Skip to content

build(deps-dev): bump all - #1769

Merged
renovate[bot] merged 1 commit into
livefrom
renovate/all
Jul 27, 2026
Merged

build(deps-dev): bump all#1769
renovate[bot] merged 1 commit into
livefrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update
@shopify/prettier-plugin-liquid (source) 1.10.31.11.0 age adoption passing confidence devDependencies minor
actions/checkout v4.3.1v4.4.0 age adoption passing confidence action minor
autoprefixer 10.5.210.5.4 age adoption passing confidence devDependencies patch
dprint 0.55.10.55.2 age adoption passing confidence devDependencies patch
github/codeql-action v3.37.0v3.37.3 age adoption passing confidence action patch
markdownlint-cli2 0.23.00.23.1 age adoption passing confidence devDependencies patch
pnpm (source) 10.34.410.34.5 age adoption passing confidence packageManager patch
pnpm (source) 10.34.410.34.5 age adoption passing confidence engines patch
prettier (source) 3.9.53.9.6 age adoption passing confidence devDependencies patch
returntocorp/semgrep 59fbed698c2572 container digest
tsx (source) 4.23.04.23.1 age adoption passing confidence devDependencies patch

Release Notes

Shopify/theme-tools (@​shopify/prettier-plugin-liquid)

v1.11.0

Minor Changes
  • 6803e99: Adopt the hand-written liquid-html-parser for performance

    Replace the parser-combinator-based Liquid/HTML parser with a hand-written
    recursive-descent parser. The new parser is significantly faster, adds
    resilient parsing (it recovers from malformed input instead of bailing), and is
    adapted to the theme-tools source model. theme-language-server-common,
    theme-check-common, prettier-plugin-liquid, and theme-graph are updated to
    consume the new parser.

Patch Changes
actions/checkout (actions/checkout)

v4.4.0

Compare Source

postcss/autoprefixer (autoprefixer)

v10.5.4

Compare Source

v10.5.3

Compare Source

dprint/dprint (dprint)

v0.55.2

Compare Source

Changes

  • fix: build linux gnu binaries against glibc 2.17 (#​1203)

Install

Run dprint upgrade or see https://dprint.dev/install/

Checksums

Artifact SHA-256 Checksum
dprint-x86_64-apple-darwin.zip b7074cf6c814f995b783b5baa7e516b34e783c42c9baf7af553dbad731adb3a7
dprint-aarch64-apple-darwin.zip e9ba8ed7988f3350501a8cf8af92da616cdec8d9d5c831c069293c587311b49d
dprint-x86_64-pc-windows-msvc.zip 12e8c26abc8c436223e70f5a30a2864001c92fa356a859eb93e06b97ab7dbd12
dprint-x86_64-pc-windows-msvc-installer.exe 60ecca3c071224d3097570dc07148457e86b97a85aba868cd0714377208825cd
dprint-aarch64-pc-windows-msvc.zip 65846975b2a8f4e36982ddff875147157c2c9b04c6eb17134d6655ed51e3a931
dprint-x86_64-unknown-linux-gnu.zip d7ccde62d789dfb048717252d259e21253e32feffe4cbf2dab9954eeab492219
dprint-x86_64-unknown-linux-musl.zip 45fc0eef3216af21c4c22c6e7e233aa45c3080fac07b6e94db7008a5c8e5c67a
dprint-aarch64-unknown-linux-gnu.zip 299923f2b56d66756ad2c7c220650c72f26437fd3f48b3fb6c0df664073eb1d1
dprint-aarch64-unknown-linux-musl.zip f0101217dd0abc94f1ac01b83d306d0288aeee8a501e8614a5e2bbe037500be0
dprint-riscv64gc-unknown-linux-gnu.zip ed70faf3ecfbb67786470c62fd3eee44172451fa91166f660c7a52a9d9c36979
dprint-loongarch64-unknown-linux-gnu.zip 9dccf17fd3d79885ece6b3442639cb62cc1ac3852d9a30467fb2f18b4c0997f4
dprint-loongarch64-unknown-linux-musl.zip 11eb0a855e862bc27c002b863125e96fa794b8d149f919759639fd76d6f31032
dprint-powerpc64le-unknown-linux-gnu.zip bb7b367b0ad41b413d4b0828cf96d5344e0686e14ab3bb1705a0705b340dd3ec
dprint-powerpc64le-unknown-linux-musl.zip 7973e0203bd5ca23fa50b75c45c61284080500fa50ec45b7ba422bd0f1dad0ed
dprint-aarch64-linux-android.zip 879a8de2c7e2b17dfd36fff855807803793fefdf8da9b1f69bc07c0a31f94ca3
dprint-x86_64-linux-android.zip 986c5f1926d9a1ae5049ac87c03f0d4cd7fdb823840d47af4fc6080725f3db32
github/codeql-action (github/codeql-action)

v3.37.3

Compare Source

No user facing changes.

v3.37.2

Compare Source

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v3.37.1

Compare Source

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
  • Update default CodeQL bundle version to 2.26.1. #​4019
DavidAnson/markdownlint-cli2 (markdownlint-cli2)

v0.23.1

Compare Source

  • Show attempted fix counts after fixing
  • Update dependencies (including markdownlint)
pnpm/pnpm (pnpm)

v10.34.5: pnpm 10.34.5

Compare Source

Patch Changes

  • 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
  • 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
  • 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
  • 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Bit

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
prettier/prettier (prettier)

v3.9.6

Compare Source

privatenumber/tsx (tsx)

v4.23.1

Compare Source

Bug Fixes
  • support tsImport after global preload (8d4ffc2)
  • watch: avoid clearing piped output (95d0672)
  • watch: treat script and dependency paths literally (79fddde)
Performance Improvements
  • index transform cache lazily (e818ad6)
  • load esbuild lazily in CLI (d067938)
  • map Node TypeScript formats directly (cdcc623)
  • use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@netlify

netlify Bot commented Jul 27, 2026

Copy link
Copy Markdown

Deploy Preview for gh-pages-openinf ready!

Name Link
🔨 Latest commit dd10f8d
🔍 Latest deploy log https://app.netlify.com/projects/gh-pages-openinf/deploys/6a66bbdac5d3ef00082efb3c
😎 Deploy Preview https://deploy-preview-1769--gh-pages-openinf.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedtsx@​4.23.0 ⏵ 4.23.1100 +110081 +192100
Updatedmarkdownlint-cli2@​0.23.0 ⏵ 0.23.199100100 +191 +2100
Updatedprettier@​3.9.5 ⏵ 3.9.699 +110097 +199100

View full report

@renovate
renovate Bot merged commit c9552d5 into live Jul 27, 2026
15 checks passed
@renovate
renovate Bot deleted the renovate/all branch July 27, 2026 04:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants