chore: update dependencies

[renovate]

Update Request | Renovate Bot

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@vitejs/plugin-vue (source)	6.0.0 -> 6.0.1					devDependencies	patch
@vue-flow/core (source)	1.45.0 -> 1.47.0					dependencies	minor
actions/stale	v9.1.0 -> v10.1.0					action	major
elkjs	^0.10.1 -> ^0.11.0					dependencies	minor
github.com/cosi-project/runtime	v0.10.6 -> v1.12.0					require	major
github.com/grpc-ecosystem/grpc-gateway/v2	v2.26.3 -> v2.27.3					require	minor
github.com/siderolabs/go-api-signature	v0.3.6 -> v0.3.11					require	patch
github.com/siderolabs/omni/client	v0.51.0-beta.1.0.20250721175047-b0f763431000 -> v1.2.1					require	major
github.com/unix4ever/yaml	v0.0.0-20220527175918-f17b0f05cf2c -> v2.4.0					replace	major
golang.org/x/sync	v0.15.0 -> v0.17.0					require	minor
google.golang.org/grpc	v1.72.0 -> v1.76.0					require	minor
google.golang.org/protobuf	v1.36.6 -> v1.36.10					require	patch
tailwindcss (source)	^3.4.17 -> ^4.1.11					devDependencies	patch
vite (source)	7.0.5 -> 7.1.12					devDependencies	minor
vue (source)	3.5.17 -> 3.5.22					dependencies	patch

---

Release Notes

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.1

Bug Fixes

• deps: update all non-major dependencies (#​618) (46f6c99)
• deps: update all non-major dependencies (#​624) (fe03fa2)
• deps: update all non-major dependencies (#​629) (b969637)
• deps: update all non-major dependencies (#​633) (aa56ad1)
• deps: update all non-major dependencies (#​636) (5f471a3)
• hmr: ignore non-js modules (#​625) (f899ad3)

Performance Improvements

• only bundle node version debug (#​627) (9dfa996)

Miscellaneous Chores

• deps: update dependency rollup to ^4.44.2 (#​623) (76bf4c4)
• deps: update dependency rollup to ^4.45.1 (#​630) (4fd92b9)
• group commits by category in changelog (#​620) (1a32018)

Build System

• use tsdown (#​626) (ffac7e1)

bcakmakoglu/vue-flow (@​vue-flow/core)

v1.47.0

Compare Source

Minor Changes

• #​1967 7828f4a Thanks @​bcakmakoglu! - Replace the existing offset option for fitView with a more expressive padding option allowing users to define padding per sides.

v1.46.5

Compare Source

Patch Changes

• #​1962 34bcf36 Thanks @​bcakmakoglu! - Unwrap connection line status ref in the connection line component to correctly append the class name.

v1.46.4

Compare Source

Patch Changes

• #​1954 f4cfc50 Thanks @​bcakmakoglu! - Remove border related styles from the required styles and move them into the default theme stylesheet

v1.46.3

Compare Source

Patch Changes

• #​1942 90cf6ff Thanks @​bcakmakoglu! - Add nullish operator to checkVisibility call

v1.46.2

Compare Source

Patch Changes

• #​1939 f9a5231 Thanks @​bcakmakoglu! - Only emit node position changes if a position change actually occurred.

v1.46.1

Compare Source

Patch Changes

• #​1935 ca54587 Thanks @​bcakmakoglu! - Correctly check if an event listener was bound to the VueFlow component, using for example @node-click or if a listener was bound using the exposed event hooks from useVueFlow when determening if a listener for an event exists at all.

• #​1932 3e0442a Thanks @​bcakmakoglu! - Use toHandle from valid handle check as target handle in ongoing connections

• #​1938 fd785e2 Thanks @​bcakmakoglu! - Prevent multi touch from aborting connections.

• #​1936 ff6b3d2 Thanks @​bcakmakoglu! - Skip resize handler if node is not visible.

v1.46.0

Compare Source

Minor Changes

• #​1923 18d103d Thanks @​bcakmakoglu! - Expose isMacOs utility

• #​1918 0568ab7 Thanks @​bcakmakoglu! - Expose wheelDelta utility fn

• #​1919 6880409 Thanks @​bcakmakoglu! - Use event target for <Handle> components to determine the "clicked" handle, avoiding calls to `getElementFromPoint and allowing "detached" handles

Patch Changes

• #​1922 957d011 Thanks @​bcakmakoglu! - Fetch the correct source and target nodes for isValidConnection.

v1.45.1

Compare Source

Patch Changes

• #​1914 8f65028 Thanks @​bcakmakoglu! - Calculate overlapping area in getNodeIntersections correctly.

