Skip to content

fix(deps): update all non-major dependencies - #131

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#131
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Mar 10, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@expo/plist (source) 0.5.2 → 0.8.1 age confidence dependencies minor
@types/node (source) 22.13.9 → 22.20.4 age confidence devDependencies minor
concurrently 10.0.3 → 10.0.5 age confidence devDependencies patch
http-cookie-agent 7.0.3 → 7.0.4 age confidence dependencies patch
jest (source) 30.4.2 → 30.5.2 age confidence devDependencies minor
node (source) 22.14.0 → 22.23.2 age confidence volta minor
open 11.0.0 → 11.0.4 age confidence devDependencies patch
semantic-release 25.0.5 → 25.0.9 age confidence devDependencies patch
tough-cookie 6.0.0 → 6.0.2 age confidence dependencies patch
ts-jest (source) 29.4.11 → 29.4.12 age confidence devDependencies patch

Release Notes

expo/expo (@​expo/plist)

v0.8.1

Compare Source

This version does not introduce any user-facing changes.

v0.8.0

Compare Source

This version does not introduce any user-facing changes.

v0.7.0

Compare Source

🐛 Bug fixes

v0.6.1

Compare Source

This version does not introduce any user-facing changes.

v0.6.0

Compare Source

This version does not introduce any user-facing changes.

v0.5.4

Compare Source

v0.5.3

Compare Source

This version does not introduce any user-facing changes.

open-cli-tools/concurrently (concurrently)

v10.0.5

Compare Source

What's Changed

New Contributors

Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5

v10.0.4

Compare Source

What's Changed

New Contributors

Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4

3846masa/http-cookie-agent (http-cookie-agent)

v7.0.4

Compare Source

Bug Fixes
jestjs/jest (jest)

v30.5.2

Compare Source

Features
  • [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#​16421)
Fixes
  • [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#​16422)
  • [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#​16345)
  • [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#​16439)

v30.5.1

Compare Source

Fixes
  • [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#​16411)
  • [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#​16411)
  • [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#​16411)
  • [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #​16390) (#​16417)
  • [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#​16413)
Chore & Maintenance
  • [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#​16404)

