Z

This PR contains the following updates:

Package	Change	Type	Update	Pending
@aws-sdk/client-s3 (source)	`3.1090.0` → `3.1096.0`	dependencies	minor	`3.1102.0` (+5)
@aws-sdk/lib-storage (source)	`3.1090.0` → `3.1096.0`	dependencies	minor	`3.1102.0` (+5)
@fastify/autoload	`6.4.0` → `6.5.0`	dependencies	minor
@harperfast/skills (source)	`1.11.0` → `1.11.1`	dependencies	patch	`1.12.0`
@modelcontextprotocol/sdk (source)	`1.29.0` → `1.30.0`	devDependencies	minor
@typescript-eslint/parser (source)	`8.64.0` → `8.65.0`	devDependencies	minor	`8.66.0`
actions/checkout	`v6.0.3` → `v6.1.0`	action	minor
actions/checkout	`v7.0.0` → `v7.0.1`	action	patch
actions/setup-node	`v6.4.0` → `v6.5.0`	action	minor
docker/login-action	`v4.4.0` → `v4.5.1`	action	minor	`v4.6.0` (+1)
fs-extra	`11.3.6` → `11.4.0`	dependencies	minor
globals	`17.7.0` → `17.8.0`	devDependencies	minor	`17.9.0`
node (source)	`24.18.0` → `24.18.1`		patch	`v24.19.0`
node-stream-zip	`1.15.0` → `1.16.0`	dependencies	minor
oxlint (source)	`1.74.0` → `1.76.0`	devDependencies	minor	`1.77.0`
prettier (source)	`3.9.5` → `3.9.6`	devDependencies	patch
systeminformation (source)	`5.33.0` → `5.33.1`	dependencies	patch
tar-stream	`3.1.8` → `3.2.0`	dependencies	minor
typescript-eslint (source)	`8.64.0` → `8.65.0`	devDependencies	minor	`8.66.0`
undici (source)	`7.28.0` → `7.29.0`	devDependencies	minor

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

aws/aws-sdk-js-v3 (@aws-sdk/client-s3)

`v3.1096.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-s3

`v3.1095.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-s3

`v3.1094.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-s3

`v3.1093.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-s3

`v3.1092.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-s3

`v3.1091.0`

Compare Source

Note: Version bump only for package @aws-sdk/client-s3

aws/aws-sdk-js-v3 (@aws-sdk/lib-storage)

`v3.1096.0`

Compare Source

Note: Version bump only for package @aws-sdk/lib-storage

`v3.1095.0`

Compare Source

Note: Version bump only for package @aws-sdk/lib-storage

`v3.1094.0`

Compare Source

Note: Version bump only for package @aws-sdk/lib-storage

`v3.1093.0`

Compare Source

Note: Version bump only for package @aws-sdk/lib-storage

`v3.1092.0`

Compare Source

Note: Version bump only for package @aws-sdk/lib-storage

`v3.1091.0`

Compare Source

Note: Version bump only for package @aws-sdk/lib-storage

fastify/fastify-autoload (@fastify/autoload)

`v6.5.0`

Compare Source

What's Changed

chore(deps): bump oven-sh/setup-bun from 2.1.2 to 2.2.0 by @dependabot[bot] in #501
chore(deps): bump denoland/setup-deno from 2.0.3 to 2.0.4 by @dependabot[bot] in #500
ci: pin actions to commit-hash by @Fdawgs in #522
ci: update dependabot.yml by @Tony133 in #525
fix: add opt-in appendAutoPrefix for directory auto prefixes by @SergioChan in #498

Full Changelog: fastify/fastify-autoload@v6.4.0...v6.5.0

HarperFast/skills (@harperfast/skills)

`v1.11.1`

Compare Source

Bug Fixes

release: consolidate release config so all commit types surface in notes (c71a709)

modelcontextprotocol/typescript-sdk (@modelcontextprotocol/sdk)

`v1.30.0`

Compare Source

typescript-eslint/typescript-eslint (@typescript-eslint/parser)

`v8.65.0`

Compare Source

🚀 Features

add warning when TS 7 is detected (#12529)
parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

Evyatar Daud @StyleShit
Josh Goldberg ✨
Kirk Waiblinger @kirkwaiblinger
송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

actions/checkout (actions/checkout)

`v6.1.0`

Compare Source

actions/setup-node (actions/setup-node)

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

docker/login-action (docker/login-action)

`v4.5.1`

Compare Source

`v4.5.0`

Compare Source

jprichardson/node-fs-extra (fs-extra)

`v11.4.0`

Compare Source

Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#925, #1076)

sindresorhus/globals (globals)

`v17.8.0`

Compare Source

Update globals (2026-07-01) (#347) 7394811

nodejs/node (node)

`v24.18.1`: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

Compare Source

This is a security release.

Notable Changes

(CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
(CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
(CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
(CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
(CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
(CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
(CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
(CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
(CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
(CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
(CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
deps: update llhttp to 9.4.3 (Paolo Insogna)
deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

[6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
[bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #64713
[9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
[8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
[a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
[34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
[95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
[fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
[ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
[9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
[6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
[af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
[05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

antelle/node-stream-zip (node-stream-zip)

`v1.16.0`

Compare Source

+ fixed reading compressed entry size to prevent exploitation reported by @DumDumSu
* updated dependencies

oxc-project/oxc (oxlint)

`v1.76.0`

Compare Source

🚀 Features

8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)
016cf2a linter/oxc: Add bad-match-all-arg rule (#24900) (camc314)
cdc941e linter/n: Implement exports-style rule (#24087) (Mikhail Baev)
1ad6f6c linter/eslint: Implement id-denylist rule (#24632) (Mikhail Baev)

📚 Documentation

3ff2e0e linter: Clarify config extends types (#24936) (Boshen)

`v1.75.0`

Compare Source

🚀 Features

dd18383 linter/node: Implement no-top-level-await rule (#24634) (Connor Shea)
16a65f2 linter/react: Implement function-component-definition rule (#24471) (Cole Ellison)
7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#24519) (Mikhail Baev)
99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#24502) (camc314)

🐛 Bug Fixes

8694167 linter/eslint/prefer-destructuring: Handle typed declarations (#24616) (camc314)

prettier/prettier (prettier)

`v3.9.6`

Compare Source

sebhildebrandt/systeminformation (systeminformation)

`v5.33.1`

Compare Source

Full Changelog: sebhildebrandt/systeminformation@v5.33.0...v5.33.1

mafintosh/tar-stream (tar-stream)

`v3.2.0`

Compare Source

`v3.1.9`

Compare Source

typescript-eslint/typescript-eslint (typescript-eslint)

`v8.65.0`

Compare Source

🚀 Features

add warning when TS 7 is detected (#12529)

❤️ Thank You

Josh Goldberg ✨
Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

nodejs/undici (undici)

`v7.29.0`

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "before 9am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-08-03T07:47:00Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@typescript-eslint/parser@8.64.0 ⏵ 8.65.0			⁺¹
typescript-eslint@8.64.0 ⏵ 8.65.0			⁺¹
@harperfast/skills@1.11.0 ⏵ 1.11.1
node-stream-zip@1.16.0
tar-stream@3.1.8 ⏵ 3.2.0	⁺¹
@aws-sdk/lib-storage@3.1090.0 ⏵ 3.1096.0	⁺¹
systeminformation@5.33.0 ⏵ 5.33.1	⁺¹			^-1
globals@17.7.0 ⏵ 17.8.0	⁺¹		⁺¹	^-1
oxlint@1.74.0 ⏵ 1.76.0				⁺¹
fs-extra@11.3.6 ⏵ 11.4.0	⁺¹
undici@7.28.0 ⏵ 7.29.0		⁺²¹	⁺¹
@fastify/autoload@6.4.0 ⏵ 6.5.0				⁺³
@modelcontextprotocol/sdk@1.29.0 ⏵ 1.30.0	⁺¹
prettier@3.9.5 ⏵ 3.9.6			⁺¹
@aws-sdk/client-s3@3.1090.0 ⏵ 3.1096.0	⁺¹

View full report

github-actions Bot requested review from Ethan-Arrowood, cb1kenobi, heskew and kriszyp August 3, 2026 07:46

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from dfff082 to 5f40b6c Compare August 3, 2026 12:16

kriszyp approved these changes Aug 3, 2026

View reviewed changes

renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 4e41eb2 to 70c4dd0 Compare August 3, 2026 22:12

fix(deps): update all non-major dependencies

22b3e64

renovate Bot force-pushed the renovate/all-minor-patch branch from 70c4dd0 to 22b3e64 Compare August 4, 2026 02:51

kriszyp merged commit 6cb4858 into main Aug 4, 2026
45 checks passed

kriszyp deleted the renovate/all-minor-patch branch August 4, 2026 03:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update all non-major dependencies - #2054

fix(deps): update all non-major dependencies#2054
kriszyp merged 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Bug Fixes

🚀 Features

❤️ Thank You

What's Changed

v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @​juanarbol

Notable Changes

Commits

🚀 Features

📚 Documentation

🚀 Features

🐛 Bug Fixes

🚀 Features

❤️ Thank You

What's Changed

Configuration

Uh oh!

socket-security Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 3, 2026 •

edited

Loading

`v24.18.1`: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

socket-security Bot commented Aug 3, 2026 •

edited

Loading