Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 20, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update
@chainsafe/libp2p-yamux ^7.0.1 -> ^8.0.0 age adoption passing confidence dependencies major
@libp2p/interface (source) ^2.6.1 -> ^3.0.0 age adoption passing confidence dependencies major
@typescript-eslint/eslint-plugin (source) 8.44.0 -> 8.46.0 age adoption passing confidence devDependencies minor
@typescript-eslint/parser (source) 8.44.0 -> 8.46.0 age adoption passing confidence devDependencies minor
actions/dependency-review-action v4.7.3 -> v4.8.0 age adoption passing confidence action minor
esbuild 0.25.9 -> 0.25.10 age adoption passing confidence devDependencies patch
eslint (source) 9.35.0 -> 9.37.0 age adoption passing confidence devDependencies minor
github.com/evanw/esbuild v0.25.9 -> v0.25.10 age adoption passing confidence require patch
github.com/golangci/golangci-lint/v2 v2.4.0 -> v2.5.0 age adoption passing confidence require minor
github.com/libp2p/go-libp2p v0.43.0 -> v0.44.0 age adoption passing confidence require minor
github/codeql-action v3.30.3 -> v4.30.7 age adoption passing confidence action major
google.golang.org/protobuf v1.36.9 -> v1.36.10 age adoption passing confidence require patch
lint-staged 16.1.6 -> 16.2.3 age adoption passing confidence devDependencies minor
tsx (source) 4.20.5 -> 4.20.6 age adoption passing confidence devDependencies patch
typescript (source) 5.9.2 -> 5.9.3 age adoption passing confidence devDependencies patch

Release Notes

ChainSafe/js-libp2p-yamux (@​chainsafe/libp2p-yamux)

v8.0.0

Compare Source

⚠ BREAKING CHANGES
  • Must be used with libp2p@3.x.x, it cannot be used with earlier versions
Features
libp2p/js-libp2p (@​libp2p/interface)

v3.0.2

Compare Source

v3.0.1

Compare Source

v3.0.0

Compare Source

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.46.0

Compare Source

🚀 Features
  • eslint-plugin: [no-unsafe-member-access] add allowOptionalChaining option (#​11659)
  • rule-schema-to-typescript-types: clean up and make public (#​11633)
🩹 Fixes
  • eslint-plugin: [prefer-readonly-parameter-types] ignore tagged primitives (#​11660)
  • typescript-estree: forbid abstract method and accessor to have implementation (#​11657)
  • eslint-plugin: removed error type previously deprecated (#​11674)
  • eslint-plugin: [no-deprecated] ignore deprecated export imports (#​11603)
  • eslint-plugin: [unbound-method] improve wording around this: void and binding (#​11634)
  • rule-tester: deprecate TestCaseError#type and LintMessage#nodeType (#​11628)
  • eslint-plugin: [no-floating-promises] remove excess parentheses in suggestions (#​11487)
❤️ Thank You

You can read about our versioning strategy and releases on our website.

v8.45.0

Compare Source

🚀 Features
  • eslint-plugin: expose rule name via RuleModule interface (#​11616)
🩹 Fixes
  • eslint-plugin: [prefer-nullish-coalescing] ignoreBooleanCoercion should not apply to top-level ternary expressions (#​11614)
  • eslint-plugin: [no-base-to-string] check if superclass is ignored (#​11617)
❤️ Thank You

You can read about our versioning strategy and releases on our website.

v8.44.1

Compare Source

🩹 Fixes
  • eslint-plugin: [await-thenable] should not report passing values to promise aggregators which may be a promise in an array literal (#​11611)
  • eslint-plugin: [no-unsafe-enum-comparison] support unions of literals (#​11599)
  • eslint-plugin: [no-base-to-string] make ignoredTypeNames match type names without generics (#​11597)
❤️ Thank You

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.46.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.45.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.44.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

actions/dependency-review-action (actions/dependency-review-action)

v4.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4...v4.8.0

v4.7.4

Compare Source

evanw/esbuild (esbuild)

v0.25.10

Compare Source

  • Fix a panic in a minification edge case (#​4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
    identity({ y: identity(123) })
  • Fix @supports nested inside pseudo-element (#​4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
    ::placeholder {
      color: red;
      body & { color: green }
      @​supports (color: blue) { color: blue }
    }
    