v30.5.0

Compare Source

Features
  • [@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#​16053)
  • [@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#​16053)
  • [jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#​16259)
  • [jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#​16322)
  • [jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialized [cause]:/[errors]: markers (#​16316)
  • [jest-circus, jest-types] Add unhandledErrorsDetailed to Circus.RunResult, so an unhandled rejection reports its cause chain and AggregateError entries with code frames instead of a pre-serialized stack (#​16316)
  • [jest-haste-map] Replace NodeWatcher and FSEventsWatcher with @parcel/watcher for the non-watchman watch path (#​16188)
  • [jest-resolve] Bump unrs-resolver to 1.12.1, remove jest-pnp-resolver and unnecessary checks (#​15721)
  • [jest-resolve] Honor Node's --preserve-symlinks / NODE_PRESERVE_SYMLINKS in the default resolver by passing symlinks: false to unrs-resolver (#​16260)
  • [jest-runtime] Apply automocking and manual __mocks__ files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic import() and require() of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw (#​16391)
  • [jest-runtime] Route process.getBuiltinModule through the sandbox, so it returns the sandbox process and the hooked node:module instead of the host's (#​16391)
  • [jest-runtime] Throw an actionable error from module.register() and module.registerHooks() inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker (#​16391)
  • [jest-runtime] Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order (#​16391)
  • [jest-runtime] Throw ERR_SOURCE_PHASE_NOT_DEFINED with an actionable message for import source and import.source(), instead of failing at instantiation with V8's bare "Source phase import object is not defined" (#​16391)
  • [jest-runtime] Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first (#​16391)
  • [jest-runtime] Set import.meta.main to true in the test file and false in every module it loads, matching Node 24+ (#​16367)
  • [jest-runtime] Resolve the module-sync export condition, so a package that exposes its ESM entry point for require() loads the same file Node would (#​16336)
  • [jest-snapshot] Add external snapshot paths to custom reporter failure details (#​16374)
Fixes
  • [jest-console, jest-reporters] CustomConsole now buffers console output so TestResult.console is populated for reporters when verbose is enabled, while GitHubActionsReporter avoids replaying buffered output in verbose mode (#​16155)
  • [expect, jest-message-util, jest-pattern, jest-regex-util, jest-util] Revert node: protocol imports to restore webpack/browser-bundle compatibility (#​16167)
  • [expect] Widen toMatchObject and objectContaining parameter type from Record<string, unknown> to object so class instances are accepted (#​16196)
  • [jest-circus] Call a generator test body with the shared test context, so this matches what a regular test function receives (#​16347)
  • [jest-circus] Capture the error listeners of the parent process instead of the in-sandbox process, so listeners registered before the test file survive teardown and sandbox listeners no longer leak onto the parent (#​16347)
  • [jest-circus] Clear currentlyRunningTest after skipped and todo tests (#​16342)
  • [jest-circus] Prevent late done() callbacks from affecting later test or hook invocations (#​16343)
  • [jest-circus, jest-jasmine2] Honor --expand when formatting node:assert failures, instead of always collapsing the diff (#​16347)
  • [jest-circus, jest-jasmine2, jest-message-util] Serialize the inner errors of an AggregateError into failureMessages, retryReasons and unhandledErrors, so --json output and reporter annotations include them (#​16316)
  • [jest-circus, jest-snapshot] Keep snapshot state and counts correct when a test retries (#​16344)
  • [@jest/create-cache-key-function] Include the caller support flags in the generated key, so a transformer that emits ESM or CJS based on them no longer shares one cache entry between the two (#​16331)
  • [@jest/create-cache-key-function] Include the stringified project config in the generated key, so editing a transformer's own settings invalidates what it cached (#​16331)
  • [@jest/transform] Include the caller support flags in a transform's cache key, so a file transformed both as ESM and as CJS no longer serves one shape's output for the other (#​16331)
  • [jest-config] Add missing findRelatedTests, outputFile, and replname entries to ValidConfig so they no longer trigger spurious "Unknown option" warnings (#​16224)
  • [jest-config] Use --config for the global config when multiple --projects are specified (#​16273)
  • [jest-core] Serialize bigint values in --json and --outputFile output as their literal form (4n), instead of failing the run with TypeError: Do not know how to serialize a BigInt (#​16338)
  • [jest-core] Do not report a CustomGC async resource (used by N-API addons such as napi-rs for per-isolate GC bookkeeping) as an open handle, since it is napi_unref'd by the addon and can never keep the event loop alive (#​16379)
  • [jest-each] Keep a $&, $`, $' or $$ inside a %p param value out of the replacement, so the title shows the value instead of the text around it (#​16338)
  • [jest-each] Interpolate a bigint into a %j title as its literal form ("4n") at any depth, instead of throwing TypeError: Do not know how to serialize a BigInt while collecting the tests (#​16338)
  • [jest-environment, jest-runtime] Bind sandboxInjectedGlobals to the right values when injectGlobals is false, instead of shifting every one of them by a position (#​16377)
  • [jest-environment-node, jest-util] Only warn about a conflicting globalsCleanup mode when one was explicitly configured, and follow the mode that is actually in effect (#​16323)
  • [jest-environment-node, jest-util] Stop resolving lazy globals when setting up an environment, so Node 26's builtin module globals are no longer loaded (and no longer emit their deprecation warnings) for every test file (#​16324)
  • [jest-haste-map] Keep watch mode alive when an outside process briefly makes a file unreadable on Windows, instead of tearing the watcher down on EPERM (#​16295)
  • [jest-haste-map] Keep indexing when an outside process holds a file open on Windows, instead of failing the whole crawl on EPERM (#​16358)
  • [jest-haste-map] Keep a duplicated manual mock resolving when the file it pointed at is deleted in watch mode (#​16360)
  • [jest-haste-map] Shut the worker farm down when a duplicate manual mock aborts the build under throwOnModuleCollision (#​16354)
  • [jest-haste-map] Attach the watchman client's error listener before the first command, so a watchman failure falls back to the node crawler instead of crashing on an unhandled error event, and always end the client (#​16355)
  • [jest-haste-map] Stop delivering watch events after WatchmanWatcher is closed, and route its warnings through the configured console (#​16355)
  • [jest-haste-map] Restore the nested duplicates index correctly in ModuleMap.fromJSON, so a haste collision reported inside a test worker raises DuplicateHasteCandidatesError instead of a TypeError (#​16353)
  • [jest-haste-map] Match watched files on a full extension, so moduleFileExtensions: ['js'] no longer accepts foo.mjs (#​16352)
  • [jest-haste-map] Delimit the fields that make up the haste map cache key, so two different option sets cannot hash to the same cache file (#​16352)
  • [jest-message-util] Print the inner errors of an AggregateError thrown inside a test (#​16316)
  • [jest-message-util] Indent nested cause and AggregateError sections of a test failure by one level per depth, so the nesting is legible instead of rendering flat (#​16316)
  • [jest-message-util] Color stack traces line by line so blank lines stay blank (#​16316)
  • [jest-message-util] Detect Jest's own frames without assuming the checkout directory's name, and cover @jest/* packages, so stack traces and code frames point at user code (#​16326)
  • [jest-mock] mockResolvedValue / mockRejectedValue now see all overload return types, so a Promise-returning overload survives even when a later overload returns a non-Promise (e.g. pg.Client['end']) (#​16237)
  • [@jest-environment/jsdom-abstract] Make @types/jsdom a peer dependency (#​16166)
  • [jest-mock] Remove the leftover own accessor descriptor when restoring a spyOn of an inherited getter or setter, so the instance keeps reflecting the prototype (#​16226)
  • [jest-resolve] Include extensionsToTreatAsEsm in the shouldLoadAsEsm cache key, so projects with different extension lists don't read each other's answers (#​16369)
  • [jest-resolve] Make getModuleIDAsync build and cache data: URI module IDs the same way as getModuleID (#​16370)
  • [jest-resolve] Keep the node: prefix when resolving a core module asynchronously, so a builtin that only exists prefixed (node:sea, node:sqlite, node:test, node:test/reporters) resolves instead of failing as a missing bare package (#​16388)
  • [jest-resolve] Look up manual mocks for node: protocol specifiers under the unprefixed name they are stored as (#​16388)
  • [jest-resolve] Apply moduleNameMapper consistently to both spellings of core module specifiers (fs vs node:fs) (#​16390)
  • [jest-resolve] Keep virtual and ordinary mock module IDs isolated across test files (#​16296)
  • [jest-resolve] Guard missing require.resolve.paths (#​16052)
  • [jest-resolve, jest-config, jest-runner] Support a user resolver written as an ES module (#​16332)
  • [jest-resolve, jest-runtime] Throw the CJS parse error for ESM syntax in a "type": "commonjs" package or a .cjs file instead of loading it as ESM, matching Node (#​16368)
  • [@jest/source-map] Keep source map sources that name a scheme, such as webpack:///, instead of resolving them into a path that does not exist (#​16327)
  • [@jest/source-map] Look up --testLocationInResults positions at the right column, and keep a mapping to the first column instead of discarding it (#​16327)
  • [@jest/source-map] Warn when a source map cannot be parsed, instead of silently leaving its frames untranslated (#​16327)
  • [jest-runner, @jest/source-map] Keep a source-mapped stack for an error thrown after the test environment was torn down (#​16327)
  • [jest-runtime, @jest/source-map] Keep source maps past teardown and past the next test file's install, so a stack from a file no earlier stack mentioned still points at the original source (#​16330)
  • [jest-runtime] Report that no coverage was collected when getAllV8CoverageInfoCopy is called after teardown, instead of returning an empty result (#​16385)
  • [jest-runtime] Cache a CJS module's parsed exports before walking its re-exports, so two modules that re-export each other no longer overflow the stack when imported from ESM (#​16363)
  • [jest-runtime] Keep a re-exported ES module's parse failure from marking the re-exporting CommonJS file as ESM, so module.exports = require('./dep.mjs') loads instead of failing with module is not defined (#​16363)
  • [jest-runtime] Scope module mocks instantiated inside jest.isolateModules/isolateModulesAsync to that block, so a mock first imported there no longer outlives it - matching how CommonJS mocks already behave (#​16365)
  • [jest-runtime] Suspend module isolation while generating an automock, so loading the real module to read its shape no longer populates the isolated registry (#​16365)
  • [jest-runtime] Check a cached ES module's status before require() returns it, so a module whose evaluation threw rethrows that error and one left linked by a failed sibling is evaluated instead of returning uninitialized bindings (#​16364)
  • [jest-runtime] Report the original ERR_REQUIRE_ASYNC_MODULE when a require() of a top-level-await graph is retried, instead of a spurious "concurrent import()" error (#​16364)
  • [jest-runtime] Throw the evaluation error when another caller's import() of the same module failed while we awaited it, instead of resolving with the errored module (#​16364)
  • [jest-runtime] Mark the result of require()ing an ES module that has a default export with __esModule: true through a live-binding facade, and serve the same object from require.cache, matching Node (#​16367)
  • [jest-runtime] Provide a CommonJS module's exports under the 'module.exports' named export when imported from ESM, matching Node 23+ (#​16367)
  • [jest-runtime] Give the test file itself a non-null require.main (#​16367)
  • [jest-runtime] Populate module.children with the modules a file loads, matching Node (#​16368)
  • [jest-runtime] Provide import.meta.resolve and import.meta.jest in data: URI modules, accept any-case mediatype parameters, and use Node's error codes for invalid data: URIs (#​16368)
  • [jest-runtime] Key ES modules by full URL, so query and fragment suffixes create the same module instances as Node and show up in import.meta.url (#​16375)
  • [jest-runtime] Share modules between overlapping graphs when a CommonJS module require()s an ES module mid-load, instead of evaluating shared dependencies twice (#​16375)
  • [jest-runtime] Throw ERR_REQUIRE_CYCLE_MODULE like Node when a CommonJS module require()s an ES module that is still being loaded, instead of evaluating the module a second time (#​16366)
  • [jest-runtime] Key builtin modules in the ESM registry by one canonical specifier (#​16341)
  • [jest-runtime] import.meta.resolve() for a builtin uses its node: specifier (#​16341)
  • [jest-runtime] Fall back to native ESM when a .js file contains ESM syntax but has no "type":"module" marker (#​16152)
  • [jest-runtime] Allow require() of ESM-marked files on Node < 24.9 via transform fallback (#​16244)
  • [jest-runtime, @jest/transform] Surface actionable ERR_REQUIRE_ESM error for files with untransformed ESM syntax instead of the generic "unexpected token" message (#​16244)
  • [jest-runtime] Support older test environments whose moduleMocker does not implement clearMocksOnScope (#​16169)
  • [jest-runtime] Apply jest.unstable_mockModule when the mocked file itself is require()d, not only when it is imported as a dependency (#​16389)
  • [jest-runtime] Apply jest.unstable_mockModule to statically imported data: URIs on Node 24.9+, matching dynamic import() (#​16389)
  • [jest-runtime] Run an async jest.unstable_mockModule factory once per module instead of twice, and fail the import instead of crashing the worker when the factory rejects (#​16389)
  • [jest-runtime] Hide a require(esm) module that failed to evaluate from require.cache, as Node does, instead of exposing a namespace with uninitialized bindings (#​16389)
  • [jest-runtime] Strip the byte-order mark when importing a JSON module, matching require() and Node (#​16389)
  • [jest-runtime] Throw ERR_REQUIRE_ASYNC_MODULE when require(esm) runs under an async-only custom resolver, instead of silently resolving with the default resolver (#​16389)
  • [jest-runtime] Parse imported JSON modules with the test realm's JSON, so their objects pass instanceof Object inside the test like require()d JSON does (#​16389)
  • [jest-runtime] Accept every file: URL string in the sandboxed module.createRequire, including one with a localhost authority, as Node does (#​16389)
  • [jest-runtime] Point at {virtual: true} when jest.mock or jest.unstable_mockModule is given a module that cannot be resolved (#​16389)
  • [jest-reporters] Fix coverage report table formatting in CI/GitHub Actions environments where process.stdout.columns is undefined by falling back to the COLUMNS env var or 80 columns in CI, preserving existing behaviour in other non-TTY environments (#​16227)
  • [jest-runtime] Support CJS-in-ESM exports via "module.exports" named exports (#​16277)
  • [jest-snapshot] Keep a skipped or failed test's hinted snapshots, instead of reporting them obsolete (#​16348)
  • [jest-util] Stop globsToMatcher reusing a cached matcher compiled with different picomatch options, and keep its dot: true default when dot is passed as undefined (#​16381)
  • [pretty-format] Move the react-is aliases into the @jest scope, so they cannot be shadowed by unrelated packages published under the alias names (#​16333)
Chore & Maintenance
  • [docs] Document the intentional divergences from Node's module system in the ECMAScript Modules page (#​16368)
  • [docs] Note deprecation of react-test-renderer in React Native tutorial and pretty-format README (#​16294)
  • [docs] Use @testing-library/react-native in the React Native tutorial instead of the deprecated react-test-renderer (#​16318)
  • [babel-jest, @jest/transform] Update babel-plugin-istanbul to v8 (#​16049)
  • [jest-config, @jest/reporters, jest-runtime] Update glob to v13 (#​16397)
  • [jest-haste-map] Refactor massive class into multiple files (#​16180)
  • [jest-haste-map] Drop walker dependency; replace hand-rolled directory recursion in the JS crawler and watcher startup with fdir (#​16187)
  • [jest-haste-map] Reuse cached metadata for files whose haste name is a known duplicate, instead of re-reading and re-parsing them on every startup (#​16351)
  • [jest-haste-map] Cache the watchman socket path and replace the watchman --version probe with get-sockname, so warm runs spawn no watchman processes (#​16386)
  • [jest-resolve] Store the per-directory package-type lookup in the cache it reads, so it actually memoizes (#​16369)
  • [jest-resolve, jest-runtime] Cut repeated work on the resolution hot path: hoist the platform-extension list to construction, memoize isCoreModule and the options cache-key serialization, skip mapper preparation when no moduleNameMapper is configured, run each mapper regex once, and stop re-parsing NODE_OPTIONS on every default-resolver call (#​16371)
  • [jest-resolve] Cut warm resolution cost to about a third: reuse one unrs-resolver factory per options shape instead of cloning per resolution, compose the factory cache key from per-array cached strings instead of serializing options, and stop constructing an Error for misses that findNodeModule swallows; add a __benchmarks__ suite for the default resolver (#​16373)
  • [jest-runner, @jest/source-map] Replace source-map-support with an implementation in @jest/source-map (#​16327)
  • [jest-snapshot] Load babel, semver and synckit lazily, so requiring the package (which every test process does through @jest/expect) no longer loads ~200 modules that only writing inline snapshots needs (#​16387)
  • [jest-runtime] Reduce per-require overhead: skip module ID resolution when no mock can apply, answer core modules before probing for a manual mock, share one require.cache proxy across modules, and cache empty files (#​16376)
  • [@jest/source-map] Deprecate getCallsite in favour of SourceMapSupport#getCallsite (#​16327)
  • [jest-runtime] Avoid magical null value in ESM loader (#​16160)
nodejs/node (node)

v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)
Commits

v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

Commits

v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits

v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @​marco-ippolito

Compare Source

Commits

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from f321c69 to 69b93f0 Compare March 27, 2025 05:06
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from a51f201 to e329007 Compare April 5, 2025 20:08
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 1fd8fbf to 2378090 Compare April 15, 2025 09:04
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from ec4832b to fc6d70b Compare April 28, 2025 09:45
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from fc6d70b to 3ff7c63 Compare May 1, 2025 01:02
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies fix(deps): update all non-major dependencies May 1, 2025
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 9f9f5d2 to 9b2c36a Compare May 8, 2025 05:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from c3aa263 to a4d7e6c Compare May 14, 2025 21:27
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 5ff2c07 to 2c978d3 Compare May 19, 2025 01:23
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 4ce6e0e to 245a457 Compare June 22, 2025 07:39
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 8b465d9 to ec7781a Compare June 28, 2025 11:53
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 46ea143 to 2b5909d Compare July 8, 2025 21:54
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from c32bfdc to 245d112 Compare July 15, 2025 15:55
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 49b1d72 to 4a19b43 Compare July 19, 2025 04:26
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from b977912 to 24b3e7c Compare August 3, 2025 15:14
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from acb94fc to 4a65639 Compare August 15, 2025 11:25
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 2e5ef83 to 3e26107 Compare August 25, 2025 11:35
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d2bce67 to 848c168 Compare September 4, 2025 10:32
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 848c168 to f9a4ade Compare September 10, 2025 22:52
cursor[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 8eccf3b to 50a5d84 Compare September 18, 2025 03:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants