Skip to content

chore(deps): update all non-major - #428

Open
cmlplatform-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major
Open

chore(deps): update all non-major#428
cmlplatform-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major

Conversation

@cmlplatform-renovate

@cmlplatform-renovate cmlplatform-renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@scalar/api-reference (source) 1.73.1 → 1.74.0 age confidence dependencies minor 1.75.0
@tanstack/query-async-storage-persister (source) 5.104.1 → 5.104.2 age confidence dependencies patch 5.104.3
@tanstack/react-query (source) 5.104.1 → 5.104.2 age confidence dependencies patch 5.104.3
@tanstack/react-query-persist-client (source) 5.104.1 → 5.104.2 age confidence dependencies patch 5.104.3
@types/node (source) 26.6.4 → 26.6.5 age confidence pnpm.catalog.default patch
@typescript-eslint/parser (source) 8.71.1 → 8.71.2 age confidence devDependencies patch
@vitest/coverage-v8 (source) 5.0.3 → 5.0.4 age confidence devDependencies patch 5.0.5
actions/create-github-app-token v3.2.0 → v3.3.0 age confidence action minor
astral-sh/setup-uv v10.2.0 → v10.3.0 age confidence action minor
astral-sh/uv-pre-commit 0.12.24 → 0.13.1 age confidence repository minor
clamav/clamav (source) 974ff8d → 2542005 digest
cloudflare (source) 5.27.0 → 5.28.0 age confidence required_provider minor
lucide-react-native (source) 1.53.0 → 1.57.0 age confidence dependencies minor 1.59.0 (+1)
mermaid 12.1.0 → 12.2.0 age confidence dependencies minor
node (source) 26.11.1 → 26.12.0 age confidence minor
ossf/scorecard-action v2.4.4 → v2.5.0 age confidence action minor
pnpm (source) 12.10.1+sha512.ba40a37eb1a370d60fea8c4cf1d364c13bcccef518e98ad2bcee954f539d38da37458e58261a3fa55e06523450ea0ffff9f497b135be41f2c15c1642bacace6c → 12.13.0 age confidence packageManager minor 12.14.0
pnpm/setup v3.0.0 → v3.1.1 age confidence action minor
postcss (source) 8.5.29 → 8.5.30 age confidence devDependencies patch
python 3.14.8 → 3.15.0 age confidence minor
react-hook-form (source) 7.89.0 → 7.90.0 age confidence dependencies minor
renovatebot/github-action v46.3.7 → v46.3.8 age confidence action patch
test-renderer 1.3.0 → 1.3.1 age confidence devDependencies patch
uv 0.12.24 → 0.13.1 age confidence minor
vitest (source) 5.0.3 → 5.0.4 age confidence devDependencies patch 5.0.5
wrangler (source) 4.149.0 → 4.151.0 age confidence pnpm.catalog.default minor 4.151.1
zod (source) 4.6.5 → 4.6.7 age confidence dependencies patch

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

scalar/scalar (@​scalar/api-reference)

v1.74.0

Minor Changes
  • #​10536: feat(api-reference): show an "Explore Scalar" call to action in the sidebar footer on localhost instead of the "Generate MCP" fan-out. The button expands on hover or focus into a card with the Scalar stickers and opens a dialog (morphing into it where the View Transitions API is available) with "Sign up for Scalar" and "Book a demo" actions. Public hosts, configured MCP servers and mcp.disabled keep their current footer. Adds exploreScalar translations to ApiReferenceTranslations and a startViewTransition helper to @scalar/helpers/dom.
  • #​10567: Search AsyncAPI channels, operations, messages, channel parameters, and nested payload and header fields.
  • #​10570: Make modern sidebar tag groups and nested parent tags collapsible by default, using the same controls as ordinary tags. Reveal ancestor tags when scrolling to a different operation.
Patch Changes

  • #​10554: Render AsyncAPI boolean schemas with explanations in message payloads, headers, and reusable models.

  • #​10570: Keep AsyncAPI messages searchable when their rendered anchors belong to operations, while deduplicating messages referenced by multiple operations.

  • #​10527: Document every visible AsyncAPI channel message in a channel catalog while preserving operation-specific message subsets, links, and server/protocol filtering.

  • #​10565: Inherit AsyncAPI operation metadata and replies from traits using recursive merge rules, and use inherited titles in navigation.

  • #​10545: Convert flow-style YAML documents to valid JSON when downloading in JSON format.

  • #​10509: Remove a redundant assignment in SDK installation tab keyboard navigation.

  • #​10529: Display AsyncAPI server titles, summaries, and protocol versions while preserving server map keys for selection.

  • #​10550: Display AsyncAPI message correlation ID descriptions and runtime expressions, with links to identifiable header and payload fields.

  • #​10513: Document browser-loaded plugins with NestJS and add a custom extension example.

  • #​10534: feat(api-reference): add Generate SDK buttons to the developer tools, client libraries and request examples that open the Explore Scalar dialog when running locally and the document does not list its own SDKs

  • #​10506: Organize imports consistently with the checks enforced in CI.

  • #​10558: Fix AsyncAPI example cards to use the full available width, keep only the code block copy button, and pad and align the example name and summary.

  • #​10525: Display the AsyncAPI application identifier in the introduction when present.

  • #​10566: Render inline AsyncAPI security schemes and scopes, keeping server authentication separate from operation security.

  • #​10573: Hide the empty Operations card for parent tags that only contain nested tags. Tags with their own operations or webhooks still show their endpoint list.

  • #​10528: Render AsyncAPI channels and their messages when no operations reference them, including server and protocol filtering.

  • #​10561: Clarify AsyncAPI operation and message sections, align message card spacing, and keep schema controls inside lighter expanded cards.

    Show channel messages only when they are not used by an operation, and keep the sidebar in sync.

  • #​10511: Expose an actions slot on Tag to add custom header controls in modern and classic layouts.

  • #​10508: Add built-in Traditional Chinese (Taiwan) translations for zh-TW, including case and underscore variants, across API Reference, API Client, and schema blocks.

TanStack/query (@​tanstack/query-async-storage-persister)

v5.104.2

Compare Source

Patch Changes
TanStack/query (@​tanstack/react-query)

v5.104.2

Compare Source

Patch Changes
TanStack/query (@​tanstack/react-query-persist-client)

v5.104.2

Compare Source

Patch Changes
typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.71.2

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
astral-sh/setup-uv

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

astral-sh/uv-pre-commit

v0.13.1

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.13.1

v0.13.0

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.13.0

cloudflare/terraform-provider-cloudflare (cloudflare)