    /* Old output (with --supported:nesting=false) */
    ::placeholder {
      color: red;
    }
    body :is() {
      color: green;
    }
    @​supports (color: blue) {
       {
        color: blue;
      }
    }
    
    /* New output (with --supported:nesting=false) */
    ::placeholder {
      color: red;
    }
    body :is() {
      color: green;
    }
    @​supports (color: blue) {
      ::placeholder {
        color: blue;
      }
    }
eslint/eslint (eslint)

v9.37.0

Compare Source

v9.36.0

Compare Source

golangci/golangci-lint (github.com/golangci/golangci-lint/v2)

v2.5.0

Compare Source

  1. New linters
  2. Linters new features or changes
    • embeddedstructfieldcheck: from 0.3.0 to 0.4.0 (new option: empty-line)
    • err113: from aea10b5 to 0.1.1 (skip internals of Is methods for error type)
    • ginkgolinter: from 0.20.0 to 0.21.0 (new option: force-tonot)
    • gofumpt: from 0.8.0 to 0.9.1 (new rule is to "clothe" naked returns for the sake of clarity)
    • ineffassign: from 0.1.0 to 0.2.0 (new option: check-escaping-errors)
    • musttag: from 0.13.1 to 0.14.0 (support interface methods)
    • revive: from 1.11.0 to 1.12.0 (new options: identical-ifelseif-branches, identical-ifelseif-conditions, identical-switch-branches, identical-switch-conditions, package-directory-mismatch, unsecure-url-scheme, use-waitgroup-go, useless-fallthrough)
    • thelper: from 0.6.3 to 0.7.1 (skip t.Helper in functions passed to synctest.Test)
    • wsl: from 5.1.1 to 5.2.0 (improvements related to subexpressions)
  3. Linters bug fixes
    • asciicheck: from 0.4.1 to 0.5.0
    • errname: from 1.1.0 to 1.1.1
    • fatcontext: from 0.8.0 to 0.8.1
    • go-printf-func-name: from 0.1.0 to 0.1.1
    • godot: from 1.5.1 to 1.5.4
    • gosec: from 2.22.7 to 2.22.8
    • nilerr: from 0.1.1 to a temporary fork
    • nilnil: from 1.1.0 to 1.1.1
    • protogetter: from 0.3.15 to 0.3.16
    • tagliatelle: from 0.7.1 to 0.7.2
    • testifylint: from 1.6.1 to 1.6.4
  4. Misc.
    • fix: "no export data" errors are now handled as a standard typecheck error
  5. Documentation
    • Improve nolint section about syntax
libp2p/go-libp2p (github.com/libp2p/go-libp2p)

v0.44.0

Compare Source

Highlights

Address Pipeline:
  • Observed Address Manager has been moved out of identify to its own package, github.com/libp2p/go-libp2p/p2p/host/obsaddrs
  • ⚠️ Identify Service doesn't support the DisableObservedAddrManager Option. The top level libp2p option DisableIdentifyAddressDiscovery works as it used to.

What's Changed

New Contributors

Full Changelog: libp2p/go-libp2p@v0.43.0...v0.44.0

github/codeql-action (github/codeql-action)

v4.30.7

Compare Source

v3.30.7

Compare Source

v3.30.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #​3168

See the full CHANGELOG.md for more information.

v3.30.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #​3160

See the full CHANGELOG.md for more information.

v3.30.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.4 - 25 Sep 2025
  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #​3099 and #​3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #​3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #​3130
  • Update default CodeQL bundle version to 2.23.1. #​3118

See the full CHANGELOG.md for more information.

protocolbuffers/protobuf-go (google.golang.org/protobuf)

v1.36.10

Compare Source

lint-staged/lint-staged (lint-staged)

v16.2.3

Compare Source

Patch Changes
  • #​1669 27cd541 Thanks @​iiroj! - When using --fail-on-changes, automatically hidden (partially) unstaged changes are no longer counted to make lint-staged fail.

v16.2.2

Compare Source

Patch Changes
  • #​1667 699f95d Thanks @​iiroj! - The backup stash will not be dropped when using --fail-on-changes and there are errors. When reverting to original state is disabled (via --no-revert or --fail-on-changes), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually.

    Additionally, the example for using the backup stash manually now uses the correct backup hash, if available:

    % npx lint-staged --fail-on-changes
    ✔ Backed up original state in git stash (c18d55a3)
    ✔ Running tasks for staged files...
    ✖ Tasks modified files and --fail-on-changes was used!
    ↓ Cleaning up temporary files...
    
    ✖ lint-staged failed because `--fail-on-changes` was used.
    
    Any lost modifications can be restored from a git stash:
    
      > git stash list --format="%h %s"
      c18d55a3 On main: lint-staged automatic backup
      > git apply --index c18d55a3

v16.2.1

Compare Source

Patch Changes
  • #​1664 8277b3b Thanks @​iiroj! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is readonly string[] and can't be mutated. Thanks @​outslept!

    export default {
    ---  "*": (files: string[]) => void console.log('staged files', files)
    +++  "*": (files: readonly string[]) => void console.log('staged files', files)
    }
  • #​1654 70b9af3 Thanks @​iiroj! - This version has been published from GitHub Actions using Trusted Publishing for npm packages.

  • #​1659 4996817 Thanks @​iiroj! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are package.json files in the working directory. This situation might happen when running lint-staged for a single package in a monorepo.

  • #​1654 7021f0a Thanks @​iiroj! - Return the caret semver range (^) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to lint-staged. This was changed in 16.2.0 after the vulnerability issues with chalk and debug, which were also removed in the same version.

    Given the recent vulnerabilities in the npm ecosystem, it's best to be very careful when updating dependencies.

v16.2.0

Compare Source

Minor Changes
  • #​1615 99eb742 Thanks @​iiroj! - Added a new option --fail-on-changes to make lint-staged exit with code 1 when tasks modify any files, making the precommit hook fail. This is similar to the git diff --exit-code option. Using this flag also implies the --no-revert flag which means any changes made my tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.

  • #​1611 cd05fd3 Thanks @​rlorenzo! - Added a new option --continue-on-error so that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.

  • #​1637 82fcc07 Thanks @​iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.

  • #​1647 a5ecc06 Thanks @​iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, the DEBUG environment variable is no longer supported — use the --debug to enable debugging

  • #​1636 8db2717 Thanks @​iiroj! - Added a new option --hide-unstaged so that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags --hide-unstaged --no-hide-partially-staged isn't meaningful and behaves the same as just --hide-unstaged.

    Thanks to @​ItsNickBarry for the idea and initial implementation in #​1552.

  • #​1648 7900b3b Thanks @​iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.

Patch Changes
privatenumber/tsx (tsx)

v4.20.6

Compare Source

Bug Fixes
  • properly hide relaySignal from process.listeners() (#​741) (710a424)

This release is also available on:

microsoft/TypeScript (typescript)

v5.9.3

Compare Source


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

socket-security bot commented Aug 20, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​esbuild/​aix-ppc64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​android-arm64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​darwin-arm64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​darwin-x64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​freebsd-arm64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​freebsd-x64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-arm@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-arm64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-ia32@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-loong64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-mips64el@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-ppc64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-riscv64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-s390x@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​linux-x64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​openbsd-arm64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​openbsd-x64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​sunos-x64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​win32-arm64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​win32-ia32@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​win32-x64@​0.25.9 ⏵ 0.25.101001003991100
Updatednpm/​@​esbuild/​netbsd-arm64@​0.25.9 ⏵ 0.25.101001004091100
Updatednpm/​@​esbuild/​netbsd-x64@​0.25.9 ⏵ 0.25.101001004091100
Updatednpm/​@​esbuild/​android-arm@​0.25.9 ⏵ 0.25.101001007091100
Updatednpm/​@​esbuild/​android-x64@​0.25.9 ⏵ 0.25.101001007091100
Updatednpm/​@​esbuild/​openharmony-arm64@​0.25.9 ⏵ 0.25.101001007088100
Updatednpm/​@​typescript-eslint/​visitor-keys@​8.44.0 ⏵ 8.46.01001007197100
Updatednpm/​@​typescript-eslint/​parser@​8.44.0 ⏵ 8.46.01001007197100
Updatednpm/​@​typescript-eslint/​project-service@​8.44.0 ⏵ 8.46.01001007297 +1100
Updatednpm/​esbuild@​0.25.9 ⏵ 0.25.10921007391100
Updatedgolang/​github.com/​golangci/​golangci-lint/​v2@​v2.4.0 ⏵ v2.5.074 +110010010070
Updatedgolang/​google.golang.org/​protobuf@​v1.36.9 ⏵ v1.36.1075 +1100100100100
See 34 more rows in the dashboard

View full report

@renovate renovate bot changed the title fix(deps): update dependency @libp2p/interface to v2.11.0 fix(deps): update all dependencies Aug 20, 2025
@renovate renovate bot force-pushed the renovate/all branch 6 times, most recently from ae2f9d0 to f4729ce Compare August 26, 2025 22:38
@renovate renovate bot force-pushed the renovate/all branch 9 times, most recently from 2a584e8 to e1cc4f9 Compare September 7, 2025 18:00
@renovate renovate bot force-pushed the renovate/all branch 5 times, most recently from 1417d8f to b67b277 Compare September 10, 2025 21:26
@renovate renovate bot changed the title fix(deps): update all dependencies fix(deps): update all dependencies - autoclosed Sep 16, 2025
@renovate renovate bot closed this Sep 16, 2025
@renovate renovate bot deleted the renovate/all branch September 16, 2025 09:12
@renovate renovate bot changed the title fix(deps): update all dependencies - autoclosed fix(deps): update all dependencies Sep 17, 2025
@renovate renovate bot reopened this Sep 17, 2025
@renovate renovate bot changed the title fix(deps): update all dependencies fix(deps): update all dependencies to v0.25.10 Sep 17, 2025
@renovate renovate bot force-pushed the renovate/all branch 2 times, most recently from cb21065 to edb6a64 Compare September 19, 2025 17:13
@renovate renovate bot changed the title fix(deps): update all dependencies to v0.25.10 fix(deps): update all dependencies Sep 19, 2025
Copy link
Contributor Author

renovate bot commented Sep 21, 2025

ℹ Artifact update notice

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 25 additional dependencies were updated

Details:

Package Change
github.com/Antonboom/errname v1.1.0 -> v1.1.1
github.com/Antonboom/nilnil v1.1.0 -> v1.1.1
github.com/Antonboom/testifylint v1.6.1 -> v1.6.4
github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 -> v0.1.1
github.com/bombsimon/wsl/v5 v5.1.1 -> v5.2.0
github.com/ghostiam/protogetter v0.3.15 -> v0.3.16
github.com/golangci/go-printf-func-name v0.1.0 -> v0.1.1
github.com/gordonklaus/ineffassign v0.1.0 -> v0.2.0
github.com/kulti/thelper v0.6.3 -> v0.7.1
github.com/ldez/grignotin v0.10.0 -> v0.10.1
github.com/ldez/tagliatelle v0.7.1 -> v0.7.2
github.com/manuelarte/embeddedstructfieldcheck v0.3.0 -> v0.4.0
github.com/mgechev/revive v1.11.0 -> v1.12.0
github.com/nunnatsa/ginkgolinter v0.20.0 -> v0.21.0
github.com/securego/gosec/v2 v2.22.7 -> v2.22.8
github.com/spf13/cobra v1.9.1 -> v1.10.1
github.com/spf13/pflag v1.0.7 -> v1.0.10
github.com/stretchr/testify v1.10.0 -> v1.11.1
github.com/tetafro/godot v1.5.1 -> v1.5.4
go-simpler.org/musttag v0.13.1 -> v0.14.0
go.augendre.info/fatcontext v0.8.0 -> v0.8.1
golang.org/x/crypto v0.40.0 -> v0.41.0
golang.org/x/exp/typeparams v0.0.0-20250620022241-b7579e27df2b -> v0.0.0-20250911091902-df9299821621
golang.org/x/text v0.27.0 -> v0.29.0
google.golang.org/protobuf v1.36.9 -> v1.36.10

@renovate renovate bot force-pushed the renovate/all branch 11 times, most recently from dbe7bb9 to b38f259 Compare September 28, 2025 17:10
@renovate renovate bot force-pushed the renovate/all branch 7 times, most recently from 7a1e1f7 to 0bc2011 Compare October 6, 2025 17:49
Copy link
Contributor Author

renovate bot commented Oct 8, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: tools/go.sum
Command failed: go get -t ./...
go: module github.com/libp2p/go-libp2p@v0.44.0 requires go >= 1.24.6; switching to go1.24.8
go: downloading go1.24.8 (linux/amd64)
go: download go1.24.8: golang.org/toolchain@v0.0.1-go1.24.8.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

0 participants