chore(deps): update dev tooling - #348
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
chore
renovate
Bot
force-pushed
the
renovate/dev-tooling
branch
from
September 10, 2026 20:27
8115af1 to
e5d7479
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/dev-tooling
branch
12 times, most recently
from
September 17, 2026 22:15
9917143 to
c574637
Compare
renovate
Bot
force-pushed
the
renovate/dev-tooling
branch
6 times, most recently
from
September 24, 2026 23:28
1286ca7 to
576d808
Compare
renovate
Bot
force-pushed
the
renovate/dev-tooling
branch
from
September 25, 2026 11:32
576d808 to
f57a35d
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.62.3→v2.63.0v4.558.1→v4.567.02.36.42→2.37.3v1.16.2→v1.16.4v3.14.0→v3.15.0Release Notes
aquaproj/aqua (aquaproj/aqua)
v2.63.0Compare Source
Security
Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host
tar, applying none of its own path or symlink containment. On hosts whosetarfollows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the systemtarout of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.Features
#5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times
Fixes
#5237 Skip minisign verification if the host platform doesn't support minisign
#5188 Ignore incomplete release assets in aqua gr
#5178 Support files[].src in go_install packages
#5171 Extract 7z archives that use the ARM64 filter
#5161 signer_workflow is a literal path, not a regex
Others
#5239 Fix Dockerfile build failure caused by a stale apt package index
aquaproj/aqua-registry (aquaproj/aqua-registry)
v4.567.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.566.0...v4.567.0
🎉 New Packages
#61157 UsefulSoftwareCo/executor: Connect AI agents to OpenAPI, MCP, and GraphQL services @casparbreloh
Security
#61326 utkuozdemir/pv-migrate: Configure Cosign @scop
#61287 open-policy-agent/conftest: Configure GitHub Artifact Attestations @yumafuu
Pin the source repository and tag in the cosign verification
Fixes
#61277 mgechev/revive: Rename the package to revive-lint/revive
The GitHub Repository of the package "mgechev/revive" was transferred from mgechev/revive to revive-lint/revive
#61273 TomWright/dasel: Use the native darwin/arm64 assets from v1.26.1 @cj81499
#61302 YS-L/csvlens: Support linux/arm64
v4.566.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.565.0...v4.566.0
🎉 New Packages
#61061 aquaproj/ar2: CLI for aqua registry g2
Fixes
#61055 XcodesOrg/xcodes: Remove a version_override that is never read
#61017 nodejs/node: Don't offer the arm64 musl build where it doesn't exist
#60962 Wilfred/difftastic: support difftastic v0.71.0 or later
Refactoring
#61018 aubepkg/aube: Exclude the shared libraries from the inference
v4.565.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.564.0...v4.565.0
🎉 New Packages
#60801 robgonnella/releasaurus - A comprehensive release automation tool that streamlines the software release process across multiple programming languages and forge platforms @robgonnella
#60983 nubjs/nub - The fast all-in-one Node.js toolkit
v4.564.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.563.0...v4.564.0
🎉 New Packages
#60759 floci-io/floci-cli - Official command-line interface for Floci @yuriy-yarosh
#60762 robgonnella/minienv - Effortless remote mini environments generated directly from docker compose config @robgonnella
Security
#60761 regclient/regclient/regbot: cosign config @scop
v4.563.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.562.0...v4.563.0
🎉 New Packages
#60699 grafana/agento11y - Actually Useful Agent Observability @zeitlinger
#60681 boyter/cs - Code search tool with CLI, TUI, MCP and HTTP support that requires no indexing @Crocmagnon
Fixes
#60720 ImageMagick/ImageMagick: Support windows/arm64 @Marukome0743
#60655 Byron/dua-cli: Install native arm64 assets on macOS and Windows @sassdavid
Security
#60698 dprint/dprint: GitHub artifact attestations config @scop
v4.562.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.561.0...v4.562.0
🎉 New Packages
#60610 microsoft/tgrep - Trigram-indexed grep with a client/server architecture for fast regex search in large codebases locally @sh1Nome
v4.561.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.560.0...v4.561.0
🎉 New Packages
#60566 kjanat/actionlint - Find problems in your GitHub Actions workflows @kjanat
#60568 redhat-et/ripwire - A zero-dependency CLI and MCP server for finding context in codebases @s0undt3ch
Fixes
#60555 yadm-dev/yadm: Resolve versions from GitHub tags @Susensio
#60567 minio/mc: Download assets from GitHub Releases as dl.min.io returns 410 @jdx
v4.560.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.559.0...v4.560.0
🎉 New Packages
#60499 getgaal/gaal - A single CLI to keep your local repositories, AI agent skills, and MCP server configurations in sync @Crocmagnon
#60412 openai/tunnel-client - Customer-run client for Secure MCP Tunnel: connect private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit without exposing them to the public internet @the9ball
#60401 yarnpkg/zpm - Safe, stable, reproducible projects (Yarn v6) @joealden
v4.559.0Compare Source
Issues | Pull Requests | aquaproj/aqua-registry@v4.558.0...v4.559.0
🎉 New Packages
#60259 yadm-dev/yadm - Yet Another Dotfiles Manager @Susensio
#60216 nklmilojevic/sofka - A Kubernetes TUI, reimagined in Rust - built on kube-rs and ratatui, async-first from the ground up @tomvoet
#60119 unikraft-cloud/cli - Command-line interface for Unikraft Cloud @garysassano
#60118 unikraft/kraftkit - Build and use highly customized and ultra-lightweight unikernel VMs @garysassano
#60117 esengine/DeepSeek-Reasonix - DeepSeek-native AI coding agent for the terminal @garysassano
Renamed Packages
#59966 Rename rancher/rke to rancher-archives/rke
#60258 Rename jdx/aube to aubepkg/aube, and follow the signer workflow change @jdx
#60374 Rename jamf/Notifier to Jamf-Concepts/Notifier
Security
#59984 charmbracelet/gum: cosign config @scop
#60039 gopasspw/gopass: cosign config @scop
#60046 masasuzu/clrnd: cosign config @scop
Fixes
#60003 sharkdp/fd: macOS Intel is supported again from v10.5.0
#60104 pnpm/pnpm: macOS Intel is supported from v12.0.0 @arianrhodsandlot
#60131 editorconfig-checker/editorconfig-checker: Follow the binary rename and the universal macOS build in 4.0.0 @sarahhodne
#60283 Byron/dua-cli: Exclude dua-core tags from versions @jdx
aws/aws-cli (aws/aws-cli)
v2.37.3Compare Source
v2.37.2Compare Source
v2.37.1Compare Source
v2.37.0Compare Source
v2.36.50Compare Source
v2.36.49Compare Source
v2.36.48Compare Source
v2.36.47Compare Source
v2.36.46Compare Source
v2.36.45Compare Source
v2.36.44Compare Source
v2.36.43Compare Source
hashicorp/terraform (hashicorp/terraform)
v1.16.4Compare Source
1.16.4 (September 23, 2026)
BUG FIXES:
Fixed an issue where Terraform fails when rendering policy evaluation outcomes for older versions of Terraform Enterprise (#39095)
stacks: Fix invalid deferred error triggered by provider returning a deferral when a resource also has an unknown count/for_each. (#39237)
v1.16.3Compare Source
1.16.3 (September 16, 2026)
BUG FIXES:
Fix handling of destroy=false around create_before_destroy instances (#39169)
Fix function result comparison when there are multiple marks (#39170)
Filter logic for marks could cause values with multiple marks to erroneously fail validations (#39171)
Fix issue with import provider resolution (#39185)
prometheus/prometheus (prometheus/prometheus)
v3.15.0: 3.15.0 / 2026-09-24Compare Source
endwas not aligned tostepcaused subqueries inside it to evaluate past the parent's last actual step, inflatingpeakSamplesin the query stats and against thequery.max-sampleslimit, and wasting storage I/O reading samples that were never used in the result. Add tests to prevent regression of the fix made in #18081. #18598--log.level; useruntime.log_levelconfiguration to supply the default level. #19511runtime.log_levelon configuration reload. #19511--auto-gomemlimit.refresh-intervalflag to periodically re-detect the container or system memory limit and updateGOMEMLIMITat runtime. #18843__meta_docker_container_imageand__meta_docker_container_image_id. #19386--enable-feature=st-storageflag now automatically enables XOR2 float chunk encoding and ST-capable histogram chunk encoding, so you no longer need to passxor2-encodingandhistograms-st-encodingalongside it. #19518session_nameandtagsfields for STS AssumeRole sessions. The previously undocumentedservice_namefield is now also documented. #19569zstd-scrape. #19502--enable-feature=xor2-encodingis deprecated; usestorage.tsdb.chunk_encoding.floats: xor2instead. Check that other software reading the TSDB directly (e.g. Thanos sidecar) supports XOR2 before enabling. #19461prometheus_tsdb_head_appenders_created_totalmetric. #19411_countand_sumseries in scrape appender v2. #19323prometheus_tsdb_head_series_pending_commit_underflow_totalto report pending-sample reservation underflows. #19470request_concurrency. #19506info()enrichment for composite expressions with mixed@/offset references or selector-free vector branches, preventing metadata from being evaluated at an unrelated timestamp. #19387request_concurrencyinstead of hanging service discovery indefinitely. #19524prometheus_sd_last_update_timestamp_secondsseries for a config that is removed on reload. #19131DetectResetno longer misses a counter reset when a populated bucket behind an empty one disappears, which could make histogramrate()/increase()undercount. #19367.*\|(foo)\|.*). #19516anchoredorsmoothedmodifier when the selected series has no samples inside the query window, for example a query evaluated inside a scrape gap. #19431@is used as the matrix argument of a call that is not step-invariant (for examplequantile_over_time(scalar(x), metric[...:...] @ T)). #19187@ start()/@ end()before range selectors, matching the existing rejection of literal offsets and@ <timestamp>. #19406histogram_quantileandhistogram_fraction. #19330firstOOOChunkIDmodulo 2^23 instead of growing unbounded. #19216__meta_kubernetes_service_loadbalancer_ipfromstatus.loadBalancer.ingress, falling back to deprecatedspec.loadBalancerIP. #19404tsdb dumpsilently dropping native histogram samples. #18051Manager.TargetsDroppedCountsto avoid miscounting dropped targets. #19304Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.