• #​1913 5366b56 Thanks @​bcakmakoglu! - Emit node drag-start, drag and drag-end events when a selection is dragged (selectionKeyCode).

• #​1882 742eb98 Thanks @​bcakmakoglu! - Use correct handlesuffix for connection lookup in getHandleConnections action.

actions/stale (actions/stale)

v10.1.0

Compare Source

What's Changed

• Add only-issue-types option to filter issues by type by @​Bibo-Joshi in #​1255

New Contributors

• @​Bibo-Joshi made their first contribution in #​1255

Full Changelog: actions/stale@v10...v10.1.0

v10.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in #​1279
  Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. Release Notes

Enhancement

• Introducing sort-by option by @​suyashgaonkar in #​1254

Dependency Upgrades

• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot[bot] in #​1186
• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in #​1201
• Upgrade @​action/cache from 4.0.0 to 4.0.2 by @​aparnajyothi-y in #​1226
• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​suyashgaonkar in #​1233
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in #​1251
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in #​1277

Documentation changes

• Changelog update for recent releases by @​suyashgaonkar in #​1224
• Permissions update in Readme by @​ghadimir in #​1248

New Contributors

• @​suyashgaonkar made their first contribution in #​1224
• @​GhadimiR made their first contribution in #​1248
• @​gowridurgad made their first contribution in #​1277
• @​salmanmkc made their first contribution in #​1279

Full Changelog: actions/stale@v9...v10.0.0

kieler/elkjs (elkjs)

v0.11.0

Compare Source

Based on ELK 0.11.0

For changes and fixed issues see the release notes.

Full Changelog: kieler/elkjs@0.10.2...0.11.0

cosi-project/runtime (github.com/cosi-project/runtime)

v1.12.0

Compare Source

runtime 1.12.0 (2025-11-03)

Welcome to the v1.12.0 release of runtime!

Please try out the release binaries and report any issues at
https://github.com/cosi-project/runtime/issues.

Contributors

• Dmitriy Matrenichev
• Andrey Smirnov
• Andrey Smirnov
• Artem Chernyshev
• Andrey Smirnov
• dependabot[bot]
• Utku Ozdemir
• Alexey Palazhchenko
• Andrew Rynhard
• Artem Chernyshev
• Andrew Rynhard
• Orzelius
• Philipp Sauter

Changes

293 commits

• b9b3e44 chore: update Go dependencies
• 7dd500a feat: update YAML library
• 10412cb chore: rekres to use our GHA runners
• d76b6e3 refactor: make QRuntime support extended resource attributes
• 23b4690 fix: correct deduplication of watch events
• 40d59e1 chore: update dependencies
• 0fa3a47 fix: set initial watch bookmark on "late watches"
• ccce7a8 fix: fix resource assertion logic and its logging
• bcd981d fix: reduce requirements for the safe.List type
• c2ab79b refactor: split parts of the adapter as owned.State
• 5e5068b feat: move Modify implementation so State
• 1148efe chore: bump dependencies
• 4a631a9 fix: allow any type in the safe.ToSlice and safe.Map methods
• 7b827b7 chore: use resource.Resource as the base type in the safe.List
• 0461ec0 fix: provide more details on buffer overrun mode
• b1de5a5 feat: implement TeardownAndDestroy helper function
• a06b473 feat: allow aliases to be skipped in resource definitions
• a0a8355 feat: add support for ModifyOptions for controllers
• 17de250 fix: invalid error message in safe.List functions
• f3757bc chore: add cached resource metrics
• e6a1237 test: ignore phase conflict errors in the rtestutils.Destory
• 4d20a81 chore: bump deps
• 7e18dd7 chore: bump deps
• 50959ee fix: do not overwrite error in watch retry
• a622beb fix: don't report that we retry context canceled
• badee96 chore: bump deps
• 2d42e3e feat: implement correct watch restart for controller runtime
• eea1d62 fix: fix kv equality check for empty values
• ce09295 chore: bump deps
• 6dd2c2b fix: make inmem bookmarks random for each run
• f4ff7ab chore: bump deps
• 6f0a50c fix: correctly map resources with differrent ns in MapperSameID
• f179603 fix: fix the bug in IgnoreTeardownUntil logic
• de18545 fix: ensure that controller conformance tests work over net too
• aa632ea chore: bump deps
• cf137ef feat: add WithIgnoreTeardownWhile to qtransform controllers
• 5eca531 test: fix a data race in the test
• 3c04d64 feat: support watch bookmarks
• 01bd2dc fix: abort watch correctly for protobuf client
• c0a68e9 fix: skip update only if the conflict error is related to main output
• 8911486 feat: respect custom JSON unmarshaler logic in protobuf resource specs
• 950adb1 chore: bump deps
• a919281 feat: use rangefunc for iterators
• 3fef540 chore: bump Go and deps
• c2910c0 chore: bump deps
• 46a2484 chore: bump deps
• 8662514 test: add parallel destroy test to the conformance suite
• abf3d8f fix: call reset backoff in the cleanup controller
• c7dec62 fix: ignore output not found errors in the cleanup controller
• 923f015 feat: add safe.List.SortFunc
• 1c82e5c feat: export controller-runtime cached state
• 50ebf72 chore: bump deps
• 7ae7edc chore: add two functions to the safe package
• 8acd6b4 feat: add generic task runner
• 690e0b6 chore: replace nested appends with slices.Concat
• e3baf1b fix: update flaky TestHooks test
• f68b7c4 chore: bump deps and remove false lock
• cabdc85 fix: replace naked go statements with errgroup
• c4208da feat: provide an option to skip cache on reads in the controller
• f64ea50 fix: validate QController mapped results
• c97e774 fix: handle non-existent output on DestroyOutputTag
• 15e9d67 feat: add an error tag to destroy outputs
• 2b7f173 chore: replace sync.Map with HashTrieMap
• b2c32a5 chore: bump stuff
• 828a29c chore: bump deps
• 6a660d6 feat: support run and shutdown hooks in the QController
• 84f7352 fix: cancel the Watch context in gRPC stream
• 5f0b368 fix: downgrade grpc library to 1.62.1
• aad9be8 chore: update dependencies
• cb1c250 chore: bump stuff
• 89916dd chore: bump gen
• cb1665b chore: bump deps
• 1418988 feat: implement resource self-destroy controller
• 1c31c46 chore: rekres, update Go to 1.22
• 7c4086a feat: implement ContextWithTeardown method
• 95e9fb6 fix: make RequeueError never push existing items execution time
• bcd68f3 feat: add a new utility method qtransform.WithExtraInput
• 0ce57c7 chore: hide "map" job reconcile events under the debug
• 3bb320b chore: implement "handle-like" resources
• 46e4dc2 chore: add an option to warn about uncached controller reads
• 705330d fix: pass through correctly requeue errors via qtransform
• 3ab41f0 feat: implement controller runtime watch cache
• 582936d fix: push to queue with non-zero timestamp
• de6b8bd fix: use destroy ready input type in CleanupController
• 957b4f7 feat: add more logging for qruntime controllers
• f7efe9a feat: add some new settings for qtransform controller
• 7ab6b55 feat: implement QController and qruntime
• f3840c2 chore: bump deps
• f99da30 chore: drop gRPC controller-runtime connector
• a837431 feat: implement pre/post transform hooks in the Transform controller
• 05e7ad1 feat: allow extra owners in the cleanup controllers
• e22b81e chore: bump deps
• a3f63ed chore: add TransformController specific metrics
• c4ad980 chore: replace State with CoreState in StateWatch and safe.StateWatchKind
• c6658ca chore: bump deps
• af3c857 feat: rework controller read/write metrics
• 9e2c0dd test: implement new assertion type that asserts on a single resource
• b73f420 feat: add ModifyWithResult to controller.Writer interface
• 8601453 feat: expose controller metrics using expvar
• 9eba76a refactor: rewrite dependency database
• a8b17b1 fix: make resource spec wrapper use protojson to unmarshal specs
• 8a0d09b test: even more destroy fixes
• 14cfd68 test: add rtestutils.AssertLength
• dcbd074 test: throttle down rtestutils reports
• c7a41ed refactor: optimize the metadata.Equal for small number of finalizers
• b0f5cb8 test: ignore not found when destroying in rtestutils
• 237e5cb chore: bump deps
• 90f411d feat: support OutputShared for the main res in Transform controller
• 332ffca feat: add on shutdown callback to the transform controller
• 759743f feat: add extra channel support to transform controller
• 7d9bc06 fix: properly handle invert for comparison, when key not found
• 007e522 fix: properly invert numeric < and <= operators
• edb30d0 chore: update stuff
• b5287f3 feat: add support for passing multiple label queries in watch and list
• 756f2f5 chore: update to latest gen module
• 8e15292 feat: introduce new query operators for label selectors
• bf3352f chore: bump deps
• dabd733 feat: allow TransformController to skip over some inputs
• 3ecce15 chore: bump deps
• 74db421 chore: bump kres, generate clone method
• 1413b7d chore: bump deps
• 7e51e27 chore: bump deps
• c7ddf56 chore: bump deps
• cb456df chore: unify all ResourceWithRD as an alias to meta.ResourceWithRD
• c8dfcf2 fix: proper type assertions in xutils.SyncMap
• adb1ed5 chore: add type-safe wrapper around sync.Map
• 2591a0f chore: bump deps
• 3d5e3ea feat: implement label query filter on safe.List
• b5ffb46 chore: bump deps
• 82b69d8 chore: code cleanup
• 6377e5f chore: add more functions to safe and kv pkg
• 470bda7 chore: replace select with channel.* functions
• 40f067b chore: bump deps
• 820e1a8 chore: replace loaded uint64 with atomic.Bool
• 1073185 chore: bump deps
• 5c7c1ad chore: pass compression options to zstd.Encoder
• 05b37ea fix: revert github.com/ProtonMail/gopenpgp/v2 to v2.5.2
• 7229e88 feat: add cleanup controller
• a4dee22 chore: add future package
• 9e5766f chore: bump deps
• 0594daa feat: aggregate WatchKind and watch event deduplication
• 2731ce3 feat: implement compressed resource marshaling
• 4fd36fe chore: bump deps
• 6f54ba7 chore: add Options to AssertResources
• 4107da2 chore: bump deps
• d6f567d chore: bump deps
• 0835d80 chore: tests allocations in LookupExtension
• 260c416 feat: allow finalizer removal func to write resources with extra outputs
• 3873496 feat: allow extra outputs for the transform controller
• e6466f3 fix: drop unused type parameter from typed.Extension type
• 011f8cd chore: extension methods for typed.Resource, simplify ResourceDefinition
• e10d7cb chore: bump deps
• 7bcfd69 chore: bump dependencies
• ae7616c feat: support query on resource IDs
• 548de97 feat: use vtprotobuf optimized proto equality check
• f9fec3b feat: allow transform controller to ignore tearing down inputs
• 54cae17 fix: ignore other resources in rtestutils.Destroy
• 62c3968 fix: restart controllers on panic
• acd6645 chore: bump deps
• 3f88d23 feat: add Set/Has methods to finalizers
• 0f37604 chore: bump go depepencies
• 940e787 chore: remove BeginDestroy and add Teardown
• 46f6f16 fix: always destroy tearing down outputs
• 32ae41c test: fix flaky unit-test
• ac48172 feat: support optional controller change actions rate limiting
• 5cea30e chore: add BeginDestroyAll and BeginDestroy functions
• c43ab5f feat: implement dynamic sizing of history buffer for in-mem resources
• 7f74646 fix: send as many events as possible from one mutex lock
• e40415e fix: report detailed error on buffer overrun
• 2d14105 chore: redo YAML inline as MarshalYAML/UnmarshalYAML instead of the field tag
• d5e5b77 feat: add ResetRestartBackoff method to the controller adapter
• 6b6f4a4 feat: add 'api-resources' as an alias for 'ResourceDefinition' type
• 3ca73af feat: support new Bootstrapped and Errored watch events
• 0aec1ea chore: add SetCreated to resource.Metadata
• 4aeb875 chore: run rekres and bump deps
• eae753f chore: add YAMLResource Resource wrapper
• 5e8f022 refactor: redo proto.RegisterResource with generics
• 8cdb0c5 chore: update dependencies, use siderolabs/go-retry
• d4ab773 chore: remove generic bug workaround
• 66daa4e chore: bump dependencies
• b464585 feat: provide an option to limit inputs for TransformController
• 4d48824 fix: update with conflicts should return new resource
• e8a8fdc feat: add support for no protobuf unmarshaling via gRPC
• 5f1a2fb feat: implement generic (template) transform controller
• d2dceb7 chore: redo error handling in key storage
• [614d051](https://redirect.github.com/cosi-project/ru

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module github.com/siderolabs/[email protected] requires go >= 1.25.2; switching to go1.25.3
go: downloading go1.25.3 (linux/amd64)
go: download go1.25.3: golang.org/[email protected]: verifying module: checksum database disabled by GOSUMDB=off