Skip to content

fix(deps): update all major dependencies (major)#292

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-major
Open

fix(deps): update all major dependencies (major)#292
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-major

Conversation

@renovate

@renovate renovate Bot commented Apr 4, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@types/archiver (source) ^6.0.3^8.0.0 age confidence devDependencies major
@types/node (source) ^22.18.7^24.0.0 age confidence devDependencies major
@types/node (source) ^22.19.17^24.0.0 age confidence devDependencies major
@types/react (source) ^18.3.24^19.0.0 age confidence devDependencies major
actions/checkout v4v7 age confidence action major
actions/github-script v7v9 age confidence action major
actions/setup-node v4v6 age confidence action major
archiver ^7.0.1^8.0.0 age confidence dependencies major
dotenv ^16.6.1^17.0.0 age confidence devDependencies major
glob ^11.1.0^13.0.0 age confidence devDependencies major
globals ^16.5.0^17.0.0 age confidence devDependencies major
lucide-react (source) ^0.577.0^1.0.0 age confidence dependencies major
node (source) 22.22.224.17.0 age confidence major
open ^10.2.0^11.0.0 age confidence dependencies major
p-limit ^6.2.0^7.0.0 age confidence dependencies major
pnpm (source) 10.33.011.8.0 age confidence packageManager major
pnpm/action-setup v4v6 age confidence action major
react (source) ^18.3.1^19.0.0 age confidence devDependencies major
react-day-picker (source) ^9.11.1^10.0.0 age confidence dependencies major
react-dom (source) ^18.3.1^19.0.0 age confidence devDependencies major
typescript (source) ^5.9.3^6.0.0 age confidence pnpm.catalog.default major
typescript (source) ^5.0.0^5.0.0 || ^6.0.0 age confidence peerDependencies major

Release Notes

actions/checkout (actions/checkout)

v7.0.0

Compare Source

v7

Compare Source

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v6

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

v5

Compare Source

actions/github-script (actions/github-script)

v9.0.0

Compare Source

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@​actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@​actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@​actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.
What's Changed
New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v9

Compare Source

v8.0.0

Compare Source

v8: .0.0

Compare Source

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

Compare Source

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:
Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed

Documentation
Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

Compare Source

What's Changed

Enhancement:
Dependency updates:
Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v6

Compare Source

v5.0.0

Compare Source

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v5

Compare Source

archiverjs/node-archiver (archiver)

v8.0.0

Compare Source

What’s changed

Breaking changes

Maintenance

Documentation

Dependency updates

motdotla/dotenv (dotenv)

v17.4.2

Compare Source

Changed
  • Improved skill files - tightened up details (#​1009)

v17.4.1

Compare Source

Changed
  • Change text injecting to injected (#​1005)

v17.4.0

Compare Source

Added
  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)
Changed
  • Tighten up logs: ◇ injecting env (14) from .env (#​1003)

v17.3.1

Compare Source

Changed
  • Fix as2 example command in README and update spanish README

v17.3.0

Compare Source

Added
  • Add a new README section on dotenv’s approach to the agentic future.
Changed
  • Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

v17.2.4

Compare Source

Changed
  • Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)
  • Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

v17.2.3

Compare Source

Changed
  • Fixed typescript error definition (#​912)

v17.2.2

Compare Source

Added
  • 🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.

v17.2.1

Compare Source

Changed
  • Fix clickable tip links by removing parentheses (#​897)

v17.2.0

Compare Source

Added
  • Optionally specify DOTENV_CONFIG_QUIET=true in your environment or .env file to quiet the runtime log (#​889)
  • Just like dotenv any DOTENV_CONFIG_ environment variables take precedence over any code set options like ({quiet: false})
# .env
DOTENV_CONFIG_QUIET=true
HELLO="World"
// index.js
require('dotenv').config()
console.log(`Hello ${process.env.HELLO}`)
$ node index.js
Hello World

or

$ DOTENV_CONFIG_QUIET=true node index.js

v17.1.0

Compare Source

Added
  • Add additional security and configuration tips to the runtime log (#​884)
  • Dim the tips text from the main injection information text
const TIPS = [
  '🔐 encrypt with dotenvx: https://dotenvx.com',
  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
  '⚙️  enable debug logging with { debug: true }',
  '⚙️  override existing env vars with { override: true }',
  '⚙️  suppress all logs with { quiet: true }',
  '⚙️  write to custom object with { processEnv: myObject }',
  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
]

v17.0.1

Compare Source

Changed
  • Patched injected log to count only populated/set keys to process.env (#​879)

v17.0.0

Compare Source

Changed
  • Default quiet to false - informational (file and keys count) runtime log message shows by default (#​875)
isaacs/node-glob (glob)

v13.0.6

Compare Source

v13.0.5

Compare Source

v13.0.4

Compare Source

v13.0.3

Compare Source

v13.0.2

Compare Source

v13.0.1

Compare Source

v13.0.0

Compare Source

v12.0.0

Compare Source

sindresorhus/globals (globals)

v17.7.0

Compare Source

v17.6.0

Compare Source


v17.5.0

Compare Source


v17.4.0

Compare Source


v17.3.0

Compare Source


v17.2.0

Compare Source

  • jasmine: Add throwUnless and throwUnlessAsync globals (#​335) 97f23a7

v17.1.0

Compare Source


v17.0.0

Compare Source

Breaking
Improvements

lucide-icons/lucide (lucide-react)

v1.21.0: Version 1.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.20.0...1.21.0

v1.20.0: Version 1.20.0

Compare Source

What's Changed

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from Zeryther as a code owner April 4, 2026 04:33
@vercel

vercel Bot commented Apr 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sdk-harmony Error Error Jun 22, 2026 12:04am

Request Review

@changeset-bot

changeset-bot Bot commented Apr 4, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 5a6a045

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Apr 4, 2026

Copy link
Copy Markdown

@renovate renovate Bot force-pushed the renovate/major-all-major branch from 8d99e02 to a1be5a6 Compare April 5, 2026 21:29
@renovate renovate Bot force-pushed the renovate/major-all-major branch from a1be5a6 to 6e75f18 Compare April 8, 2026 19:11
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 6e75f18 to 29fafd6 Compare April 9, 2026 10:47
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 29fafd6 to 0234089 Compare April 10, 2026 00:46
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 0234089 to 778209b Compare April 11, 2026 01:52
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 778209b to 7340e13 Compare April 12, 2026 09:09
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 7340e13 to ac800de Compare April 12, 2026 17:15
@renovate renovate Bot force-pushed the renovate/major-all-major branch from ac800de to b9bb037 Compare April 16, 2026 10:08
@renovate renovate Bot force-pushed the renovate/major-all-major branch from b9bb037 to b743df9 Compare April 17, 2026 01:14
@renovate renovate Bot force-pushed the renovate/major-all-major branch from b743df9 to fd7bce5 Compare April 23, 2026 19:53
@renovate renovate Bot force-pushed the renovate/major-all-major branch from fd7bce5 to 9684743 Compare April 24, 2026 15:45
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 9684743 to 7fd8290 Compare April 28, 2026 17:46
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 7fd8290 to 58cdfb6 Compare April 29, 2026 15:54
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 58cdfb6 to 484b1c8 Compare May 1, 2026 17:04
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 484b1c8 to e6fd9f2 Compare May 6, 2026 17:43
@renovate renovate Bot force-pushed the renovate/major-all-major branch from e6fd9f2 to 58a534d Compare May 7, 2026 10:47
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 58a534d to 488db83 Compare May 8, 2026 05:17
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 488db83 to 1625abb Compare May 8, 2026 09:44
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 1625abb to 1b25fdb Compare May 9, 2026 01:17
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 1b25fdb to 0fe7355 Compare May 11, 2026 12:31
@renovate renovate Bot force-pushed the renovate/major-all-major branch from 0fe7355 to 2d481ba Compare May 11, 2026 20:45
@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm powershell-utils is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/open@11.0.0npm/powershell-utils@0.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/powershell-utils@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants