[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[GraemeF]

Held until 2026-11-03 00:50Z.

Every move in this refresh is younger than the repo's seven-day minimumReleaseAge, so a trim would leave nothing to merge. The cutoff at review was 2026-10-26 03:15Z. The head also fails nix flake check, because pluginModules' fixed-output hash did not move with plugin/bun.lock.

Lock	Young releases (published)
Cargo.lock	rustix 1.1.6 (10-27), unicode-width 0.2.3 (10-28), ctutils 0.4.7 (10-29), js-sys and wasm-bindgen 0.130 (10-30), pulldown-cmark 0.13.6 (10-30), log 0.4.35 (10-30), signal-hook 0.4.6 (10-31), pest 2.9.5 (10-26 12:54Z), which pulls in pest_stack_guard 1.0.0
plugin/bun.lock	@types/node 26.6.6 (10-28), encodeurl 2.0.1 (10-28), qs 6.17.1 (10-28), redis 6.3.1 (10-29), express-rate-limit 8.7.2 (10-29), ws 8.22.1 (10-31), hono 4.13.16 (11-01), jose 6.2.15 (11-01)
flake.lock	nixpkgs 1c89083 (10-30), crane 4866304 (11-01)

The hold ends when rustix 1.1.6, the oldest move, turns seven days old. The branch will then be trimmed afresh to releases at least seven days old, with the hash moved in the same commit, and reviewed.

[GraemeF]

Review: trimmed to releases at least seven days old, then reviewed.

The hold for rustix 1.1.6 has ended. The cutoff is 2026-10-27 03:14Z, which is the repo's seven-day minimumReleaseAge and stricter than the merge rule's three days. The trim commit rebuilds each lock from main and keeps only the moves that are old enough. No version between main's and Renovate's is old enough for any of the young packages, so each of them stays at main's version.

Lock	Moves kept (published)	Pinned back to main
Cargo.lock	pest, pest_derive, pest_generator and pest_meta 2.9.4 → 2.9.5 (10-26), pest_stack_guard 1.0.0 added (10-26), rustix 1.1.5 → 1.1.6 (10-27 00:49Z)	ctutils 0.4.7, js-sys and wasm-bindgen 0.2.130, log 0.4.35, pulldown-cmark 0.13.6, signal-hook 0.4.6, unicode-width 0.2.3 (all 10-28 or later)
plugin/bun.lock	none	redis 6.3.1, @types/node 26.6.6, encodeurl 2.0.1, express-rate-limit 8.7.2, hono 4.13.16, jose 6.2.15, qs 6.17.1, ws 8.22.1 (all 10-28 or later)
flake.lock	none	crane 4866304 (11-01) and nixpkgs 1c89083 (10-30) stay at main's revs

The bun lock is back to main's, so pluginModules' fixed-output hash needs no move. Renovate's head failed nix flake check only because that hash did not move with its bun lock.

What the kept moves change:

• pest 2.9.5 makes its stacker-based stack guard opt-in on non-native targets, so it no longer needs a C toolchain there. The guard moved into the new pest_stack_guard crate. pest reaches the lock only through termwiz, a ratatui backend this crate does not enable, so none of it is compiled into bdi.
• rustix 1.1.6 fixes GHSA-jh2m-fhpj-3vr7, a high-severity soundness bug in xattr buffer handling on zero-size queries. It also carries platform fixes for Android, Apple fallocate, FreeBSD, 32-bit UID syscalls and termios flags. rustix reaches bdi through crossterm's terminal handling, which never calls the xattr functions.

None of these moves changes authentication, networking, storage or a setting the repo uses. No major version moves, and the devshell's tools from nixpkgs do not move.

nix flake check passes locally on the trimmed tree.