v5.28.0

Compare Source

Full Changelog: v5.27.0...v5.28.0

⚠ BREAKING CHANGES
  • api_shield_discovery_operation: operation_id has been renamed to discovery_id, zone_id is now required, and the computed id attribute has been removed. Update resource arguments and any expressions referencing id. This resource remains deprecated and cannot be imported. No new state upgrader is included for these schema changes.
  • email_security_trusted_domains: is_recent, is_regex, and is_similarity are now required instead of optional. Set all three explicitly, using false for protections that should not be bypassed.
  • registrar_domain, registrar_domains: the cloudflare_registrar_domain resource and data source, and the cloudflare_registrar_domains list data source, have been removed. Configurations using these types must be updated before upgrading; this release does not provide a replacement Terraform resource or data source.
  • zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed word_list attribute is now a list of strings instead of a JSON-encoded string, on resources and their data sources. The same change applies to nested word_list values in the zero_trust_dlp_custom_profile and zero_trust_dlp_predefined_profile data sources. Remove jsondecode(...) around these values and update expressions expecting a string. No new state upgrader is included for this type change.
  • zero_trust_organization: mfa_ssh_piv_key_requirements has been replaced with mfa_piv_key_requirements on the resource and data source, restoring the field name accepted by the API. Rename the argument and any references to it; the nested attributes are unchanged. No new state upgrader is included for this rename. This also restores API serialization and empty-list normalization, so PIV requirements use the correct API field name and empty SSH key lists do not cause perpetual diffs.
Notes
  • pages_project: the API documentation now clarifies that build image version 1 is retired and affected projects are moved to version 3. Once a project's builds have moved, requests setting deployment_configs.preview.build_image_major_version or deployment_configs.production.build_image_major_version to 1 are rejected. Use version 3 for those projects.
  • zero_trust_device_custom_profile: the read-only target_tests attribute is deprecated on the resource and its data sources.
  • zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed deprecated attribute no longer defaults to false.
Features
New Resources
  • cloudflare_monetization_rules: manage a zone's Payment Required ruleset, including exact, upto, and origin_controlled payment schemes. Supports terraform import using the zone ID.
New Data Sources
  • cloudflare_monetization_rules: read a zone's Payment Required ruleset.
New Attributes
  • ai_search_instance, ai_search_instances: metadata.created_from_emdash_plugin, with type (native or rest) and version.
  • pages_project, pages_projects: read-only build_image_auto_upgrade.from_version and build_image_auto_upgrade.to_version, identifying projects moved from a retired build image.
  • worker_version, worker_versions, workers_script: Durable Object binding retry settings, bindings.retry.max_attempts and bindings.retry.timeout_ms. max_attempts counts retries after the initial request and accepts 0–10; zero disables retries. timeout_ms accepts 500–60000 and controls the retry window, not the initial-request timeout.
  • workers_kv_namespace, workers_kv_namespaces: mode; set mode = "instant" when creating a namespace to use KV Instant, or omit it for a classic namespace. Changing the resource's mode forces replacement.
  • workers_script: bindings_inherit = "strict" makes uploads fail when an inherited binding cannot be resolved, instead of silently dropping that binding.
  • zero_trust_access_application, zero_trust_access_applications: target_criteria.include, target_criteria.require, and target_criteria.exclude, supporting hostname and tag selectors for infrastructure targets. The rule format requires include; require and exclude are optional. Each rule must contain a hostname selector or tags, with selector sizes and empty values validated at plan time. The legacy target_criteria.target_attributes format remains supported for unchanged persisted maps, including non-hostname keys. For new or changed criteria, prefer the rule format. The legacy format and rule format cannot be combined in the same criterion.
  • zero_trust_access_identity_provider, zero_trust_access_identity_providers: config.login_page_auto_prompt, defaulting to false on the resource, to automatically prompt for passkey authentication on the Access login page.
  • zero_trust_gateway_certificate, zero_trust_gateway_certificates: read-only region, identifying where the certificate authority's key material is pinned.
  • zero_trust_resource_library_application, zero_trust_resource_library_applications: lookup query support for finding complete application name mentions in a phrase. Use filter.lookup on the singular data source or lookup on the list data source. It cannot be combined with search.
New Accepted Values
  • zero_trust_access_application: session_duration is now supported for infrastructure applications and defaults to 24h, fixing creation failures when the API returns this default. It sets the maximum connection duration and must use s, m, or h in whole seconds.
  • zero_trust_access_identity_provider: type accepts passkeys.
  • zero_trust_device_custom_profile: match expressions support device.tags.
Bug Fixes
  • d1_database: make read_replication optional and computed with a nested custom type, allowing API-returned replication settings to populate state when the block is omitted.
  • dns_record: default missing include_shadow_metadata to false during refresh and v4 to v5 migration, avoiding spurious updates for older state. Allow modified_on to change when private_routing or include_shadow_metadata changes, preventing inconsistent-result errors after updates.
  • hostname_tls_setting: populate the required setting_id during import, so imported hostname TLS settings can be refreshed and managed.
  • pages_domain, r2_data_catalog, stream_caption_language, stream_download, stream_key, zero_trust_access_short_lived_certificate: stop sending JSON request bodies to API operations that do not accept a body.
  • pages_project, workers_kv_namespace, workers_script, zero_trust_access_application, zero_trust_access_identity_provider, zero_trust_gateway_certificate: add newly introduced attributes to the v500 migration target models so existing state upgraders match the current schemas.
  • ruleset: improve legacy v4 state detection and migration at schema versions 0 and 1, including nested blocks, retired metadata, and v4.52.9 content_converter fields. Preserve configured content_converter values and existing v5 state, including rules managed with lifecycle.ignore_changes.
  • worker: preserve changes made only to previews_base_config, including configuration-derived unknown values, so preview-only updates do not incorrectly retain the previous updated_on value or suppress the planned change.
  • workers_script: prefer the API's CF-Entrypoint header when refreshing multipart script content, allowing renamed entrypoints to surface as drift instead of failing to find a stale module name. Preserve service-worker body_part format during refresh.
  • zero_trust_access_application: clear prior target criteria before decoding refresh responses, so removed rules and selectors become null instead of retaining stale objects in state.
lucide-icons/lucide (lucide-react-native)

v1.57.0: Version 1.57.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

v1.56.0: Version 1.56.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

v1.55.0: Version 1.55.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

v1.54.0: Version 1.54.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

mermaid-js/mermaid (mermaid)

v12.2.0

Compare Source

Minor Changes
Patch Changes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

  • Branch creation
    • Only on Monday (* * * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@cmlplatform-renovate
cmlplatform-renovate Bot enabled auto-merge (squash) October 12, 2026 15:38
@cmlplatform-renovate
cmlplatform-renovate Bot force-pushed the renovate/all-non-major branch 17 times, most recently from 4ba7631 to e74b61b Compare October 13, 2026 15:01
@codecov

codecov Bot commented Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@cmlplatform-renovate
cmlplatform-renovate Bot force-pushed the renovate/all-non-major branch 5 times, most recently from 27bf38f to 924afab Compare October 13, 2026 22:22
@simonvanlierde simonvanlierde mentioned this pull request Oct 13, 2026
Merged
@cmlplatform-renovate
cmlplatform-renovate Bot force-pushed the renovate/all-non-major branch 4 times, most recently from 19399f6 to 13703f3 Compare October 14, 2026 21:47
@cmlplatform-renovate
cmlplatform-renovate Bot force-pushed the renovate/all-non-major branch 10 times, most recently from 907e9ad to b3579d7 Compare October 17, 2026 04:36

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants